> Fault doctrine for trading infrastructure: an append-only registry with proven emission sites, and a crash-honest journaling bus. - Canonical: https://hadalinstruments.com/instruments/fail-visible-ops/ --- [Back to Instruments](https://hadalinstruments.com/instruments/) P19 The Honesty Stack # Fail-Visible Ops In trading infrastructure, silence is a fault — not a status. Anticipated price Anticipated · not ratified · not an offer From £15,000/yr - **Annual term** — from £15,000/yr Twelve months of service for the price of ten. Nothing on this site is on sale. There is no checkout, no cart and no payment link on any page. Prices publish pre-launch so they can be read, compared and checked rather than requested — [seat bands, group licences and multi-year terms are set out in full below](#commercial). here would have added one landmark per placement, which on the homepage means a landmark list that is mostly disclaimer. --> Standing policy — read this beside the figure - **No promise of profit, ever.** Hadal makes no performance claims and carries no implied edge. Past measurements describe instrument behaviour — never future returns. - **You own risk management.** Hadal cannot control it and does not insure it. Good tools do not fix bad discipline — and this site says so. - **Analytical tools, for discretionary use.** Nothing here is investment advice or a recommendation to trade. Every decision, and every outcome, is yours. The same statement stands in the footer of every page.[Terms](https://hadalinstruments.com/terms/) [Privacy](https://hadalinstruments.com/privacy/) [How it measuresThe Honesty Stack suite methodology](https://hadalinstruments.com/methodology/stack/)[BoundsWhat it does not establish](#what-it-does-not-do) Published measurements NOT YET PUBLISHED Specification | Value | Catalogue no. | P19 | Suite | [The Honesty Stack](https://hadalinstruments.com/suites/stack/) | Methodology | [How the Honesty Stack suite measures](https://hadalinstruments.com/methodology/stack/) | Availability | Pre-launch — not on sale | Anticipated price | [from £15,000/yr](#anticipated-price) | Delivery | Seat licence · deployment licence | Published measurements | NOT YET PUBLISHED | Provenance artifact | NOT YET PUBLISHED | The most expensive infrastructure failure is the quiet one. A process dies and the monitor shows nothing; a journal stops writing and the absence of errors reads as health. Trading systems fail like everything else fails — the question is whether the failure is visible at the moment it happens or reconstructed weeks later from an incident that should not have been possible. Fail-Visible Ops is the fault doctrine I run on my own infrastructure, packaged: a set of structural rules that make silent failure a state the system cannot occupy. The doctrine is live internally — the journals it mandates are being written on my own systems today. ## What it does The doctrine is a rule the whole system obeys, not a tool somebody sits in front of. - **An append-only fault registry with proven emission sites.** Every fault code the system can raise lives in a registry that only grows — codes are never deleted or renumbered, so historical journals stay readable forever. And a code cannot claim Active status without a **proven emission site**: an actual location in the codebase demonstrated to raise it. No aspirational error handling, no catalog of faults the system theoretically reports but structurally cannot. If the registry says a fault is Active, somewhere real code can emit it. - **A crash-honest journaling bus.** The journal is the system’s memory, and the doctrine’s founding demand is that the journal account for its own failures. The bus records what it wrote and what it lost, and its semantics are explicit: `records_written: 0` means the bus was unreachable — never a quiet system. Zero is a report of failure, not a report of calm. A journaling layer that cannot distinguish “nothing happened” from “I was down” will eventually launder an outage as an uneventful day. - **Loss accounting as a first-class output.** When the bus drops records — crash, backpressure, unreachability — the loss itself is journaled and attributed. You learn not just that the record of events is incomplete but where the holes are, which is the difference between a dataset with documented gaps and a dataset that lies by omission. - **Registry and journal statistics, from the deployment I run myself.** The registry defines 119 codes: 114 `Active`, four `Retired`, one `Reserved`. A rail tests that every code marked `Active` reaches a real emission expression, and it currently reports none inert — so Active is checked, not asserted. That rail also states the direction it is blind in: it tests *active implies emitted*, never *emitted implies active*, so it can understate the wiring and cannot overstate it. On the journal, 484,310 records across 10,427 session files, none unparseable, of which 44,023 carry a code and **47 distinct codes have actually fired** — led by `CAPTURE-005` at 23,086, `CONJ-900` at 6,298 and `SCALE-008` at 3,291. Read the pair honestly: 119 defined, 47 fired; the rest have had no occasion. And read the record count honestly too — it spans acks and lifecycle events alongside coded faults, so it counts *records*, never faults. ## What it does not do Fail-Visible Ops does not prevent crashes, and it does not promise uptime. Systems fail; that is not negotiable. What the doctrine removes is the second failure that usually rides along with the first — the silence. A crash under Fail-Visible Ops produces an honest, attributed record of what was lost. A crash without it produces a mystery. ## Who it is for Teams running live trading infrastructure who have learned — or would rather not learn — that “no alerts” and “no problems” are different sentences. Operators who want their post-incident review to start from a journal that admits what it missed, instead of a monitoring stack that swears everything was fine. ## The ship gate No instrument is sold until it does what this page says it does. Where a page is written in the future tense, that tense is a statement about timing rather than a hedge about capability: the instrument is not finished, so it is not listed as available, not priced as available, and not sold. It waits. Nothing described in this catalogue is a placeholder that will quietly disappear. An instrument that turns out to be wrong gets a [kill-ledger entry](https://hadalinstruments.com/kill-ledger/), not a deletion — which is the only version of that promise anyone can check. ## Commercial terms Published in full, pre-launch, so they can be read and checked rather than requested. Every figure is an anticipated indication I have set and not yet ratified, and every derived figure is the arithmetic of the one above it — shown, not asserted. Nothing here is purchasable: there is no checkout on this site. ### Why Fail-Visible Ops is priced the way it is - **What the figure buys** — An organisation-wide licence to the doctrine and its enforcement: the append-only fault registry, in which a code cannot claim Active status without a proven emission site — an actual location in the codebase demonstrated to raise it; the crash-honest journaling bus, whose zero records means the bus was unreachable rather than the system quiet; and the loss accounting that journals and attributes what the bus dropped, so a hole in the record is documented rather than silent. Where the boundary sits is stated on this page rather than discovered later: the doctrine makes failure visible and attributable, and it does not prevent crashes or promise uptime. - **Why it is priced this way** — Per estate rather than per person, because what is licensed is a rule the whole system obeys rather than a tool somebody sits in front of — another engineer reading the same journals costs Hadal nothing, so charging for them would be charging for nothing. Annual, because a fault registry that only ever grows is a living document rather than a delivery: codes accumulate as the estate learns what it can fail at, and a licence is the honest shape for something that keeps being extended. It starts at a floor rather than a fixed figure because the part that varies is integration, not the doctrine — an estate with a single service and one journal is a different job from a fleet of services behind a message bus, and one quote covering both would mean the smaller estate paying for the larger one's work. The floor is published so the conversation starts from a stated number rather than from no number at all. - **What the alternative costs** — Writing it yourself, which is genuinely possible — the doctrine is rules rather than magic, and this page states them. What the licence buys is the finding-out that produced them: that a journal must account for its own silence, that a report of no records written means unreachable rather than quiet, that a fault code nobody can emit is decoration. The other alternative is the status quo, which costs nothing until the quiet failure — and the doctrine does not prevent that failure either. What it changes is that the failure arrives as an attributed record of what was lost, instead of as a mystery reconstructed weeks later from an incident that should not have been possible. Every figure on this page is an anticipated indication awaiting ratification, and nothing here is purchasable. The reasoning above is published for the same reason the arithmetic below is: a price you can interrogate is worth more than a price you have to accept. ### The two-SKU split One route. This instrument has no marketplace equivalent, and the cell says so rather than sitting empty — an empty cell reads as an omission, and this is a fact about how the instrument is sold. Route | What it is | Anticipated | Marketplace SKU | None. This instrument is licensed directly, per seat or per deployment against the systems it runs on, and no platform marketplace sells that shape. There is no third-party SKU between you and it. | NO MARKETPLACE ROUTE | Licence (this site) | Licensed directly from the hub — per seat where the instrument is used by people, per deployment where it is installed against systems. Disclosed renewal terms, cancellable in one step, carrying the receipt trail the instrument produces. | from £15,000/yr | The price rule The at-or-below-marketplace cap binds the instruments that ship through a platform. This one does not, so the cap has nothing to bind. What holds in its place is simpler and checkable: the figure above is the only figure. There is no separate, higher list price it is discounted from, nothing on this site has ever been sold at any price, and so there is no “was” anywhere to strike through. ### The commitment ladder One month less paid per year of service, per step, taken off this instrument's own anticipated annual rate of from £15,000/yr . The rate is held at the figure you sign for the whole term, so a multi-year commitment fixes the price as well as reducing it. Term | Months paid per year | What it means | Anticipated | Monthly billing | 12 | The anticipated indication for this instrument is stated annually, so no monthly figure is derived. An undirected figure renders as absent, not as a number. | No monthly rate directed | 1-year term | 10 | Twelve months of service for the price of ten. This is the annual rate every band below is taken off. | from £15,000/yr | 2-year term | 9 | Ten per cent off the annual rate, held at that figure for the whole term. | from £13,500/yr | 3-year term | 8 | Twenty per cent off the annual rate, held at that figure for the whole term. | from £12,000/yr | Three years for what two years of monthly billing costs Eight months paid per year, across three years, is 24 months paid for 36 months of service — one year in three carries no charge. On this instrument the three-year term totals from £36,000 . ### Group licences, across entities Licensing here is per account or per desk, not per seat, so a seat band does not apply and none is offered — applying one would be a category error dressed as a discount. The scaling axis here is **entities**: where the same instrument is run by more than one legal entity, desk, fund or network inside a group, the licence is negotiated as a single group licence rather than replicated entity by entity. Multi-network clients are exactly the case this exists for, and the commitment ladder above applies to a group licence on the same terms it applies to a single one. ### Commercial routes Pricing scales on entities and on term — one negotiated group licence across desks, funds and legal entities, never a seat band. [Licensing — seat bands, group licences and multi-year terms in full](https://hadalinstruments.com/licensing/) ### Support - Tier **Named** at this instrument’s base contract — ticket, prioritised · named onboarding, first response targeted at same business day . Support tier follows the annual contract value, not the price of a single unit — more seats, a suite licence or a group agreement raise the contract value and can raise the tier with it. [Support — the tiers, the ticket-only channel model, and what a target does and does not promise](https://hadalinstruments.com/support/) ### Trial mechanics The trial runs on a seat — thirty days, disclosed in plain words before you start it and cancellable in one step; none of it is live yet. [Trial mechanics in full, by delivery class](https://hadalinstruments.com/licensing/#trial). ### Read before you commit The documentation is published ahead of the product on purpose — intended behaviour is only a commitment if it exists first. Start with [installation and first run](https://hadalinstruments.com/docs/install/), then [the limits](https://hadalinstruments.com/docs/limits/): the conditions under which this instrument refuses to produce a number are the part worth reading before you pay. The full centre is at [/docs/](https://hadalinstruments.com/docs/), and the [support model](https://hadalinstruments.com/support/) states what a ticket does and does not cover. ## Questions and answers Answered from what this instrument publishes about itself. Nothing below is attributed to a customer, because there are none yet. ### Does it prevent crashes or promise uptime? Neither. Systems fail, and that is not negotiable. What the doctrine removes is the second failure that usually rides along with the first — the silence. ### What does a fault registry entry have to prove? A proven emission site: a real location in the codebase demonstrated to raise that code. A fault cannot claim Active status on the strength of aspirational error handling. ### What does a journal reporting zero records written mean? A zero-record journal means the bus was unreachable — never that the system was quiet. Zero is a report of failure, not a report of calm, and dropped records are journaled and attributed so you learn where the holes are. ### Can I licence this instrument today? No. Nothing on this site is on sale — there is no checkout, no card capture, and no product account to create. Every figure on this page is an anticipated indication I have set so it can be read and compared, not an offer, and final pricing awaits my ratification. The launch list is the only thing you can join today. ## Change log NOT YET PUBLISHED Fail-Visible Ops has not shipped, so there is nothing to record. When it does, every version lands here — dated, append-only, written by a person, and including the changes that removed a capability rather than added one. ## Where this sits Fail-Visible Ops is one of the instruments in the [Honesty Stack suite](https://hadalinstruments.com/suites/stack/). How that suite measures — the per-instrument battery, and the receipts each measurement will carry — is set out in the [Honesty Stack methodology](https://hadalinstruments.com/methodology/stack/), part of the site-wide [measurement methodology](https://hadalinstruments.com/methodology/). ### Also in the Honesty Stack suite Fail-Visible Ops shares the Honesty Stack suite with three other instruments. - P4 [Epistemic Harness](https://hadalinstruments.com/instruments/epistemic-harness/) Registry-as-a-service: pre-registration, walk-forward enforcement, the kill ledger. - P5 [Agent-Governance Constitution](https://hadalinstruments.com/instruments/agent-governance-constitution/) The rails that caught a forged ratification — packaged. - P15 [Provenance-Grade Ingestion](https://hadalinstruments.com/instruments/provenance-grade-ingestion/) Vendors sell data. Nobody sells provenance discipline around data. ### Research behind this instrument Fail-Visible Ops draws on one research note on this site. - [How do you tell if a CI gate can actually fail?](https://hadalinstruments.com/research/how-do-you-tell-if-a-ci-gate-can-actually-fail/) Asked as: "how do you tell if a ci gate can actually fail" --- ## Raw artifact — NOT PUBLISHED FOR THIS PAGE No downloadable artifact ships with this page. Eight published measurements do, each content-hashed so a reader can verify the figures independently. Where a measurement is published here without one, that is a gap rather than a policy, and it is stated rather than left to be noticed. [Measurements that ship their data](https://hadalinstruments.com/research/) [Join the launch list](https://hadalinstruments.com/pricing/#waitlist)[How this suite measures](https://hadalinstruments.com/methodology/stack/)