Case File 006 documents two revisions of one machine. Gen 1 made Smartsheet the system of record for a real factory — 22 serverless functions holding every business rule — and still runs the floor. Gen 2 rebuilds the same order-to-cash spine on an append-only Postgres ledger, drafted and checked, waiting for cutover.
This is the only case file in the drawing office with a second edition: the same factory, the same order-to-cash spine, engineered twice.
The spine both generations share is the plant itself: a customer LPO arrives, production tags are planned, the cutting machine's nesting software emits its manifest, material is mapped and allocated, consumption is recorded, a margin gate decides whether the delivery may bill, and a truck leaves the gate with paperwork that reconciles back to the LPO. Gen 1 built that spine on Smartsheet — the grid the staff already trusted — with every business rule moved out of the sheet into 22 Python Azure Functions. It runs the plant tonight.
Its success is what exposed its ceiling. A spreadsheet is last-write-wins; references rot; line items live as JSON in text columns. Gen 2 keeps the domain and replaces the physics: twelve Postgres modules around an append-only inventory ledger where UPDATE and DELETE are revoked at the database role. It is built through eleven of sixteen planned streams — and the migration that would retire Gen 1 is, deliberately, not one of them yet.
At month-end the plant has three counts of the same aluminum coil — the system's, SAP's, and the bin's — and no way to say which one is lying.
The rest of the month leaks in quieter ways. A truck idles at the gate carrying finished duct with no delivery order behind it. A tag was cut against an LPO that never had the balance to cover it. A gross margin was approved on a hand calculation nobody can reproduce. Deliveries ship and the invoices don't follow, because nothing forces them to.
Before Gen 1, all of this lived in Excel and memory: no audit trail, no idempotency, re-keyed piece counts from the cutting software's merged-cell exports. FIG. 1 shows the four leaks as observed. The monthly reconciliation loop that is supposed to close them runs by hand — and returns a recount, not an answer.
Gen 1's bet: keep the grid the staff already trusted as the interface — and move every rule that matters out of it, into code.
Smartsheet stayed the UI and the data store; 22 Azure Functions became the brain. Every state change flows through an event backbone — webhook receiver, Service Bus queue, ID-routed dispatcher — with the queue pinned to a batch size of one, because idempotency mattered more than throughput. All 32 sheets sit behind an ID-first manifest: code addresses logical names, the manifest resolves them to immutable physical IDs, and plant staff can rename or reorder anything without breaking a single integration.
The most characteristic station is the margin gate. When consumption is submitted, deterministic costing runs in code — material, a fixed per-SQM cost, a credit-risk buffer, the UAE's 9% corporate tax, checked against the target margin — and the decision goes to a human: an Adaptive Card on the production manager's phone, approve or append a billing-area penalty. The machine computes; the manager decides.
And it worked — which is how its ceiling was found. A spreadsheet is last-write-wins, so concurrent writes could over-allocate stock. References are loose, so integrity rotted quietly. Line items lived as JSON in text columns. The 84 KB manifest, the queue locks, the deterministic idempotency strings — each was platform tax, paying interest. Gen 1's later fixes hardened the platform; none of them could change its physics.
The plant's data residency forced Smartsheet's EU region — a region Power Automate's connector simply cannot reach. The orchestration layer the whole design assumed was unavailable.
Margin math is fully deterministic and lives in code. The decision to release a delivery stays human — one card, one tap. No model, no automation, sits in the money-release path.
Nothing is cut without cover. An LPO carries brand line items and a balance; a production tag that would breach it is refused at the form, with the reason — and the database CHECK refuses it again if the form ever lies. Leak four dies at intake.
The cutting software emits merged cells and floating headers. Gen 1's anchor-based parser — proven in production — is vendored unchanged as an internal service. One real workbook resolves to 44 typed BOM lines, each mapped to a canonical material and SAP code. Test-proven, byte for byte.
Every resolved code drops an ALLOCATE row into the ledger — quantity signed negative, actor stamped, reserved for 24 hours. Re-running allocation is a no-op: idempotency is a UNIQUE constraint, not a convention the code has to remember.
The consumption form arrives prefilled with what was allocated; the supervisor edits differences only, and variance bands flag what drifts. The margin gate recomputes live as the manager moves the inflation slider — spread only across non-straight pieces. Then a delivery order, a gate pass, a proof-of-delivery photo. No truck leaves undocumented.
A bin recount finds three square metres less than the ledger says. Gen 1 would have edited the cell. Gen 2 cannot: UPDATE and DELETE are revoked at the database role, so the correction is a new signed row pointing at the row it corrects, and the balance re-derives by walking the ledger. Silent history rewrites aren't forbidden by policy — they are impossible by physics.
Twelve modules, each owning its Postgres schema. A module's only public surface is its api.ts and Zod contract — no sibling imports, no cross-schema joins, no cross-module transactions; durable messages go through an outbox.
The app connects as a role that can write business rows but can never UPDATE or DELETE the ledger, and cannot touch DDL. Migrations, analytics and backups each get their own role and login.
Real machines carry revision tables because real machines break. This one broke across two generations — and the pattern differs.
Gen 1 broke where the platform was weak, and each fix hardened the plumbing. Gen 2 broke where all software breaks — constants, edge comparisons, transaction plumbing — and what caught it was machinery built to catch it: a parity audit in CI, edge-pinning tests, concurrency suites. Every row below traces to a commit or a logged decision.
Rows C through F share an author-unflattering truth worth stating plainly: the reviewer missed some of these, and the guardrails did not. That is the argument for building guardrails — 63 logged decisions and 46 documented gotchas are what let a solo engineer be wrong safely.
Read the plate against the four leaks. Unbilled revenue: a delivery order cannot be marked invoiced without an invoice behind it. Trucks without paperwork: the gate pass exists only downstream of a DO. Material discrepancy: one append-only ledger over a SAP snapshot floor, so variance becomes signal with an audit trail. Overproduction: refused at intake, by the form and the schema both.
None of these is a business KPI. Hours saved and dirhams recovered are not measured anywhere in either repository, so they are not claimed anywhere on this page.
Discuss a system like this →The honest close-out: the successor is finished enough to be checked, and it has not replaced anything yet.
Eleven of sixteen streams are built. The two that remain are the consequential ones: the production manager's dashboards, and the data migration itself — parallel run, daily diff reports, cutover. The runbook for that cutover exists in detail, down to "five consecutive clean diffs and sign-off from sales, production and finance." The scripts do not. No row of production data has moved. The last commit on Gen 2 is dated 2026-05-06, and the old machine has kept running the floor every night since.
I show it unfinished because the two-generation arc is the real lesson of this file. Gen 1 proved the domain in production; every invariant Gen 2 enforces in Postgres was first learned the expensive way in a spreadsheet. And replacing a live factory's system of record is a decision with a runbook, not a deploy — the old machine has earned the right to keep running until the diff reports come back clean. What I sell from this drawing is not a cutover story. It is the discipline that makes one safe: an append-only spine, boundaries a CI gate enforces, and a paper trail that caught its own author's mistakes.
If your operation leaks money at month-end — three counts of the same stock, trucks the paperwork never saw, margins approved on a hand calc — the fix starts with an honest drawing of the machine you already run. Bring it.