Harbour Watch

The obligation nobody owns

Ask an operations director how a filing was missed and the answer is rarely that nobody knew. Somebody knew. They knew in March, they had it in a calendar, and in June they moved to a different company. The obligation stayed where it was, still carrying their name, still counting down, and the next person to look at it was on the other side of a conversation nobody wanted to have.

A register is an org chart frozen on the day somebody wrote it down. It says “Head of Quality” and the role has been vacant for six weeks. It says a name and the mailbox now auto-forwards to a team address that three people ignore because none of them believes it is theirs. The obligation is not lost — it is visible, dated, and sitting in a system that is technically working.

Watch treats this as the primary output rather than a side effect. An obligation is an orphan when its owner has left the directory, when their role has changed such that the obligation now sits outside it, when the owning team no longer exists, or when a transfer was initiated and never accepted. Each of those is a different sentence in the record, because the remedies are different.

The count is standing, on the front page, next to the count of what is due. This is a deliberate choice against the usual design, in which orphan detection is a report. Reports get run by people who are already worried. The number that matters is the one in front of somebody who is not.

Ownership transfers as an explicit act. Somebody makes the transfer, somebody accepts it, and both halves are recorded with a time and a reason. Until the recipient accepts, the obligation remains an orphan and keeps counting in the headline figure. This is more friction than inheriting ownership from a team in an identity provider, and the friction is the point: an org chart that changed at the weekend has not agreed to anything.

The second number worth watching is notice lead time achieved against policy. Your policy says ninety days’ notice before a certificate lapses. The register says the renewal was filed in time and the deadline was met. The lead time says notice went out on day eleven, and has been going out later every cycle for the past year. Nothing has been missed yet. Everything about that trend says something will be, and it says it weeks in advance, which is the only useful property a compliance number can have.

Escalating with no network

An escalation ladder that lives on a server is a ladder that works wherever the server is reachable. For most offices, most of the time, that is everywhere. The exceptions are not evenly distributed: they cluster precisely where the obligations are heaviest, which is to say underground, in flight, inside a secure facility, on a pooled data plan somebody is rationing, or at a site where a member of staff walks to signal roughly every ten days.

That surface is shrinking, and we would rather say so than let you discover it. Starlink Maritime and the mining Performance Kits now run past 400 Mbps, and they are quietly removing the offline requirement from surface mining and vessel operations. A product whose entire pitch is “works without signal” is selling into a market that satellite is eroding from the top. What remains is genuinely hard and is not eroding: satellite does not reach into tunnels, aircraft cabins and secure facilities are not getting easier, and a capped plan is a budget decision rather than a coverage one.

So escalation rules evaluate on the device, against the local clock. When a rule fires, the escalation record is written locally with the local firing time. The notification queues. When the device reconnects, the record syncs and delivery is attempted, and the delivery time is written as a separate field. Two timestamps, never collapsed into one.

The two-timestamp rule is the part that survives contact with an auditor. When did you know is answered by the firing time. When was the responsible person told is answered by the delivery time. A system that stores one date implicitly claims a person was notified on a day when they demonstrably could not have been, and that is a worse position to be in than a documented gap.

Clocks on devices are wrong sometimes, and we cannot stop a device with a bad clock firing at the wrong moment. What we can do is refuse to hide it. Watch records the clock reading at firing, the skew measured against the server at the last successful sync, and flags any escalation that fired outside a tolerance you set. An escalation carrying six hours of measured skew is marked as such in the record rather than quietly trusted.

Underneath all of this is the failure mode that ruins offline products: counting a local save as a server success. Local firing, sync success, sync failure, conflict, and time spent offline are five separate events in Watch, and they are reported separately. A dashboard showing green while records are stranded on a tablet in somebody’s van is worse than no dashboard, because it converts an operational problem into a surprise.

The other thing we say out loud is the retention window. A device holds a bounded amount, so there is a length of time it can stay disconnected before the oldest unsynced record is at risk. That number belongs in user-facing documentation rather than in a support ticket written after somebody lost a day of capture. Watch warns from well before the boundary, escalates the warning as headroom falls, and treats quota exhaustion as a visible failure. Failing loudly and early beats failing at the end of a long capture session, which is exactly when it costs the most.

Recurrence that does not drift

Consider a quarterly inspection discharged eleven days late. The next one is scheduled twelve weeks from the day it was completed, which is the obvious implementation and feels generous to the person who was late. Do that for three years and you have drifted a hundred and thirty-two days: twelve inspections performed where the interval required thirteen, with nobody having made a decision to skip one.

Watch computes from the schedule. An obligation due on the first working day of each quarter is due then, whether the last one was discharged on time, late, or at all. Lateness is recorded as drift — signed days between the scheduled date and the discharge date, kept per occurrence and as a series statistic — and it never flows back into the schedule.

If the series genuinely needs to move, that is an amendment. The regulator granted an extension, the vessel was in dry dock, the site was closed. An amendment has an actor, a time, a reason, and both the old and the new schedule remain in the record. The distinction being drawn is not between rigid and flexible; it is between a change somebody made and a change that happened.

Some intervals are genuinely anchored to the event rather than the calendar: the certificate says twelve months from the date of the last inspection, and that is what it means. Watch supports both anchors. What it insists on is that you declare which one applies when the obligation is loaded, and the anchor stays visible on the obligation from then on. Event-anchored recurrence is not a bug. Event-anchored recurrence that somebody assumed was calendar-anchored is the bug, and it is invisible until the year it matters.

Discharges captured offline arrive late and sometimes arrive twice, because a lost acknowledgement means the same write may be replayed. Every discharge carries a client-generated identity, so the second arrival is recognised as the same event rather than written as a second inspection. Discharges are also validated on replay against the schedule as it stood when they were captured: a discharge arriving after an amendment is checked against the world it was made in, and flagged where the two disagree rather than silently applied to whatever the register looks like now.

This is also where we decline a piece of fashionable infrastructure. Conflict-free replicated data types guarantee convergence, not correctness — the standard illustration is a card moved to two different columns concurrently and ending up in both. The obligation equivalent is being discharged on one device and reassigned on another, and a merge that keeps both is consistent and wrong. Watch does not merge state-machine transitions. The server is authoritative for an obligation’s state and is allowed to reject a transition rather than reconcile it into something nobody intended.

What a snooze costs

Snooze is the most used control in any reminder system and the least examined. It feels like a courtesy: the notice arrived at a bad moment, the work is in hand, the person will deal with it on Thursday. Almost always that is exactly what happens. The failure is not one snooze, and it never looks like a decision to ignore anything. It is a deferral repeated forty-seven times until the obligation has effectively been deleted by a series of reasonable people.

Watch applies three rules. Every snooze is an event with an actor, a duration and a reason. Every snooze draws against a budget, expressed in days and set per obligation class. When the budget is spent, the next request is refused: the notice returns and the escalation ladder proceeds from where it was.

The refusal is the feature. You set the cap and you can set it small. What you cannot do is set it to infinity, or to a number so large it amounts to the same thing. We have had this argument in early conversations and expect to have it again, and the answer does not change, because a cap that yields to the person with the most pressing reason is not a cap.

Snooze and lead time are the same story told twice. Deferral converts warning into nothing: the deadline is still met, the register still shows green, and the ninety days of notice your policy asked for have quietly become nine. Lead time achieved against policy is where a snooze habit becomes visible while it is still a habit rather than an incident.

Snoozes attach to a person, and the useful reading is almost never the disciplinary one. An owner who snoozes the same class of obligation every cycle is reporting something: it is wrongly owned, or scheduled against a period when that team is always busy, or written so vaguely that nobody can tell what discharging it would involve. Aggregate snooze by class, not by name, and you have the cheapest register-quality signal in the product.

Three things a snooze is not. It is not a discharge, and it does not create evidence of one. It does not alter the schedule or the next occurrence. And it cannot be applied to an orphan, because an obligation with no owner has nobody with standing to defer it — the correct action there is to give it an owner.

The honest state of this product

Watch is the least mature of the nine products on this site. Design partner is not a pricing tier here, it is a description: we have no customers, no reference deployments and no case studies, and nothing on this page should be read as implying otherwise.

What works today is the core of the argument above. Register load against a documented schema. Ownership, transfer and acceptance. Orphan detection against a directory feed. Calendar-anchored and event-anchored recurrence with explicit drift. Capped, attributed snooze. Local escalation evaluation with separate firing and delivery times and recorded clock skew. Discharge capture with client-generated identities and validation on replay. The MCP server, with every tool listed above.

What is not finished, in the order we would want to be told. The retention window is measured per deployment rather than published as a single figure: we can tell you what it is for your device class and your record volume after a fortnight of measurement on your own fleet, but we cannot print a number here that would be true both for a rugged tablet capturing photographs and for a phone carrying text, and we would rather leave the space empty than fill it with the wrong one.

Notification delivery outside Watch — your paging tool, your SMS gateway, your internal mail relay — is built for a small set of targets and configured with each partner rather than self-served. Air-gapped delivery through internal mail works. Anything exotic is a conversation rather than a setting.

Recurrence handles calendar and event anchors, working-day calendars and per-site holidays, and windows that open before an anniversary and close after it. Conditional obligations, where the trigger is another obligation’s discharge, are not built. They are on the list, and they are the most requested thing we do not have.

Schema migration across a device fleet is unsolved, by us and by everyone else in this category. We write migrations, we test them against the device classes a partner actually has rather than the ones we own, and we give notice. We do not yet have the deterministic replay harness that would let us reproduce a partner’s sync bug from their event log, which means some debugging will be done by anecdote until we do.

There is no third-party audit, no SOC 2 report and no penetration test result to hand you. Self-hosted deployment narrows the question considerably, because the data does not leave your estate. It does not remove it, and we are not going to describe an absence as an architectural decision.

Finally, the things we are not going to build to make the demonstration better: a model that reads contracts and produces obligations, a statutory deadline feed, and ownership inferred from an org chart. Each of the three would make the first fifteen minutes considerably more impressive and cost you the property you were buying.

What a design partner is signing up for

What a partner gets. The rate you sign at, held for two years past the point this product reaches general availability. Direct access to the people writing it, which is a phone number rather than a support tier. The register schema and the escalation ladder designed against your obligations rather than a generic template, with the general product shaped by what your case turns out to need. Migrations written and tested against your device fleet before they ship to you. And export of everything, documented in both directions, available from the first day rather than negotiated on the way out.

What a partner gives. A real register to load, including the parts that are embarrassing — the obligations with no owner, the ones whose text nobody can interpret, the spreadsheet with the merged cells. Access to somebody who can say what an obligation actually means when the wording is ambiguous, because we cannot answer that and guessing would poison the data. A device fleet we can test against, including the oldest and slowest thing you still have in service. And tolerance for a data model that will change underneath you, with migrations and notice, but change.

We also ask for the feedback we cannot generate ourselves: tell us when a notice fired at the wrong time, and tell us how you found out. If you learned it from a regulator, an inspector or a counterparty rather than from us, that is the single most valuable thing you can send, and it is the thing nobody volunteers.

This is the wrong product for some buyers, and it is cheaper for both of us to establish that now. If you need a supported product with a service level this quarter, if your obligations must arrive as a maintained statutory feed, or if your buying process cannot start without a SOC 2 report, Watch is not ready for you. Ask again when the status on this page changes. We would rather lose a design partner than acquire one who needed a finished product.

A realistic first quarter looks like this. Weeks one and two: load the register, connect the directory, escalate nothing. Weeks three and four: read the orphan count, which is usually the first genuinely uncomfortable number, and decide who owns what before any notice goes anywhere. Weeks five to eight: escalation on at one site, chosen for being the worst-connected one you have, because a ladder tested only in the office has not been tested. Month three: the first recurrence cycle completes, drift becomes measurable, and the lead-time figure starts to mean something. Nothing before that point is evidence, and we will not present it as such.

What the largest deployments oblige us to

The top tier is not a bigger licence. The register, the orphan count, the escalation ladder and the two-timestamp record are identical in every deployment, and not one of them improves because a contract is larger. What changes is the list of things we are obliged to in writing — and one verdict about this product that we will state before a reviewer does, because a reviewer will find it: on the composition of obligations alone, Watch lands about a tenth short of the floor of the band the other eight products in this portfolio are held to. We are saying so on the product’s own page rather than padding the list with obligations that belong to other products, because the gap is not ours to manufacture and the reviewer who caught the padding would be right.

What closes the gap is not another promise from us. It is the buyer’s own penalty denominator, and it is real money with a statutory basis rather than vendor rhetoric. NERC CIP assesses up to $1,000,000 per violation per day, so two violations outstanding for two days cost more than a full year of this tier — one penalty episode, at the low end of the regime’s own scale, prices the tier at a fraction of itself. NIS2 regimes, Germany’s §38 BSIG among them, attach personal liability to the officers who signed, and the record this product keeps — who knew, when the notice fired, when delivery happened, how much measured skew the clock carried — is what that officer’s answer is made of; several of its components cannot be insured away at all. The Cyber Resilience Act fines the seller, not you — EUR 15,000,000 or 2.5% of turnover, from December 2027 — so read it as our denominator, not yours. Counterparties write cure periods with daily rates of their own choosing. Read honestly, the obligation tier is priced against a small fraction of one penalty episode under any of these regimes — and a buyer who has no denominator at all should buy the ordinary deployment, which is the same product and does not pretend otherwise.

One correction to our own earlier arithmetic, volunteered because a procurement reviewer would catch it: every proportionality figure in an earlier draft of this analysis was computed against the top of the band rather than against the composition this tier actually carries, which roughly doubles each of them. Corrected, the figures halve — and the argument survives the halving, which is the only reason to keep it.

What the tier does obligate in writing is Watch’s own before it is anyone else’s. Escalation fidelity becomes a contractual duty rather than a demonstration: firing time and delivery time recorded as separate facts, clock skew carried in the record, and an escalation whose delivery gap goes unrecorded treated as a credit event rather than an apology. Recurrence correctness is warranted: the schedule moves only by amendment, never by lateness, and a cycle that silently skips an occurrence is a credit event. And orphan surfacing gets a stated window — a leaver event in your directory must turn the affected obligations into orphans inside it, not at the next audit, because an owner who left on Friday and an orphan that appears at the next audit are separated by exactly the gap this product is bought to close. What triggers a credit is published here; what counts as an unrecorded delivery gap and what counts as a skipped occurrence are defined in the contract — a credit whose trigger only we could read would be the old trick in new clothes.

The rest of the tier is shared, and it is labelled as shared. The air-gapped release train is a property of the Harbour platform: Registry, Flow and Watch ship from the same train, and what the posture is worth in the market is published in one place — Google’s air-gapped Distributed Cloud at USD 300,000 a month — while the tier convention around us holds self-managed deployment behind Enterprise tiers. Field co-determination is a portfolio property, with one caveat that belongs to this product more than to any other: Watch tracks accountability by named person, which makes it the cleanest German §87(1)(6) case in this portfolio, and in Austria §96(1)(3) is a consent no arbitration body can substitute — a council that says no ends the deployment in that country. One set of works councils, one duty rota, one escrow deposit, one regulatory feed; none of them charged whole against this product, and a quotation that does otherwise is a billing error you should treat as one.

How it is priced, and why

The unit is one register under management — the whole obligation estate of one organisation, at whatever size and whatever date it is loaded. Not owners, not obligations, not notices. Watch used to be quoted per owner, at a rate per named person accountable for at least one live obligation, and the model was retired for a reason we would rather hand to you than have a reviewer hand to us: under a per-owner rate, the register’s own headline number becomes a revenue line. Every orphan the product finds, every owner who leaves without a transfer, every transfer refused is a seat that stops paying — so the honest incentive flips, and a register becomes something to tidy for the invoice rather than to tell the truth about. The product whose entire value is finding what nobody owns cannot bill by what somebody owns.

The per-obligation alternative fails the same way from the other end. The register is loaded by you, from your own contracts and certificates, and a meter on what you load pays the buyer to under-load — and an under-loaded register is the exact failure this product exists to make visible. A meter on escalations and notices would price the outputs, so the month your escalation ladder saves a filing is the month the invoice is largest, which is the same perverse arithmetic as billing the long resync on the day a fortnight of offline work comes home.

What the unit gives up is visible. A three-hundred-obligation estate and a forty-thousand-obligation estate pay one unit each, and the failure this product prevents is not proportional to headcount or to register size — it is proportional to the cost of the deadline that gets missed, which is a property of your regime and not of your volume. That is also why the qualification gate above is written about your penalties rather than our pricing: it is the one test a buyer can run without us, and it is the one that decides whether the tier’s composition is weight worth carrying or a premium on a corrective action.

We do not publish a number, for the same reason as the rest of this portfolio and with none of the usual embarrassment: an organisation with a live penalty denominator and one without it pay amounts an order of magnitude apart for the same software, and a single figure on a page cannot be honest about both. What is published instead is the unit, the list of what is never metered, the gate, and the verdict stated above — including the part that is awkward for us. That is the whole of the position, and it is the part you can check before speaking to anyone here.