The shipyard must remember. An operating doctrine for AI-native shipbuilding.

An approved sensor module goes out of production and the vendor offers its successor. It fits the same footprint, it is a better instrument, and the substitution is approved on those two facts.

Object

The module, as an installed position on the vessel rather than a line on a purchase order: one addressable thing with a variant, an envelope and a set of declared interfaces.

Governing revision

The drawing revision that governs the position, and the configuration the vessel is approved to carry. The successor is a different variant, so the position is now described by a revision that does not govern it.

Dependency

The declared interfaces the position holds: electrical demand, thermal load, mounting, mass and center of gravity, network and software identity. Each is an edge to a domain owned by a different discipline.

Evidence

What exists: the vendor datasheet and the approval of the substitution. What does not exist yet: a generator margin result, a cooling result and a stability result computed against the new figure.

Authority

Electrical load stays with the electrical authority, thermal with thermal, stability with naval architecture, configuration release with configuration control. No reasoning layer resizes a generator or accepts a stability result.

Computed consequence

The change propagates along declared interfaces into energy, thermal and platform, and then out of the vessel’s engineering domains altogether into production sequence and maintenance burden. That is ten hops from a swap nobody thought was structural.

Human decision

Each named discipline dispositions its own domain. The configuration authority releases the new variant only once every one of them has answered.

Physical action

Cable is pulled to a different size, a cooling branch is re-cut, the block is re-weighed, and the maintenance plan the vessel carries for its service life is rewritten. Or the substitution is declined, and the original module is bought ahead.

What the system must not concludeThe system may not report the position as approved because a substitution was approved. Until the dependent domains have answered, the configuration state is not established. That is not the same as rejected, and it resolves by computing the answers rather than by re-approving the swap.

A configuration change supersedes the drawing revision a work package was planned against. The crew is on shift. The package read READY an hour ago.

Object

The work package, and the objects the change model declares it reaches. Not every object in the zone, and not every object anyone is worried about.

Governing revision

The superseding revision becomes the governing one for the objects inside the change’s declared scope. Objects outside it keep the revision they had.

Dependency

The propagation model states which objects are known-affected, which are known-not-affected, and which cannot be assessed. All three are answers; only the first two are conclusions.

Evidence

Records captured against the superseded revision describe an object under a basis that no longer governs. They are retained with their capture date, authority and the reason they stopped governing. They are never deleted or rewritten.

Authority

Configuration control owns which revision governs. Quality owns whether an observation is accepted. The planner or supervisor owns whether work starts. None of those moves because a change was issued.

Computed consequence

The gates whose evidence lost its basis become CANNOT ESTABLISH, never open, because losing the ability to establish a claim is not learning the claim is false. The package itself, still released at the superseded revision, is NOT READY: its configuration gate is known open until it is re-released at the governing one.

Human decision

A named person re-baselines the affected records or sends someone to capture new ones, and re-releases the package. Objects the model marked not-affected are left alone.

Physical action

Either the crew keeps working on the part of the package the change never reached, or the work stops before steel is cut against a revision that no longer governs.

What the system must not concludeThe system may not invalidate everything nearby to be safe. Conservative explosion stands crews down for guessed reasons and is its own failure mode; an unmodelled relation is not a licence to invalidate. It also may not report an unknown gate as open, because that sends a crew to fix something that may already be correct.

A source that has been shipping for months fails a surveillance audit, or lets a process certification lapse. Nothing on the shop floor looks different that morning.

Object

The source, as a record with a qualification state, and the requirements that record is the qualified answer for.

Governing revision

The qualification state that governs today, and the date the evidence behind it stopped being current.

Dependency

Every requirement whose only qualified source is this one. That set is the actual exposure, and it is usually smaller than the panic and larger than the purchase order.

Evidence

The audit finding, the certificate and its expiry, and the material already received under the qualification that held when it was received.

Authority

Supplier quality owns the qualification state. Procurement owns sourcing. Engineering owns whether an alternative is acceptable. A reasoning layer surfaces the constraint and the candidate responses; it approves no substitution and releases no material.

Computed consequence

Requirements covered only by this source lose their qualified coverage. Material already received keeps the qualification it was received under. Expiry reaches forward to new work, never backward into a record that was valid when it was captured.

Human decision

Supplier quality dispositions the finding. Procurement and engineering decide together whether to qualify an alternative, hold, or accept a deviation with its own named approver.

Physical action

Purchase orders stop, or a second source enters qualification, or the program accepts a longer lead time. The steel already in the yard does not change state because the audit failed.

What the system must not concludeThe system may not treat a lapsed qualification as a defect in the material already delivered. Those are different claims about different objects at different times, and collapsing them scraps good material to protect a claim nobody made.

A scan comes back outside tolerance. A nonconformance is raised and the board dispositions it to rework.

Object

The physical subject that was measured, the finding raised against it, and the hold the finding places on acceptance.

Governing revision

The acceptance plan that governs, and the hold points inside it. Each hold point names the measurement classes that can close it. A dimensional read never closes a pressure test, however many dimensional reads exist.

Dependency

The work that cannot be accepted while the hold stands, and the downstream operations sequenced behind that acceptance.

Evidence

Every observation captured before the disposition. A decision to rework is a decision to change the physical thing, so those records describe an object that no longer exists.

Authority

Quality owns acceptance. The Material Review Board is the only authority that may take use-as-is, which is precisely why it is the only disposition that closes without new measurement. Scrap holds permanently.

Computed consequence

Clearing the hold requires an accepted observation of the subject captured AFTER the disposition timestamp. Any accepted observation would not do, because it would accept the thing that was just rejected.

Human decision

The inspector accepts or rejects the re-verification. The rework path does not lower the evidence bar; it raises the capture date.

Physical action

The part is reworked and re-measured, or repaired under a named disposition, or scrapped. Downstream work stays sequenced behind an acceptance that has not happened.

What the system must not concludeThe system may not let the original measurement close the hold it triggered, and may not let a satisfied hold point stand in for an unsatisfied one. Acceptance is a property of the whole plan, not of the most recent good result.

A calibrated sensor returns a reading inside tolerance. Nothing is wrong, and nothing about the result is surprising.

Object

The measurement, and separately the instrument that produced it, each with its own identity, because a record about a part and a record about a head are different populations.

Governing revision

The calibration that was valid when the reading was captured, and the acceptance criteria in force for that subject at that time.

Dependency

Whether a second, independent read exists. Two reads off one head are two records and one observation: a single miscalibrated instrument agrees with itself perfectly.

Evidence

The reading, its method, its instrument, its operator, its time, and the requirement it is offered against. A reading with no claim attached is not evidence of anything in particular.

Authority

The instrument establishes a measured value. It does not establish acceptance. An authorized inspector does, and no model score substitutes for the measurement.

Computed consequence

The observation counts toward sufficiency only if it is accepted AND about the subject the plan governs. A rejected measurement is real evidence that does not satisfy an acceptance threshold.

Human decision

The inspector accepts or rejects. A second read off the same head adds a record and no confidence; only a read from an independent instrument does.

Physical action

The hold point closes and the next operation is released, or a second independent read is taken before anything moves.

What the system must not concludeA sensor never self-accepts, and agreement is not independence. A monitor reading the work it watched, or two reads off one head, establishes a measured value and nothing more.

A requirement arrives specifying a different alloy. The welding class is qualified, staffed, and sitting idle.

Object

The capability class, and the process-and-material pair the arriving requirement actually needs.

Governing revision

The procedure qualification record, which is per process and per material. Class-level status is not the answer to a requirement-level question.

Dependency

Whether any qualified class covers this requirement at all. The question has three answers, because "not assessed" is not "not covered".

Evidence

The qualification records that exist, and the specific one that does not: a procedure qualified for the arriving alloy.

Authority

Welding engineering owns procedure qualification. Production owns the schedule. Neither can borrow the other’s answer.

Computed consequence

The class is unqualified for this work rather than busy with other work. Those are different shortages: admissibility outranks throughput, because capacity that may not lawfully do the work is not slow capacity, and adding a shift does not retire it.

Human decision

Welding engineering qualifies the procedure, or the requirement is re-sourced, or the material is changed. A planner cannot decide this by moving the schedule.

Physical action

A qualification coupon is welded and tested before any production weld is made, or the work goes somewhere that already holds the procedure.

What the system must not concludeThe system may not read an unassessed requirement as a missing capability. Not knowing is checked first, because the most expensive mistake available is industrializing against capacity the program may already have.

A cell completes commissioning, passes its site acceptance test, and a named supervisor releases it into the plan. It is, finally, capacity.

Object

The asset, in a lifecycle state the schedule is allowed to plan against. Most of the eleven states do not qualify.

Governing revision

The release record, and the named person on it. Ordered, delivered, installed and commissioned are each a different state, and none of them is this one.

Dependency

The capability class the asset was proposed against, and the constraint that class was binding on.

Evidence

Acceptance test results, safety validation, operator authorizations, calibration. Enough to release the machine. Not enough to say what it adds.

Authority

Production releases the asset. Nobody has measured its contribution, and no authority can supply a number by deciding one.

Computed consequence

The asset counts as schedulable. How much executable capacity it adds is NOT ESTABLISHED. The throughput model carries scenarios that move a whole class’s inputs, and none of them is a measured contribution from one machine.

Human decision

The program either plans conservatively against the class and measures the delta over the next hulls, or it commits to a number it does not have.

Physical action

Work is scheduled through the cell. Whether the program’s throughput actually moved is a question the next hull answers, and only if someone instrumented this one to ask it.

What the system must not concludeThe system may not print a capacity delta it did not compute. This is the case where the honest output is a boundary rather than a figure, and where the claim that industrial memory compounds across hulls stays an ambition. Nothing here demonstrates it.