Regions Design Examination

Scope and Method

I examined all thirty design artifacts and the Regions responsibility boundary against the pinned backend and console. The examination opened the cited sources and anchors, compared route declarations, schemas, persistence, table constraints, registered handlers and screen components, and read the cited tests as evidence of their actual assertions. Every design artifact received an OpenAI rewrite in its own commit after verification; the responsibility text was also rewritten.

The supplied planning corpus remains unchanged. It records draft or proposed intent rather than the approval described by the job, and the requested design brief is absent. Those gaps are findings, so this examination does not confer product approval or resolve planning decisions.

Coverage

Boundary	Examined coverage	Qualification
Operations	All 32 declared operations have one service contract: one health route, nineteen regional business routes and twelve hosted import routes.	Access and permission keys were checked against declarations. Every operation is unpublished to Submissions; no scoped binding was found.
Tables	All six regional tables are mapped by the four domain objects.	Placement also maps the regional facets of the two Entities record tables; Entities retains aggregate ownership.
Objects	Four objects, their attributes and relationships, and all 33 invariants were examined.	Database enforcement is distinguished from service validation, and legacy reference exceptions remain explicit. Neither catalogue nor policy opts into custom fields.
States	Four models and all 28 transition rows were examined.	Placement outcomes are explanatory states rather than a persisted manual-versus-calculated discriminator.
Workflows	Five workflows and all 26 hops were examined.	Coverage includes six regional handler registrations across contact, organization and recalculation streams, the shared delivery queue and scheduled dispatch, and the delegated file-processing state machine and queue. Shared-engine internals remain a boundary qualification.
Screens	Three contracts cover the catalogue and the rules view and editor.	Actual component patterns, controls, validation, regional permission gates and operation mappings were checked against the console.
Decisions and ownership	Thirteen decisions and the Regions responsibility row were examined.	Existing product records are cited; composite regional proposals are not elevated to confirmed intent by code observation.
Inference	All nine service, workflow and screen contracts retain an inference declaration.	No regional model-call task was found in the scoped code, so no inference operation was created. The existing planning declaration gap remains open.

Changes by Artifact

All prose and explanatory fields in the following artifacts were rewritten. The metadata ledger in this report records verification changes to provenance, sources, enforcement and intent separately from prose changes.

Artifact	Verification result and final treatment
Region object	Qualified legacy references, separated enforcement layers and replaced overly broad test attribution with implementation evidence.
Assignment policy object	Made the unsaved version optional, distinguished dense ordering from database checks, and qualified unlocked reads and first-write races.
Regional placement object	Clarified Entities ownership, deciding-address behavior, locked-record handling and legacy references.
Recalculation run object	Distinguished admission constraints from best-effort failure settlement and checked persisted counters, cursor and phases.
Region availability model	Corrected creation and deletion evidence, immediate reference checks and inactive creation in the diagram.
Assignment policy currency model	Qualified concurrency and initialization; policy currency does not promise that stored placements have caught up.
Regional placement model	Removed an invented persisted distinction, corrected clearing after an unmatched address, and described asynchronous override release.
Recalculation model	Distinguished the request boundary from persisted states and made exhausted failure settlement an explicit recovery gap.
Address-change workflow	Checked capture and reconciliation anchors, organization locking, delivery retries, production-only alarms and redrive; removed a completion-time guarantee.
Linked-contact workflow	Checked organization-address propagation, record locking, traversal and retry behavior.
Recalculation workflow	Qualified final failure settlement and batch progress; documented polling and failure-display limitations.
Policy-change workflow	Distinguished schema and service validation and qualified policy initialization and snapshot consistency.
File-import workflow	Corrected insert, update and upsert distinctions and configured reject-versus-overwrite behavior; retained uncertainty at the shared-engine boundary.
Regions service contract	Sourced every operation to its route, proved public health access through the integrity-verified pinned dependency, and checked capabilities, permissions and publication status.
Catalogue screen	Corrected control labels and combined manage/delete gating; checked replacement payload behavior.
Rules-view screen	Removed an unrendered change-time claim and documented missing historical-failure restoration, running-error display and read-error handling.
Rules-editor screen	Identified the actual drawer and page patterns and made cancellation confirmation conditional on changes.
Placement-ownership decision	Sourced the implementation boundary and distinguished automatic decisions from authorized staff selections.
Asynchronous-placement decision	Reworded the committed-event boundary and recovery qualifications against the registered handlers.
Policy-change decision	Preserved the separation between saving coverage and requesting recalculation.
Resumable-recalculation decision	Reworded batching, continuation and failure behavior without promising unconditional final settlement.
First-match decision	Reworded ordering, enabled-rule matching and fallback behavior against the matching service.
Whole-or-individual-policy decision	Reworded shared policy mutation and version-reset behavior without resolving the existing open choice.
No-custom-fields decision	Checked the absence of an opt-in and retained the proposed product decision.
Complete-replacement decision	Preserved observed replacement behavior and its disagreement with the preferred product contract.
Version-read decision	Downgraded the composite decision to proposed because the cited product record does not approve its regional exceptions.
Audited-lock-actions decision	Preserved the cited product direction while distinguishing ordinary regional lock writes from dedicated audited actions.
Placement-version decision	Checked that only a changed stored region advances the record version.
Submissions-publication decision	Checked the publication boundary against the cited architecture decision and available bindings.
Workspace-reference decision	Distinguished current composite references from tolerated legacy references and shared outbox storage.
Regions responsibilities	Reconciled ownership and the 32-operation boundary, then rewrote event descriptions and prose with the implementation qualifications.

The module registry now names the actual regional console boundary and records design examination. Permanent identifiers were retained, and ten new finding identifiers were allocated before their rows were written. The design verification commits precede the separate final-text commits; no planning rule was changed to make the implementation appear compliant.

Open Disagreements

The new findings cover the missing brief and unrecorded planning approval; inconsistent policy read snapshots and concurrent initialization; recalculation monitoring and best-effort failure settlement; inaccurate display and component assumptions; evidence narrower than compound claims; partial database enforcement and tolerated legacy references; and configurable import overwrites. These remain open rather than receiving an invented product resolution.

Existing disagreements about retirement, replacement, lock actions, history, individual-rule versions and delegated infrastructure evidence remain open. The documented product direction on complete replacement and audited lock actions is cited rather than re-decided. Andrew must establish which planning records are approved and resolve the regional proposals before implementation preparation relies on them.

Validation and Limits

The final acceptance run completed dependency installation, corpus conformance with zero errors, and all four corpus test cases. Conformance also passed after every design rewrite commit. The changed-file audit confines work to the authorized design, finding, registry, responsibility, module-row and report surfaces; the planning artifacts are unchanged.

Backend integration and browser suites were not executed. Their existing source assertions were examined, so this report provides a pinned-source examination and corpus validation rather than fresh runtime proof. Shared execution details that cannot be established within the permitted evidence boundary remain findings or explicit qualifications.

Verdict for Andrew

The rewritten design is a faithful, qualified account of the regional implementation at the pinned commits, but the supplied planning corpus does not establish approved product intent. Its weakest areas are policy concurrency, recalculation recovery and monitoring, and evidence for delegated execution guarantees. Before implementation preparation begins, confirm the planning authority and decide the outstanding replacement, locking, versioning and recovery requirements.