Digital Traceability in Reactor Safety

Store HAZOP findings as versioned JSON for interlocks and alarm limits, not Excel. CI simulates changes; flood test required before promote to prod.

Every limit change is event-sourced: who, when, which batch active — one-click reports for GMP and process safety audits.

Limit changes require dry-run in simulation; prod promote needs two-level approval (engineer + shift lead).