Skip to content
LQMS
ADR-0125: The Export Twin — Export Emits an Arrival Bundle
Initializing search
nburri/lqms
LQMS
nburri/lqms
Home
Evaluate LQMS
Evaluate LQMS
LQMS Known Limits
LQMS Security Posture
Architecture
Architecture
1. Introduction and Goals
2. Architecture Constraints
3. Context and Scope
4. Solution Strategy
5. Building Block View
6. Runtime View
7. Deployment View
8. Crosscutting Concepts
9. Architecture Decisions
10. Quality Requirements
11. Risks and Technical Debt
12. Glossary
The arrival bundle format
Decisions (ADRs)
Decisions (ADRs)
ADR-0001: Content-Addressed Document Storage with PostgreSQL as Source of Truth
ADR-0002: Single Instance with Scope Hierarchy and Copy-on-Derive
ADR-0003: Fixed Life Cycle States with Configurable Review Processes
ADR-0004: Global Catalogs for Roles and Document Types with Per-Scope Activation
ADR-0005: Modular Monolith
ADR-0006: Three-Layer Search with In-Database Index and Pluggable LLM
ADR-0007: Angular Frontend with Server-Side-Only Enforcement
ADR-0008: Flyway Migrations and jOOQ Codegen from the Migrated Schema
ADR-0009: RLS Enforcement via a Session-Scoped Authorized Scope Set
ADR-0010: Self-Managed QMS via an Internal Mandator
ADR-0011: Authentication via OIDC SSO with Server-Side (BFF) Sessions
ADR-0012: Permission-Based Authorization and System Bootstrap
ADR-0013: User Identity Lifecycle
ADR-0014: Electronic Signatures (Part 11 / Annex 11-Capable)
ADR-0015: Document Effectivity, Periodic Review & Validity
ADR-0016: Data Retention, Disposal & Privacy (FADP / GDPR)
ADR-0017: Multi-Part Version Content
ADR-0018: Non-Functional Targets (Capacity, Availability, Security)
ADR-0019: Notifications & Tasks
ADR-0020: Internationalization (Content Language, Time Zones, Formatting)
ADR-0021: General Typed Document Relationships
ADR-0022: Read-Acknowledgement & Questionnaires
ADR-0023: Migration / Import — Current Released State
ADR-0024: Draft / In-Review Cancellation
ADR-0025: Disposal & Erasure Mechanics (Storage, Index, Backups)
ADR-0026: RLS Runtime Safety — Connection-Pool Scope Isolation
ADR-0027: RLS Boundary — Content-Plane vs Control-Plane
ADR-0028: Stateless Encrypted Token-State Cookie (no server-side session store)
ADR-0029: Document Content Model — Draft-Freeze, Content-Table RLS, Append-Only Audit
ADR-0030: Review & Life-Cycle Realization Model
ADR-0031: Released-base readability enforcement & copy-on-derive mechanics
ADR-0032: Frontend realization — Quinoa, Angular Material, i18n & E2E
ADR-0033: CSRF control for the BFF session — SameSite + JSON content-type
ADR-0034: Notification realization — in-process domain events + system-context fan-out
ADR-0035: Fan-out contract as shipped — gate semantics, count disclosure, audit protocol
ADR-0036: Repository layer — services carry rules, repositories carry jOOQ
ADR-0037: Task scheduler — in-process tick, advisory-lock election, SQL sweep
ADR-0038: Periodic-review realization — derived due date, policy-gated confirmation
ADR-0039: Sweep & periodic-review contract as shipped — grants, guards, addressing
ADR-0040: Disposal-due surfacing — closure-anchored retention, scope-level legal hold
ADR-0041: Email channel & notification i18n — notification-as-outbox, structured messages
ADR-0042: Disposal execution — document tombstoning, single-actor hard-gated destruction
ADR-0043: Disposal blob deletion is post-commit, GC-backstopped
ADR-0044: Search FTS baseline — event-indexed, RLS-scoped search_index
ADR-0045: Image Attachments as Content Parts (Rich-Content Slice R2)
ADR-0046: Four-Eyes — Submitter Excluded from Approval
ADR-0047: Four-Eyes — Submitter-Only Exclusion
ADR-0048: Document Organization — Folder Tree per Scope
ADR-0049: Content Model Round 2 — Type Categories, Template Instantiation, Trace Relations, Completeness Rules
ADR-0050: Live Frontend — SSE State Push, CodeMirror 6, Draft Presence
ADR-0051: In-Text Document Links (doc: Scheme)
ADR-0052: Addressees & Read-Acknowledgement (REQ-TRN Realization)
ADR-0053: Addressees Per Document + Process Owner (amends ADR-0052 K-1)
ADR-0054: Process Owner Is a Role (amends ADR-0053 P-3)
ADR-0055: WYSIWYG Editing Mode over Markdown (editor step R4)
ADR-0056: Visual-Editor Chrome via Milkdown Crepe (gated adoption)
ADR-0057: Content Record Is the ProseMirror Document Tree; Markdown Becomes a Derived Projection
ADR-0058: PM_DOC Is the Only Content Format (pre-production cut; amends ADR-0057 §5)
ADR-0059: Editor Engine Switches to TipTap (spike-gated; supersedes the Milkdown/Crepe choice)
ADR-0060: Backup & Restore — Scripted Ordered Backup with Automated Restore Rehearsal
ADR-0061: CSV — Generated Validation Package per Release
ADR-0062: SBOM — CycloneDX over the Production Layers, Validated Against the Artifact
ADR-0063: User Identity Binds on Subject Only (Issuer Becomes Provenance)
ADR-0064: Per-Document Workflow Role Bindings (Author / Reviewer / Releaser), Enforced
ADR-0065: Diagrams — Excalidraw as the Manual Layer, Mermaid Stays for Text-First/UML
ADR-0066: WITHDRAW — the Author Side May Reclaim a Version from Review
ADR-0067: Review Comments — Anchored, Immutable, Resolvable
ADR-0068: Confluence/Jira QMS Import — Staged, Read-Only, Repeatable
ADR-0069: Arbitrary File Attachments — Download-Only Confinement
ADR-0070: Training Questionnaires — Versioned, Auto-Scored, Release-Gated
ADR-0071: Training Plans — Document Obligations + External Trainings & Certifications
ADR-0072: Diagrams — Self-Hosted draw.io Replaces Excalidraw
ADR-0073: Per-Scope QMS Configuration Surface
ADR-0074: PDF Export of Released Documents — Server-Side via Apache FOP over the Canonical Projection
ADR-0075: Source History Import — Continuity Without Forged Audit
ADR-0076: Periodic-review status visibility (completing MVP gap #2)
ADR-0077: Requirement Items — Keyed Blocks Inside Controlled Documents
ADR-0078: Generalized Trace Items (Traceability Model — Stage A)
ADR-0079: Risk & Risk-Control Items (Traceability Model — Stage B)
ADR-0080: Traceability Workspace — Hub, Sub-Pages, and Role-Gated Views
ADR-0081: Draft-Only Trace-Structure Changes, Server-Enforced
ADR-0082: Table-Shaped Risk Authoring over Risk Blocks
ADR-0083: The TD Dossier — a Versioned, Cross-Scope, Regulatory-Structured Deliverable
ADR-0084: Validation & Regulatory Axes (Traceability Model — Stage C)
ADR-0085: Relation-Layer Consolidation — One Trace Vocabulary, One Surface
ADR-0086: Requirement Traceability Chains — End-to-End Path View + Flat Path Export
ADR-0087: The Scope Traceability Report — One Derived Overview Artifact, Never a Controlled Document
ADR-0088: Verification Evidence Classes — Planned vs. Verified, Derived at the Read Layer
ADR-0089: Recurring Obligations — Periodic Tasks With Record Evidence, Not Calendar Series
ADR-0090: Release & Versioning Policy — Deliberate Releases, One Auditor-Facing Number
ADR-0091: Release Modes — Single-Person Record Release With a Structural Four-Eyes Floor
ADR-0092: Orphan-Blob Garbage Collection With a Quarantine Bin
ADR-0093: One Scope Context — the Toolbar Switcher Is the Only Scope Selector
ADR-0094: Calendar-Anchored Obligation Schedules (Clamped, Never Too Late)
ADR-0095: Key-Rule Governance — Free Until First Use, Then Frozen
ADR-0096: Transition Permissions — Always Visible, Deny Unless Granted
ADR-0097: A Governed Provisioning Surface — MANAGE_SCOPES
ADR-0098: Org Chart × Role System — Marriage at the Evidence Level, Never in Authorization
ADR-0099: The User Manual is an In-App Topic Reference, Not a Document
ADR-0100: LQMS Is the Living Quality Management System
ADR-0101: The Executable Validation Journey (PQ Evidence That Cannot Drift)
ADR-0102: Typed Template Variables (text | date | number — and Deliberately No Enum)
ADR-0103: npm audit Joins the Verification Gate as a Second Standing Input
ADR-0104: The Issued Dossier Is a Persisted Artifact of Record — and Clones to a New Draft
ADR-0105: Navigation Information Architecture — Group by Moment-of-Use
ADR-0106: The Client Reflection Follows Assignments, Not Only Content Reach
ADR-0107: The Audit Append Gate Follows Assignment Reach, Not Content Reach
ADR-0108: Mandator Membership — Invite-Accept, with Pre-Assigned Responsibilities
ADR-0109: Organization Founding Is Its Own Process
ADR-0110: The Audit Trail Is Not a Read Model
ADR-0111: The Imported-Person Model, and Project Portability's First Doctrines
ADR-0112: The Element-Kind Catalog — Semantics in the Model, Not Only in the Code
ADR-0113: Project Arrival Import — Records Arrive as They Are, People Arrive as They Were
ADR-0114: The Operating Model Arrives — Roles as Functions, Names as Words, People as This Instance's Decision
ADR-0115: Collaborative Draft Editing — Two Carets, One Truth, Honest Credit
ADR-0116: The System Maintenance Surface — the App Backs Itself Up, the Host Keeps One Dumb Job
ADR-0117: Role Documentation — a Link, a Finding, Per-Source Recognizers; Substitution Rejected
ADR-0118: The Offline QMS Copy — the Repo Carries the Audit Pack, Not a Second Renderer
ADR-0119: Module-Internal Package Structure — Capabilities First, Layers Second, the Root Is the Surface
ADR-0120: The Shared Kernel — the Domain-Exception Vocabulary Leaves the Authorization Module
ADR-0121: The Project Administrator Role — Per-Scope Administration With Read Access, Seeded in the Base Catalog
ADR-0122: Organization-Level Administration — the Cascade Stays, Becomes Visible, and Founds Projects
ADR-0123: Draft Save-Points — Every Save Restorable, Kept for the Life of the Version
ADR-0124: The Birth Path Completes Without Borrowing Content Clothes
ADR-0125: The Export Twin — Export Emits an Arrival Bundle
ADR-0125: The Export Twin — Export Emits an Arrival Bundle
Table of contents
Context
Decision
Consequences
Amendment 1 (2026-08-25) — the format-gap rulings (register rows 31/32/33)
Amendment 2 (2026-08-27) — the base-library landing (ADR-0127 §5 executes)
Amendment 3 (2026-09-02) — the EXPORTED event precedes the bytes (register row 51)
Amendment 4 (2026-09-05) — the bundle-format point release (register rows 52, 53, 55)
ADR-0126: Project Dissolution — the Un-Birth of an Unused Scope
ADR-0127: The Base-QMS Layers — One Library, Derived Adaptations, Local Records
ADR-0128: The GLOBAL Cascade Carries Administration, Never Content
ADR-0129: Role Identity from a GLOBAL Assignment Acts in GLOBAL Alone
ADR-0130: Break-Glass — the Project Administrator's Escalation Is a First-Class, Witnessed, Self-Expiring Act
ADR-0131: Role Substitution as Declared Adoption Edges — Emergency Cover Is Governed, Own-Name, Timed Staffing
ADR-0132: Dual-Hat Reviewer Satisfaction Is a Declared Policy Choice — the Strict Floor Stays the Default
ADR-NNNN:
</span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" > <div class="md-nav__link md-nav__container"> <a href="../../requirements/" class="md-nav__link "> <span class="md-ellipsis"> Requirements </span> </a> <label class="md-nav__link " for="__nav_5" id="__nav_5_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_5"> <span class="md-nav__icon md-icon"></span> Requirements </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../requirements/stakeholder_requirements/" class="md-nav__link"> <span class="md-ellipsis"> Stakeholder Requirements </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/gap-analysis/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Gap Analysis </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_admin/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Administration, Permissions & Onboarding </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_api_ui/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: API & User Interface </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_audit_reporting/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Audit Trail & Regulatory Reporting </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_auth/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Authentication & Session </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_backup/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Backup & Restore </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_catalogs/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Catalogs, Roles & Users </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_data_protection/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Data Protection, Retention & Disposal </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_documents/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Documents, Versions & Storage </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_dossiers/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Technical Documentation Dossiers </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_effectivity/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Effectivity, Periodic Review & Validity </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_gspr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Regulatory Conformity (GSPR / Essential Principles) </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_i18n/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Internationalization </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Life Cycle & Reviews </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_memberships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Mandator Membership & Invitations </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_migration/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Migration & Import </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_nfr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Non-Functional </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_notifications/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Notifications & Tasks </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_obligations/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_relationships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Document Relationships </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_risk/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Risk Management (ISO 14971 Hazards & Controls) </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_sbom/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Software Bill of Materials & Supply-Chain Assurance </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_search/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Search </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_separation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Scopes, Mandators & Separation </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_signatures/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Electronic Signatures </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_training/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Read-Acknowledgement & Questionnaires </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_users/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: User Identity & Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_validation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Design Validation & the Validation Traceability Axis </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" > <div class="md-nav__link md-nav__container"> <a href="../../process/" class="md-nav__link "> <span class="md-ellipsis"> Process (IEC 62304) </span> </a> <label class="md-nav__link " for="__nav_6" id="__nav_6_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_6"> <span class="md-nav__icon md-icon"></span> Process (IEC 62304) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../process/configuration_management_plan/" class="md-nav__link"> <span class="md-ellipsis"> Configuration Management Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../process/problem_resolution/" class="md-nav__link"> <span class="md-ellipsis"> Problem Resolution Process </span> </a> </li> <li class="md-nav__item"> <a href="../../process/risk_management/" class="md-nav__link"> <span class="md-ellipsis"> Risk Management </span> </a> </li> <li class="md-nav__item"> <a href="../../process/software_development_plan/" class="md-nav__link"> <span class="md-ellipsis"> Software Development Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../process/verification_plan/" class="md-nav__link"> <span class="md-ellipsis"> Verification Plan </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" > <label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0"> <span class="md-ellipsis"> Operations </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_7"> <span class="md-nav__icon md-icon"></span> Operations </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../operations/genesis-installation/" class="md-nav__link"> <span class="md-ellipsis"> Genesis: Birthing an LQMS Installation with a Base Library </span> </a> </li> <li class="md-nav__item"> <a href="../../operations/deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Deployment Guide </span> </a> </li> <li class="md-nav__item"> <a href="../../operations/server-deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Server Deployment (single Linux host, public HTTPS) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8" > <div class="md-nav__link md-nav__container"> <a href="../../traceability/" class="md-nav__link "> <span class="md-ellipsis"> Traceability </span> </a> <label class="md-nav__link " for="__nav_8" id="__nav_8_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_8"> <span class="md-nav__icon md-icon"></span> Traceability </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../traceability/matrix/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Traceability Matrix </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_9" > <div class="md-nav__link md-nav__container"> <a href="../../validation/" class="md-nav__link "> <span class="md-ellipsis"> Validation (tool lane) </span> </a> <label class="md-nav__link " for="__nav_9" id="__nav_9_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_9_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_9"> <span class="md-nav__icon md-icon"></span> Validation (tool lane) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../validation/templates/ai-authorship-posture/" class="md-nav__link"> <span class="md-ellipsis"> AI-Authorship Posture — How LQMS Is Built, and Why the Validation Evidence Does Not Rest on It (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../../validation/templates/intended-use/" class="md-nav__link"> <span class="md-ellipsis"> Intended-Use Specification — LQMS as a QMS / Document-Control Tool (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../../validation/templates/tool-risk-assessment/" class="md-nav__link"> <span class="md-ellipsis"> Tool-Risk Assessment — LQMS as a QMS Tool (TEMPLATE) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_10" > <label class="md-nav__link" for="__nav_10" id="__nav_10_label" tabindex="0"> <span class="md-ellipsis"> Regulatory </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_10_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_10"> <span class="md-nav__icon md-icon"></span> Regulatory </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../regulatory/mdr-annex-i-skeleton/" class="md-nav__link"> <span class="md-ellipsis"> MDR Annex I — GSPR authoring skeleton (paraphrased) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_11" > <div class="md-nav__link md-nav__container"> <a href="../../user-guide/" class="md-nav__link "> <span class="md-ellipsis"> User guide </span> </a> <label class="md-nav__link " for="__nav_11" id="__nav_11_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_11_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_11"> <span class="md-nav__icon md-icon"></span> User guide </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../user-guide/tutorial/" class="md-nav__link"> <span class="md-ellipsis"> Tutorial — from zero to a released document </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/administration/" class="md-nav__link"> <span class="md-ellipsis"> Administering an LQMS Installation </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/diagrams/" class="md-nav__link"> <span class="md-ellipsis"> Diagrams </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/documents-lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Documents & the Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/exports/" class="md-nav__link"> <span class="md-ellipsis"> PDF Exports & the Audit Pack </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/obligations/" class="md-nav__link"> <span class="md-ellipsis"> Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/project-context/" class="md-nav__link"> <span class="md-ellipsis"> The Project Context & App Version </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/review-comments/" class="md-nav__link"> <span class="md-ellipsis"> Review Comments </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/activity-trail/" class="md-nav__link"> <span class="md-ellipsis"> Who did what, when — reading a project's activity </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/admin-scopes/" class="md-nav__link"> <span class="md-ellipsis"> Renaming a project, and what can never change </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/authority-view/" class="md-nav__link"> <span class="md-ellipsis"> Who holds each function here, and what may it do </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/break-glass/" class="md-nav__link"> <span class="md-ellipsis"> The permission I need is held by a role I do not hold — what now? </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/coverage-and-chains/" class="md-nav__link"> <span class="md-ellipsis"> Coverage or chains? — which requirement view answers your question </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/credentials/" class="md-nav__link"> <span class="md-ellipsis"> Your password: changing it, resetting it — and why LQMS never sees it </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/emergency-cover/" class="md-nav__link"> <span class="md-ellipsis"> Who may cover for whom here — declaring emergency cover, and reading where the glass was broken </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/key-rules/" class="md-nav__link"> <span class="md-ellipsis"> Special elements: what a project declares, and when its names freeze </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/memberships/" class="md-nav__link"> <span class="md-ellipsis"> Belonging to an organization: invitations, acceptance, and what they change </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/provisioning-birth-path/" class="md-nav__link"> <span class="md-ellipsis"> How a new organization and project are born </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/review-policies/" class="md-nav__link"> <span class="md-ellipsis"> What a review policy controls, and what an empty grant means </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/setup-wizard-lanes/" class="md-nav__link"> <span class="md-ellipsis"> The setup wizard: the lanes, and what it writes </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/staffing-and-assignments/" class="md-nav__link"> <span class="md-ellipsis"> Staffing people into roles, and the accountable holder </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/technical-dossier/" class="md-nav__link"> <span class="md-ellipsis"> How do I assemble a technical dossier? </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/trace-items/" class="md-nav__link"> <span class="md-ellipsis"> Trace Items — Requirements, Risks & Risk Controls </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/trace-links/" class="md-nav__link"> <span class="md-ellipsis"> Trace Links & the Suspect Cycle </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/traceability-workspace/" class="md-nav__link"> <span class="md-ellipsis"> The Traceability Workspace </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/training/" class="md-nav__link"> <span class="md-ellipsis"> Training & Acknowledgements </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" > <div class="md-sidebar__scrollwrap"> <div class="md-sidebar__inner"> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#context" class="md-nav__link"> <span class="md-ellipsis"> Context </span> </a> </li> <li class="md-nav__item"> <a href="#decision" class="md-nav__link"> <span class="md-ellipsis"> Decision </span> </a> </li> <li class="md-nav__item"> <a href="#consequences" class="md-nav__link"> <span class="md-ellipsis"> Consequences </span> </a> </li> <li class="md-nav__item"> <a href="#amendment-1-2026-08-25--the-format-gap-rulings-register-rows-313233" class="md-nav__link"> <span class="md-ellipsis"> Amendment 1 (2026-08-25) — the format-gap rulings (register rows 31/32/33) </span> </a> </li> <li class="md-nav__item"> <a href="#amendment-2-2026-08-27--the-base-library-landing-adr-0127-5-executes" class="md-nav__link"> <span class="md-ellipsis"> Amendment 2 (2026-08-27) — the base-library landing (ADR-0127 §5 executes) </span> </a> </li> <li class="md-nav__item"> <a href="#amendment-3-2026-09-02--the-exported-event-precedes-the-bytes-register-row-51" class="md-nav__link"> <span class="md-ellipsis"> Amendment 3 (2026-09-02) — the EXPORTED event precedes the bytes (register row 51) </span> </a> </li> <li class="md-nav__item"> <a href="#amendment-4-2026-09-05--the-bundle-format-point-release-register-rows-52-53-55" class="md-nav__link"> <span class="md-ellipsis"> Amendment 4 (2026-09-05) — the bundle-format point release (register rows 52, 53, 55) </span> </a> </li> </ul> </nav> </div> </div> </div> <div class="md-content" data-md-component="content"> <article class="md-content__inner md-typeset"> <a href="https://github.com/nburri/lqms/edit/main/docs/decisions/adr-0125-portability-export-twin.md" title="Edit this page" class="md-content__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id="adr-0125-the-export-twin--export-emits-an-arrival-bundle">ADR-0125: The Export Twin — Export Emits an Arrival Bundle<a class="headerlink" href="#adr-0125-the-export-twin--export-emits-an-arrival-bundle" title="Permanent link">¶</a></h1> <ul> <li><strong>Status:</strong> accepted (2026-08-24 — proposal <code>docs/planning/export-twin-proposal.md</code> read on the train; his ruling on the whole design including D-6's cross-scope argument: <em>"that twin argumentation sounds really good. I'd say go for it :)"</em>)</li> <li><strong>Date:</strong> 2026-08-24</li> <li><strong>Deciders:</strong> Nicolas Burri</li> <li><strong>Relates to:</strong> C-4 (the one FEATURE row of v1.0 — "the corpus leaves as honestly as it arrives"), ADR-0113 (the arrival import this twins — its bundle format and head-only floor), ADR-0111 (external persons; the importer as "step one of the generic transfer arc" — this is step two), ADR-0075 (the audit trail is the instance's record — the red line that draws the fidelity boundary), ADR-0108 (re-invitation is the only way a real account exists), V106 (the one-shot working-record tripwire, read backwards to define what does NOT travel), ADR-0083/-0074 (the pack surface reused: <code>document/export</code>'s PackWriter, sha256 manifest, EXPORTED-event lineage), ADR-0118 (the offline copy — the evidence-grade sibling this must not be confused with), open decisions 28/29 (base-QMS layering — constrained by §6, to be ruled WITH it).</li> </ul> <h2 id="context">Context<a class="headerlink" href="#context" title="Permanent link">¶</a></h2> <p>The import half of portability exists and is battle-proven: three full corpus arrivals through <code>load_arrival</code>, a survived live interruption, and (as of the ruling-13 lane) resume verification measured on the 293-document staging corpus. The export half did not exist by design — C-4 was deliberately sequenced last among the big arcs. Building it as a second, independent format would mean two new systems and a new equivalence proof. The proposal's central insight collapses that: one exporter, aimed at a consumer that already survived production use.</p> <h2 id="decision">Decision<a class="headerlink" href="#decision" title="Permanent link">¶</a></h2> <ol> <li><strong>Export emits an ARRIVAL BUNDLE.</strong> The export's output is the same structure <code>load_arrival</code> consumes — manifest (documents, folders, counts), per-document metadata + markdown with historical versions, attachments, version-chains, operating-model — generated from a live LQMS scope, keyed by human id instead of source pageId. The build's first act verifies structural sufficiency against <code>load_arrival --preview</code> and names any gap honestly as the work list.</li> <li><strong>The unit of export is a project scope plus a DECLARED dependency manifest</strong>: the catalog rows it uses (document types, roles — by name and configuration, for the target's adopt-or-create machinery) and its cross-scope citations (listed, not embedded).</li> <li><strong>The fidelity line: the released corpus travels; acts stay where they happened.</strong> Travels: all versions per the arrival floor, folders, attachments, trace links, releaser/date provenance. Stays: the audit trail (ADR-0075 — the target must never claim acts it did not witness), acknowledgements, approvals, comments, periodic reviews, tasks, save-points. A migration LOSES the working-record layer by design; the source instance (or its final backup) remains the archive of record. That sentence appears in the export's manifest and the operator documentation, in bold — never in fine print.</li> <li><strong>The exporter is an in-app AUDITED act</strong>: a streaming bundle-zip endpoint on the scope, PackWriter pattern (manifest-last completeness marker, sha256 per file), one EXPORTED audit event, permission-gated at GLOBAL beside the import gate (own permission <code>EXPORT_PROJECTS</code>; the classification guard will demand its category). Exporting is a READ: it closes nothing on the source, and an exported-then-imported corpus lands under V106's one-shot rule on the TARGET exactly like any arrival.</li> <li><strong>Identity across instances</strong>: human ids travel verbatim; persons travel as ADR-0111 external persons whose source-system origin is the SOURCE INSTANCE's identifier; real accounts never travel (ADR-0108 re-invites).</li> <li><strong>Cross-scope references: identity re-binding, never tree export.</strong> The ownership principle — <em>you export what you own; you re-bind to what you reference</em> — rejects full-dependency-tree bundles (they duplicate the QMS wherever a copy lives and ship one party's IP inside another party's bundle). Instead: references export as identities <code>(scope-code, human-id, relation kind, pinned-version where the source pinned)</code>; import re-binds them against the target via a binding map in the arrival role-mapping pattern (default same-code→same-code, operator- overridable at preview); version skew inherits the in-instance semantics (<code>doc:</code> references resolve to the currently-effective released version — a migrated project governs under the target QMS's effective heads exactly as if the QMS had updated in place; pinned evidence travels unchanged); unresolved references are RECORDED, never dropped (counts in the preview, visibly inert in the corpus — the XPAGE precedent). The leaving customer's completeness need is served by their bundle plus the citation-closure audit pack (evidence-grade PDFs), not by shipping the living QMS — which remains its owner's separate export.</li> </ol> <h2 id="consequences">Consequences<a class="headerlink" href="#consequences" title="Permanent link">¶</a></h2> <ul> <li>C-4 becomes demonstrable in one command pair, and the round-trip test lands in the shape we already trust: export a production-class internal-QMS corpus → arrival-import into a second Dev-Services instance → diff the C-5 count series. The same code path proves both directions.</li> <li>§6 makes "the QMS exists on both instances" a designed state, not an accident of parallel imports: the base-QMS layer DISTRIBUTES as its owner's own export — rows 28/29's layering design must agree with this format and is to be ruled together with it.</li> <li>The bundle format is promoted from "import staging convention" to a PUBLISHED interface between instances; format changes now need the same care as API changes.</li> <li>Build shape (agreed in the proposal): format-gap audit first, exporter service + resource (PackWriter pattern), the round-trip fullstack test as the C-4 evidence artifact, then §8c "Exporting a corpus" beside §8b with §3's loss statement.</li> </ul> <h2 id="amendment-1-2026-08-25--the-format-gap-rulings-register-rows-313233">Amendment 1 (2026-08-25) — the format-gap rulings (register rows 31/32/33)<a class="headerlink" href="#amendment-1-2026-08-25--the-format-gap-rulings-register-rows-313233" title="Permanent link">¶</a></h2> <p>The format-gap audit (<a href="https://github.com/nburri/lqms/blob/main/docs/planning/export-format-gap-audit.md">export-format-gap-audit.md</a>) proved the §1 design offline and surfaced three decisions; ruled <em>"31) ii 32) agree to extend by adding REVOKED and finally 33) b"</em>:</p> <ol> <li><strong>§5 becomes true by ID ADOPTION, not prediction</strong> (row 31). The arrival surface gains an id-adoption path: permitted ONLY inside an import batch on an import-born scope; the per-(scope, type) counter is seeded past the highest adopted id; adoption REQUIRES the target scope to adopt the source's scope code (the code is embedded in every id); a collision with an existing id refuses loudly in the V107 grammar. Ordinary source-system arrivals keep minting exactly as today — adoption applies only to bundles whose manifest declares their ids authoritative. The export client's <code>predict_human_id</code> machinery retires with the conflict it worked around.</li> <li><strong>The bundle format gains <code>REVOKED</code></strong> (row 32), and the arrival surface lands it. <code>IN_REVIEW</code> travels as DRAFT (the review round is an act in progress — the target restarts its review); <code>CANCELLED</code> is skipped (the machine-noise precedent); <code>REVOKED</code> travels as the state it is — the revocation ACT stays at the source (§3), the resulting STATE is corpus truth, exactly as the releaser provenance already travels. Anything else either resurrects a withdrawn document on the target or silently forgets a revocation.</li> <li><strong>The bundle carries <code>treeJson</code> beside the <code>.md</code>, and the loader prefers it</strong> (row 33). The native tree is the record; markdown remains the human-readable projection and the fallback for foreign bundles, which keep working unchanged. This removes the node-coverage dependency from the import path entirely — no identity proof over the projection, now or for any future node type.</li> </ol> <p>Rules 2 and 3 land as ONE format version step — the first exercise of the published-interface change discipline this ADR created. The exporter's document loop is unblocked.</p> <h2 id="amendment-2-2026-08-27--the-base-library-landing-adr-0127-5-executes">Amendment 2 (2026-08-27) — the base-library landing (ADR-0127 §5 executes)<a class="headerlink" href="#amendment-2-2026-08-27--the-base-library-landing-adr-0127-5-executes" title="Permanent link">¶</a></h2> <p>Running the ruled migration surfaced a conflict between ADR-0127 §5 ("arrival-import the base layer into the GLOBAL scope with id adoption — references stay intact") and Amendment 1's own fine print, both halves of which were guards for the general case and wrong for the ruled one:</p> <ol> <li><strong><code>idsAuthoritative</code> extends to a scope the batch ADOPTED WHILE EMPTY.</strong> V114's import-born restriction guarded against claiming id authority over a scope with prior history — but the D1 cage already admits an adopted scope only while it holds zero documents, and an empty scope has no ids and a zero counter: adoption into it is exactly as safe as into an import-born one. V118 relaxes the constraint to cage-admitted scopes (born, or adopted empty); everything else about adoption is unchanged.</li> <li><strong>The id NAMESPACE is the bundle's DECLARED code, not the target scope's.</strong> Ids are names (row 31); a corpus landing in the base library keeps the names its citations, training records and printed copies already use. Adoption therefore validates ids against <code>scope-manifest.json</code>'s code, and landing them in a differently-coded scope is a DELIBERATE operator act behind an explicit flag — the accident the old check prevented (a wrong mapping silently re-homing ids) stays prevented, because without the flag divergence still refuses. Future native mints in the target keep the target's own code; the per-type counter is seeded past adopted numbers, so the two namespaces cannot collide.</li> <li><strong>The mandator check yields to the target's nature</strong>: the GLOBAL scope has no organization, so a bundle's <code>mandatorName</code> declaration is checked only when the target HAS one.</li> </ol> <p>The bundle-split tool (§5's "a script over the manifest") is product tooling: it filters a bundle to a declared subset and re-derives its manifests; the LAYER TABLE it consumes is instance data and never ships with the product.</p> <h2 id="amendment-3-2026-09-02--the-exported-event-precedes-the-bytes-register-row-51">Amendment 3 (2026-09-02) — the <code>EXPORTED</code> event precedes the bytes (register row 51)<a class="headerlink" href="#amendment-3-2026-09-02--the-exported-event-precedes-the-bytes-register-row-51" title="Permanent link">¶</a></h2> <p>The C-1a D-11 wave moved every streaming <em>evidence</em> export (the audit pack, the dossier zip) to record its <code>EXPORTED</code> audit event on the read that decides the copy, committed BEFORE the first byte, and named this bundle the one streaming export left recording it AFTER the last byte. Row 51 rules that gap closed: <strong>align the portability export with the same ordering.</strong></p> <p>The reasoning is ADR-0074's clarification, not a new one. The trail's entry is the <em>audited issue event</em>: a server can record that it issued a copy, never that one was received — receipt is not observable — so "issued" (the moment the first chunk leaves the process) is the honest fact a distribution record can hold, and the event belongs before the stream, not after it. The export is therefore now: a preflight that enforces the <code>EXPORT_PROJECTS</code> gate and resolves the download name; then, when the container drives the stream, a PLAN transaction that reads the corpus, records the one counted <code>EXPORTED</code> event and commits; then the archive, written outside any transaction from that read (the blobs render from the immutable content store).</p> <p><strong>What this changes about §3's "exporting is a READ".</strong> Nothing about the corpus: the export still closes, seals and mutates nothing on the source, and still performs exactly one write, its own <code>EXPORTED</code> event. What moves is only WHEN that event commits relative to the bytes.</p> <p><strong>The residue, named (the D-11 residue, adopted here).</strong> The prior guarantee was "a refused corpus transfer records nothing" — the event marked a <em>finished</em> export. Under the new ordering an event can exist for a transfer that then aborted: a G-8 completeness refusal (a referenced attachment whose bytes are gone), a broken socket, a container that never drives the stream after the plan commits. This is the <em>conservative over-record</em> — it may over-state that a corpus left, never the reverse — and it is the honest direction for a distribution-control record, exactly as the audit pack argues. The G-8 protection is undiminished: the completeness marker <code>manifest.json</code> is still written LAST and still absent from an aborted archive, so <code>load_arrival</code> still refuses it on sight. The one thing that no longer distinguishes a complete export from a truncated one is the PRESENCE of the event; the manifest does that job, and always did it better.</p> <p><code>PortabilityExportServiceTest</code> is re-pinned accordingly: a successful export records exactly one counted event, and a G-8 abort now leaves that event standing over a manifest-less archive rather than recording nothing. <code>StreamingBundle</code>'s KDoc no longer names this bundle as the lone divergence.</p> <h2 id="amendment-4-2026-09-05--the-bundle-format-point-release-register-rows-52-53-55">Amendment 4 (2026-09-05) — the bundle-format point release (register rows 52, 53, 55)<a class="headerlink" href="#amendment-4-2026-09-05--the-bundle-format-point-release-register-rows-52-53-55" title="Permanent link">¶</a></h2> <p>The row-37 two-instance rehearsal (<a href="https://github.com/nburri/lqms/blob/main/docs/planning/row-37-rehearsal-local.md">row-37-rehearsal-local.md</a>) ran the whole export→land cycle between two installations and found the corpus arriving byte-identical — and <strong>the conclusions drawn from it arriving wrong</strong>. Three rows were ruled from it ("agree with all your suggestions", 2026-09-04 evening; the eligibility line confirmed 2026-09-05).</p> <p><strong>Format 1.2, the second exercise of this ADR's own published-interface discipline</strong> (Amendment 1 was the first). Three ADDITIVE fields on <code>documentTypes[]</code>, so a 1.2 reader still reads every 1.1 bundle; the fields are optional on read and mandatory on write. Full text in <a href="../../architecture/arrival-bundle-format/">arrival-bundle-format.md</a> §1, §3, §4, §15 item 4 and Appendix C.</p> <ol> <li><strong><code>verificationEvidence</code> travels (row 52).</strong> <code>document_type.verification_evidence</code> (ADR-0088) decides whether an inbound <code>verifies</code> claim reads <em>verified</em> or <em>planned</em>. With no slot for it, the rehearsal's fully-VERIFIED chain landed reading <code>fullyVerified: 0</code> / <code>VERIFICATION_PLANNED_ONLY</code> over a bit-identical corpus, with zero refusals reported and the operator's count diff clean. The corpus was right and what the system SAID about it was wrong — the one failure mode a portability format may not have. Silence was the unacceptable option; a field is cheaper than making the loss loud.</li> <li><strong><code>retentionPeriodDays</code> + <code>reviewIntervalDays</code> travel (row 53).</strong> A records-retention obligation (ADR-0040 D3) was dropped by a migration, silently. The stored day count travels faithfully; what the TARGET's own <code>/defaults</code> write path makes of it is that path's business — register row <strong>67</strong>'s interval skew is deliberately not worked around here, because an imported period must not disagree with a hand-typed one on the same installation.</li> <li><strong>CREATE APPLIES, ADOPT REPORTS.</strong> All three are columns on the installation-wide <code>document_type</code> row. A type the import MINTS takes the declaration, through the surfaces that already govern those columns (<code>VERIFICATION_EVIDENCE_SET</code>, <code>DOCUMENT_TYPE_DEFAULTS_UPDATED</code> — MANAGE_CATALOG at GLOBAL, the gate the type creation just passed, so each sub-act still audits as itself per ADR-0113 D5). A type the catalog ALREADY carries keeps this installation's values and the difference is REPORTED — in the preview's proposal detail, in the vocabulary outcome's <code>catalogDivergences[]</code>, and on the operator's terminal. An arriving corpus may not re-decide, for every tenant of the receiving installation, what counts as verified — that is precisely the cross-tenant defect the 2026-08-19 ruling closed when it moved the flag's write to MANAGE_CATALOG-at-GLOBAL — and it may not drop the difference on the floor either.</li> <li><strong>The manifest's honesty counters count what is actually dropped (row 53).</strong> <code>crossScopeReferencesNotCarried</code> keyed on <code>trace_link.target_scope_id</code>, which is NULL for a document-target link even when the target document lives in another scope: the rehearsal's bundle reported <code>0</code> while dropping <code>1</code>. The counter now asks whether the target is outside the scope at all, and two siblings name the other two classes the bundle drops (<code>documentTargetReferencesNotCarried</code>, <code>documentRelationsNotCarried</code>). §6's "unresolved references are RECORDED, never dropped" is only worth anything if the record is true.</li> </ol> <p><strong>Export eligibility, clarified (row 55).</strong> <code>GET /api/scopes/{id}/portability-export</code> accepts a <strong>PROJECT</strong> and the <strong>GLOBAL</strong> base library, and refuses a <strong>MANDATOR</strong> anchor with a named 400: <em>"An organization anchor holds no corpus — export its projects."</em></p> <ul> <li>The anchor holds no <code>document</code> rows by construction — memberships, assignments and its own trail live there, the corpus lives in the projects beneath it. So the thing this refusal prevents is not an error: it is a 200 with a well-formed bundle of nothing, <code>documents: 0</code>, a real <code>EXPORTED</code> event and a file named after the organization. An operator carrying a customer's QMS off the installation would have no reason to doubt it.</li> <li><strong>GLOBAL stays exportable, and that is a DELIBERATE CAPABILITY rather than a gap in a type check.</strong> The base QMS layer DISTRIBUTES as its owner's own export — §6's own consequence, realized by ADR-0127 §5 and Amendment 2's namespace rules, landed into the recipient's GLOBAL with id adoption. That is the supplier-distribution story (Ergon's base QMS reaching a customer installation), and it is why <code>load_arrival</code> has a <code>--land-into GLOBAL</code> path at all. Refusing GLOBAL here would break the one distribution channel this ADR designed.</li> <li>The refusal is a 400 in the V107 grammar and it happens in the PREFLIGHT, so no 200 stream ever opens and nothing is recorded. Offering the export affordance only where the server would accept it is a named follow-up on the web UI, not part of this amendment: <strong>the server refusal is the substance.</strong></li> </ul> <p>The rehearsal's remaining divergences are triaged item by item in the format document's Appendix C — four closed here (the two counters, the <code>DOCUMENT_IMPORTED</code> arithmetic, the attachment units and the batch evidence's Confluence wording), three argued and left with their reasons (the missing installation-instance identifier, element-kind descriptions, and <code>manifest.json</code> standing outside its own digest listing).</p> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <button type="button" class="md-top md-icon" data-md-component="top" hidden> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg> Back to top </button> </main> <footer class="md-footer"> <nav class="md-footer__inner md-grid" aria-label="Footer" > <a href="../adr-0124-birth-completes-without-content-clothes/" class="md-footer__link md-footer__link--prev" aria-label="Previous: ADR-0124: The Birth Path Completes Without Borrowing Content Clothes"> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </div> <div class="md-footer__title"> <span class="md-footer__direction"> Previous </span> <div class="md-ellipsis"> ADR-0124: The Birth Path Completes Without Borrowing Content Clothes </div> </div> </a> <a href="../adr-0126-project-dissolution/" class="md-footer__link md-footer__link--next" aria-label="Next: ADR-0126: Project Dissolution — the Un-Birth of an Unused Scope"> <div class="md-footer__title"> <span class="md-footer__direction"> Next </span> <div class="md-ellipsis"> ADR-0126: Project Dissolution — the Un-Birth of an Unused Scope </div> </div> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class="md-copyright"> <div class="md-copyright__highlight"> Built from <code>v0.9.56-4-g06c7f811</code> (commit <code>06c7f811</code>, 2026-09-09) — the same Markdown the repository ships. </div> </div> </div> </div> </footer> </div> <div class="md-dialog" data-md-component="dialog"> <div class="md-dialog__inner md-typeset"></div> </div> <script id="__config" type="application/json">{"base": "../..", "features": ["navigation.instant", "navigation.tracking", "navigation.top", "navigation.footer", "navigation.indexes", "toc.follow", "search.suggest", "search.highlight", "content.code.copy", "content.action.edit"], "search": "../../assets/javascripts/workers/search.6ce7567c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src="../../assets/javascripts/bundle.83f73b43.min.js"></script> </body> </html>