# ADR-0003: Linking and Session Are Distinct Lifetimes

Status: Accepted

## Context

E27 uses a two-tier cryptographic model:
long-lived link keys and per-session keys.
Confusing these lifetimes risks invalid reconnect behavior.

## Decision

Linking and session lifetimes are distinct.

- Link keys (enc, hmac):
  - long-lived
  - persist across connections
  - represent device-to-panel trust
- Session keys (sk, shm):
  - issued during client hello
  - reused across session_id changes
- session_id reflects authorization context only.

Changing session_id does not change session keys.

## Rationale

This matches panel behavior and Java reference semantics
and allows reconnects without re-linking.

## Consequences

- Link keys must be persisted.
- Session bootstrap is required on every reconnect.
- Authorization escalation does not renegotiate crypto.

## Scope / Non-Goals

- Does not define how keys are stored.
- Does not define crypto primitives.

## References

- E27 API Comms Protocol7 API Comms Protocol
