Graticula · Phase 1 — Implementation

Control Room

Everything below is read out of the repository at build time — the ADR headers, open-questions.md, architecture-debt.md, architecture-assumptions.md and git. Nothing on this page is typed by hand, because the two versions that were went stale within a day.

Generated from commit e429a8ee · 2026-10-31 17:17

Where it stands

247

ADRs

81 accepted outright

577/658

ADR conditions discharged

71 live · 10 deferred with their decision

open questions

226 answered

open debts

309 repaid · 5 waiting on a trigger · 5 partly

7/9

review gates run

1 need an outside reviewer

16/91

assumptions validated

the rest are unproven

5619

tests

609 source files, 271,525 lines

What is left

Three buckets, sorted by who can move them. The sort is derived: an item is the owner's when the question register names them, and an outside reviewer's when the gate says in its own words that it needs somebody who did not write this. Everything else is ours, and it is the only bucket that shrinks by working.

Owner0 open

Nothing is waiting on the owner.

An outside reviewer1 gates

Operations — Needs a deployment somebody operates.

§67 also still owes a review round by somebody who did not participate. Rounds 1 and 2 were self-review; round 3 was commissioned and briefed by the author.

Ours96 items

71 ADR conditions outstanding across 49 decisions — the largest commitment on this page.

21 debts with their repayment triggers already written down.

3 capability areas not started: Publishing, Observability, Resource governance.

1 review gates nobody else is blocking: Extensibility.

Open conditions, by decision

A condition is discharged when its text is struck through in the ADR itself. Nothing here is marked done by this page — it is counted from the decision that made the promise.

ADR-204 · One deployment holds several organ

ADR-191 · ArcGIS Pro publishes hosted featur

ADR-012 · Clustering

ADR-055 · A connection is fields, and this s

ADR-076 · OAuth 2.0 authorization code with

ADR-079 · A web map is a saved document, and

ADR-089 · Sign-in through an LDAP directory,

ADR-090 · Sign-in through a SAML 2.0 identit

ADR-177 · OGC API Records is a searchable ca

ADR-224 · grapy aims at arcpy's whole builda

ADR-243 · grapy builds the image classifiers

ADR-249 · grapy carries deep learning on poi

ADR-006 · Plugin Model

ADR-013 · Feature Service Data Model: Identi

ADR-024 · Shapefile import, and the exceptio

ADR-026 · Serving through a platform-store o

ADR-032 · The product is named Graticula

ADR-046 · Admission control bounds the queue

ADR-048 · CI does not run the real-data suit

ADR-059 · Quiescing a data source

ADR-074 · Z and M are read, said out loud, a

ADR-077 · Z and M ride beside x and y, and a

ADR-080 · Hosted tables keep the Z and M the

ADR-081 · Migration publishes an ArcGIS Serv

ADR-083 · The where clause evaluates ArcGIS'

ADR-087 · A domain is a named object that fi

ADR-088 · Sign-in through an OpenID Connect

ADR-101 · Studio is walked the way a Portal

ADR-106 · A layer's data can be exported as

ADR-162 · WMS and WFS at a service's own add

ADR-164 · `generateKml` is a network link to

ADR-165 · OGC API Features filters in Basic

ADR-175 · OGC API Maps, over the WMS rendere

ADR-176 · OGC API Styles, read-only, over th

ADR-178 · HTTP Basic on the OGC faces, over

ADR-181 · The ArcGIS REST API version this s

ADR-182 · An image service can be an elevati

ADR-201 · A member with a password here may

ADR-211 · Tables of an attached DuckDB file

ADR-214 · The portal's item writes do what t

ADR-217 · A versioned or archived geodatabas

ADR-218 · A pinned service is kept warm

ADR-222 · Geoprocessing is built-in analysis

ADR-231 · grapy holds utility networks

ADR-232 · grapy holds network diagrams

ADR-234 · grapy holds terrain datasets and o

ADR-237 · grapy holds SAR data and motion im

ADR-241 · grapy builds path distance, its fa

ADR-242 · grapy builds Topo to Raster, Segme

Review gates (§66)

Each gate runs against the whole architecture, not per ADR, and a failure reopens decisions rather than being noted and passed over. A gate ticked without evidence is worse than one left open: it turns an unknown into a false assurance and nothing afterwards re-examines it.

Gate	Run	Result, or what it is waiting for
Correctness	FAIL	FAIL, and all five findings are repaired.
Simplicity	FAIL	FAIL, narrowly, and not for the reason this row expected.
Performance	FAIL	FAIL, on a finding about behaviour rather than speed.
Failure	FAIL	FAIL, and all ten findings are now repaired — six on the day, the last four on 2026-08-23, each measured before and after.
Operations	not run	Needs a deployment somebody operates.
Security	FAIL	FAIL on one finding, repaired the same day.
Extensibility	not run	No plugin code exists, so the gate has nothing to examine.
Licensing	PASS	PASS.
Consistency	FAIL	FAIL, and all four findings are now answered — three on the day, the fourth on 2026-08-23.

Decisions

Every architectural decision is an ADR. Status and confidence are read from each file's own header, so a decision cannot quietly change grade here without changing there.

ADR	Decision	Status	Confidence	Conditions
001	Core Language	ACCEPTED 2026-08-25, by owner decision: "ben Q-01'i kabul ettim .NET olarak".	MEDIUM — 2026-08-25.
002	Primary Data Architecture	REOPENED → re-decided, ACCEPTED WITH… REOPENED → re-decided, ACCEPTED WITH CONDITIONS	MEDIUM	3/3
003	Geometry Engine	ACCEPTED WITH CONDITIONS single-provider scope.	HIGH for the split, which is measured.
004	Rendering Engine	ACCEPTED un-deferred 2026-08-20 by ADR-041, which is where the decision now lives.	—
005	API Architecture	ACCEPTED WITH CONDITIONS re-closed 2026-08-20.	MEDIUM-HIGH	4/4
006	Plugin Model	ACCEPTED WITH CONDITIONS re-closed 2026-08-15, see §0.	MEDIUM-HIGH	1/2
007	Service Runtime	ACCEPTED WITH CONDITIONS	MEDIUM — structure well supported, routing unproven	2/4
008	Query Engine	ACCEPTED WITH CONDITIONS	MEDIUM	3/3
009	Raster Engine	ACCEPTED WITH CONDITIONS re-closed 2026-08-15, see §0.	MEDIUM	2/3
010	Caching	ACCEPTED WITH CONDITIONS	MEDIUM	4/4
011	Job System	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH	4/4
012	Clustering	REQUIRES PROTOTYPE (was DEFERRED until… REQUIRES PROTOTYPE (was DEFERRED until 2026-10-22, when the owner asked for the plan: "En son server clusteringi planla")	MEDIUM for the inventory, which is read from the code · LOW for every cost below, none of…	1/4
013	Feature Service Data Model: Identity, Relationships and Attachments	ACCEPTED WITH CONDITIONS	MEDIUM	6/7
014	TLS and Certificates	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH	4/4
015	Authentication	ACCEPTED WITH CONDITIONS	MEDIUM	5/5
016	Packaging, Deployment and Upgrade	ACCEPTED WITH CONDITIONS	MEDIUM	5/5
017	Admin API Shape	ACCEPTED WITH CONDITIONS	MEDIUM — the shape is decided, the surface is not	2/3
018	Authorization: user types, roles and privileges	REOPENED 2026-08-14 by owner direction →… REOPENED 2026-08-14 by owner direction → re-decided, ACCEPTED WITH CONDITIONS	MEDIUM	5/5
019	One deployable, three fused tiers	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH for the decision · LOW for the trigger conditions in §5	3/3
020	An admin console, and what "stop a service" means	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH for the console · MEDIUM for the status model	3/3
021	Tiles are encoded by PostGIS, and we do not write an encoder	ACCEPTED WITH CONDITIONS	HIGH for the decision · MEDIUM for the condition in §7	3/3
022	GeometryServer ships in halves, and the projection engine is the datastore's	ACCEPTED WITH CONDITIONS · §2 SUPERSEDED by… ACCEPTED WITH CONDITIONS · §2 SUPERSEDED by §2b, 2026-08-15	HIGH for the split · HIGH for the engine · MEDIUM for the vertex cap	4/4
023	The REST Services Directory: an HTML face for the API	ACCEPTED WITH CONDITIONS	HIGH	7/7
024	Shapefile import, and the exception it costs	ACCEPTED WITH CONDITIONS	HIGH	4/5
025	Governance: what a gift owes, and what it does not	ACCEPTED WITH CONDITIONS	HIGH	4/4
026	Serving through a platform-store outage: public-only, while blind	ACCEPTED WITH CONDITIONS	HIGH for the policy · MEDIUM for the window	4/5
027	Glyphs and sprites: the tile service could not draw a label	ACCEPTED WITH CONDITIONS	HIGH for the decision · MEDIUM for the coverage	5/5
028	Style documents: the one thing about a map a server cannot guess	ACCEPTED WITH CONDITIONS	HIGH	5/5
029	Affinity routing is not the default, and A-003 stops being load-bearing	ACCEPTED WITH CONDITIONS	HIGH for the reversal · MEDIUM for what replaces it at scale	2/4
030	Reading the reference implementation, not only its documentation	~~ACCEPTED WITH CONDITIONS~~ WITHDRAWN the permission this ADR granted ended 2026-09-09 by owner decision.	MEDIUM	2/3
031	A service's capabilities are configured, and configuration only ever restricts	ACCEPTED WITH CONDITIONS	MEDIUM	6/6
032	The product is named Graticula	ACCEPTED	HIGH	3/4
033	Symbology: one canonical document per layer, and both protocol faces derive from it	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH for the canonical model · MEDIUM for the derivation's fidelity	5/5
034	Two surfaces over one API: Server for the operator, Studio for the publisher	ACCEPTED WITH CONDITIONS	HIGH for the split · MEDIUM for where each screen lands	5/5
035	Role privileges are editable, except the administrator's	UNKNOWN	—	7/7
036	Groups, and the two axes an authorization answer now has	UNKNOWN	—	5/5
037	Job workers come in two kinds	ACCEPTED WITH CONDITIONS	MEDIUM	6/6
038	How a geodatabase becomes one service with many layers	UNKNOWN	—	6/6
039	WFS 2.0, read-only, is the first surface after v1	UNKNOWN	—	6/6
040	The portal surface is how ArcGIS Pro connects	UNKNOWN	—	4/4
041	The map renderer, and the two faces that hang off it	ACCEPTED WITH CONDITIONS	MEDIUM-HIGH for the placement and the library · MEDIUM for labels · HIGH for throughput,…	6/6
042	OGC API Features, and the inversion it unwinds	ACCEPTED WITH CONDITIONS	HIGH for the decision, which was already taken · MEDIUM for the conformance claim until…	5/5
043	ImageServer, and where the raster Tier 1 line falls	ACCEPTED WITH CONDITIONS	MEDIUM for the decomposition and the Tier 1 line · LOW for the first cut's completeness,…	6/6
044	Tiles are served, because the claim had to be true	ACCEPTED WITH CONDITIONS	HIGH	6/6
045	The server keeps a log you can ask questions of	ACCEPTED WITH CONDITIONS	MEDIUM	6/6
046	Admission control bounds the queue, not the wait	ACCEPTED WITH CONDITIONS	MEDIUM	4/5
047	The outbound licence is Elastic License 2.0	ACCEPTED · SUPERSEDED by… ACCEPTED · SUPERSEDED by ADR-180, 2026-10-13	HIGH for the decision · MEDIUM for what it will cost in adoption	3/3
048	CI does not run the real-data suites, and says so on every run	ACCEPTED	HIGH for the exclusion · MEDIUM for whether announcing it is enough	1/2
049	A face refuses in its own vocabulary, even when that vocabulary has no word for it	ACCEPTED	HIGH for refusing at all · MEDIUM for which exception code
050	A release is a tag, and what it publishes is two images	ACCEPTED	HIGH for the registry and the trigger · MEDIUM for the tag scheme
051	An appearance is chosen by looking at it	ACCEPTED	HIGH
052	The canonical symbology document is CIM	ACCEPTED WITH CONDITIONS	MEDIUM	5/5
053	The symbology editor is three columns, and the item page has a head	ACCEPTED	HIGH
054	The symbology document is not bounded	ACCEPTED	HIGH — MEDIUM on what replaces the bound until 2026-09-05, when condition 1 was measured	2/2
055	A connection is fields, and this server assembles it	ACCEPTED	HIGH	0/2
056	An item is its own thing, and a service is one kind of it	ACCEPTED	HIGH — MEDIUM on the field layout until 2026-09-05, when condition 1 was answered	2/2
057	Composing and publishing a service	ACCEPTED	HIGH for the composition and the publish rules · MEDIUM for the faces	7/7
058	The datastore's schema is edited from the screen	ACCEPTED WITH CONDITIONS	HIGH for the rule and the refusals · HIGH for the dependency list — MEDIUM until…	4/4
059	Quiescing a data source	ACCEPTED WITH CONDITIONS	HIGH for the refusal and the deadline · MEDIUM for the window's length · LOW for the…	4/5
060	The axis order comes from the authority's register, carried as data	ACCEPTED WITH CONDITIONS	HIGH for the answer, which is the authority's own · HIGH for the defect, measured on a…	4/4
061	Metrics are aggregate; per-entity numbers live in the admin API	ACCEPTED WITH CONDITIONS	MEDIUM	2/2
062	The query face streams, like every other face	ACCEPTED	HIGH — the choice is between two behaviours that were both measured on the same route…
063	A field list may differ from the table, in two ways and no more	ACCEPTED WITH CONDITIONS	~~MEDIUM — the decision is the owner's and the shape is forced by what already exists,…	3/3
064	Editor tracking, and what `features:edit` means	ACCEPTED WITH CONDITIONS	MEDIUM	3/3
065	Domains and subtypes	ACCEPTED WITH CONDITIONS	MEDIUM	5/5
066	GeoParquet layers, read in place by DuckDB	ACCEPTED WITH CONDITIONS	MEDIUM	5/5
067	DuckDB sources beyond a local folder: remote GeoParquet, a DuckDB database file, MotherDuck	ACCEPTED WITH CONDITIONS	MEDIUM	6/6
068	Responses are compressed, on an allowlist rather than everywhere	ACCEPTED	HIGH
069	Query responses carry the layer's cache lifetime	ACCEPTED WITH CONDITIONS	MEDIUM
070	A layer has a visible scale range, and publishing measures one from the data	ACCEPTED WITH CONDITIONS	MEDIUM	4/4
071	A layer's thumbnail is drawn once and kept until somebody redraws it	ACCEPTED	HIGH
072	Pages on other origins may read service responses, never with credentials	ACCEPTED §5 amended 2026-10-14 by owner decision on Q-169: credentials are now allowed, and the session cookie never counts across origins (§5a)	MEDIUM
073	A FeatureServer query answers in PBF, on the grid the caller names	ACCEPTED	HIGH
074	Z and M are read, said out loud, and not served	ACCEPTED WITH CONDITIONS	HIGH	1/3
075	A layer is edited by its owner, an administrator, and the group its owner shares it with	ACCEPTED WITH CONDITIONS	HIGH	3/3
076	OAuth 2.0 authorization code with PKCE, for registered apps	ACCEPTED WITH CONDITIONS	MEDIUM	3/5
077	Z and M ride beside x and y, and a flat geometry pays nothing for it	ACCEPTED WITH CONDITIONS	HIGH	4/5
078	A hosted layer can keep its history, and the database keeps it	ACCEPTED WITH CONDITIONS	HIGH that the database keeps it · MEDIUM on the write cost, which is measured once on one…	6/6
079	A web map is a saved document, and ArcGIS clients can open it	ACCEPTED WITH CONDITIONS	HIGH on the format · MEDIUM on the viewer's shape until the owner has used it	2/4
080	Hosted tables keep the Z and M their data carries	ACCEPTED WITH CONDITIONS	HIGH	1/2
081	Migration publishes an ArcGIS Server's layer definitions over the tables they already read	ACCEPTED WITH CONDITIONS	MEDIUM	0/1
082	Offline sync is not in v1	ACCEPTED	HIGH
083	The where clause evaluates ArcGIS's standardized functions	ACCEPTED WITH CONDITIONS	MEDIUM	1/2
084	The page size is one number, and the server's is set from the console	ACCEPTED WITH CONDITIONS	HIGH	3/3
085	A tile leaves out what it cannot draw	ACCEPTED WITH CONDITIONS	HIGH	3/3
086	The operator chooses the map ground, and it is the portal's default basemap	ACCEPTED WITH CONDITIONS	HIGH	3/3
087	A domain is a named object that fields on many layers point at	ACCEPTED WITH CONDITIONS	HIGH	1/2
088	Sign-in through an OpenID Connect provider	ACCEPTED WITH CONDITIONS	MEDIUM	2/3
089	Sign-in through an LDAP directory, and groups mapped to roles and groups here	ACCEPTED WITH CONDITIONS	MEDIUM	1/3
090	Sign-in through a SAML 2.0 identity provider	ACCEPTED WITH CONDITIONS	MEDIUM	1/3
091	Server's sidebar is five rows; the rest are pages under them	ACCEPTED	MEDIUM
092	Sprites are uploaded per service, and a style's icons are checked against them	ACCEPTED	MEDIUM
093	Seeding the tile cache	ACCEPTED	MEDIUM
094	A service may carry several styles, and a style may name hosts an administrator allowed	ACCEPTED	MEDIUM
095	Registered PostGIS layers serve vector tiles	ACCEPTED	MEDIUM
096	A vector tile service may be tiled in another reference	ACCEPTED	MEDIUM — the grid arithmetic is tested by hand-worked numbers; what an ArcGIS client does…
097	Vector tiles are served through OGC API Tiles, TileJSON and WMTS	ACCEPTED	MEDIUM — the grids, documents and refusals are tested against numbers typed in from the…
098	Vector tiles can be exported as a package	ACCEPTED WITH CONDITIONS	MEDIUM — both formats are written from their published specifications and read back in…	3/3
099	Picture markers are drawn on every face	ACCEPTED	MEDIUM — every face is written and unit-tested, and the Skia drawing is read back from…
100	Labels in more scripts	ACCEPTED	MEDIUM — the glyph ranges are generated, decoded and pinned by tests, and the raster…
101	Studio is walked the way a Portal user walks it	ACCEPTED WITH CONDITIONS	MEDIUM — every change below was reproduced in a browser before it was made and is pinned…	3/4
102	The Studio item is one page, and every setting has one home	ACCEPTED WITH CONDITIONS	MEDIUM — the structure was drawn by an ArcGIS administrator's review and a design review…	3/3
103	A hosted layer is updated from a file: append, or overwrite	ACCEPTED WITH CONDITIONS	MEDIUM — the write path is the import's, measured by its own tests; what is new is one…	4/4
104	A web map styles its own layers	ACCEPTED WITH CONDITIONS	MEDIUM — the storage is the ArcGIS Web Map specification's own place for it and the…	3/3
105	ArcGIS clients append to a hosted layer through `uploads/upload` and `append`	ACCEPTED WITH CONDITIONS	MEDIUM — the two operations are shaped as the public ArcGIS REST reference documents them…	2/2
106	A layer's data can be exported as a file	DRAFT	MEDIUM — every format rests on a GDAL driver measured present and able to create on both…	8/9
107	A layer is exported as a GeoPackage, a zipped shapefile or a workbook	ACCEPTED WITH CONDITIONS	MEDIUM — GDAL writes the files and is the same GDAL the import reads with; what is…	3/3
108	An item's owner is changed by an administrator; Move waits for content folders	ACCEPTED WITH CONDITIONS	HIGH for Change owner — one row, the member transfer's rule for one item; MEDIUM for…	3/3
110	A web map sets its layers' pop-ups	ACCEPTED WITH CONDITIONS	MEDIUM — stored where the ArcGIS Web Map specification keeps it and drawn by the viewer…	2/2
111	An item carries tags	ACCEPTED	HIGH — a list of words per item, searched as text; nothing measurable is at stake	2/2
112	A CSV or Excel table with coordinates is published and added to a layer	ACCEPTED	HIGH — GDAL's CSV driver does the reading, and the path after it is the shapefile's	2/2
113	A hosted feature layer has views, and a view is a PostgreSQL view	ACCEPTED WITH CONDITIONS	MEDIUM — PostgreSQL's automatically updatable views were measured doing what this needs;…	4/4
114	A member's content has folders, and an item is moved between them	ACCEPTED WITH CONDITIONS	HIGH — a table, a column per item kind, and Portal's documented REST shape	3/3
115	Editor tracking stops as well as starts, and editors may be kept to their own features	ACCEPTED	HIGH — the writer's own-only predicate existed and was measured dormant; this turns it on…	3/3
116	Update data may update the features a file matches and add the rest	ACCEPTED	HIGH — two statements in the transaction append already runs	2/2
117	A web map labels its layers	ACCEPTED	HIGH — Web Map's own fields, drawn by the viewer that already draws the layer	1/1
118	A web map's pop-up formats numbers and dates	ACCEPTED	HIGH — one Web Map field per field info, drawn by the viewer that draws the pop-up	1/1
119	A web map has a description and a picture	ACCEPTED	HIGH — two columns and the Map Viewer's own canvas	2/2
120	A GeoPackage or KML is imported as a geodatabase is	ACCEPTED	HIGH — the geodatabase path, measured reading both formats through /vsizip/	1/1
121	A point layer is drawn as a heat map, or sized by a number	ACCEPTED	HIGH — Web Map's own renderer shapes, drawn by OpenLayers' own layers	1/1
122	A pop-up has text and an image	ACCEPTED	HIGH — two Web Map fields, drawn as text	1/1
123	Imagery comes into Studio, and an export refuses what it does not apply	ACCEPTED WITH CONDITIONS	MEDIUM — the refusal is measured; the scope it opens was inferred and is confirmed	5/5
124	An image service is shared to a group, and identify refuses what it does not apply	ACCEPTED	HIGH — each defect is reproduced by a test that failed before the change
125	An image service has a legend, key properties and statistics	ACCEPTED	MEDIUM — the shapes are ArcGIS's documented ones; what Pro does with each is read from…
126	An imagery item describes itself, and sits in its owner's folder	ACCEPTED	HIGH — measured on the portal face Pro and the Python API read
127	An image service exports its values as a GeoTIFF	ACCEPTED WITH CONDITIONS	MEDIUM — the file is read back by this server's reader and by GDAL; what ArcGIS Pro does…	1/1
128	An image service has histograms, and NaN is not a measurement	ACCEPTED	MEDIUM — the shape is ArcGIS's documented one; what Pro draws from it is not measured here
129	Several items at once, and a map says which of its layers its readers will not see	ACCEPTED	MEDIUM — the shapes are Portal's; each action is a sequence of requests the single-item…
130	The Map Viewer has an attribute table and bookmarks	ACCEPTED	MEDIUM — both are ArcGIS Map Viewer's shape over requests this server already answers
131	Labels have a visible range	ACCEPTED	HIGH — the Web Map specification's own fields, read and written as ArcGIS does
132	The Map Viewer has a time slider	ACCEPTED	MEDIUM — the server already answers time; the slider is ArcGIS Map Viewer's shape over it
133	The Map Viewer prints the view as a page	ACCEPTED	MEDIUM — composed in the browser from what the map already drew; no print service
134	Features are edited in the browser	ACCEPTED WITH CONDITIONS	MEDIUM — every write goes through the layer's own applyEdits, which ArcGIS clients…	3/3
135	A service counts its use	ACCEPTED	MEDIUM — what is counted is measured; that a count is what an administrator needs is…
136	An elevation model is shaded, sloped and given its aspect	ACCEPTED	HIGH — the arithmetic is checked on planes whose answers are known in closed form, and…
137	An image service answers LERC	ACCEPTED	HIGH — every blob type opens in Esri's own decoder with the values it was given, and the…
138	A renderer sent as a rendering rule is drawn	ACCEPTED	HIGH — every chain is the one the SDK was measured sending, and each is drawn where it…
139	An uploaded image is given its overviews	ACCEPTED	HIGH — measured before and after on the same image, and the full resolution is…
140	Several images are one mosaic	ACCEPTED WITH CONDITIONS	MEDIUM — the reading is measured and checked against GDAL's format; what a mosaic should…	1/1
141	An image service answers about an area and along a line	ACCEPTED	HIGH — the statistics agree with numpy on the same file to the last digit, and a hole is…
142	An image is read between its cells as the request asks	ACCEPTED	HIGH — the arithmetic is checked on ramps whose answers are known, and end to end on a…
143	An uploaded image is given back to its owner	ACCEPTED	HIGH — the file given back is byte-identical to the one sent
144	The geometry service answers the JS SDK as it asks	ACCEPTED WITH CONDITIONS	HIGH — every request is the SDK 4.30's own shape, read from its published source	1/1
145	A geometry request is answered in the units it names, or refused	ACCEPTED	HIGH — each conversion is checked on a shape whose answer is known, and each refusal…
146	project takes extents and WKT, relation reads RELATE, and GARS and GEOREF are converted	ACCEPTED	HIGH — each is checked on an answer known in advance
147	A mosaic grows, and images that do not fit its grid are put on it	ACCEPTED	MEDIUM — the resampling is the raw export's, measured there; the growth is checked end to…
148	An image may be downloaded by everyone it is shared with, and every image is given its pyramid	ACCEPTED	HIGH — both are checked end to end, with a second user
149	The portal may name another server's geometry service	ACCEPTED	HIGH
150	autoComplete, reshape and trimExtend are computed	ACCEPTED	MEDIUM — each is checked on the cases the specification describes; ArcGIS's handling of…
151	NDVI, band arithmetic and a choice of bands	ACCEPTED	MEDIUM — the arithmetic is checked against closed-form answers; ArcGIS's defaults for…
152	A mosaic is a catalog: queried, ordered by a rule, and edited as ArcGIS edits one	ACCEPTED	MEDIUM — each operation is checked end to end; ArcGIS's ordering methods that need a…
153	An image service has the time of its images	ACCEPTED	MEDIUM — time is checked end to end; multidimensional imagery is not served
154	A classified image names its classes: ArcGIS's raster attribute table	ACCEPTED	HIGH for the table and its reading · MEDIUM for ArcGIS's shape of identify with a table,…
155	An image service measures on the ground, and moves between its cells and the map	ACCEPTED	MEDIUM — distances, azimuths and areas are checked against closed-form values; ArcGIS's…
156	Clip, Remap, Mask, Statistics and Arithmetic	ACCEPTED	MEDIUM — each is checked against closed-form answers; ArcGIS's enumerations for…
157	Imagery in other formats is written as GeoTIFF on its way in	ACCEPTED	MEDIUM — the formats are GDAL's and the conversion is checked end to end on samples; real…
158	A mosaic combines its images, is reordered in Studio, and a map chooses its bands	ACCEPTED	MEDIUM — each operator and each control is checked end to end on samples; blending is…
159	A multidimensional file is a service of slices	ACCEPTED	MEDIUM — checked end to end on a NetCDF of two variables over time and depth; real files…
160	Datum transformations are listed from the register and applied as named	ACCEPTED	MEDIUM — listing and applying are checked end to end; the ranking without an area of…
161	A mosaic's seamline is the halfway line between its images	ACCEPTED	MEDIUM — checked end to end on two overlapping images; ArcGIS's generated seamlines…
162	WMS and WFS at a service's own address, and image services in WMS	ACCEPTED WITH CONDITIONS	MEDIUM — each address and each layer is checked end to end; no ArcGIS-migrated QGIS…	1/2
163	An image service answers WMTS over its own tiles	ACCEPTED WITH CONDITIONS	MEDIUM — a WMTS tile is checked byte for byte against the ArcGIS tile; no WMTS client has…	1/1
164	`generateKml` is a network link to the service's map	ACCEPTED WITH CONDITIONS	MEDIUM — the document and the request it makes are checked; Google Earth has not been…	0/1
165	OGC API Features filters in Basic CQL2 text	ACCEPTED WITH CONDITIONS	MEDIUM — each claimed class has a case that observes it; no OGC test suite for Part 3 has…	0/1
166	A service's OGC faces are turned off one by one	ACCEPTED	MEDIUM — each face is checked against the switch end to end; ArcGIS Manager's vocabulary…
167	A service's own OGC documents describe it	ACCEPTED	MEDIUM — the documents are checked; ArcGIS Manager's other OGC properties (contact a…
168	WFS 1.1.0 is spoken beside 2.0.0	ACCEPTED WITH CONDITIONS	MEDIUM — each operation is checked end to end in 1.1.0's own terms; no 1.1.0-only client…	2/2
169	WFS-T through the one write path	ACCEPTED WITH CONDITIONS	MEDIUM — each action is checked end to end in both versions; OGC's Transactional test…	2/2
170	Image services are WCS 2.0.1 coverages	ACCEPTED WITH CONDITIONS	MEDIUM — each operation, trimming, scaling, reprojection and the switch are checked end…	2/2
171	SLD at the WMS boundary	ACCEPTED WITH CONDITIONS	MEDIUM — a style sent with GetMap is drawn and forgotten, GetStyles' document draws the…	2/2
172	A service may be an INSPIRE View and Download service	ACCEPTED WITH CONDITIONS	MEDIUM — the documents validate against INSPIRE's published schemas with and without the…	1/1
173	WCS 1.0.0 is spoken too, so that QGIS opens an image service	ACCEPTED WITH CONDITIONS	MEDIUM — QGIS 3.28's own WCS provider opens a coverage through it, its documents validate…	1/1
174	OGC API Processes, over the geometry service	ACCEPTED WITH CONDITIONS	MEDIUM — each process is one geometry-engine operation under the geometry service's own…	2/2
175	OGC API Maps, over the WMS renderer	ACCEPTED WITH CONDITIONS	MEDIUM — a map drawn here is byte-identical to the WMS GetMap for the same box, size and…	1/2
176	OGC API Styles, read-only, over the styles the tile faces already serve	ACCEPTED WITH CONDITIONS	MEDIUM — the documents, the negotiation and SLD 1.0 beside 1.1 are unit-tested, the face…	3/4
177	OGC API Records is a searchable catalogue of the portal's items	ACCEPTED WITH CONDITIONS	MEDIUM — every claimed class has a test against a running server, and OWSLib 0.25 and…	1/3
178	HTTP Basic on the OGC faces, over HTTPS	ACCEPTED WITH CONDITIONS	HIGH — QGIS 3.28 signs in with its own authentication manager and saves a WFS-T insert…	0/1
179	A layer may carry a title	ACCEPTED WITH CONDITIONS	HIGH — one column, one setter, and the three faces that composed a title each read it…	1/1
180	The outbound licence is the Graticula Community License	ACCEPTED WITH CONDITIONS	HIGH for the decision, which is the owner's · MEDIUM for the licence text, which no…	3/3
181	The ArcGIS REST API version this server reports is 12.1	ACCEPTED	MEDIUM	0/1
182	An image service can be an elevation surface	ACCEPTED WITH CONDITIONS	MEDIUM	1/2
183	The catalogue manifest	ACCEPTED WITH CONDITIONS	MEDIUM — the shape is the one ADR-002 condition 3 was amended to on 2026-09-09; what is…	2/2
184	The basemap gallery is a group, and its vector tile services are basemaps	ACCEPTED WITH CONDITIONS	MEDIUM	3/3
185	Sharing is additive: an item's level and its groups both count	ACCEPTED	HIGH
186	An edit empties the tiles it reached, not the whole layer	ACCEPTED	HIGH
187	Both surfaces navigate from a top bar, and Server's is Server Manager's four tabs	ACCEPTED	MEDIUM — the structure is the owner's, taken from two reference products; nothing is…
188	A document is an item: a file kept in the platform store and shared like a web map	ACCEPTED WITH CONDITIONS	MEDIUM	4/4
189	Studio holds the organization and Server the engine	ACCEPTED	MEDIUM — every part is an owner decision of one day, taken against Portal and Server…
190	Members are searched in the database, sorted into categories, and have profiles	ACCEPTED	MEDIUM — the shape is Portal's and the owner's; the search has not been measured past a…
191	ArcGIS Pro publishes hosted feature layers here	ACCEPTED WITH CONDITIONS	MEDIUM	0/6
192	A screen is a path, not a fragment	ACCEPTED	HIGH — measured on dev.graticula.com in a browser before release; the old addresses are…
193	Backup and restore are the server's own commands, and they take the database with them	ACCEPTED WITH CONDITIONS	MEDIUM	4/4
194	An ArcGIS shop's addresses answer: `/arcgis` and `/server/rest`, always	ACCEPTED	HIGH
195	JSONP is answered without the session cookie, and portal listings page	ACCEPTED WITH CONDITIONS	MEDIUM	1/1
197	The ArcGIS gap review's second half: what a layer says it can count, compute and page	ACCEPTED WITH CONDITIONS	MEDIUM	3/3
198	The geometry service measures on the ellipsoid when asked	ACCEPTED WITH CONDITIONS	HIGH for lengths, areas and distances — each checked against WGS 84's known figures;…	2/2
199	A group may be public: anybody finds it, signed in or not	ACCEPTED WITH CONDITIONS	MEDIUM	2/2
200	Service accounts sign in with API keys	ACCEPTED WITH CONDITIONS	MEDIUM	3/3
201	A member with a password here may have a second factor at sign-in	ACCEPTED WITH CONDITIONS	MEDIUM	2/3
202	An item has terms of use and categories, and a member keeps favourites	ACCEPTED WITH CONDITIONS	MEDIUM	4/4
203	A deleted item waits in the recycle bin, whole, with its ids	ACCEPTED WITH CONDITIONS	MEDIUM	3/3
204	One deployment holds several organisations, each at its own host name	ACCEPTED WITH CONDITIONS (was REQUIRES… ACCEPTED WITH CONDITIONS (was REQUIRES PROTOTYPE until 2026-10-19, when condition 1 ran)	MEDIUM for the shape · MEDIUM for the floor of §5b since 2026-10-19, measured at or under…	9/16
205	A registered Oracle database is served as a registered PostGIS database is	ACCEPTED WITH CONDITIONS	MEDIUM for the shape · LOW for the driver's licence until condition 1 runs	7/8
206	Vector tiles are served from the datastore only	ACCEPTED	HIGH
207	Attachments and history on registered layers	ACCEPTED WITH CONDITIONS	MEDIUM	5/5
208	A registered MySQL database is served like PostGIS	ACCEPTED WITH CONDITIONS	MEDIUM	6/6
209	MariaDB is a dialect of the MySQL provider	ACCEPTED WITH CONDITIONS	MEDIUM	5/5
210	A registered SQL Server database is served to read, and edited	ACCEPTED WITH CONDITIONS	MEDIUM	5/5
211	Tables of an attached DuckDB file or MotherDuck database are edited	ACCEPTED WITH CONDITIONS	MEDIUM	2/3
212	Editor tracking and attachments on every registered database's layers	ACCEPTED WITH CONDITIONS	HIGH	2/2
213	A layer may be a table: ArcGIS's standalone table	ACCEPTED WITH CONDITIONS	HIGH	10/10
214	The portal's item writes do what they answer	ACCEPTED WITH CONDITIONS	MEDIUM	2/3
215	What ArcGIS ignores is not refused	ACCEPTED	HIGH
216	The organisation has one id, at every address	ACCEPTED	HIGH
217	A versioned or archived geodatabase class is refused, not served wrongly	ACCEPTED WITH CONDITIONS	MEDIUM	2/3
218	A pinned service is kept warm	ACCEPTED WITH CONDITIONS	HIGH for what goes cold, which is measured · MEDIUM for the limit, which is not	2/3
219	Two organisations partner before their groups mix	ACCEPTED WITH CONDITIONS	HIGH for the shape, which is ArcGIS Online's · MEDIUM for what this version leaves out…	4/4
220	An item may be shared with every organisation on the server	ACCEPTED WITH CONDITIONS	HIGH for the reading rule, which is one line in the one place reading is decided · MEDIUM…	5/5
221	The system administrator has a surface of their own	ACCEPTED WITH CONDITIONS	HIGH for the split, which follows the API's own (TenantRouting.SystemOnly) · MEDIUM for…	3/3
222	Geoprocessing is built-in analysis tools, served as ArcGIS's Spatial Analysis Service	ACCEPTED WITH CONDITIONS	MEDIUM — the protocol is publicly documented and copied as documented; which clients find…	5/7
223	User tools are Python toolboxes written against grapy, run in a sandboxed process with no network	ACCEPTED WITH CONDITIONS	MEDIUM — every mechanism named is a documented, unprivileged Linux facility, and none is…	7/7
224	grapy aims at arcpy's whole buildable surface	ACCEPTED WITH CONDITIONS	MEDIUM	4/6
225	grapy holds topology rules and relationship classes in the GeoPackage	ACCEPTED WITH CONDITIONS	MEDIUM	3/3
226	grapy holds network datasets and solves routes on them	ACCEPTED WITH CONDITIONS	MEDIUM for the model · LOW for agreement with Pro's numbers, which this cannot reproduce…	3/3
227	grapy holds branch versions and archives in the GeoPackage	ACCEPTED WITH CONDITIONS	MEDIUM	3/3
228	grapy holds subtypes, field defaults, global IDs and attachments in the GeoPackage	ACCEPTED WITH CONDITIONS	MEDIUM	6/6
229	grapy holds LAS datasets and TINs	ACCEPTED WITH CONDITIONS	MEDIUM for the model · HIGH for the TIN measurements, which are exact on a triangle's…	7/7
230	grapy holds mosaic datasets	ACCEPTED WITH CONDITIONS	MEDIUM for the model · HIGH for the methods and operators the pages define (FIRST, LAST,…	6/6
231	grapy holds utility networks	ACCEPTED WITH CONDITIONS	MEDIUM for the model and the configuration tools, whose pages give their parameters,…	5/6
232	grapy holds network diagrams	ACCEPTED WITH CONDITIONS	MEDIUM for the diagram management, template and rule tools, whose pages give their…	5/6
233	grapy holds geostatistical layers	ACCEPTED WITH CONDITIONS	HIGH for the kriging systems, the semivariogram models' formulas and the cross-validation…	5/5
234	grapy holds terrain datasets and ortho mapping	ACCEPTED WITH CONDITIONS	HIGH for the window size pyramids, the TIN measurements at any level and the collinearity…	5/6
235	grapy holds attribute rules, contingent values and database sequences, runs Arcade, and refuses replicas	ACCEPTED WITH CONDITIONS	MEDIUM	6/6
236	grapy holds multidimensional rasters	ACCEPTED WITH CONDITIONS	MEDIUM for the model and its netCDF form · HIGH for the tools whose pages give the answer…	4/4
237	grapy holds SAR data and motion imagery metadata	ACCEPTED WITH CONDITIONS	HIGH for the Sentinel-1 calibration and thermal noise removal, the unit conversions and…	3/4
238	grapy holds multipatch features	ACCEPTED WITH CONDITIONS	HIGH for the measurements, each exact on planar faces (areas, volumes by the divergence…	3/3
239	grapy solves fleet routing with published heuristics, and its networks hold turns	ACCEPTED WITH CONDITIONS	MEDIUM for the model and the heuristics · LOW for agreement with Pro's routes, which this…	5/5
240	grapy holds editor tracking, last edit time, COGO, unregistered tables and registration, and refuses enterprise geodatabase administration by name	ACCEPTED WITH CONDITIONS	MEDIUM	2/2
241	grapy builds path distance, its factor graphs, distance accumulation and least-cost paths	ACCEPTED WITH CONDITIONS	MEDIUM	1/2
242	grapy builds Topo to Raster, Segment Mean Shift and the combinatorial tools	ACCEPTED WITH CONDITIONS	HIGH for the combinatorial tools, which follow a worked example Esri publishes · MEDIUM…	3/4
243	grapy builds the image classifiers, pansharpening, segmentation and Fu and Rich's solar radiation as cited equivalents	ACCEPTED WITH CONDITIONS	MEDIUM	1/3
244	grapy builds the described-but-unspecified surface, cartography and seeded statistics tools as equivalents, and refuses the rest by name	ACCEPTED WITH CONDITIONS	MEDIUM	2/2
245	grapy builds the raster functions whose pages answered 404, from the pages at their new addresses, and refuses the display renderings by what each page leaves out	ACCEPTED WITH CONDITIONS	MEDIUM	2/2
246	grapy runs custom evaluators, keeps what its solvers traversed, and builds the solver property objects	ACCEPTED WITH CONDITIONS	HIGH that the three groups are buildable · MEDIUM for the choices the pages leave open…	2/2
247	grapy builds the storage properties a GeoPackage has, the random number generators, and toolboxes in a session, and refuses only what needs Esri's format, licensing or catalogue	ACCEPTED WITH CONDITIONS	MEDIUM	2/2
248	grapy carries deep learning on PyTorch: training data, training, inference and accuracy for imagery	ACCEPTED WITH CONDITIONS	MEDIUM	4/4
249	grapy carries deep learning on point clouds: training data, classification, object detection and evaluation	ACCEPTED WITH CONDITIONS	MEDIUM	1/3

Open questions

Uncertainty is recorded rather than hidden. An empty list here would mean the recording stopped, not that the uncertainty did.

Architecture debt

Temporary compromises, each with the trigger that repays it. A compromise with no trigger is a permanent decision wearing a temporary label.

ID	Debt	Repay when	State
D-04	Multi-tenant resource isolation is not designed.	Before multi-tenant deployments are supported	PARKED
D-10	~~ADR-015 is implemented for local passwords only.~~ OIDC, LDAP and SAML 2.0 are built 2026-09-24, in the owner's order (ADR-088, ADR-089, ADR-090); SCIM, API keys and mTLS remain unbuilt, and were not asked about.	OIDC before the first deployment with an IdP; /generateToken before any unmodified ArcGIS client is pointed at us The…	OPEN
D-115	The Server/Studio surface split is the single cause of four recorded console defects.	The next defect whose cause is the split	PARKED
D-144	~~Nothing bounds how long one request may hold a database permit.~~ The headline is struck 2026-09-09 rather than reworded, because it was false and the correction had already been written into this row's status cell without reaching its first sentence — half…	A way to refuse before the first byte, or a way to end a response that says why.	PARKED
D-162	A provider that is not PostGIS would be handed PostGIS SQL.	When DuckDB is designed as the file-format query engine (Q-81), and not after.	PARTLY
D-261	Every request under /rest/services makes six to eleven short database round trips, and that — not the query, not the response size, not admission control — is what holds the path at about 1,300 requests a second.	A deployment whose request rate approaches it, or the day the catalogue and identity reads are held the way ADR-015 §3a…	PARKED
D-262	The product's own containers are amd64 only, so docker compose up — the first command README.md offers — fails on every arm64 machine.	The release workflow publishing both architectures, which GitHub's arm64 runners make free for a public repository; and…	PARKED
D-266	Only FeatureServer query answering features is cacheable (ADR-069); every other read a map draws from is not, and a PostGIS layer has no validator.	A second client family drawing from one of the uncovered faces; or a cheap PostGIS data version appearing (an edit…	PARTLY
D-282	An exported tile package lives on the server that wrote it~~, and the console's download holds it in the browser's memory.~~ ADR-098 writes packages to Graticula:TileExportPath — exports under the state directory by default — which is each server's own disk…	A deployment runs more than one server against one catalogue and exports; or an operator reports the console failing on…	PARTLY
D-290	~~Three OGC faces have CITE failures that are counted rather than fixed: WMTS 15, WMS 1.1 10, WFS 1.1 9.~~ Updated 2026-10-06: WMTS 0, WFS 1.1 4, WMS 1.1 10, and two suites added with failures of their own — WFS 2.0 Transactional 18 and OGC API Maps 4.	WFS 1.1: the engine's image fixed upstream.	OPEN
D-295	A GeoTIFF is opened apart at the door and read in the serving process afterwards.	When ImageServer or any raster read returns to scope, or the first time a file that passed the door faults a read: the…	OPEN
D-314	The provider jobs fail a test once and pass on a rerun.	A third occurrence, or one that fails its rerun	PARTLY
D-321	A document's item page has less than a web map's.	A member asks for one of them, or the next pass over Studio's item pages	PARTLY
D-328	grapy's SAR tools have run only on synthetic scenes.	ADR-237 condition 3: the first real product run through the chain, or a user tool that fails on one	OPEN
D-330	grapy's fleet routing is unmeasured and pure Python.	A user tool's fleet solve reaching ADR-223's time limit, or a Pro run of one of testfleet.py's instances (ADR-239…	OPEN
D-332	grapy's path distance tools refuse the legacy source characteristics, and none is measured.	A user tool that passes one of the refused parameters, or one whose distance run reaches ADR-223's time limit	OPEN
D-333	grapy's Topo to Raster and Segment Mean Shift are unmeasured beyond small grids.	ADR-242 condition 3, or a user tool reaching ADR-223's time or memory limit in either	OPEN
D-334	grapy's insolation is unmeasured against Pro and slow on a real DEM.	ADR-243 condition 1 (a Pro run of one DEM), or a user tool's insolation run reaching ADR-223's time limit	OPEN
D-338	grapy's utility network traces and diagram layouts differ from Pro's where five measurements do not say Pro's rule.	A toolbox whose answer turns on one of these, or a Pro session with a mesh where the propagated attribute is on the…	OPEN
D-339	grapy's terrain windows start at a different corner from Pro's.	A rule that predicts the corner from the domain and the spacing, found by more runs of Pro, or a user tool that counts…	OPEN
D-335	grapy's deep learning trains from random weights and is unmeasured on real imagery.	ADR-248 condition 2 run in CI, or a user tool training on real imagery reaching ADR-223's time or memory limit, or the…	OPEN
D-341	grapy's point cloud deep learning is unmeasured on real lidar.	ADR-249 condition 1, or a user tool training on real lidar reaching ADR-223's time or memory limit	OPEN
D-337	grapy's insolation duration and support vector machine still differ from Pro's.	Insolation durations or an SVM classification compared with Pro's by a user, or a fourth classifier comparison	OPEN
D-336	Two of grapy's equivalents differ from ArcGIS Pro 3.7 beyond any tolerance, measured 2026-10-31.	Esri publishes either method; or a few more Pro runs (a factor field on a straight-line source; Segment Mean Shift on…	OPEN
D-346	A geoprocessing toolbox is an item, and its delete is final: it never reaches the recycle bin.	Somebody deletes a toolbox by mistake, or a tool's published outputs are found to name a toolbox that is gone.	OPEN
D-340	A GeoPackage grapy wrote before 2026-10-31 is still unreadable to ArcGIS Pro, and grapy does not repair it.	A user's pre-2026-10-31 GeoPackage reaching Pro, or a request for grapy to upgrade its own files; a tool's output whose…	OPEN

309 repaid — every one of them kept in the register with what it cost, because a repaid debt is evidence and this page is only the work

Assumptions

Invalidating one triggers a review of every ADR that rests on it. The unvalidated majority is the honest state of the project, not an oversight.

ID	Assumption	State
A-001	The tile path is CPU-bound enough that language performance materially affects capacity	VALIDATED
A-002	Single-binary distribution is genuinely valuable for air-gapped installs, not just aesthetically pleasing	UNVALIDATED
A-003	Most published services are idle most of the time, making shared workers viable	DOWNGRADED
A-004	Hot-path geometry overhead is material enough to justify our own primitives	VALIDATED
A-005	Geometry running in the same runtime meaningfully reduces defect resolution time versus FFI	UNVALIDATED
A-006	One internal geometry representation can serve both the feature path and the tile path without a second conversion	VALIDATED
A-007	Crash containment is required in practice, not merely in principle — workers really do die (GDAL on malformed input, plugins, OOM)	CONTESTED,
A-008	Administrators will not correctly hand-tune per-service worker settings, so defaults must be good and adaptive	VALIDATING
A-011	A distinguished central manager process is a robustness and recovery liability, so placement and routing state must be recoverable without one	VALIDATING
A-012	The sharing question is really about per-service state size, binding cost and neighbour tolerance — not about "shared versus dedicated"	VALIDATING
A-013	Our Tier 2 dependencies (GDAL, GEOS, PROJ) are thread safe enough to permit a threaded worker model	VALIDATED
A-014	Routing requests to workers already warm for a service materially improves L1 hit rate without wrecking load balance	DOWNGRADED
A-015	Per-service warm state is small — connections, schema, symbology, fonts, CRS — making bind/unbind cheap	VALIDATED
A-018	~~A deliberately boring platform schema can be supported across SQLite and PostgreSQL at acceptable cost~~	SUPERSEDED
A-019	In-process MVT encoding can meet our latency targets	VALIDATED
A-020	Cache seeding absorbs the provider performance gap, so an expensive Oracle tile path is acceptable when paid once rather than per request	UNVALIDATED
A-036	RLS delegation and large streaming reads do not collide often — the layers wanting row-level security are not usually the layers wanting bulk export	UNVALIDATED
A-035	Data source count stays low relative to service count — many services share one registered database	UNVALIDATED
A-032	COG range-request traffic is view-proportional, so proxying it costs about what serving tiles costs	UNVALIDATED
A-033	Target clients can render COG directly, so serving one format suffices	UNVALIDATED
A-034	Internal ports designed for our own use will be good enough to become a plugin contract later, without a redesign	UNVALIDATED
A-030	Lease expiry plus checkpoint verification prevents one job running twice across nodes	UNVALIDATED
A-031	Job rate stays low enough for a database-backed queue — jobs per minute, not messages per second	UNVALIDATED
A-028	Administrators can and will declare layer volatility usefully, and keep it roughly accurate	UNVALIDATED
A-029	Tiles, not feature query responses, are where cache reuse actually is	PARTLY
A-026	OGC API Features Parts 1+2+3 plus additive extensions can express what §28 requires, without bending the standard's meaning	UNVALIDATED
A-027	Optimistic concurrency can be made correct against writes we never see, by relying on database-maintained versioning rather than our own event record	UNVALIDATED
A-025	A small number of pinned service contexts suffices for real deployments, and administrators will not pin everything	UNVALIDATED
A-024	A small residual executor plus explicit refusal is acceptable to real users, given a capability report published in advance	UNVALIDATED
A-022	~~The datastore schema can be created on PostGIS, SQL Server Spatial and Oracle Spatial at acceptable cost~~	SUPERSEDED
A-023	A cheap schema fingerprint can be polled often enough to detect drift on registered sources without loading the source database	UNVALIDATED
A-021	Filter and predicates can be pushed down usefully on all three spatial dialects — narrowed by Q-67: clip and simplify no longer need to be, since only PostGIS serves tiles.	VALIDATED
A-017	Data sources will frequently be foreign and possibly read-only, so the platform cannot rely on DDL rights in them	VALIDATING
A-016	GDAL-backed providers can be made optional, so a PostGIS-only deployment ships as one artefact	VALIDATED
A-037	Allocation rate, not CPU, sets the tile-serving ceiling per worker	VALIDATED
A-038	GDAL is needed for the import formats we care about at all	INVALIDATED
A-039	~~Every provider can clip server-side cheaply enough to avoid shipping whole geometries~~	SUPERSEDED
A-040	All three engines can stream BLOBs out of a query without materialising them in our process	UNVALIDATED
A-041	A bounded separate connection pool is sufficient protection against slow-client exhaustion during attachment streaming	UNVALIDATED
A-042	Caps on vertex count, batch size and wall clock are sufficient to make a public general-overlay endpoint safe	INVALIDATED
A-043	Six geometry engines can be made to agree closely enough that the same query returns the same answer on any provider	VALIDATED
A-044	Certificate rotation can take effect on the next handshake without recycling the listener or the worker	VALIDATED
A-045	Soft-fail revocation checking is an acceptable posture for the air-gapped profile	UNVALIDATED
A-046	An opaque-token session lookup per request is affordable at the concurrency ADR-007 targets	VALIDATED
A-047	Every provider supporting RLS delegation can accept a principal name we generate, through administrator-controlled mapping	UNVALIDATED
A-048	Expand-and-contract is achievable for every migration we will need, including index and constraint changes on large hosted tables	UNVALIDATED
A-049	A curated Python wheel set can cover realistic geoprocessing without pip at runtime	UNVALIDATED
A-050	Per-worker allocation rate and GC pause can be sampled continuously, cheaply enough to be always-on metrics	UNVALIDATED
A-051	A supervisor-served admin surface can authenticate without the platform store without becoming a bypass	UNVALIDATED
A-010	The 100–1,000 service target will not shift upward by an order of magnitude after launch	UNVALIDATED
A-057	STAsMVT output is acceptable to the ArcGIS and MapLibre clients we care about	PARTLY
A-058	The datastore has spare capacity for tile encoding in a 100–1,000 service deployment	UNVALIDATED
A-059	A vertex cap bounds the work for single-pass geometry operations	UNVALIDATED
A-060	Using the datastore's PROJ rather than an in-process library costs nothing that matters	PARTLY
A-061	An administrator's first act against an unfamiliar server is to open its URL in a browser	UNVALIDATED
A-064	A security report will arrive at some point after publication, and the cost of having nowhere to send it exceeds the cost of the policy	UNVALIDATED
A-065	Requiring a DCO rather than a CLA does not deter contribution, and requiring a CLA would	UNVALIDATED
A-066	A stale Public grant discloses nothing that was not already disclosed	VALIDATED
A-067	Platform-store failures that leave the data sources up are common enough to be worth serving through	UNVALIDATED
A-068	Fifteen minutes is longer than a transient outage and shorter than one nobody is handling	UNVALIDATED
A-069	~~One Latin/Greek/Cyrillic typeface serves the deployments this product is for~~	RETIRED
A-070	Substituting an unavailable font beats refusing the request	UNVALIDATED
A-071	One style per service is enough to be useful, even though it is not enough to be finished	INVALIDATED
A-072	Refusing a style at write time costs an author less than a blank map costs them at read time	UNVALIDATED
A-073	Warm-state fragmentation across workers costs less than the affinity control system would cost in instability	UNVALIDATED
A-074	A QGIS or GDAL client asking a WFS feature type for its default output format gets GML 3.2 — so a WFS offering only GeoJSON would not have connected, and the GML writer is…	VALIDATED
A-075	ArcGIS Pro's portal connection works against a portal API this project implements, rather than requiring something only Esri's own portal returns	VALIDATED
A-076	A CPU rasteriser meets the latency a WMS client expects at typical image sizes on this runtime, without the allocation profile ADR-007 §4.14's worker sizing has no term for	VALIDATED
A-077	The canonical symbology document carries enough to draw a map a cartographer would accept, rather than enough to describe one.	PARTLY
A-052	Enforcing the user-type ceiling costs nothing in deployments that never use it	UNVALIDATED
A-053	A fused deployable remains operable at the top of the stated scale target — 1,000 services	UNVALIDATED.
A-054	Catalogue load and serving load stay similar enough that separate scaling is never forced	UNVALIDATED,
A-055	A single-page console with no build step stays maintainable	UNVALIDATED.
A-056	Operators want start/stop rather than only sharing	UNVALIDATED
A-062	256 MB uncompressed is above any shapefile a person uploads through a browser and below what troubles the machine	CONTRADICTED
A-063	Refusing an undeclared encoding costs less than silently corrupting text	UNVALIDATED
A-078	An operator would rather write MapLibre than a format we invented, because tools exist for the first	UNVALIDATED,
A-079	The publisher and the operator are different people often enough for two surfaces to be worth their cost	UNVALIDATED,
A-080	admin:manageServer is the right single gate for Server, so no reader is left without a tool they need	UNVALIDATED
A-081	The operator console is read on a screen at least 1,180 CSS pixels wide	SUPERSEDED
A-082	The EPSG register's axis definitions change rarely enough that regenerating from whatever proj.db the PostGIS image ships is soon enough	UNVALIDATED
A-083	No deployment needs an axis answer for a CRS code PROJ's own register does not carry	UNVALIDATED
A-084	Documents filed beside layers are mostly small — specifications, metadata sheets, pictures — well inside 64 MB, so keeping them whole in the platform store and reading them whole…	UNVALIDATED
A-085	A file's first bytes and its extension together are enough to refuse every type a browser would run	REASONED
A-086	A deployment holds tens of tenants, not thousands	UNVALIDATED
A-087	A customer's spatial tables in Oracle carry SDOGEOMETRY with spatial metadata and an index, or can be given them without moving data	UNVALIDATED
A-019	In-process MVT encoding meets latency targets — on PostGIS only, which v1 made the whole of it: D-05 closed 2026-08-24 with the scope cut	2026-08-12
A-004	Hot-path geometry overhead justifies our own primitives	2026-08-12
A-001	The tile path is CPU-bound enough that language performance materially affects capacity	2026-08-12
A-013	GDAL, GEOS and PROJ permit a threaded worker model	2026-08-12
A-009	PostgreSQL/PostGIS is an acceptable hard dependency for the baseline deployment	REINSTATED

What is verified

Counted from [Fact] and [Theory] attributes in the test sources, so this number cannot drift from the suite that produces it.

Host

1552

Core

944

Conformance

891

Platform.Postgres

565

Api.ArcGis

423

Console

373

Platform

243

Providers.DuckDb

131

Api.Wfs

124

Providers.Oracle

106

Providers.MySql

Architecture

Render.Skia

Raster.Tiff

Providers.SqlServer

Security.Argon2

grapy against arcpy

Names grapy builds, of the public names arcpy 3.7 has in each module. Counted by tools/grapy_surface.py from grapy’s source; a name grapy refuses is not counted.

arcpy

115 / 183

arcpy.da

24 / 29

arcpy.management

250 / 447

arcpy.analysis

35 / 40

arcpy.conversion

31 / 64

arcpy.cartography

6 / 49

arcpy.edit

16 / 19

arcpy.stats

38 / 65

arcpy.sa

289 / 378

arcpy.ia

288 / 347

arcpy.ddd

126 / 156

arcpy.ga

25 / 42

arcpy.na

46 / 62

arcpy.nax

77 / 95

arcpy.nd

68 / 74

arcpy.un

101 / 124

Module	Built	of which equivalents (ADR-224 §5.6)	Refused, with the reason
arcpy	115	1	68
arcpy.analysis	35	1	5
arcpy.cartography	9	8	40
arcpy.conversion	31	2	33
arcpy.da	24	0	5
arcpy.ddd	126	19	30
arcpy.edit	16	6	3
arcpy.ga	25	4	17
arcpy.ia	288	55	59
arcpy.management	250	20	197
arcpy.na	46	3	16
arcpy.nax	77	9	18
arcpy.nd	68	14	6
arcpy.sa	298	58	80
arcpy.stats	43	23	22
arcpy.un	101	16	23

Recent work

e429a8ee2026-10-31Merge branch 'grapy-a' into grapy-surface
6efea2482026-10-31Every equivalent's docstring now says EQUIVALENT with its method and source, and a test holds all three marks (ADR-224 condition 6; conditions 4 and 5 read again)
0f5ab8ed2026-10-31A SQL Server layer keeps a history and follows relationships, as MySQL and Oracle layers do (ADR-210 condition 5, ADR-212 condition 2)
778241a32026-10-31UpgradeGDB brings a GeoPackage an earlier grapy wrote to the form ArcGIS Pro reads, and grapy offers it when it writes into one (D-340, partly)
d6d8a2182026-10-31The six legacy cost and path distance tools take a source's start cost, cost multiplier, resistance rate and capacity, as the source characteristics page gives them (D-332, partly)
425b41792026-10-31Mosaic items off the read's grid, finer than it or in another reference are warped onto it by BILINEAR, CUBIC, MAJORITY or NEAREST (ADR-230 condition 4)
31bddd5c2026-10-31A service account signs in with OAuth client_credentials, and its client secrets are made, shown once and revoked on the Security screen (ADR-200 condition 2, migration 113)
4508d6622026-10-31A topology rule can be restricted to one subtype of each class, and ValidateTopology evaluates it on those features only (ADR-228 condition 6)
6d66335a2026-10-31grapy triangulates CONSTRAINED_DELAUNAY by Sloan's algorithm, and LandXMLToTin, SurfaceDifference and TinDifference are built on it (ADR-229 condition 6)
074327e92026-10-31grapy reads and writes LAZ through lazrs in CI and the server image, and a LAS dataset of LAZ files has an extent (ADR-229 condition 5)
114e57ab2026-10-31The Linux torch and torchvision wheels' bundled libraries are read, and the x86-64 one carries Intel oneMKL (ADR-248 condition 3)
7a8b27e62026-10-31Owner decisions of 2026-10-31, second round: Q-218 and Q-219 confirmed, client_credentials to be built, clustering's phase order confirmed
af1876af2026-10-31ADR-248's image and fence conditions are measured: +270 MB on amd64, +232 MB on arm64, and a fenced tool trains on Linux
9d6ab92e2026-10-31Merge branch 'grapy-a' into grapy-surface