ADR-0005: Safety content is offline-first; only the chatbot requires a network

Status: Accepted Date: 2026-09-02

Decisions

D-06 The entire safety corpus ships on-device and works with no network

Hazards, PPE, spill response, first aid and storage are all available in airplane mode. The generative chatbot is the only networked feature, and degrades to pointing at the relevant SDS section when offline. Corpus updates sync opportunistically.

Context

R-17 names a "Cloud Database", but R-03's settings are plant floors, warehouses and storage rooms, and the moment of peak need is a spill (R-13) — indoors, urgent, often with no signal. R-02 states the problem being solved is speed of access; a spinner fails that problem precisely when it matters.

The D-02 extractive/generative line maps exactly onto this split: extractive safety content is local structured data, and the generative half is the only thing that needs a server. With a curated corpus (D-04) the on-device payload is a few megabytes.

Rejected options

• Online-first with an offline cache of recently viewed chemicals — rejected because the first lookup of an unfamiliar chemical is the emergency case, and it is exactly the one a recency cache cannot serve.
• Online only, honouring R-17 literally — rejected: simplest to build, but it breaks the core promise of R-02 in the settings named in R-03.
• Fully offline including an on-device chat model — rejected as disproportionate: large app, weak on-device Thai quality, and significant scope for an academic effort (D-01).

This ruling may not be re-decided

If a change contradicts this ADR: stop and raise it. Do not implement over it. Do not move a safety field behind a network call for freshness — staleness is handled by sync, not by fetching at the point of need.

Consequences

The corpus needs an on-device store and a sync mechanism with a visible "last updated" date, so a user can judge staleness. "Cloud Database" in the source is reinterpreted as the origin of truth, not the point of read.

Coverage

Upstream	Landed in	Evidence	Note
R-02	D-06	speed-of-access framing quoted in Context
R-03	D-06	the four settings drive the connectivity assumption	R-03 superseded by R-22, R-23. ADR-0018 D-34 already restated this rationale on R-22 — one plant, whose floor and store are the setting — and the ruling is unchanged. This row is the part that correction missed.
R-13	D-06	the spill scenario is the worked peak-need case
R-17	D-06	"Cloud Database" reinterpreted as origin of truth, not point of read	ADR-0002 covers only R-17's chatbot half