ADR-0049: Until a site authority signs it, the Curated Escalation is the hotline alone, and the trigger fires on a person rather than a topic

Status: Accepted — amends ADR-0006, ADR-0041 and ADR-0042, all of which stand Date: 2026-09-11

Decisions

D-113 Until a named site authority has signed it, the Curated Escalation carries the hotline act alone

"Call 1669" is a fact about Thailand and true without anyone's signature, so it ships. Evacuating and seeking medical attention are The Plant's own procedure: when they apply, and what a Handler does first, is a site authority's call. Those steps ship only under that person's name. The closed set of acts D-95 enumerates is unchanged; what changes is which members may ship unsigned — the first alone.

In Spill Response, what precedes step 1 is therefore the hotline until the evacuate-and-call condition is signed. The condition returns with the signature, in the wording the site authority approves.

D-114 The shipped escalation is gated on its content, and unsigned is null rather than a string

A build fails if the Curated Escalation carries any act other than the hotline without a named reviewer and a real review date. The reviewer field is null while nobody has signed, and the panel says so in words. It is never a placeholder string, because a non-empty string is what a check for a reviewer accepts.

D-115 The Escalation Trigger fires on something happening to a person now, and a fixture of routine questions must stay quiet

The phrase list is tuned for precision. A phrase stays only if it describes a person exposed, hurt, collapsing, or asking for help or for the number. Words the SDS itself uses — "if inhaled", "harmful if swallowed", ห้ามสูดดม, "accidental release measures" — are kept out, because a question quoting the document carries them. The list is decided by two fixtures, one that must fire and one that must stay quiet, and a phrase that fires on the second fails the suite.

What each amendment touches

Stated precisely, because "amends" is a claim the status gate cannot check.

• ADR-0006 — D-07 stands entirely. D-08's evacuate-and-call condition ("large, enclosed, or you are unsure") is suspended from display until a site authority signs its wording (D-113). The ordering it ruled — escalation ahead of procedure in Spill Response — stands, and is carried by the hotline in the meantime.
• ADR-0041 — D-95 stands for every act but the hotline: evacuate and seek-medical-attention text still needs a named reviewer, and now a build enforces it (D-114). What narrows is D-95's reach over the hotline, which needs no reviewer because it asserts nothing about The Plant. D-96 stands; the gate it keeps before step 1 is the hotline alone until D-113's signature. D-97 is untouched.
• ADR-0042 — D-98's "curated and reviewed exactly as D-95 requires" is narrowed the same way. D-99 and D-100 stand, and D-115 leans on D-100: a trigger tuned for precision is only affordable because a miss costs a tap.

Context

The grill of 2026-09-11 read the shipped escalation before ruling on it.

The D-95 guard was green on the placeholder. The reviewer field read ยังไม่ได้กำหนดผู้ตรวจสอบ — ต้องกำหนดก่อนใช้งานจริง — "no reviewer assigned — must be assigned before real use" — and the test enforcing D-95 asserted reviewedBy.length > 0. A non-empty string saying there is no reviewer passed the check that there is one. It was the eighth test found that day green for the wrong reason, and the first on a safety path.

What it guarded was three unsigned steps. Call 1669; "if the spill is large, in a confined space, or you are unsure, leave the area and tell your supervisor first"; and "take the exposed person to a doctor with the SDS". The second is ADR-0006's own condition, so it was not invented by whoever typed it — but it asserts a procedure at The Plant, and nobody at The Plant has reviewed it. Whether "unsure, leave the area" sends a Handler the right way or past the eyewash is exactly the judgement D-95 exists to put under a name. The code was honest about this; its own comment said placeholder, replace before field use. Nothing enforced "before field use".

A gate on the reviewer string could not have fixed it. Under D-113 the shipped escalation carries no name at all, so a check that refuses a placeholder reviewer refuses the one build this ruling allows — and passes on the next placeholder anyone writes. The check that fails on the thing that matters is on content: an evacuate step restored with nobody's name on it.

The trigger fired on eight of nine routine questions. Run through the real module: what breathing protection for acetone (breathing), which fire extinguisher for this and is it flammable, fire risk? (fire), ใส่หน้ากากสูดดมได้ไหม (สูดดม), ถ้ารั่วไหลเล็กน้อยต้องเก็บยังไง (รั่วไหล), can this help clean parts (help), ต้องทำยังไงถ้าจะเก็บในที่ร้อน (ต้องทำยังไง, which is Thai for "how do I"), what gloves for burn protection (burn). Only how to store near a heat source stayed quiet. The suite held one quiet case, so nothing noticed.

The list had been written generous on the reasoning that a spurious match costs a panel nobody needed. The costs run the other way. D-100 makes a miss cost one tap. A false alarm puts the emergency panel in front of routine PPE, storage and fire-safety questions and teaches Handlers to dismiss the one screen that has to be trusted.

Decision

The Curated Escalation ships as the hotline alone until a site authority signs more, and a build refuses any other act without a name and a date. The trigger fires on a person, not on a topic, and is held there by a fixture that must stay quiet.

Rejected options

• Ship all three steps, marked unreviewed — rejected. A label a Handler under stress will not read, on text that asserts a procedure nobody at The Plant approved.
• Keep all three for development and gate only the production build — the close second. It keeps agent-typed emergency guidance in front of every developer and tester as if it were the product, and makes the build that ships the only one nobody has looked at.
• Refuse a placeholder reviewer string — rejected, as argued above: it refuses the hotline-only build and passes the next placeholder.
• Leave the trigger until a site authority exists — rejected. It keeps the cry-wolf in the meantime, and the harm of a false alarm accrues from the first day of use.
• Turn the trigger off — rejected. It throws away US-58: someone typing สารเคมีเข้าตา should see 1669 at once, and phrases about a person almost never occur in routine questions.

This ruling may not be re-decided

If a change contradicts this ADR: stop and raise it. Do not implement over it.

Specifically: do not restore the evacuate or seek-medical-attention step without a named site authority and a date; do not represent "unsigned" as a string; do not replace the content gate with a check on the reviewer field; and do not add a phrase to the trigger without adding the routine questions it could collide with to the quiet fixture.

Consequences

What becomes true. Nothing reaching a Handler mid-emergency asserts a site procedure nobody at The Plant signed. The escalation panel is shorter than it was, and the one thing on it is correct everywhere in Thailand.

What this costs. A Handler in a large enclosed spill is not told to leave the area first — until The Plant says so. The persistent route to Escalation (D-100) and the hotline are unchanged, and the supplier's own spill and first-aid spans still render verbatim.

What remains open. Who the site authority is stays with the handoff's blocker 6, gated on the same access as the binder. The phrase list is still a module constant, where the glossary calls it a Corpus artifact; that gap is unchanged, and the final list is the site authority's too.

Coverage

No upstream finding lands here. Both halves were driven by reading the shipped module and running it, which is the case D-104 describes.