Export should survive the assistant

I disconnected V0M3's model provider and opened one of its finished documents in a plain text editor.

The words were there, but the document was not whole. Evidence lived behind internal identifiers. Images pointed at temporary object URLs. Comments existed only in the review database. A custom block for a comparison table rendered as unreadable JSON outside the application.

Nothing had been intentionally locked in. I had simply optimized the internal representation until export became an afterthought.

An AI-assisted writing tool should not require the assistant to remain useful after the writing is done.

Portability began with the authored artifact

V0M3's canonical state was structured so it could target exact nodes, preserve claim lineage, and apply reviewable operations. That structure was valuable inside the workflow and an inappropriate dependency for every reader.

The primary export became ordinary Markdown with predictable frontmatter, relative asset links, standard headings, lists, tables where representable, fenced code, and conventional footnotes. It could be opened in a text editor, stored in Git, rendered by common tools, or migrated with a small script.

The file did not contain provider response objects, opaque conversation handles, or a runtime call back to V0M3.

Portability started with a useful document, not a perfect reconstruction of the application.

“Download” had meant whichever renderer happened to run in the browser. I replaced it with a versioned export profile.

The profile declared document format, line-ending and Unicode normalization, frontmatter schema, asset layout, link policy, footnote style, unsupported-node behavior, and whether provenance was included. The resulting manifest named every file and its digest.

Given the same document revision, export profile, and eligible asset revisions, V0M3 produced the same logical package. Archive timestamps and filesystem metadata were excluded from content identity.

This made export testable and let a future importer know which decisions had shaped the files.

A portable format cannot express every editor feature. V0M3 could represent review comments, collapsible evidence panels, interactive diagrams, and structured callouts that plain Markdown could not preserve exactly.

The exporter had three choices for each node type: a faithful standard representation, an explicit static fallback, or a hard error. It never dropped a node silently.

An interactive chart could export as accessible image, caption, data file, and source link. A review-only annotation could move to the provenance sidecar or be omitted under a profile that stated the omission. An unknown extension stopped the export with its node identity and available alternatives.

Graceful degradation required admitting where fidelity ended.

Assets received durable names

Editor previews had used signed URLs that expired. Export copied approved assets into a relative directory and named them with readable slugs plus short content digests. The Markdown referenced those local paths.

The manifest recorded original identity, exported filename, media type, size, digest, alt text, caption, and license note where supplied. Duplicate binary content could share one exported file while retaining multiple document references.

Remote images were not fetched automatically during export unless an explicit asset-ingestion step had already authorized and recorded them. Otherwise the profile kept the remote URL or failed according to policy.

A folder copied to another machine remained renderable without V0M3's object store.

Links kept meaning outside the application

Internal links often targeted stable node identities rather than headings. The exporter generated predictable heading anchors and rewrote links to the exported location. It detected collisions, missing targets, and links into excluded material.

Links to other V0M3 documents could become relative files when both were in the package, public canonical URLs when configured, or explicit unresolved references. The manifest recorded which rule applied.

Evidence links required similar care. A footnote pointed to a human-readable source reference, not /sources/8f3… on a server the reader could not access.

An internal graph became a set of ordinary navigable relationships without pretending every private source could travel with it.

Stuffing source digests, proposal IDs, and review state into the Markdown made the main artifact hostile to read and edit. Omitting all of it threw away valuable history.

V0M3 offered an optional provenance sidecar using documented JSON. It mapped exported spans and structural nodes to source revisions, claims, accepted proposal operations, authored edits, review decisions, and document revisions. Identifiers were stable within the package, and records used relative references where possible.

The sidecar was additive. Losing it left a valid document. Keeping it allowed a future tool to reconstruct much of the lineage without contacting V0M3.

This asymmetry was deliberate: the work survived without the workflow, while the workflow evidence could survive when wanted.

Private evidence did not leak through portability

A complete provenance graph could include private notes, licensed source excerpts, provider diagnostics, or rejected text that did not belong in a shared export.

The export profile selected visibility classes and ran policy against the exact document revision and destination intent. Public packages could include source citations and safe metadata while excluding private excerpts and reviewer notes. A private archive could include more under encryption.

Redaction produced explicit tombstones in the sidecar when a relationship mattered but its payload could not travel. The manifest listed omitted classes and counts without revealing their content.

“Include provenance” was never interpreted as “dump the database.”

Export was a consequential command

Creating a local download seemed harmless until an export included sensitive sources or wrote to a shared destination. V0M3 modelled preparation and delivery separately.

Preparation assembled an immutable artifact from a document revision and export profile, ran validation, calculated digests, and produced a preview manifest. Delivery copied that artifact to the requested destination under current authority.

Approval, where required, bound the artifact digest and destination. Retrying delivery used one effect identity. A timeout led to destination query or unknown-state review rather than preparing subtly different bytes.

The assistant could propose an export. It could not silently broaden what left the workspace.

A provenance sidecar and manifest were useful to software and intimidating to a person recovering work years later. Every archival package included a short README generated deterministically from the export profile.

It explained which file was the primary document, where assets lived, how links were represented, what the optional provenance contained, which material was omitted, and how to verify digests with ordinary tools. It named the format version without requiring V0M3 terminology to understand the prose.

The recovery exercise was simple: hand the folder to someone who had never seen the application and watch where they became confused.

Documentation was part of the export format, not a help-centre link that might vanish with the product.

Round-trip was scoped carefully

I initially promised that an export could be imported with no loss. That was too broad. Editing Markdown elsewhere could change heading anchors, collapse custom nodes, remove sidecar mappings, or combine spans whose provenance differed.

V0M3 guaranteed that an untouched package from a supported profile could be re-imported into an equivalent portable document. For externally edited packages, import preserved the current prose and assets, validated the sidecar, and reported which lineage mappings remained sound.

It did not invent provenance for new text. It treated external changes as authored import operations with a new revision and explicit source package digest.

Round-trip fidelity was a tested contract, not a slogan covering arbitrary transformations.

Markdown remained allowed to be edited

Some portable formats are technically open and practically generated-only. V0M3's Markdown favored readable source over densely encoded fidelity.

Frontmatter used documented names. Paragraphs were not split by hidden comments on every sentence. Stable node mappings stayed in the sidecar rather than contaminating normal editing. Formatting conventions were consistent but not required for a human to make a small change.

On re-import, the parser accepted reasonable common Markdown and reported ambiguity. It did not demand byte-for-byte reproduction of the exporter.

The test was whether I could fix a typo in a basic editor without fearing that I had corrupted an invisible control structure.

Static rendering was a separate artifact

HTML and PDF were valuable for reading, sharing, and visual preservation. They were not substitutes for an editable source export.

V0M3 could render static HTML with bundled styles and accessible structure, or prepare a PDF through a versioned renderer. The manifest linked each rendition to the same document revision and recorded renderer identity.

Visual snapshots caught overflow, missing assets, broken code blocks, and bad page breaks. Text extraction and heading checks caught failures a screenshot could hide.

Every archival export still included the Markdown source unless policy explicitly selected a rendition-only package. A beautiful PDF did not become the only remaining copy of the work.

Provider data was optional historical material

Raw model responses could help diagnose how a proposal formed. They could also include proprietary metadata, sensitive prompts, and provider-specific structures with unclear long-term value.

The default document export excluded them. A forensic archive could include redacted attempt records, adapter events, and configuration digests under a separate retention class. Accepted operations and their document lineage did not depend on those raw payloads.

If a provider account disappeared, V0M3 could still explain that a proposal introduced two spans, which evidence it referenced, and who accepted the patch. The provider's conversation replay was not the root of document truth.

This was the architectural version of keeping the assistant visually secondary.

V0M3's evidence graph knew more than a footnote could express: source revision, retrieved passage, claim relationship, review state, and later source changes. The Markdown still needed citations a reader could understand without that graph.

The exporter produced stable footnote labels and a references section from safe bibliographic fields. Each reference included author or publisher where known, title, publication or update date, canonical URL, and retrieval date when relevant. Missing fields stayed missing rather than being invented for visual consistency.

The optional sidecar connected the footnote to exact claim and source revisions. If a private excerpt could not travel, the public citation remained only when policy allowed the underlying source to be named.

This gave ordinary readers an ordinary citation while preserving richer evidence for tools capable of using it.

Git was a useful hostile environment

I exported a corpus into a repository, changed it with a normal editor, reviewed the diff, renamed an asset, and merged two branches. The exercise exposed choices that looked harmless inside a database and became noisy in files.

Random identifiers in every paragraph made diffs unreadable. Unstable wrapping rewrote entire documents. Export-order changes moved footnotes with no semantic cause. I adjusted the profile for stable ordering, one final newline, predictable wrapping, and sidecar records keyed without contaminating the prose.

V0M3 did not require Git, but a version-control diff was a useful test of whether the portable representation respected human maintenance. A small textual edit should usually produce a small textual change.

External Git history remained distinct from internal document revisions. Import could record a commit identity as provenance without pretending the two graphs were the same.

Digests proved identity, not authorship

The manifest included content digests so files could be checked after copying or storage. I was careful about the language around them.

A matching digest showed that bytes matched the manifest. It did not prove who created the document, whether the content was true, or whether the archive had been obtained honestly. A manifest stored beside altered files could itself be replaced.

An archival profile could optionally sign the manifest using a user-managed key. Signature verification then established control of that key at signing time, still not factual correctness. Key rotation and revocation required their own records.

The default package kept simple checksums useful without dressing them as a universal trust mechanism.

Export previews showed omissions first

The earliest preview focused on the beautiful rendered document. Authors missed that private notes were excluded, one remote image would remain online-only, and a custom interaction had fallen back to a static table.

I added a preflight summary before rendering: included documents and revisions, asset count and total size, external dependencies, redactions, unsupported fallbacks, broken links, stale evidence, and profile limitations. Each item linked to the affected location.

Warnings were not all blockers. A private note omitted from a public package could be correct. An unresolved internal link might require a decision. Policy determined which conditions prevented preparation.

The preview made portability consequences reviewable rather than leaving them to whoever opened the archive later.

Archives had an accessibility floor

Exporting visual fidelity while losing heading order, link purpose, alt text, table labels, or language metadata would preserve appearance and discard use.

V0M3 validated structural accessibility before static rendering. Missing alternative text or an ambiguous heading jump appeared in preflight. The Markdown retained semantic structure; HTML used real landmarks and headings; PDF verification included tagged structure only where the selected renderer could reliably provide it and otherwise disclosed the limitation.

The package README explained keyboard-independent navigation and where transcripts or data files accompanied media. Accessibility was not a feature available only inside the live editor.

Survival meant remaining usable to the people for whom the document was made.

I ran an exit drill

The final test was procedural. I pretended V0M3 would shut down in a week and tried to move every document using only the export screen and package documentation.

The drill found orphaned drafts, assets referenced only by rejected proposals, one unsupported diagram node, and an evidence source whose license did not permit redistribution. I added explicit choices for current documents, selected milestones, proposal history, and private archives instead of one misleading “Export everything” button.

After import into a small static site, I sampled links, code blocks, images, citations, and non-ASCII text. I also opened random files without the site. The corpus remained understandable.

An exit path tested under calm conditions was more credible than a portability promise discovered during an emergency.

Deterministic fixtures protected old exports

I kept representative documents containing nested lists, code, tables, duplicate headings, Unicode, footnotes, local and remote assets, redacted evidence, rejected proposals, and reverted revisions.

Fixture tests compared parsed meaning, manifest entries, digests, link integrity, accessibility structure, and sidecar references. A formatting change could update a profile version; it could not silently make an old package uninterpretable.

An importer test opened earlier versions after schema migrations. Unknown future sidecar fields were ignored where safe, while unknown required semantics failed with a clear message.

Portability had to be maintained across V0M3 releases, not demonstrated once against today's exporter.

Migration could happen without generation

The most important test disabled every model and tool connection. I could still open a document, inspect history, edit manually, export, import, verify assets, and render static output.

Moving to another writing system might lose V0M3's review interface, but it did not require asking a model to translate the corpus. Ordinary files and documented metadata were enough for a deterministic migration.

This constrained internal features in a healthy way. A node type that could not produce a meaningful portable fallback had to justify why it belonged in the authored document instead of remaining transient workspace UI.

The exit path influenced the product before anyone needed to leave.

An author might export an archive and then delete the workspace. V0M3 could verify what it prepared and what it deleted, but it could not revoke copies already downloaded or moved elsewhere.

The deletion workflow named documents, revisions, proposals, history payloads, indexes, provider caches under local control, and pending export artifacts. It required external destinations to be handled under their own capabilities and receipts.

The export manifest gave the author a concrete inventory before deletion. It did not claim that possession of the package fulfilled every retention or privacy obligation automatically.

Portability increased control and responsibility together.

Survival was a design constraint

After the changes, I repeated the original exercise. I disconnected providers, copied an export folder into a plain environment, opened the Markdown, followed its relative assets, rendered it with another tool, and inspected the optional provenance without a V0M3 account.

Some interactive review behavior was naturally gone. The document remained coherent. Its important sources were legible. The package explained its omissions. Nothing tried to wake an assistant in order to display a paragraph.

That outcome made V0M3 more trustworthy while it was still running. The author knew that accepting help did not surrender the artifact to the helper's lifetime.

Good assistance should leave behind work that can stand on its own. The model may be unavailable, the provider may change, the product may end, or the author may simply prefer another tool.

The document should survive all four.