24. Product escape, recall and affected-product accountability
Govern escaped delivered-product risk from exact identity trace through independently approved population, product-safety decision, externally evidenced obligations and QA closure without taking messaging, custody or configuration authority.
Purpose
Govern escaped delivered-product risk from exact identity trace through independently approved population, product-safety decision, externally evidenced obligations and QA closure without taking messaging, custody or configuration authority.
Quality Engineer, different QA Head, separate Product Safety Manager, separate Project / Contract Manager, Configuration Manager/Auditor read-only
NCR-ESC-001 → ESC-001 scope v1 rejected → genealogy-backed scope v2 approved → Product Safety RECALL → product return plus customer/authority evidence → linked NCR closed → QA closure.
Before you begin
- One open contained S1/S2 NCR exists at the affected site
- The exact material batch/serial or directly affected product unit is known
- Retained assembly-output genealogy links the component identity to serialized product units, or unresolved scope is explicitly declared
- Quality Engineer, QA Head, Product Safety Manager and Project / Contract Manager are four different eligible users
- At least one same-site ACTIVE, CLEAN evidence version exists
Escape, recall and authority boundaries
Flow 18 requires one open contained S1/S2 NCR. The escape references that authoritative Quality record and cannot close before its NCR/CAPA closes separately.
Select one item plus one exact batch or serial. Moduvio follows retained assembly allocations and output-component links recursively into serialized product units; it never infers actual installation from a design baseline alone.
Trigger, risk, population definition, trace input, genealogy paths, candidate product snapshots, completeness and evidence are frozen. QA rejection retains the version and permits a new one.
A partial trace must name the unresolved population and cannot be approved for monitoring only. Closure still requires every product in the approved current scope to be final.
A separate Product Safety Manager assigns exactly one disposition per affected unit and creates accountable obligations. Safety, regulatory or critical risk cannot be monitoring-only; regulatory impact requires authority reporting.
Project / Contract coordination records references and CLEAN evidence for actions performed outside Moduvio. Flow 18 creates no notification delivery and sends no customer, authority or supplier message.
A RECALL, STOP_USE, RETURN or FIELD_INSPECTION decision is an accountable instruction, not a stock transaction. Authoritative custody workflows must perform any physical block, move, return or release.
The genealogy snapshot references product unit and released baseline identity but never changes product delivery status, physical-instance custody, configuration item or baseline state.
QA closure requires every affected-product action and obligation to be completed/excluded/evidenced/waived, the linked NCR/CAPA to be CLOSED and CLEAN closure evidence with acceptable or monitored residual risk.
Procedure
- 1
Create scope v1 as Quality Engineer from an eligible NCR and exact identity; confirm genealogy resolves the delivered product unit.
- 2
Reject v1 as QA, create and submit immutable v2, then approve it as the independent scope authority.
- 3
As Product Safety Manager, record a recall decision with one disposition per affected unit and accountable customer/authority obligations.
- 4
As Project / Contract Manager, record externally performed product action and acknowledgement evidence; confirm Quality or Product Safety cannot coordinate their own work.
- 5
Confirm closure is blocked while the linked NCR remains open; close the NCR separately, then close Flow 18 as QA.
- 6
Read the complete chain as Auditor and reconcile four actors, immutable versions, exact genealogy, CLEAN evidence, audit/outbox facts and zero messaging/inventory/configuration side effects.
Expected result
- Lifecycle follows DRAFT → SCOPE_REVIEW → DECISION_PENDING → ACTION_TRACKING → VERIFICATION → CLOSED
- Quality scope author, QA approver, Product Safety decider and Project / Contract coordinator are four different user IDs
- Rejected scope versions and their affected-product snapshots remain immutable
- Exact component genealogy resolves only actual as-built product units, not design-only candidates
- Every affected product receives exactly one Product Safety disposition
- Regulatory impact requires an authority-reporting obligation
- Flow 18 creates zero notification_deliveries and sends no external message
- Product actions never change current_stock, stock_ledger, product-unit status or released baseline state
- Closure is blocked until every product and obligation is final and the linked NCR/CAPA is CLOSED
- Auditor and Configuration Manager mutation attempts are rejected