DR-145: Document review is a client-optional capability, not part of the admission model

DR-145 — Document review is a client-optional capability, not part of the admission model

Context

{427.15} needed to know whether source_documents.publication_status is DR-025’s knowledge-admission gate before filtering the producer’s reads on it, and escalated when measurement said it is not (see DR-143’s S550 amendment for the evidence).

That left two questions the codebase could not answer, because the column’s origin is a pre-reframe spec (publication-approval-gate-spec.md, S220, archived and no longer in the repo) ported onto source_documents by a column-placement rule. What the column is for now is a product call, not a measurement.

Measured on Platform staging, so the scope is understood: 36 source documents, all published; 25 q_a_pairs, all published. Neither gate has ever been exercised there. Standard DR-104 caveat — pre-launch data is synthetic, so that is evidence about exercise, never about correctness. This is design work, not a migration.

Decision

Two axes on the evidence register, with distinct jobs:

Column	Answers
`publication_status`	Has this document been reviewed and approved? (`draft → in_review → published`)
`admission_status`	Is this document still admitted to the corpus? (`admitted → withdrawn → tombstoned`)

1. The document review surface is RETAINED, as a client-optional capability. in_review on a document stays, and /review’s document queue with it. The requirement it serves is a client who wants a human to approve a document before it is treated as reviewed — a capability offered per client, not a step every client passes through.

2. Withdrawal re-homes onto admission_status. “Withhold this document and its chunks from retrieval” is not a publication question. admission_status already exists (text NOT NULL DEFAULT 'admitted') and this ledger already names it as the source-lifecycle column — tasks/id-409.md:84, sourced to id-138 M1 and DR-023/DR-025. A withdrawn state must stay clearly distinct from tombstoned, whose meaning is GDPR erasure with cascade and whose register row survives by design.

Scope — what this decision does NOT do

Stated explicitly, because the natural misreading is much larger than the ruling.

It does not change DR-025’s two gates. The binding gate remains retention_class/origin_type; the authoritative knowledge-admission gate remains record promotion plus the id-133 ontology linter, over records. Neither moves, and neither acquires a document-level tier.
It does not make document review a precondition for anything. publication_status defaults to 'published', so the front door stays light and a connected source is admitted immediately. A client that never enables document review sees no queue and no gate. Nothing in the pipeline blocks on it.
It does not weaken corpus-reframe-review.html R2. R2’s argument is that the queue which scales is over units of knowledge — “nobody can hand-curate a gated folder at that scale, but everyone can sign off a review queue” — and that authority is earned at promotion, not inherited from a folder. Both still hold. Authority is still earned at record promotion; a client-optional document review confers no authority on anything.
It is not a general ruling on document-level approval as a pattern. A future design that made document review mandatory, platform-wide, or a precondition for extraction would be a different decision and would need to answer R2’s scale argument on its own terms. This one does not, because it is opt-in and confers nothing.

Consequences

publication_status = 'archived' collides with the new withdrawn — two ways to say “stop serving this”. One must give, and archived is the weaker: its archived_at/archived_by columns have no independent writer and are set only as a side-effect of the publication transition (lib/governance/publication-transitions.ts:129,152, measured S550). id-420 owns the reconciliation.
source_documents.publication_status has no CHECK constraint while q_a_pairs does (re-confirmed S550 against staging: q_a_pairs_publication_status_check is the only one in public). id-420’s finding 6 is upgraded from an observation to a defect by this ruling — a column ratified as a real review gate must not accept arbitrary text.
The MCP governance tools drive publication polymorphically over {source_document, q_a_pair} (lib/mcp/tools/governance.ts:176). That polymorphism is no longer obviously wrong, but the two owner kinds now mean different things by “published” — review-approved versus admitted-to-canon — and the tool surface does not distinguish them. id-420’s tool-side consolidation.
DR-143 is unaffected and better grounded. A document that has not passed its own review gate should not back or be cited by a concept — an independent justification for the same filter. See DR-143’s S550 amendment.
id-408’s vocabulary gap can close. The source-lifecycle terms are still absent from reference/entity-glossary.md; this ruling supplies the two definitions the glossary entry needs, to be reused verbatim (S504 R6).

Alternatives considered

Retire publication_status from source_documents entirely. The strongest read of R2, and defensible on the evidence — no live path moves a document out of published except an E2E seed script. Rejected because it forecloses a capability a client may want, for a column that costs nothing while unused. The owner’s framing: keep it available, do not make it structural.
Keep withdrawal on publication_status = 'archived'. Rejected: it conflates “not yet reviewed” with “no longer served” on one axis, and leans on archived_at/archived_by, which no independent writer maintains.
Route withdrawal to retention_class or record_lifecycle. Rejected as a category error — retention_class governs how the bytes are treated, and record_lifecycle carries governance/freshness. Neither means “stop serving”.