ADR-0058: A stored copy is never deleted through the API

Status: Accepted Date: 2026-09-20

Decisions

D-130 There is no DELETE route for a stored copy, for the prototype's life

No composition mounts one. The existing assertion that neither composition carries a DELETE route becomes the enforcement of this ruling, rather than an accident of file/ being unmounted.

Context

A stored copy can be referenced from three directions at once: a Source Span cites the page it was verified against, a Chemical Record reaches its document through it, and a published snapshot carries the payload that froze both. Nothing in the schema checks any of that.

So a DELETE is not one route. It is a reference query across fifteen models, plus a rule for what a deleted copy means to a payload that ADR-0056 deliberately froze — a published version is the bytes the gate passed, and those bytes do not change because a file behind them went away. Building that to delete files on a single curator's machine is the wrong order of work.

The capability is refused rather than deferred because a half-built delete is worse than none: a route that deletes without the reference check would silently hollow out a published version.

Decision

The API exposes no way to delete a stored copy. The absence is asserted, not assumed.

Rejected options

• A DELETE that refuses when the copy is referenced — rejected because it needs a reference query the schema does not have, across fifteen models, plus a rule for what a deleted copy means to a payload ADR-0056 froze. The check is the whole of the work and none of it exists.
• Leaving file/ unmounted and saying nothing — rejected because an unmounted composition is an accident, not a ruling. The next person to mount it would be restoring a route, not contradicting a decision, and nothing would stop them.

This ruling may not be re-decided

If a change contradicts this ADR: stop and raise it. Do not implement over it.

Specifically: do not mount a DELETE route for a stored copy, do not add a soft-delete flag that hides one from a read path, and do not remove the assertion that no composition carries the route — that assertion is this ruling's enforcement.

Consequences

What becomes true. A stored copy that any Source Span, Chemical Record or published version ever referenced is still there. A published version's payload cannot be hollowed out from underneath.

What this costs — stated, not discovered. Stored copies accumulate, including the orphans of refused admissions. Curation is loopback-only on one machine (D-110) over one Study Area, so disk is not the constraint at this scale. The day it is, that is a decision about storage, not a licence to delete.

What is closed off. Any deletion path for a stored copy, including an administrative one, for the prototype's life.

Coverage

Upstream	Landed in	Evidence	Note
D-127	D-130	a published version is the stored payload the gate passed, so a delete would need a rule for what it means to bytes ADR-0056 froze	the frozen payload is half of why the reference check is unbuildable now
D-110	D-130	Curation runs on one loopback-bound machine, which is why accumulating copies are a stated cost rather than a constraint	ADR-0048
D-112	D-130	the abandoned upload ADR-0048 named as a cost is the same orphan class, and stays uncollected for the same reason	ADR-0048; no object delete was mounted there either