Northbeam Precision / Machine Shop

The premise had to be proved before any code was written. Everyone believed the accounting system already held the raw stock rack. It did not. Accounting held only the blanks set aside for resale, which is a completely different pool of the same physical thing. Had that not been checked, this ledger would have been double counting against live financial records from the start. The rack pool is greenfield; the sale pool belongs to accounting.

This demo shows the older batch-level shape. The live system now tracks each part. A batch is a card holding parts, and parts can split, merge and move separately. Every press is planned, then applied, and a plan is refused if a part moved after it was made.

Corrections leave a full record. A correction keeps the batch number and records the full row before and after. Numbers a receipt was posted under are never silently changed: the receipt is redone. The move and event logs are append only, enforced by the database in the live system. An undo is a new reversing move.

Attribution is enforced at the server, not the screen. An opaque overlay until a name is picked is a convenience. The rule is that any state-changing call arriving without an actor is rejected, so the gate cannot be bypassed by hitting the API directly. Steps that write to accounting are restricted by role, on the server.

Unknown outcomes park for a human and never auto retry. If a write to the accounting system returns something the system does not understand, the claim stays open and a person is told. Automatic retry against a financial system is how you get duplicate receipts. Related, and learned the expensive way: a health check that can never pass is indistinguishable from permanent failure. A two day outage here turned out to be a liveness guard testing for an attribute the API bridge strips, so the guard could never pass and every call reported a false outage.

Two print paths, deliberately separate. Travelers print from the server straight to a network printer, so there is no per workstation print agent and no printer name to capture. Labels print through a small agent at the bench to a dedicated label printer. The two never claim the same job, because two claimants means two sheets. In the live system an unreachable printer gets its page back with a pause and a retry, and labels go out one at a time. Accounting claims that never complete stay parked for a person.

The watcher gets a read only database connection, not a promise. It has no insert, update or delete path at all, and the connection itself is opened read only at the driver. A watcher must never be able to corrupt the ledger it watches.

Measured. In August, twenty five of twenty five isolated smoke tests passed with nothing written to accounting, the storefront or the workbook, and twenty three of twenty three on the older correction matrix. The 2.0 test suite stands at 487 passed. The watcher has grown to two dozen rules. While designing it, I found 101 units of demand on the wrong work station, and several were already backordered. Nobody had done anything wrong. There had simply never been anything watching.

On the barcodes. These are Code 39, generated in the page from the batch identifier, with no library. Code 39 was chosen over denser symbologies here because its encoding table is small enough to verify by inspection and it needs no check digit, so the demo can prove its own output is correct rather than asking you to trust it.