| Bounded context | A service plus its schema. Auth, social, feed, media, messaging, expense, notification, communication. |
| Kong | Public edge. Port 8080. Does not issue JWTs. |
| Access token | Short-lived JWT. Verified inside each service with the shared public key. |
| Refresh token | Stored hashed in auth.refresh_tokens, rotated on use. |
| Outbox | {schema}.event_outbox row written in the business transaction. |
| Relay | outbox-relay-service, the only process that publishes outbox rows to Redis Streams. |
| Inbox | {schema}.inbox_messages plus InboxMessageWorker, for at-least-once consumers. |
| Stream | Redis Stream key splick.streams.<context>.<fact>. |
| Consumer group | Per service and event, for example social-service.user-registered. |
| traceId | MDC field copied from X-Request-Id. |
| Internal API | /internal/v1/**, authenticated with INTERNAL_API_KEY, not exposed as a public product route. |
| Strangler fig | Rust services that mirror Java ports and schemas so a context can move without a rewrite of the contract. |