One funnel, one mapper, and a database that arbitrates the race.

The legality of every move lives in one pure module with no database dependency: an adjacency table of which statuses may follow which, a map of which timestamp column each transition stamps, and a map of which timestamps a transition clears. That last map encodes a real business reversal — completed is not fully terminal, and moving it to rejected or cancelled nulls the collection and completion timestamps so a voided collection stops counting as collected and drops off the laboratory audit report.

A sibling module generalises the same pattern to three other entities that originally had no enforced lifecycle at all. Each carries a comment naming the specific QA finding that made it necessary: a state resurrecting itself, orphaned records, an urgent request page coming back from the dead. Every mutating route calls one guard that turns an illegal move into a conflict response — deliberately a client error rather than a server error, because the field application's offline queue treats server errors as retryable.

Every extracted field is independently nullable and carries a confidence object — patient, physician, service, tests and overall — so the review interface can flag a low-confidence field rather than silently trusting an OCR guess. A separate billing sub-object tells the model that insurance identifiers often live on an attached face sheet rather than the requisition body, and a barcode field captures the number under the sticker, deduplicated when the sticker repeats on the page.

The field path is different: a phlebotomist photographs a paper requisition on site, the model pre-fills the same field set, and staff review and edit before it confirms into a real patient and order. Both paths — plus CSV import and the partner API — end in one mapping function. Three producers, one normalized shape, no chance of the paths quietly diverging.

The caller may pass the assignee it last saw on the board. When it does, the write is not a read, compare and then write. It is a single update whose where-clause includes that expected assignee. If the affected row count is zero, the database has proved that someone else won, and the route returns a conflict telling the dispatcher to reload.

The comment in the code is explicit about why the obvious approach fails: a read-then-compare in application code still races two dispatchers who read the same expected value a millisecond apart. Only putting the expectation inside the where-clause makes it a true compare-and-set. The assignment message to the technician fires only for the winner.

The code records what that used to cost. The violation surfaced as an unmapped server error, and because the offline queue treats server errors as retryable, a write that had already succeeded kept being retried. A specific recogniser now maps that violation to the existing row.

The client half tries the network first and falls back to a local queue only on a genuine network failure, not on a server rejection — a rejected action is dropped rather than wedging the queue forever. It flushes on the online event, on an interval while work is pending, and on visibility change. The last two were added because the browser's online flag can stay true in a dead zone with no working data path; the comment records a queued collection sitting unsent for the better part of a minute with the application open and apparently reachable.

Its old generator still exists and is still unit-tested, but it is no longer called from any live route. That is unusual and worth noticing: rather than deleting working, tested code on the strength of a decision that might reverse, it was disconnected and left with its tests intact.

The actual recurring engine today is a facility-level contract — weekday cadence, shift, expected patient volume, pre-assigned technician — which generates visit blocks rather than orders directly. Generation is a pure, database-free function anchored to the Pacific business date rather than UTC, so a run after five in the afternoon local time does not over-generate an extra day.

The laboratory audit report is built from those custody rows rather than from the order's current status alone, and it filters out orders in the excluded statuses. That combination is what makes the earlier reversal behave correctly: an order later voided drops off the audit trail even though a collection event still exists in its history, which is exactly right — the event happened, and the order should not be reported as collected.

What the log gives you is a reconstructable timeline: who acted, when, on what, and with what note attached — written at the moment of the action rather than assembled afterwards from status changes. That is the property an audit actually tests, and it is why the report reads the log rather than the record it describes.

A facility carries two deliberately different names: an internal, region-coded name for staff sorting, and a billing name that is the only name ever shown to a laboratory or on a lab-facing form. That separation is documented at the schema level rather than left to whoever writes the next template.

Facilities also carry coordinates captured through a place picker, which feed a straight-line mileage estimate at clock-in — an estimate presented as one, not as a measured route.

The comments name the production symptoms that made it necessary: an afternoon clock-in disappearing from the day view after five in the afternoon local time, leaving no way to clock out short of an administrator fix, and daylight-saving transition days producing filters off by an hour.

The fix is subtle and worth stating: the module probes the timezone offset at the day boundary rather than at the current moment. Offset-at-now is the intuitive implementation and it is wrong on exactly the days people notice.