[Gerrrt]

Closes #150. Documentation only — no code changes, which is what the issue asked for.

Why

roadmap.md already carries "Decided but not built", on this reasoning:

an accepted ADR with nothing tracking it is indistinguishable from a rejected one after six months

This is the same argument turned around. A service considered and rejected for good reasons, with nothing written down, is indistinguishable from one nobody thought of — and gets proposed again, evaluated again, and possibly deployed on the second pass because the first pass left no trace.

What

A new "Considered and declined" section, placed between "Decided but not built" and "Done", recording the five rejections that came out of the same shortlist as #129–#148:

	Why it was declined
Nextcloud	Overlaps Immich (#132), Paperless-ngx (#133) and file sync; more surface than all three together. Its app ecosystem is a second, unpinned supply chain outside compose.yaml — the same objection that rules out Home Assistant add-ons in #134
The *arr stack	Five-plus services, each holding indexer credentials with a standing outbound appetite, added to the tier ADR-0008 defined as low consequence. That tier's justification is that its compromise costs a film night
YunoHost-class installers	They own the compose file, the update path and often the proxy — conflicting with one stack per host (ADR-0004), digest pinning, CI validation and SOPS rendering. Trades reproducibility for a faster first install
Guacamole	Turns any browser session on Hicks into a potential path to every console in the estate, and stores connection credentials to do it. There is already a KVM in U6
Authelia / Authentik	Already decided — ADR-0008 defers SSO knowingly, ADR-0022 gives it an expiry, #103 tracks it. Listed only so the next shortlist does not present it as new

Declines, not bans

The section says so explicitly, because the distinction is the whole value of writing them down:

• the *arr stack is declined for now, and should get its own decision rather than a footnote to the NAS build
• Nextcloud names what to evaluate instead if the actual want is file sync — Syncthing, which needs no server-side application at all
• the SSO decline has a known end condition, unlike the others, and it is the only route to a second factor for Grafana, Immich and AdGuard Home

make validate passes.

🤖 Generated with Claude Code