26. Metrology out-of-tolerance impact and calibration recall
Govern a failed-certificate impact investigation from exact invalid-interval reconstruction through immutable affected-use scope, independent product-safety decision, cited authoritative action evidence, independent effectiveness and final closure.
Purpose
Govern a failed-certificate impact investigation from exact invalid-interval reconstruction through immutable affected-use scope, independent product-safety decision, cited authoritative action evidence, independent effectiveness and final closure.
Metrology Engineer, different QA Head scope approver, separate Product Safety Manager, assigned Quality Engineer, second QA Head verifier/closer, Auditor read-only
CAL-FAIL-E2E → OOT-E2E scope v1 rejected → immutable v2 approved → Product Safety recall recommendation → Product Escape/NCR responses → response v1 rejected → v2 effective → separate QA closure.
Before you begin
- One exact same-site calibration certificate has result FAIL and is not already assigned to an OOT case
- The instrument has a prior PASS certificate that bounds the suspected invalid interval
- At least one affected measurement use falls inside that interval
- Metrology Engineer, QA scope approver, Product Safety Manager, Quality Engineer action owner and QA verifier/closer are five distinct active, site-scoped and cleared users
- Expected authoritative NCR, Product Escape, inspection lot, FAI or maintenance references already exist where those routes are selected
- Same-site ACTIVE, CLEAN evidence versions exist
Invalid interval, affected-use trace and authority boundaries
A case can use only the selected instrument's unused FAIL certificate. Detected date must equal its calibrated date, and the suspected invalid-from date cannot predate the prior PASS certificate.
Tolerance minimum must be below maximum, as-found minimum cannot exceed maximum, and at least one as-found boundary must be outside tolerance. Measurement range, uncertainty, lab, accreditation and reference-standard traceability stay frozen with the scope version.
Product unit, FAI, inspection lot and maintenance work must resolve to an exact governed same-site record whose reference and status are snapshotted. Process and other uses retain an explicit manual reference. Every occurrence must fall inside the suspected invalid interval.
PARTIAL must explain unresolved scope; COMPLETE cannot retain unresolved text. QA rejection preserves the entire version and a replacement receives a new version number.
High, critical, safety or regulatory scope cannot be NO_PRODUCT_IMPACT. Every non-cleared use receives exactly one assigned action, and a recall recommendation forces every affected PRODUCT_UNIT through the PRODUCT_ESCAPE route.
The assigned Quality Engineer cites the exact expected NCR, Product Escape, inspection, FAI, maintenance or controlled other reference. Moduvio verifies governed references exist but never changes their records.
A second QA user, distinct from author, scope approver, Product Safety decider, owner and response submitter, verifies or rejects. Rejection preserves response v1 and permits immutable v2.
Every action must be VERIFIED with no unacceptable residual risk. The closer cannot be the original scope approver or any prior core actor.
Flow 20 never changes calibration instrument/certificate state, current_stock, stock_ledger, NCR, Product Escape, inspection, FAI, maintenance, product-unit or notification-delivery state; a recall is a recommendation until authoritative workflows execute it.
Procedure
- 1
Create scope v1 as Metrology Engineer from one exact unused FAIL certificate and a prior-PASS-bounded invalid interval; add a governed delivered product unit plus another affected process/use.
- 2
Submit v1, reject it as the first QA user, create immutable v2 and approve the corrected scope with the same snapshotted source identities.
- 3
As Product Safety Manager, choose RECALL_RECOMMENDED, route the product-unit action to an existing Product Escape and another action to its existing authoritative NCR or equivalent record.
- 4
As assigned Quality Engineer, submit process response v1; reject it as the second QA user, submit v2 and verify it effective. Submit and verify each remaining action with exact authoritative references.
- 5
Confirm closure is denied to the original QA approver and Auditor; close as the separate QA verifier/closer only after every action is VERIFIED.
- 6
Reconcile the case as Auditor: two scope versions, affected-use snapshots per version, one safety decision, assigned actions, immutable response/verification history, CLEAN evidence, audit/outbox chronology and zero source-record effects.
Expected result
- Lifecycle follows DRAFT → SCOPE_REVIEW → DECISION_PENDING → ACTION_TRACKING → CLOSURE_REVIEW → CLOSED
- Metrology author, QA scope approver, Product Safety decider, Quality Engineer action owner and QA verifier/closer are five different user IDs
- Rejected scope and action-response versions remain immutable
- Every governed affected-use source is validated and snapshotted inside the exact invalid interval
- A recall recommendation forces every affected product unit through Product Escape
- Every non-cleared use has exactly one action and only its named Quality Engineer can submit the response
- Authoritative references must exist and match the expected reference
- Closure is blocked until every response is independently VERIFIED
- Flow 20 creates zero notification deliveries and never changes calibration, inventory, NCR, Product Escape, inspection, FAI, maintenance or product-unit records
- Auditor mutation attempts are rejected