ADR-0040: No user-facing surface may require a network; a network may only improve one

Status: Accepted — amends ADR-0005, which stands Date: 2026-09-10

Decisions

D-94 No surface a user can reach may require a network connection to function

Every screen renders and answers with no signal. A network may make a surface better — the Query Intent tier is the one such improvement in this product — but no surface may be unavailable, blank, or reduced to an error because a connection is absent.

The rule is about surfaces, not about the system. Sync requires a network. Curation tooling is curator-side and out of this rule's reach. What is constrained is what a person can be shown.

What each amendment touches

• ADR-0005 — D-06 stands entirely and is unchanged: no Safety-Critical read may require the network. D-94 does not weaken it or restate it; it extends the same protection to the surfaces D-06 never covered, which is how one of them came to be specified as online-only without anything objecting.

Context

D-06 protects Safety-Critical reads. The Conversational surface is not one, so nothing forbade specifying it as online-only — and the spec did, in three places, saying the surface would report "its own unavailability" with no signal.

Then ADR-0031's D-66 made the Routing Floor answer with no network, and ADR-0037's D-90 moved term explanation onto the device as a Curated Explanation. Between them, nothing on that surface needed a connection any more. The spec was not revised to match, and the contradiction sat there until a cross-model grill found it.

The acceptance test had become the wrong assertion. The spec's offline check confirmed the Conversational surface "reports its own unavailability" — so a correct implementation would have failed it. A test that fails correct work is worse than no test: it teaches that the suite is unreliable, and the fix people reach for is to change the code.

The instructive part is not the stale sentences, which are cheap. It is that nothing forbade the drift. D-06's protection had a boundary, the Conversational surface sat outside it, and a design decision walked across that boundary in the direction nobody was watching. First Aid, Spill Response and the Curated Explanation lookup are all still unbuilt; the rule should exist before they are written rather than after one of them acquires a fetch.

Decision

Every user-facing surface functions with no network. The network improves query understanding and nothing else. Seam 4 widens from safety surfaces to all surfaces, with the Query Intent tier as the single documented, optional, capped exception.

Rejected options

• Observe it without ruling it — rejected. It fixes the sentences and leaves the permission. The hole is precisely what produced this defect, and leaving it means the next surface drifts the same way and is found the same way, by review rather than by a gate.
• Bind the rule to the Conversational surface alone — rejected. It fixes today's instance and not the class, and three surfaces that would be governed by it have not been written yet.
• Extend D-06's own wording instead — not available. ADR-0005 is Accepted and D-83 permits editing only Coverage Note cells. It is also the wrong shape: D-06 is about the content of a read, and this is about the availability of a surface. Two different guarantees, and collapsing them would make each harder to state.
• Rule that no part of the system requires a network — rejected as false and unbuildable. Sync requires one. The rule is deliberately about what a person can be shown.

This ruling may not be re-decided

If a change contradicts this ADR: stop and raise it. Do not implement over it.

Specifically: do not add a surface that shows an error or a blank state when offline; do not make the Query Intent tier a precondition for the Conversational surface, which D-66 already forbids and this now doubles; and do not narrow Seam 4 back to safety surfaces because asserting zero requests across the whole app is inconvenient. The inconvenience is the assertion doing its job.

Consequences

What becomes easy. The product now has a single sentence a Safety Officer can act on: no screen in this app requires a network. The previous framing — every safety surface works offline, and one other surface does not — invited the question of which and when, at exactly the moment nobody wants to reason about it.

Seam 4 gets simpler, not harder. It currently carves the Conversational surface out of a zero-network assertion. Under D-94 the assertion covers everything, with one named exception that Seam 5 already tests with the tier dead.

What becomes hard. Any future feature wanting a network must either be an improvement that degrades cleanly, or not be a surface. That is a real constraint on design and it is the point.

Where the weight now sits. The Query Intent tier is the only exception in the product, which puts real load on it staying optional. That is already D-66's ruling and already asserted by Seam 5, so the weight lands on something load-bearing rather than on a promise.

Coverage

Upstream	Landed in	Evidence	Note
R-02	D-94	speed of access at the point of use is the reason no screen may wait on a connection	ADR-0005 landed R-02's Safety-Critical half in D-06
R-13	D-94	the spill case, where the surface a Handler reaches for must not be the one that fails