ADR-0036: There are four reasons the app cannot answer, and it says which one

Status: Accepted — amends ADR-0002, ADR-0031 and ADR-0032, all of which stand Date: 2026-09-08

Decisions

D-85 Not Stated is narrowed: an SDS was consulted, the question fell inside a field the record curates, and the document is silent

That and nothing else. It is a statement about a supplier's document, and it may only be shown when a document was actually read.

D-86 Not In Corpus is the answer when no Chemical Record exists for what the user identified

The Corpus has never held that chemical. Nothing was consulted, so nothing can be reported silent.

D-87 Outside The Record is the answer when a record exists but the question falls outside the fields it curates

A Chemical Record curates identity, hazards, health effects, PPE, storage, first aid and spill response. A question landing outside those is answered as outside them, with the original SDS reachable — never as the document being silent.

D-88 A snapshot-version sentinel is read on every safety read, and its absence is Corpus Unavailable

One O(1) lookup. Version record present and the chemical absent means Not In Corpus; version record gone means the store was evicted and the answer is Corpus Unavailable. This is what makes D-86 distinguishable from a Corpus that has vanished underneath a running app.

D-89 Corpus Unavailable pre-empts Routing rather than being one of its outcomes

Routing resolves to five things: a Source Span, the chooser, Not Stated, Not In Corpus, or Outside The Record. The Corpus being gone is not a fact about the user's question, so it is a precondition on every surface rather than an answer the Conversational surface composes.

What each amendment touches

Stated precisely, because "amends" is a claim no gate can check.

• ADR-0002 — D-03 stands entirely: when the app has no answer it says so and never composes a plausible one. What changes is that "says so" now has three forms rather than one, and D-85 fixes which of them means what ADR-0002 meant.
• ADR-0031 — D-65 and D-71 stand. Routing still decides only where to point and still never composes Safety-Critical Content. Its outcome set grows from three to five, and the Routing Fixture grows with it.
• ADR-0032 — D-72 stands untouched and is the ruling this ADR extends: Corpus Unavailable is a statement about the device, never about a document. D-73's startup verification stands as the full check; D-88 adds a standing cheap check beside it, because startup-only left an evicted store answering for the rest of the session.

Context

The 2026-09-08 cross-model grill found that CONTEXT.md and ADR-0032 defined Not Stated incompatibly. The glossary said "when the Corpus does not contain a safety answer"; ADR-0032 said "reserved for what a consulted SDS does not say." Those describe different sets, and the spec's Seam 5 mandated the glossary's reading while US-62 promised the opposite.

The root cause is worth recording: ADR-0032 introduced Corpus Unavailable beside the Not Stated entry without re-reading it. Adding a term is not the same as re-reading the one it borders.

Behind the contradiction were four distinct facts sharing two words:

1. an SDS was consulted and is silent,
2. the Corpus holds no record for that chemical,
3. the device holds no verifiably complete Corpus,
4. a record exists and the SDS does say it, but the curator never selected that span.

The first three are things the app can always tell apart. A Handler who reads "the SDS does not state this" about a chemical the Corpus never held has been told something false about a supplier's document, with the full authority of a curated answer — which is ADR-0002's failure arriving through vocabulary rather than through a model, exactly as ADR-0032 found it arriving through storage.

Decision

Four named states, one per fact the app can distinguish. Not Stated is narrowed to a consulted document inside a curated field. Not In Corpus and Outside The Record take the cases it wrongly covered. Corpus Unavailable is unchanged in meaning and is now decided by a sentinel on every read rather than only at startup.

Rejected options

• Keep two states and widen Not Stated honestly — rejected. It is what is built today, and it makes US-62's promise undeliverable by construction: a Not Stated could never tell a Safety Officer anything about the SDS, because it would also mean "we never had one."
• Record per-Section Curation coverage so the runtime can distinguish fact 4 — rejected, and this is the trade worth understanding. It is the complete fix and it adds per-Section bookkeeping to every document, on top of a cost D-58 measures at half a day to a day and D-59 calls a floor. ADR-0028 rules that corpus size is the schedule, so this is paid in Study Area coverage — and a smaller Corpus produces more Not In Corpus answers than the Outside The Record answers it buys. It makes the common failure worse to fix the rare one.
• Fold Outside The Record into Not Stated — rejected. It reintroduces the same lie one size smaller: claiming a supplier was silent when nobody looked at that part of the document.
• Fold Outside The Record into Not In Corpus — rejected. The two differ in what the user should do next. Under Not In Corpus they go and find a binder; under Outside The Record the document is held and reachable.
• Make Corpus Unavailable a Routing outcome — rejected. It puts an infrastructure failure into the Conversational surface's answer vocabulary, and it leaves the startup-only window open.
• Re-verify the whole Corpus on every read — rejected as unnecessary. The sentinel is one key lookup and resolves the only ambiguity that mattered.

This ruling may not be re-decided

If a change contradicts this ADR: stop and raise it. Do not implement over it.

Specifically: do not render two of these four states through one component because they look alike in a mockup — that is the defect ADR-0032 was written for, and this ADR exists because it recurred in the vocabulary a day later; do not widen Not Stated back to "no answer available" because four states feel like a lot of UI; and do not drop the sentinel read as an optimisation, because without it Not In Corpus silently absorbs an evicted store.

Consequences

What becomes easy. Every no-answer screen now tells a Handler what to do next, which none of them could when two of the four meanings shared one sentence. Seam 5 gains real discriminating power: five outcomes mean a fixture case can fail for saying the wrong true thing.

What becomes hard. Four states are four components, four sets of Thai copy, and four things a person must read correctly under pressure. That cost is real and was accepted deliberately.

What is not fixed, and is not fixable by naming. Fact 4 remains: a question landing inside a curated field whose specific answer went unselected still renders as Not Stated. The dangerous half of it is already ruled out elsewhere — ADR-0015 forbids a selection omitting a Restriction, D-44 requires whole-document Reconciliation, and Seam 1 asserts every Restriction was considered. What remains is a curator overlooking non-Restriction detail, which is a Curation quality problem. A fifth state would not catch it, because the runtime cannot tell it from fact 1 without the per-Section bookkeeping rejected above.

Coverage

No upstream finding lands here. This decision came from adversarial review of the repository's own vocabulary rather than from the source, in the same way ADR-0021 and ADR-0018 did. Recorded plainly rather than attached to a finding it does not follow from — the 2026-09-08 grill found three Coverage rows doing exactly that, and one of them was in ADR-0032.

Upstream	Landed in	Evidence	Note