ADR-0081: A Handler can open the original document over the network, and no surface waits for it

Status: Accepted Date: 2026-09-20

Decisions

D-166 The stored original is served to a device from the Corpus prefix, and the control that opens it exists only where there is a connection

GET /v1/corpus/documents/:sdsId/original streams the same stored bytes the curator's route serves, on the prefix a device can reach. The Chemical Record surface offers "open the original SDS" when the device has a connection, and where it has none the control is absent and one line says the original needs a connection — never an error, never a blank panel, never a spinner.

Everything else on the record is unchanged and offline as before. The network improves this surface; it does not gate it (D-94), and no Safety-Critical read passes through the new route (D-06).

The route serves bytes keyed on the document and issues no URL a third party can hold. The loopback-only mount of the curation prefix (D-110) is unchanged and this route is not on it; a presigned URL remains the credential this project declines to invent.

Context

A Handler testing the prototype asked to read the original PDF of the chemical they were looking at. Today the stored copy is reachable only through the curation prefix, which mounts only on a loopback bind — so a phone cannot reach it at all, by design.

Two ways to change that were available. Shipping the documents inside the snapshot would make the original as offline as everything else, and would put every document's bytes on every phone, which is the budget D-39 protects. Serving them over the network makes the original conditional, which D-94 permits explicitly: a network may make a surface better, and may not make one unavailable.

Decision

A new read route on the served prefix, and an affordance that is present or absent rather than enabled or failing. Absence is stated in one sentence that also says the safety content below is unaffected.

Rejected options

• Ship the original documents inside the Corpus snapshot — rejected: several hundred kilobytes to several megabytes per document, times the whole Corpus, precached onto every phone; and the snapshot payload stops being a record of curated rows and becomes a file archive.
• Answer the felt need with provenance instead — identity triple and page number per span, no PDF — rejected by the owner: it is cheaper and touches no ruling, and it does not answer the request that was made.
• A presigned URL to object storage — rejected: D-110's reasoning holds outside curation too. A URL works from any machine holding the string for as long as it lives.

This ruling may not be re-decided

If your change contradicts an Accepted ADR: stop and raise it. Do not implement over it. Superseding requires a new ADR that says so; never edit an Accepted one.

Consequences

A Handler who doubts a line can read the page it came from, where there is signal. The trust question the prototype surfaced gets a real answer rather than a citation.

What becomes hard: the served prefix now streams document bytes, which it never did, so the API's read surface is no longer only curated rows. And a surface's content now varies with connectivity, which every test of that surface has to account for.

Coverage

No upstream finding lands here. The ruling came from a Handler's prototype test on 2026-09-20, bounded by D-94, D-39 and D-110 (D-104).