ADR-0088: The Curator's record read serves live rows, and corrected ones are a count rather than content

Status: Accepted Date: 2026-09-20

Decisions

D-184 A Curator reads a Chemical Record's live selections, each with the id a correction names

GET /api/v1/curation/documents/:sdsId/record answers what one Chemical Record currently holds: every live selection, with its id, the field and position it occupies, and the Source Span it displays with that span's SDS Section.

The id is the point. Superseding a selection names the row it replaces, retracting one names the row it removes, and superseding a Spill Response branch names the branch (D-169, D-170, D-180). Before this read, the only place an attachment row's id appeared was the response to the select-span call that created it — so correcting anything required a Curator to have written the id down when they first selected it. The correcting acts were reachable by the API and unreachable by a person.

D-185 A superseded or retracted row is counted, never served as content

The read carries supersededCount and retractedCount per Chemical Record. It does not carry the rows, their passages, their Curators or their reasons.

A Curator is told that corrections happened and how many. What a corrected row said is not on this surface.

The reason is the one this whole line of rulings turns on: content that looks authoritative and is not is the failure mode. This surface renders Safety-Critical Content as the Corpus holds it, and a retracted passage rendered beside a live one is two answers to "what does this document say about spills" on a screen that is shaped to be believed. A count is a fact about the record's history; a passage is a claim about the document.

What this does not rule. Whether a surface should exist that shows a correction chain in full — who replaced what, when and why — is not decided here. The audit trail is stored, in full, on the rows themselves; this ADR rules only that the record read is not that surface. If one is wanted it is an ADR first and a route second.

Context

ADR-0084 and the three rulings after it made a curated selection correctable, and built every correcting act. None of them is reachable by a person: each names a row by id, and no query in the Curation module returns one. The five that exist answer about the stored copy, verified pages, Reconciliation Gaps, published snapshots and what a version shipped — none about what a record currently holds.

So a Curator who has selected a passage into the wrong field has no way to learn which id to correct, short of the response they saw at the moment they created it.

Decision

The Curator's record read serves every live selection of one Chemical Record with the id a correcting act names, and reports superseded and retracted rows as counts rather than as content.

Rejected options

• Serving corrected rows alongside live ones, marked — rejected. It is what D-162 does for verifications, and the analogy does not carry: a verification record is a judgement about a page, and a selection is the safety text itself. Marking is a rendering promise, and the cost of the mark being missed on this surface is a Curator reading a retracted first-aid passage as current. The product refuses the same trade elsewhere — Curated Escalation ships with the shell precisely so a Handler is never shown text whose standing is ambiguous.
• Serving them behind a separate route, unmarked — not taken here, and deliberately not refused either. It is the shape a correction-history surface would have, and it is a different question from what the record read serves. Named above as unruled rather than closed.
• Omitting the counts entirely, serving only live rows — rejected. A record that has been corrected four times looks identical to one never touched, and a Curator about to correct it again has no signal that somebody has been here. The count asserts nothing about what changed and cannot be misread as content.
• Deriving the read from the snapshot serialiser's payload — rejected. That payload is what a device receives, and it deliberately carries no attachment row ids: labelKey is the id a snapshot ships (ADR-0051), and the row numbers stay server-side. This read exists to hand a Curator exactly the ids the payload is built to withhold, so it reads live rows.

This ruling may not be re-decided

If a change contradicts this ADR: stop and raise it. Do not implement over it.

Specifically: do not add a superseded or retracted row's text, Curator or reason to this read, and do not add a flag that makes it serve them. The counts are facts; the passages are not on this surface. A correction-history surface is a new ADR, not a query parameter on this one.

Consequences

What becomes easy. Every correcting act ADR-0084's line of rulings built becomes reachable by a person rather than only by a caller who kept a note. A Curator can see what a record holds, which nothing until now allowed at all.

What becomes hard. Reading back what a correction removed. That is deliberate, and the audit trail is stored rather than lost — it is simply not on this surface.

What is closed off. A record read that renders corrected safety text.

Coverage

No upstream finding lands here. This came from building ADR-0084's correcting acts and finding that none of them could be reached by a Curator, the same way the three rulings before it arose (D-104).

Upstream	Landed in	Evidence	Note