Trust the evidence. Never the document.

I’ll start by defining the unit of work and the safety boundary. Then I’ll quantify the peak, draw a durable asynchronous architecture, and deep-dive on immutable observations, calibrated expected loss, and reviewer/downstream workflows. I’ll end with replay, air-gapped release, and degradation.

My north star is not maximum automation. It is minimum expected harm with a reproducible chain of custody. NEEDS_REVIEW is a correct product outcome, not an error.

I need five policy answers. First, is a case one patient plus one requested service under one tenant and jurisdiction? Second, does a retransmitted fax amend that case, or start a new one? Third, which business timestamp selects policy: receipt, service, or decision time? Fourth, which outcomes may auto-act, and which require one or two humans? Fifth, can a reviewer override policy, and what reason/approval is required?

I’ll assume: a submission is one transport event; immutable raw objects become a packet revision; multiple revisions can belong to a case. The tenant’s jurisdictional policy selects an explicit business-effective instant. Low-risk approvals may act automatically after release gates; forced denials and consequential overrides require dual control. Late evidence creates a new revision and superseding decision—it never mutates history.

1. No successful acknowledgement before raw bytes, checksum, tenant, and submission manifest are durably committed.
2. Raw document text is untrusted data. It can never become a system instruction or directly invoke a tool.
3. No extracted value exists without source object, page, bounding polygon, extraction channel, and artifact version.
4. Contradictions remain first-class observations. Resolution points to them; it does not overwrite them.
5. Every decision pins evidence snapshot, policy, extractor/model/calibrator, loss matrix, time basis, and actor.
6. Uncertainty, missing evidence, failed artifact verification, or unsupported policy falls closed to review—not approval.
7. External “exactly once” means a stable business key, an outbox, response receipts, and reconciliation of ambiguity.
8. Live intake is isolated from replay/evaluation capacity, and poison documents have bounded attempts.

At 300,000 packets per day, average input is 3.47 packets/s. Four-and-a-half million pages is 52 pages/s, or 15 pages/packet. The 15× replay burst is about 52 packets/s and 781 pages/s.

I will treat the supplied six-second figure as six CPU-seconds per PDF; under that assumption, average processing consumes roughly 21 continuously busy CPU cores and peak consumes 313. If a 4-vCPU worker scales ideally, that is 79 workers; with 35% retry/P99/headroom I provision about 110 peak workers. If the figure instead means six wall-seconds while all four vCPUs are saturated, the core estimate rises by up to 4×. I would measure each stage because OCR—not the whole packet—may dominate.

For storage, the median is not the mean. I’ll assume a measured planning mean of 6 MB/packet: 1.8 TB/day raw. If rendered images average 250 KB/page and provenance/OCR averages 25 KB/page, derivatives add about 1.24 TB/day. That is ~3.0 TB/day, 1.1 PB/year, 7.8 PB over seven years before replication, compression, tiering, and deletion.

The hidden contradiction is human capacity. At 85% touchless, 45,000 cases/day require review. With 1,500 reviewers, 390 productive minutes/day, and 8-minute average handling time, nominal capacity is 73,125 cases/day; at a safe 75% utilization, capacity is 54,844—adequate, but region and skill fragmentation matter. At 12 minutes, required staff at 75% utilization becomes 1,847, so the queue is unstable.

I would not promise 85% touchless universally. I’d set per-slice safety gates and use aging/priority SLAs. Reviewer utilization should stay around 70–80%; near 100%, queue latency explodes.

The live path is a staged, idempotent pipeline. Edge ingress authenticates the tenant and channel, accepts a resumable upload, computes hashes, and writes the immutable object plus submission manifest transactionally with an outbox event. Only then do we acknowledge.

A sandbox renders the untrusted PDF under resource limits. Separate workers analyze native-text visibility, OCR the raster, classify pages, and associate pages to cases. Each stage writes immutable output keyed by (input_hash, stage_code_version, artifact_manifest), so retries and replay reuse safe work.

Evidence observations flow to conflict resolution, then effective-dated deterministic policy. A calibrated model may support ambiguous, non-forced cases; an expected-loss gate selects auto-action or review. A review decision or safe auto-decision enters an outbox-driven integration service. The integration uses a business idempotency key and holds ambiguous writes for reconciliation.

Ingress is strongly consistent only where safety needs it: submission metadata, object checksum, completion state, and outbox event commit together. Processing is asynchronous and at-least-once, made effectively once by idempotency keys. Reviewer claims use leases plus optimistic versions. Decisions append; they never update in place. External writes are at-least-once attempts around one business idempotency key.

Because one mutable row collapses five different truths: what was visible, what an extractor proposed, what policy resolved, what the system recommended, and what an authorized person finally decided. I keep them separate.

An observation says “extractor X saw candidate Y at polygon Z through channel C.” A belief resolves a set of observations according to field-specific source authority and records conflicts. A recommendation applies a pinned policy/model/loss matrix. A decision records final authority and supersession. A downstream action records the external side effect and its reconciliation state.

Authority is field-specific and policy-versioned, not one global confidence score. For a prescribed quantity, a signed prescription may outrank an intake form; for adjudication state, an authorized visible adjudicator note may outrank a prior payer response. OCR confidence tells me how sure I am about reading the pixels; source authority tells me whether that source is allowed to establish the fact. They are separate axes.

A reviewer note can resolve a case but must not silently manufacture a clinical fact. The resolution always references the observations it accepted or rejected.

I treat both as hostile content. For native PDF spans, I don’t assume extractable means visible. In a no-network sandbox I render normally and also render with suspect text removed, then compare pixels around each bounding region. I reject off-crop, zero-opacity, covered, microscopic, and white-on-white spans. On image-dominated pages I quarantine the native layer and OCR the raster.

Visible malicious text is still document data, not a command. The LLM or parser receives schema-bound content in a data envelope, no system-prompt concatenation, no tools, and no authority to decide or act. The deterministic policy sees a source-typed observation—perhaps “instruction-shaped free text”—and the visible denial stamp with its source authority. A conflict or adversarial flag can force review or denial.

The renderer runs with no network, read-only root/input, bounded bytes/pages/decompression, 4 vCPU, 8 GiB memory, 2 GiB scratch, PID and wall-clock limits. Active content is dropped; bombs and malware enter quarantine after a finite retry budget.

Not from that number alone. First, hard policy and unresolved conflicts can force review or deny. Then I require the probability to be calibrated for this tenant, policy, provider, and document slice. Finally I compare actions using the business loss matrix.

Let q = P(ineligible | evidence). With false approval cost 25, false denial cost 8, and review cost 1:

Approval beats review only when q < 1/25 = 0.04, or eligibility is above 96%. Denial beats review only when q > 1−1/8 = 0.875. Between those thresholds, review has the lowest expected loss. At 88% eligibility, q=.12: approval loss is 3, denial is 7.04, review is 1—so NEEDS_REVIEW.

No. Aggregate F1 and a judge score can hide catastrophic slices. The low-contrast/provider false-approval gate fails, so I block promotion, lower automation for that slice, route it to review, and investigate visibility/OCR/calibration drift. Golden labels remain isolated from training; a stratified sample receives blinded double-human adjudication. An LLM judge is diagnostic only and must be calibrated against human ground truth.

I deduplicate at three levels: source message key prevents transport replay; whole-object SHA-256 detects byte-identical packets; canonical rendered-page perceptual plus cryptographic hashes identify duplicate pages. I never drop first and inspect later—duplicates still preserve receipt lineage.

The genuinely new page creates a new packet revision. It produces new observations and a new evidence snapshot; the prior decision becomes stale and superseded, not erased. Policy decides whether the downstream order is suspended pending review. The UI opens on the changed field, shows old and new crops side by side, highlights authority/confidence, and requires a reason. A consequential reversal uses dual approval.

The action service issues a correction/void with the original business key plus a new operation ID. If the downstream timeout is ambiguous, it queries by business key or reconciles; it never blind-retries a non-idempotent create.

Inside our database, the final decision and an outbox row commit atomically. A relay delivers at least once. The downstream request carries tenant + case + decision_version + action_type as the business idempotency key. We store attempt and response receipts. On timeout, state becomes UNKNOWN; reconciliation queries the target or raises a human task. We claim exactly-once business effect only when the receiver honors that key or exposes lookup—not magical exactly-once transport.

Policy has bitemporal semantics: business-effective time answers when a rule applies; recorded time answers when we learned or published it. Tenant policy explicitly defines the basis—say service date in the patient’s jurisdiction, not worker clock. The decision stores the resolved timestamp, timezone, jurisdiction, and policy digest. Clock health is monitored, but application correctness does not depend on an arbitrary node’s local clock.

I support three distinct replays: ORIGINAL reconstructs the exact historical decision with old bytes and artifacts; CORRECTED uses the policy that should have applied at that historical business time; WHAT_IF runs today’s proposed artifacts without changing production state. Impact queries find decisions by wrong policy/time range; corrected decisions supersede them and feed reconciliation.

For the missing model, the signed manifest lists every executable artifact and hash. Startup verifies image digest, OCR data, model, lexicon, schema, calibrator, rules, and runner compatibility. A required missing hash is fatal. Release tests build a clean image, disable network, import only the release bundle, assert artifact identity at runtime, then run adversarial fixtures and hidden slice gates. We never test the developer tree and call it the release.

We preserve durable acknowledgement and safety, then sacrifice freshness and automation. Admission control validates compressed/uncompressed size and page limits before expensive work. Per-stage queues expose age, tenant, priority, and version; workers enforce CPU/memory/wall/PID/scratch limits. Retries have exponential backoff, jitter, and a fixed budget keyed by immutable input plus stage version. A poison item goes to quarantine/DLQ, not the head of the queue.

I reserve capacity for live and urgent amendment traffic, then weighted-fair-share normal intake; reviewer-support crops come next, and replay/backfill uses a separate pool with a kill switch. Successful render/OCR stages checkpoint immutably, so retry resumes rather than restarts.

If backlog threatens the five-minute SLO, we disable optional enrichments, reduce low-risk auto-decision where evidence is incomplete, and surface cases to review with clear “processing incomplete” reasons. We do not skip provenance, bypass policy, or silently use a weaker model.

Isolation starts with tenant-scoped identity, per-tenant envelope keys, private endpoints/mTLS, least-privilege service identities, and ABAC for role, case, purpose, region, and break-glass. Queue messages carry opaque IDs—not raw PHI. Logs, traces, and metrics use redacted reason codes and hashes. Evidence crops use short-lived authorized URLs; broad embeddings are off by default.

A derived-data lineage graph connects raw objects to renders, OCR, crops, indexes, prompts, evaluation examples, and backups. Deletion creates a signed work order over that graph. Items under legal hold move to a separately encrypted, access-restricted retention class; we retain only minimally necessary non-PHI audit metadata elsewhere. The air-gapped customer returns a signed deletion attestation.

Release gates cover end-to-end evidence correctness, unsupported values, wrong-person association, catastrophic false approvals, expected loss, calibration/Brier score, review rate, queue SLA, downstream duplicates, clean-image artifact identity, and per-slice metrics. Rollout is shadow extraction → reviewer-only suggestions → provider/policy canaries → touchless approval only for proven low-risk slices → wider rollout, with an instant switch back to review and version-specific replay.