Order history, quantities and confirmed dates, offline — conflicts settled by a state machine, not a merge
Flow keeps a client’s orders as commitments — quantity, place and date — each in one declared state. Every change is a transition with actor and time. Devices work offline and synchronise to a backend inside your boundary, under one state machine. Concurrent changes get a legal interleaving or a named rejection, never a record in two states. Flow reports how often a client’s confirmed dates held (descriptive, not a forecast) and exports the commitment log for audit. Not an ERP: it does not invoice or post to a ledger.
Every sync engine on the market ships either last-write-wins or CRDT convergence, and both are the wrong answer for a business object. The canonical failure is a card moved to two different columns at the same moment and ending up in both: every device agrees, and what they agree on could not have happened. Convergence guarantees that replicas match. It does not guarantee that the result is a thing your business can do — and an order with a date on it is a promise somebody will be held to.
Everything Harbour Flow reads, and nothing beyond it. Inputs that widen quietly after an evaluation make the evaluation worthless, so this list is part of what you are buying.
| Source | Cadence | What it contributes |
|---|---|---|
| Commitment capture | continuous, online or offline | The promise itself — counterparty, quantity, place, date — created on whatever device is to hand, with an identity generated on that device so that a lost acknowledgement produces one commitment rather than two. |
| Capacity snapshot | on every sync | A dated extract of available capacity from your planning system, carried to the device so that a local check has something to check against. Every snapshot carries its age, and the age travels with the number. |
| Counterparty and site register | on change | Delivery points, notice periods, cut-off times, and who may sign for what — the contract terms that decide whether a transition is legal. Read only in Flow; your ERP stays the master. |
| State model | at deployment, then on version change | The states a commitment may hold and the transitions between them, declared as a versioned document rather than buried in code. A device carries the version it last synced and reports it on every write. |
| Signing context | at the moment of signature | Content hash, signer identity and credential, device enrolment, local clock reading, and the drift measured later against a trusted source. Sealed on the device before the record joins the outbox. |
| Device and outbox telemetry | continuous | Outbox depth, oldest unsynced write, cursor position, last successful sync, offline duration. States and counts about the device; never the content of what it is carrying. |
Every signal below is computed from the inputs above by a documented formula. Nothing here is a black box: an output nobody can explain is an output that gets overruled the first time it is inconvenient.
| Signal | Scale | How to read it |
|---|---|---|
| Commitment state | one of the declared states | The record reduced to a single legal value. There is no state called "in conflict": either a commitment is in a declared state, or the write that would have moved it was refused and said so. |
| Promise reliability | 0–100 per counterparty | How often confirmed dates held, derived entirely from your own commitment history. Descriptive rather than predictive, and suppressed below a configured minimum number of closed commitments. |
| Capacity headroom | units of your own capacity measure | Free capacity against the snapshot this device holds, never displayed without the snapshot's age beside it, so an operator knows what the figure is worth before they say it out loud. |
| Snapshot age at commitment | hours | How stale the capacity data was when the promise was made. The most useful number in the system when a commitment is rejected on reconnect, and the one that tells you whether to sync more often. |
| Rejection class | closed set of nine classes | Every refused write comes back as exactly one named class, because each class maps to a different instruction. A rejection with no class is a spinner, and a spinner is how a support ticket starts. |
| Outbox depth | writes, and days since the oldest | Per device. Depth alone is unalarming; depth that has not fallen in nine days is the single clearest sign that something is stuck and nobody has been told. |
An order is not a row in a table. It is a promise: this quantity, to this counterparty, at this place, on this date. The date is the part with consequences attached. A truck is booked against it, a berth is held, a technician’s Tuesday morning is spent on it, and in a good many contracts a penalty accrues if it moves. Everything downstream depends on whether the promise holds its shape.
Most software models this as a record with fields, which turns every concurrency question into a field-level question: who wrote the delivery date last, and what ought to happen when two people wrote it at once. That question has an answer. It is also the wrong question. The one that decides the outcome is whether this commitment is still in a condition where the date may be changed at all, by this person, given everything that has happened to it since they last looked.
Flow models a commitment as a state with declared transitions between states — drafted, offered, confirmed, amended, part-fulfilled, fulfilled, cancelled, lapsed. Each transition names who may make it, what must be true beforehand, and what evidence it requires. The history of a commitment is the sequence of transitions that produced it, each with an actor and a time, rather than a diff of fields that nobody can interpret six months later.
The first benefit shows up on the device rather than in the architecture diagram. An operator standing at a gate with no signal sees the same set of available actions they would see at a desk, because the same state model is evaluating them. An action the server would refuse is not offered. Preventing a conflict by declining to present an impossible action is considerably cheaper than resolving one, and it happens before anybody has said anything to a customer.
Something useful falls out of holding history this way, without anybody having to collect it. If every transition is kept, you already know how often each counterparty’s confirmed dates held and how often they moved — a question your commercial team currently answers from memory and mood. Flow reports it as a rolling figure per counterparty. It is descriptive and not predictive: it says what happened, not what will happen. It is suppressed entirely below a configured minimum number of closed commitments, because a counterparty with four commitments does not have a reliability score, they have four anecdotes.
Harbour Registry supplies the layer underneath: declarative per-field merge policy, an audit trail of every resolution, and the record-level machinery for deciding what two versions of the same row mean. Flow builds on it and adds the part that is specific to a commitment — not which value wins, but whether the change was permitted to happen at all.
The distinction is easiest to see where field-level merging produces a confident answer that is nonsense. One operator cancels a commitment at 09:40 because the site has stood them down. Another confirms it at 09:41 because they are standing in front of the customer. Both devices are offline. Last-write-wins picks whichever clock the server prefers. A CRDT converges on some deterministic combination of the fields. Either way, every replica now agrees on a record describing something that cannot have occurred.
Put the same pair through a state machine and there is no combination to compute. Cancel-then-confirm is an illegal sequence, because confirmation requires an open commitment. Confirm-then-cancel is legal, and produces the cancellation of a confirmed order — a different and more expensive event than withdrawing an offer, which is precisely the distinction your business cares about and the merge could not see. One write is accepted. The other comes back named, attributed and explained.
This is the best-documented failure in the whole local-first category, and it is not an argument against CRDTs. Yjs and Automerge do exactly what they say. The guarantee on offer is convergence, not correctness, and teams who adopt them for a domain model rather than for text routinely discover months later that their merges are technically consistent and operationally absurd. The card that was moved to two columns at once and landed in both is the example everyone in this field has heard. Convergence is the easy half of the problem; persistence, schema migration, access control and semantics are the product.
Order independence is the property worth testing us on. Devices reconnect in whatever order the world gives you, and the result must not depend on it. Flow evaluates each queued transition against the server’s state at the moment of replay, so the device that arrives second is judged against what the first one did. The same pair of writes produces the same final state and the same rejection whichever way round they arrive. You can run that against us rather than believe it.
The honest cost is the modelling. Declaring which states a commitment may hold and which transitions are legal between them is a business conversation, not a configuration screen, and it tends to surface disagreements between sales, planning and operations that the previous system was able to leave undisturbed because it never asked. Expect a workshop in the first fortnight rather than an import. We think it is the right cost to pay, and we would rather you heard about it now than in week three.
The hard case is not the tunnel or the flight. It is the device that reappears after a fortnight. A published government field test of one of the sync engines in this market makes the shape of it plain: five schools, two of them with no coverage at all, staff travelling to signal roughly every ten days, and a written requirement that local records survive weeks so that a missed trip costs nobody their data. When that device comes back it is not resuming a session. It is replaying a queue of writes against a world that moved on without it.
Flow does not trust the queue. Every queued write is validated on replay against the current state, the current state-model version and the operator’s current permissions, exactly as though it had just been made. Writes that carry an expiry — a quotation whose validity has lapsed, a capacity hold that has been released — expire rather than apply, and the expiry is reported rather than quietly dropped.
What comes back is one of nine named classes, never a generic failure: transient network, authentication, permission, validation, illegal transition, expiry, stale capacity, unsupported state-model version, server fault. The classes exist because each maps to a different action. A transient network failure is a retry. A permission rejection is not, and a client that retries it forever is a support incident rather than a resilient client. An unsupported state-model version means the device must update before it may write again, which is a different sentence from “sync failed”.
The operator sees the instruction rather than the class. “This commitment was cancelled by the site on 3 March; your amendment was not applied, and the replacement is here.” Or: “Your promise of 400 units on the 14th was made against capacity that was eleven days old and is no longer free; the next available date is the 19th.” A named rejection somebody can act on at a gate is worth more than any quantity of automatic resolution they cannot see.
Which brings up the part that cannot be engineered away. A commitment made offline against a capacity snapshot is a commitment made against information that may already be wrong, and it can be rejected on reconnect. Flow narrows the window — snapshots carry their age, the age sits next to the number instead of being buried, and the commitment records the age it was created against — and Flow will not pretend the window ever closes. A promise made against eleven-day-old capacity is a provisional promise. Our contribution is that the operator knows it at the moment they make it, so the words they say to the customer are “subject to confirmation” rather than “yes”.
The last piece is duplication, which is dull and has spoiled more offline rollouts than conflict has. A lost acknowledgement means the same write may arrive twice. Every commitment therefore carries an identity generated on the device that created it, and every mutation is idempotent, so a second arrival is recognised rather than written. Teams who discover this after go-live have already put duplicate orders into production, and the clean-up is manual.
The paper version of this works. Somebody signs a docket at a gate, the docket travels in a pocket, and it is filed that evening. The digital version usually demands a network at the exact moment of signature, so field staff do the sensible thing and fall back to paper, and the same information is re-keyed later by somebody who was not there — the practice the whole programme was bought to remove.
The legal ground for doing better is firmer than most vendors admit. An Advanced Electronic Signature under Article 26 of eIDAS must be uniquely linked to the signatory, capable of identifying them, created using signature creation data the signatory can use with a high level of confidence under their sole control, and linked to the signed data such that any later change is detectable. Read that list again: every requirement is about control and linkage. Not one of them is about connectivity. EASA’s 2023 guidelines on electronic documents, records and signatures adopt eIDAS terminology, and a representative involved in drafting them has said an Advanced Electronic Signature should be more than sufficient for an electronic technical logbook.
And yet, in the market survey behind this product, no vendor documentation we could find describes queued offline signature capture with an audit trail built for that argument. The aviation MRO suites advertise paperless execution; the deciding technical detail — what evidence a signature captured with no network carries when it finally arrives — is absent from their public documentation. The same hole exists for HSE sign-offs, chain of custody and inspection attestations across mining, construction and energy. That gap, rather than the act of capturing a signature, is what Flow is built for.
What Flow seals on the device, at the moment of signature and before anything queues: a canonical serialisation of the commitment as it stood and its hash; the signer’s identity as authenticated on that device and the credential used; the device’s identity and enrolment record; the local clock reading; the position, where the deployment collects it; and the signer’s own attestation of what they understood themselves to be signing. These are bound together and sealed before the record joins the outbox, so what eventually syncs is evidence about the moment of signing rather than evidence about the moment of arrival.
On reconnect, Flow measures the device’s clock drift against a trusted source, records it, and applies a timestamp to the already-sealed bundle. We are precise about what that establishes. The timestamp proves when we received the bundle. The local reading and the measured drift are evidence about when it was signed, and they are not proof of it. Anyone telling you an offline device can produce a trusted timestamp is selling you something.
Then the limit that matters most. Whether this package satisfies the Advanced Electronic Signature standard in your jurisdiction depends on the credential your signer holds and on the authority reading it, and we offer no legal conclusion about either. We produce the evidence in the shape an auditor or a regulator asks for, and we document the mechanism completely enough that your counsel can form their own view. IATA names authority approval delay as the highest risk in an electronic-logbook programme, which tells you the conversation happens early and with your regulator — and that what you carry into it should be an artefact rather than a vendor’s assurance.
Evaluations in secure facilities rarely fail on features. They fail in a corridor, on installation day, because the product wants to phone home and there is no home to phone. Software entitlement management overwhelmingly assumes a constant or at least periodic internet connection, which makes it structurally incompatible with an air gap, and the consequence is that an otherwise suitable product simply cannot be installed. Publishers who rely on such systems are capping their own addressable market, mostly without noticing.
Flow activates two ways. Where removable media may cross the boundary, the installation generates a request file, which is carried out, exchanged for a signed response file, and carried back. Where nothing may cross as a file, the exchange is codes: an initialisation code from the portal, an activation code produced by the installation, and a confirmation code verified against an air-gap public key — short enough to be read aloud down a phone and typed in, because in some facilities that is the only channel there is.
Activation is where most vendors stop, and it is the easy half. What costs a customer time is the years afterwards: renewals tracked by hand, a licence file that expired while the only person cleared to carry its replacement was not due on site for another three weeks, and an auditor who wants the entitlement history. Flow keeps a local repository of licence files with their validity windows, warns far enough ahead that somebody can travel, and exports the repository as an audit artefact.
We will also say plainly what happens when a licence does lapse, because the alternative is that you find out. Flow stops accepting new commitments. It does not stop you reading your own commitment history, exporting it, or producing the attestation chain for a record signed while the licence was valid. An unpaid invoice is a commercial problem. A customer locked out of their own evidence is a different kind of problem, and we are not going to create one.
Re-hosting is part of the licence rather than a negotiation. Hardware in these environments is replaced on its own schedule, and the rules for moving a licence to new hardware vary by vendor in ways that are discovered at the worst possible moment. Ours: two self-service re-hosts per licence year by the same file or code exchange, further ones on request, and the request does not route through sales.
The larger point is the combination, which is the actual hole in this market. Air-gapped platform vendors sell servers for people sitting at terminals inside a facility. Offline-mobile vendors sell field clients whose control plane is the vendor’s own cloud, so the app survives losing signal but the system behind it does not survive losing the vendor. A disconnected field client syncing to an air-gapped on-premise backend — what a defence prime, an ITAR-constrained manufacturer or a classified-site contractor actually needs — was not sold as a product by anyone the survey identified. Flow’s control plane runs inside your boundary or it does not run.
A counterweight, since we would rather not sell you something you are about to stop needing. Low-earth-orbit satellite is quietly removing the offline requirement from surface mining and vessel operations: maritime and mining service kits now advertise several hundred megabits with service levels attached, and one provider argues the distinction between offshore and onshore is disappearing. The cases where disconnection is structural rather than incidental are narrower than this category’s marketing suggests — underground, in flight, inside a SCIF, on a capped or pooled data plan, and anywhere bulk transfer waits for an overnight window. If your links are merely unreliable rather than absent, evaluate Flow on its conflict semantics and ignore the offline story entirely.
There is a specific way an offline deployment lies to the people running it. The application counts a local save as a success, the dashboard is green, and records sit stranded on devices in the field. Nothing alerts, because from the telemetry’s point of view nothing went wrong. This is worse than a visible sync failure, which at least gets investigated, and it is why a sync status surface is not a nice-to-have.
Flow counts five separate events and derives no metric that collapses them. A local save means the operator’s work is on the device. A sync success means the server accepted it. A sync failure means it did not, with its class. A conflict means a transition was refused because the world had moved. An offline duration measures how long a device has been away, per device, alongside the age of its oldest unsynced write. The first two are routinely counted as the same thing, and that single error is how a quarter’s records go missing.
Your own support desk sees per-device sync state: outbox depth, oldest unsynced write, cursor position, last successful sync, last rejection and its class. It also has the levers — retry one write, retry the queue, force a full resync, rebuild the local database from the server. This exists because the alternative is documented and expensive. Buyers on Gartner Peer Insights report Field Service sync issues their own teams could not unblock; Salesforce’s own knowledge base names data-hygiene causes that a technician in a plant room can neither see nor fix. A desk that cannot see a device’s sync state is the largest hidden cost in an offline rollout.
Sync defects reproduce only under particular interleavings of edits and connectivity, which is why they are usually debugged by anecdote. Because a commitment’s history is an ordered sequence of transitions rather than a sequence of field writes, a device’s log can be replayed against a scratch instance and the same rejection produced deliberately. That is not a promise never to ship a sync bug. It is the difference between a bug you can reproduce and a bug you can only be told about.
One deliberate omission. Conflict counts are held per commitment and per device, and Flow does not aggregate them into a score against an operator. A conflict is nearly always two people doing their job correctly with different information, and the quickest way to ruin an offline rollout is to give people a reason to work around the thing that counts their conflicts.
Flow is in beta, which is the honest word for a product whose offline path has been exercised hard in testing and not yet by four hundred devices across three countries for a year. Something in that position asking for your trust should hand you the instruments to catch it out. The five counters, the per-device state, the nine rejection classes and the replayable log are how you would discover we were wrong, which is the reason they ship before anybody asks for them.
The top tier is not a bigger licence. The state machine, the nine rejection classes, the sealed signature bundle and the per-device sync surface are identical in every deployment, and not one of them improves because a contract is larger. What changes is the list of things we are obliged to in writing, and that composition is the whole of the difference. Where an obligation belongs to the Harbour platform or to the portfolio rather than to this product, it says so below, because a shared promise sold twice is a shared promise sold once too often, and a reviewer who catches one is entitled to stop reading the rest.
The obligation that is genuinely Flow’s own is reconciliation correctness, and it is Flow’s own because of what this product sits in front of. A survey tool that is wrong has produced a bad chart. A commitment ledger that is wrong has produced a wrong number in your revenue, a truck against a berth that is not held, or a promise a counterparty is entitled to enforce. So the top tier names an engineer in the contract in each of your field regions who owns reconciliation disputes, with a stated turnaround on a disputed replay, and it attaches money to the outcome: no accepted transaction lost and none applied twice, a credit ladder printed in the contract before you sign rather than assessed afterwards by us, and a disputed determination decided by an independent examiner instead of by our support desk. That last clause is the one worth reading twice, because a warranty whose trigger the vendor adjudicates is a warranty the vendor has written itself permission to refuse.
The published shape of this already exists, which is the useful thing about it. AWS sells Countdown Premium at $10,000 per project per month for dedicated engineers with deep expertise reserved around one named event — a launch, a migration, a quarter close. Field operations have that event four times a year and call it a harvest, a shutdown or a storm season. Flow’s top tier is Countdown Premium running permanently instead of around a date, staffed follow-the-sun across the regions your operators actually work in, which is a different cost structure from a project team and is priced as one.
Availability carries two commitments rather than one, because this product has two distinct ways of failing you. Service credits of 25% of the monthly fee for each hour the control plane is unavailable without plan; and 50% of the monthly fee for any month in which replica divergence is recorded after a reconnection, which is the failure this product exists to prevent and therefore the one it should pay for. Both accrue automatically from our own reconciliation, because Redress Compliance reports from its own sample of contract reviews that 60 to 80 per cent of eligible credits go unclaimed — not disputed, simply never filed by anyone whose job it was. Neither is your sole and exclusive remedy, and neither is capped at six months of fees; Cloudflare’s enterprise SLA does both, and it is worth knowing that the second one is the industry’s normal position rather than an outlier. The rate and the absence of a cap are published here; what counts as unplanned and where the hour starts are defined in the contract — a credit whose trigger only we could read would be the old trick in new clothes.
Which invites the obvious question, so we will ask it before you do. A credit is calculated on what you pay us, never on what the failure cost you. The Uptime Institute found 57% of respondents pricing their last major outage above USD 100,000 and one in five above a million; ITIC finds 41% of large enterprises putting an hour of downtime at USD 1–5 million and up. Against numbers of that order, a credit is evidence that we take the clock seriously and it is not a remedy. Anyone selling it to you as the second thing is describing a discount.
The offline acceptance test becomes a contractual duty rather than a sales demonstration: a physically disconnected enclave, a protocol agreed with you beforehand, repetition after every major release, and your right to refuse the release if the final state and the named rejection do not come out identical whichever order the devices reconnect in. The distinction that matters here is who is holding the clipboard. The rig we run this against internally — the standing matrix of break, duration, operation order and client version — is our regression suite, and we do not bill you for it. You would refuse to buy a sync product from a vendor who did not have one, and you would be right to.
Two obligations in this tier are not Flow’s, and both are usually sold as if they were. The air-gapped release train — reproducible offline artefacts, mirrored dependency stores, signed packages, a regression environment with no route out — is a property of the Harbour platform. Registry, Flow and Watch ship from the same train, and it is allocated across the three rather than charged whole against each, which is not a courtesy: charging it twice would be a billing error, and you should treat it as one if you ever see it. What the posture itself is worth in the market is published, if only in one place — Google’s air-gapped Distributed Cloud lists at USD 300,000 a month — and the tier convention around us says the same thing more quietly: Ditto sells Self-Managed and BYOC only in its Enterprise tier, and PowerSync keeps hardened images and advance access to CVE-patched images there too. What sits in Harbour as the default is what the category holds behind its top tier.
Field co-determination is the second, and it belongs to the portfolio rather than to this product. We carry it per jurisdiction as a delivery: the technical annex mapping every configurable setting to a clause a council can actually enforce, the data-flow dossier in the council’s own language, named engineers who attend the sessions rather than a representative of the company, the council’s own §80(3) expert funded to a contractual cap, and for Italy either the prepared RSU/RSA agreement text or the filing with the Ispettorato Nazionale del Lavoro, since Italian law expects an RSU or an RSA to exist, with an INL filing as the fallback route. The failure mode has a published price: a collapsed negotiation goes to an Einigungsstelle that the employer funds entirely under §76a(1) with no statutory ceiling, running to roughly EUR 36,000 to 47,000 an episode; in France skipping CSE consultation is a criminal matter at EUR 37,500 for the legal person with personal liability for the officer who signed; and in Austria §96(1)(3) is a consent no body can substitute, so a council that says no ends the deployment in that country. All of which is real, and none of which happens twice. You employ one set of works councils. They do not reconvene because you bought a second product from us, and a vendor billing this against each product separately is charging you several times for one negotiation. The same correction applies to training your field staff in three languages: Registry and Flow are used by the same people at the same gates, and that is one delivery rather than two.
The commercial structure is itself an obligation here, and it is the one we would defend hardest. Staged acceptance, standalone value at each stage, your right to exit at a stage boundary, and no requirement to commit the whole horizon up front. The reason is a public failure in exactly this category, and it is not ours to hide: PKP Polskie Linie Kolejowe announced an enterprise asset management procurement of 95,077,000 PLN across 7.7 years, received one bid, and cancelled it — “No winner was chosen… Decision of the buyer, because of insufficient funds.” A national infrastructure operator designed the purchase it wanted and then could not pay for it. The contrast is Alliander N.V., the Dutch grid operator, which bought the same category successfully at an estimated EUR 50,000,000 excluding VAT precisely because it was broken up: an implementation partner on three years with twelve annual renewals, software suppliers on six years with nine. Any structure that requires your signature on the whole horizon at once is a structure that has already failed once in public, and we are not going to propose it to you.
And the price fixed for the term: no annual uplift, no CPI index, no true-up when your operator count grows, no supplement per additional jurisdiction or deployment. The risk that your field force doubles while our figure does not move is ours, deliberately, and it is a real one — the metered alternative is visible in public procurement, where successive GSA Fleet telematics calls ran $12.2 million, $16.7 million, $18.4 million and $25.6 million, and the VA’s ServiceNow spend went from $116.2 million across 2020–2023 to $312.6 million across 2023–2026, a factor of 2.69 in a single three-year cycle. A buyer who signed a meter in 2020 was paying nearly three times as much by 2026 for a decision they made once.
Three things are deliberately absent from that list, and their absence is what a procurement reviewer should check first. Supporting previous client versions is not an obligation we bill for: a device disconnected for a fortnight is by definition running an older build, so that is what offline-first means rather than something a larger contract buys. Keeping the replay rig standing is not one either, for the reason given above. Neither is promise reliability — that is what Flow is, not what the top tier adds. If any of the three ever appears as a line on a quotation from us, strike it and tell us you did.
The unit is one field operation, counted in the operators who make commitments with no network. Not devices, not connections, not writes, not gigabytes of sync, not seats for the dispatchers and planners who read what the field produced. The reasoning is direct: a product bought because the field is unpredictable cannot be sold on a meter that makes the invoice unpredictable too. If a storm doubles your crew for six weeks, the thing recording their commitments must not arrive as a second surprise in the same month as the first.
What that commitment gives up is visible in the published rates, and field seats are the most expensive per-head unit in this entire survey. Salesforce Field Service lists Dispatcher and Technician at $175 per user per month in Enterprise Edition, Field Service Plus at $230, Dispatcher and Technician at $330 in Unlimited, and Agentforce 1 Field Service at $650; Agentforce for Field Service adds $125 per user per month on top of a licence you already hold. Microsoft plays quieter at $105 for Dynamics 365 Field Service and $50 for a contractor. Fulcrum, at the small end, is $43 to $55 per user licence a month with a five-user minimum. TrueContext no longer publishes a per-licence rate at all and starts at $400 a month for a whole team. A utility or telco with 20,000 field technicians on the Salesforce Technician list pays $42,000,000 a year, or $54,600,000 with Premier Success at 30% of net licence fees on top, or $25,200,000 on Microsoft’s — a $16.8 million annual gap between two list prices for the same twenty thousand people, which on its own explains why nobody in this category publishes what a deal actually closed at.
We are not going to publish one either, and the reason is not coyness. An individual, a fifty-person contractor and a grid operator running this across twelve countries pay amounts two orders of magnitude apart; a single figure on a web page is a lie at one end of that distribution and an insult at the other. What we publish instead is the unit, the list of things that are never metered, and the threshold below which you should not buy the obligation tier — which is more than the category next door publishes, and it is the part you can check before speaking to anyone here.
Then the number this argument usually reaches for, with the caveat that belongs on it. Five thousand operators standing still for one working day costs $1,978,400 at the Bureau of Labor Statistics’ total employer cost of $49.46 an hour, released in September 2026. Be exact about what that figure is, because almost nobody selling into this category is: it is idle payroll. You pay it whether or not you buy anything, and most of it is unavoidable, so it measures the size of the disruption rather than the loss. The lost output sits on top of it and we cannot compute that for you — it depends on what your crews would have finished that day and what the contract behind it says. A vendor quoting the payroll figure as damage is quoting the easy half, and it is the half that flatters the vendor.
The contractual half is better evidence, and it comes from documents both sides signed. Navigator Holdings’ shipbuilding contract, filed as exhibit 10.1 to a 6-K of 23 August 2024, prices late delivery at US$28,000.00 per day after forty-five grace days, capped at US$5,040,000.00 — exactly 180 chargeable days — with a termination right at 225, and calls it liquidated damages rather than a penalty. Alongside it sit scales for speed deficiency from $150,000 to $1,050,000 and for fuel over-consumption at $125,000 per full percentage point above tolerance. That is the price of one missed date in one contract, agreed by parties dealing at arm’s length, and that last clause is why it leads. The larger and more quotable figure in this area is $80,000 a day, from an LNG sale agreement filed as exhibit 10.46, and we put it second on purpose: the parties there are affiliated — Corpus Christi Liquefaction selling to Cheniere Marketing International — so the rate is intra-group, and any reviewer who opens the exhibit will see that inside a minute. Better that you hear it from the page than find it. For a US federal buyer the cleanest form of the same idea is FAR 52.211-11, where the daily rate is simply a blank the contracting officer fills in, assessed in place of actual damages and in addition to the excess cost of buying the work elsewhere.
What we were unable to establish belongs here too. There is no published industry rate for demurrage as a category: Drewry and Container xChange would not release data, and carriers do not disclose it as a line — Pangaea books it as variable consideration under ASC 606 with no figure attached, and Genco mentions it only inside insurance cover. So the argument rests on two contract rates and a regulation, not on a market average, and we would rather you knew the shape of the evidence than be handed an average with nothing under it.
The last thing to say is the one that sits least comfortably beside a tier of this size, and it is the beta status set out further up this page. A product whose offline path has not yet been exercised by a real fleet for a real year has no business asking a grid operator to commit a multi-year horizon in one signature, and we are not going to ask you to. That is the honest reason staged acceptance is in the contract rather than in a sales deck: it is not generosity, it is the structure this product is currently entitled to. Start with one region and one state model, take the export to your auditor, run the reconnection test yourself in either order, and decide at the stage boundary. If it does not hold, you leave with your commitment history, your state model and your attestation chain, and you owe us nothing further.
An agent that can see what a commitment is allowed to become next, and why the last attempt was refused, can do something useful about it. An agent that can only read fields will cheerfully offer to change a date that cannot be changed. Flow exposes the state machine, not just the record.
Server
hlebourg-flow
| Tool | Effect | What it does |
|---|---|---|
| flow.list_commitments | read | Commitments matching a filter — counterparty, state, date window, site. Each carries the transitions the calling operator may legally make, so you never have to infer what is permitted. |
| flow.get_commitment | read | One commitment in full: current state, transition history with actor and time, attached attestations, and the capacity snapshot it was created against. |
| flow.check_capacity | read | Free capacity for a site and date window, with the age of the snapshot it was computed from. A stale snapshot is grounds for saying "subject to confirmation", not grounds for saying yes. |
| flow.explain_rejection | read | Why a write was refused: the class, the transition attempted, the state that blocked it, and the action expected next. Call this before proposing a retry, because most classes must not be retried. |
| flow.create_commitment | write | Create a commitment in its initial state with a client-generated identity. Idempotent: calling twice with the same identity yields one commitment, not two. |
| flow.amend_commitment | write | Propose a change to quantity, date or delivery point as a declared transition. Fails with a named class when the commitment is not in a state that admits the amendment. |
| flow.record_signature | write | Attach a captured signature and its sealed context to a commitment. This records evidence; it does not assert that the signature meets any particular legal standard. |
| flow.confirm_commitment | act | Move a commitment to confirmed — the transition with external consequence, after which the counterparty is notified and the date is the one you are held to. Logged with the calling operator attached. |
Claims a buyer cannot test are worth nothing. Each of these is verifiable during an evaluation, without our involvement.
This section is written before the rest of the page, not after. If one of these limits is a dealbreaker, better to find out now.
Flow is not an ERP. It does not price, it does not invoice, and it does not post to a ledger. It tracks what was promised and what happened to that promise, and hands the rest to the system that already owns it.
A commitment created offline against a stale capacity snapshot can still be rejected on reconnect. No amount of engineering removes this; it only surfaces it earlier, which is what we do.
The legal weight of a captured signature depends on your jurisdiction and on the credential your signer holds. We supply the evidence and document the mechanism. We do not supply the conclusion, and you should be wary of anyone who does.
Flow will not auto-resolve a rejected replay by overwriting the server's state. There is no flag for it and there will not be one: a queue that wins arguments with the server is the failure mode this product exists to prevent.
Flow does not forecast demand. Promise reliability describes what your counterparties have already done; it is not a prediction, and treating it as one is a misuse we would rather name here than discover later.