Auto-run or named approval — the checklist automation that never forges a signature — step 6 of 8

Exceptions are a queue, not a shrug

The worst possible output for an automated checklist run isn't a page of errors. It's all clear — printed over a failure. The export wasn't there, so the low-stock report silently regenerated from last week's file; the vendor scorecard source hadn't refreshed in 41 days, so the "current" scores are stale fiction. Nothing crashed. Everything lied.

You've spent this chapter making the machine unable to fake a signature. This step makes it unable to fake a clean run. The rule is one sentence: a failed or doubtful item never disappears — it lands in the exception queue with a reason, and the queue is part of the run report.

Three properties make an exception queue worth having:

• Every entry carries a reason, in operational language. export missing and source stale: 41 days old are things the 8am human can act on without archaeology. An exception without a reason is just a fancier silent failure — it tells you something's wrong and makes you re-derive what.
• The queue is visible where the results are. Not a log file nobody tails. The run report prints successes, then the count, then the queue. If the count isn't zero, nobody can read the report and come away thinking the night was clean — the format itself refuses to let a failure hide.
• Carried items carry their reason too. Sometimes the exception is human: the cycle count didn't happen because aisle 3 was blocked by an inbound load. Fine — real operations have Tuesdays. The item gets carried with the reason written down, not quietly marked done to keep the streak green. A checklist with three honest carries is a record; a checklist with a perfect completion rate is a suspect.

There's a trust argument here that ops people feel in their bones. Your team already lives in a world of traceability — lot numbers, chain of custody, calibration stickers. An automation that swallows failures breaks that culture from the inside: the first silently stale report someone catches is the last time anyone trusts the automated ones, and then you're back to everyone rebuilding the numbers by hand, except now there's also a bot to babysit. The exception queue is what lets the automation keep its credibility on the nights it fails — which is the only kind of credibility that counts.

Next: you build the full router — due list in, three-way routing out. Then the checkpoint bolts the exception queue on and produces the complete nightly run report.