Your quality program audits a sample of charts, weeks after the cases they describe, and gets survey-ready as an event. SURVEYOR rebuilds all three into the record itself: every chart checked at the keystroke, corrective actions that follow themselves up, a regulation-to-policy crosswalk that maintains itself, and a survey binder that is current every morning. Your quality team stops re-performing arithmetic — and gets its judgment back.
Chart review today covers what human attention can reach. The floor checks 100% of records at entry — the audit becomes a property of the chart, not a department's afternoon.
A chart missing its second signature, its subtype, or its attached consent recording doesn't become a finding next month. It doesn't close. The finding arrives while the case can still be fixed.
The line-of-sight report, the committee packet, and the survey binder are generated from the same tamper-evident record — current every morning, every claim linked to its evidence.
One screen, first coffee. Everything below is computed from the record itself and every line links to its evidence. Nothing here was compiled by a person the night before.
Every check your auditors perform by hand today is either mechanical — and belongs in the record, at entry, on every chart — or it is judgment, and belongs to your people, with better instruments. SURVEYOR draws exactly that line.
The audit checklist your team runs at week three — cross-document identity matching, two-person verification, branching completeness, revision control, timestamp sequencing — compiled into gates that run on 100% of records as they're written. A chart that fails doesn't close; a hazard that can be blocked can't occur (one organ, one primary offer — enforced by the system, not by a phone call).
No AI in this layer at all. It must pass its full battery with every learned component switched off.
Every quality team has tried to keep a crosswalk between the regulations and their own policies. Every one has abandoned it — one agency overhaul and you start over. SURVEYOR maintains it as a standing computation: public regulations read daily, every claim byte-matched to a pinned source, edition changes surfaced with lead time and the affected SOPs named, draft diffs ready for your review — never auto-applied.
The 24-hour transmission report, the 72-hour draw windows, the refrigeration clocks, the 5-business-day feedback measured from the correct anchor field, the 30/60-day submissions. Deadline arithmetic is exact, run continuously, and alarmed before the breach — not discovered in the audit after it.
Every corrective action carries an owner, a falsifiable expectation, a check-by date, and an expiry. "Sustained corrective action" stops being a phrase in the plan and becomes a measurement that runs at the horizon — met, or auto-returned to committee with the data attached. The committee packet and the survey binder are generated from the same record, every claim linked to its evidence.
A standing watcher on the case stream that surfaces the drift while it's happening — the closing window, the contradiction between pages, the silence where a lab should be — at a livable rate, with every decision not to speak on the record too. Ships off by default; turns on by your hand; every ambitious surface degrades to a useful ordinary one.
Before day one, SURVEYOR reads your past — closed charts, findings logs, policies, committee minutes — into the same evidence-linked record. Your first morning it can answer "when did we last see this variance class?" with citations. The site starts with a memory, not a blank.
Read it like a site plan. Everything solid ships in the repo, byte-identical, for every OPO. Everything dashed is authored in your building, by your people, under signature. And the red line is the compliance posture drawn as geography: the frontier model lives on the public side and PHI never crosses — no BAA, because nothing protected ever reaches it. Your records meet only the local model, on your hardware, zero egress, air-gap supported. The record stays yours: exportable in full, no license server, no vendor in the loop.
| SURVEYOR · DWG-003 · REV 0 |
| QUALITY, REBUILT INTO THE RECORD |
| SCALE: NONE · MIT · ZERO EGRESS |
| SCHEMATIC — NOT THE CODE |
Your quality program already professes Just Culture: variance is attributed to system and process, not the person. SURVEYOR is the version of your record that can keep that promise — because the fence is built into what the software is, not written in a memo about how to use it.
Your team stops re-performing arithmetic on a sample and starts adjudicating on the census. Chart review becomes exception review. The crosswalk you gave up maintaining, maintained. Your line-of-sight report writes itself — from evidence, not from memory.
Census assurance instead of sampled assurance. Metrics with honest denominators. CAPA effectiveness as a measurement, not an assertion. Survey-readiness as a standing property of the organization — and a quality cost curve that finally bends without cutting the judgment that matters.
The record catches it before the chart closes — not in a finding three weeks later. The feedback lands on the case, never on you. And the Just Culture your organization already promises is finally enforced by the architecture instead of by memo.
The substrate is mentioned last on this page, on purpose — but when it is mentioned, it is shown properly. What follows is the actual mathematics and the actual shape of the code, short enough to read whole, honest about what it does and does not prove.
A check is a patch row in the same algebra REGISTRAR proves on its own page: every row carries its inverse, and composition twists — inverses accumulate in reverse. Two things fall out for free. Fifty-nine checks mounted in any order land in the same fit (confluence, derived rather than borrowed). And retiring a check must unwind in reverse dependency order — the algebra forces it; no implementation gets a vote. A wrong check is reversible, not scar tissue.
where s is the audited sample fraction and L the audit lag. It is a model, not a measurement, and it carries no number. The claim is not that the machine is smarter than your auditors. It is that s ≈ 0.05–0.10 and L ≈ 2–4 weeks today, while the record is always there. The census inversion is that denominator.
The theorem is true of the algebra unconditionally. Whether the floor catches what your auditors catch is F-RETRO's question — recall, precision, the census surplus, hours per case — and not a corollary. A proof about the design is not a receipt about the build. Nothing on this page is exempt from the pre-registration.
# floor/checks/SV-070.check.yml — the flagship id: SV-070 title: single-active-primary-offer guard layer: L0 # mandated — citation pinned via the crosswalk authority: "OPTN allocation policy (pin: sha256 …)" trigger: on_write predicate: "count(active_primary_offers[organ_id]) <= 1" action: hold # the record holds; nobody's phone rings message: "A primary offer is already active on this organ (see {offer_ref})." evidence: [offer_ref] # every result links what it saw expires: P2Y # every check re-earns its place inverse: retire # unmount is total — a wrong check unwinds tests: fixtures/SV-070/ # ships with passing AND failing fixtures
One organ, one primary offer — today a professional norm, recovered by phone calls when it slips. Here: thirteen lines of data with a citation, an expiry, and an undo. A quality director can read this. That is the point. This is what "a check is a patch" means.
# clocks/lattice.py — the 24-hour rule, as code, with its citation attached stn.at_most("county_report", "reactive_serology", minutes=24*60, cite="pinned") stn.at_most("chart_to_processor", "recovery_end", minutes=30*24*60) stn.window("recovery_start", opens="death+0", closes="death+24h | +15h by cooling") # floor/closure.py — every deadline in the lattice, simultaneously for k in range(n): # Floyd–Warshall in the (min,+) semiring D = minimum(D, D[:,k,None] + D[None,k,:]) # ⊕ = min, ⊗ = + if any(D[i][i] < 0 for i in range(n)): # a negative cycle: return INFEASIBLE # this plan cannot be met — with the return earliest, latest # chain of rules that caused it
Deadline arithmetic as a temporal network: the earliest and latest legal time for every obligation, alarmed before breach — and when a plan is impossible, the answer is not a red icon but the chain of rules that made it impossible. Every clock declares its anchor field with a citation, because an SLA computed from the wrong anchor is a defect that looks like compliance.
{"i": 4118, "kind": "verdict", "ts": "2026-…",
"body": {"gate": "SV-070", "status": "HELD", "case": "TR-4118", "evidence": ["offer_ref"]},
"h": "9f3ac2…"} ← h = blake2b( prev_h ‖ canonical(record) )Append-only, hash-chained, local, yours. Every verdict, every hold, every silence, in order, forever. The line-of-sight report, the committee packet, and the survey binder are computations over this — which is why they are current every morning, and why every claim in them can point at its evidence.
SURVEYOR is built in public, backwards from this page. The decisive test is pre-registered: implement the floor, run it against historical closed charts, and score it against the quality team's own findings log — how much of what your auditors found does it reproduce at entry-time, what did the census catch that the sample missed, and what does an audit-hour per case become. Whatever the numbers say, they publish here — including the funeral, if that's what prints. And one result would not be a failure: if the deterministic floor alone captures most of what retrospective review finds, that is the product.
Claim grammar, binding on every number this page will ever carry: measured (dated receipt) · harvested (line-referenced source) · derived (chain shown) · spec (designed, unbuilt) · bet (kill condition named). A number without its grain, denominator, and source is not a number.