Overrides: how reality pokes a running contract

The problem in one sentence

Real contracts contain their own escape hatches, written down: force majeure clauses, waiver boilerplate, variation orders, emergency-access provisions, court-order compliance. A mechanical contract that cannot transcribe those clauses fails the fidelity test the translation layer exists to run - the machine would be more rigid than the paper it replaced, and the paper would win.

The axiom: an override is an event, never an edit

Determinism is sacred: replay reproduces state bit-for-bit. Nothing may touch state except signed events in the log. That single constraint kills every naive design - the admin panel, the platform “pause button”, the hotfix to a signed document - and forces the only shape that survives:

Every override is a signed event, through a declared port, with declared effects, producing a receipt.

The machine is never bypassed. It judges the paperwork about the exception exactly the way it judges invoices. The machine does not judge the storm; it judges the force-majeure notice - who sent it, when, citing what, with what declared consequences. Whether the storm qualifies as force majeure is a soft term: hashed, legally operative, prose governs, and no machine pretends to evaluate “a circumstance beyond the party’s control.”

Corollary, from “everything declared”: absent override port = no mechanical override. A contract that declares no force-majeure port still carries the soft term; the parties handle it the old way (negotiate, escalate, amend) while the machine keeps judging. That is a legitimate authoring choice - but see the transcription discipline below for when it is an under-transcription finding instead.

Delivery: as standard-library modules, not rewritten per contract

Nobody wants to re-draft a force-majeure clause into every contract. So the mechanisms in this RFC are meant to ship as standard-library modules - std/se/force-majeure, std/se/hardship, std/se/waiver - a soft-term spine plus a minimal executable mechanism only where there is a real state transition. A contract writes use std/se/force-majeure and pins the module’s hash; the module in turn cites the relevant statute rather than restating it. Settled, well-understood law is transcribed once and reused, not reinvented in each agreement.

Already in the machine

The worked corpus forced most of this before it was named:

Mechanism	What it already gives us
active / suspended in the finite control	suspension is a control state, entered and exited by events
Escalation as throw / catch / finally	the universal unanticipated-case handler: throw, suspend, humans, amendment
Faults (a failure of the machinery, attributed)	machinery failure is not an override; no judgment on the merits happened
Transforms	the amendment mechanism: a signed delta, never a hotfix
Soft terms, hashed	force majeure already lives in the annex as prose that binds the parties, not the machine
Emergency access (break-glass)	a worked override: escalate, widen scope for a fixed window, mandatory review, notify the affected party
An authority’s order	a worked external-authority event: a declared authority key, a declared effect

Two of the five families below already exist as worked contract text. This document names the pattern, generalizes it, and gives the other three their transcriptions.

The five override families

“Override” is five distinct mechanics. Conflating them is where designs go wrong.

#	Family	Prose home	Invoked by	Mechanical consequence
1	Suspend & toll	force majeure, hardship	one party, by notice	obligations suspend, deadlines toll
2	Waive	waiver boilerplate	the claim-holder	a recorded claim is extinguished; the breach stays
3	Judgment override	“pay anyway”, break-glass	declared roles	a receipt’s outcome is deviated from, chained to it
4	Amend	variation clause	the parties	the rules themselves change (a signed transform)
5	External authority	court order, agency decision	a declared authority key	whatever the contract declared for that key class

Amendment is also the terminal state of every other family: overrides handle the instance; a recurring override is the signal that the rules are wrong, and the structural nudge toward a transform is built into each family below.

1. Suspend & toll - the force majeure family

A real force majeure clause has four parts, and only one of them is unjudgeable:

1. the exemption predicate - “a circumstance beyond the party’s control that the party could not reasonably have foreseen” - a soft term, forever;
2. the notice duty - “shall notify the counterparty in writing without undue delay, and no later than 10 days after the impediment arose” - an event with a deadline, fully mechanical;
3. the consequences - affected obligations suspend without penalty, for the duration - declared effects, fully mechanical;
4. the duration threshold - “if the impediment lasts longer than 90 days, either party may terminate” - an event-time predicate, fully mechanical.

Most of the clause’s operative content mechanizes without the machine ever evaluating “unforeseeable.” The transcription:

annex:
  §14 force-majeure    tier soft    category force-majeure
       # verbatim prose, hashed; the PREDICATE lives here and only here
       implemented-by: fm.invoke, fm.clear, fm.dispute, level fm-active

ports:
  in  fm.invoke   from either-party  payload signed-notice   # cites §14 + hindrance start
  in  fm.clear    from invoker       payload signed-notice   # hindrance over
  in  fm.dispute  from counterparty  payload signed-notice   # legitimacy contested -> ladder

cadence:
  due fm.invoke within 10 days of payload.hindrance-start    # the notice bar; invoked later
                                                             # -> toll runs from NOTICE, not
                                                             # from the hindrance itself
rule on fm.invoke:
  toll obligations delivery.* while fm-active                # DECLARED scope: delivery tolls,
                                                             # confidentiality never tolls, payment
                                                             # for already-delivered never tolls
  escalate level fm-active
  accept                                                     # accept = notice RECEIVED,
                                                             # never legitimacy JUDGED

escalation:
  level fm-active:
    notify counterparty
    due fm.reaffirm or fm.clear every 30 days                # keep-alive: silence lapses the toll
    when fm-active > 90 days -> open termination path per prose §17
  finally:
    confidentiality per §16                                  # survival obligations, untouched

Three design points carry the weight:

• Which obligations toll is declared, not implied. Real force majeure disputes are mostly about scope (“does your payment obligation pause because MY factory flooded?” - no). The declaration forces that negotiation to signing time, where it belongs.
• accept on fm.invoke means “notice received”, never “claim validated.” The counterparty’s dispute path and the escalation ladder carry the legitimacy fight; the higher levels hand it to humans and courts.
• toll is a proposed new effect verb: stretch the due-windows of the named obligations by the suspension duration, computed purely from the log. Not derivable per-contract without inviting drift - see the creaks below.

2. Waive - extinguish the claim, never the breach

The machine recorded a breach (a due-window passed; a late-payment claim became claimable). The claim-holder chooses not to enforce. Accounting solved the semantics a century ago: no erasure, only reversal entries.

ports:
  in  claim.waive  from claim-holder  payload signed-decision

rule on claim.waive:
  if payload.overrides is not a breach receipt of this contract -> reject "nothing to waive"
  extinguish claim payload.overrides       # the breach stays in the log forever; the claim dies
  accept

alerts:
  when count(claim.waive, same clause) >= 3 within 12 months
    -> escalate level amendment-talk       # habitual waiver = the contract is wrong; sign a transform

• The waiver event must reference the breach receipt’s hash - you waive a specific recorded thing, not a category.
• Per-claim by default means the classic boilerplate “no waiver of any breach shall constitute a waiver of any subsequent breach” falls out of the grammar instead of being litigated. And the course-of-dealing risk - repeated waivers modifying a contract by conduct - becomes countable: the alert above is that legal doctrine, turned into an event-count predicate.
• extinguish is a proposed effect verb: it touches the claim view, not history - claims equal the breach receipts folded together, minus the extinguishing events.

3. Judgment override - pay-anyway and break-glass

The hard one. The machine says REJECT; the humans know the machine is right about the contract but the contract is wrong about reality - delivery happened, the patient is dying, pay it or open it anyway. The clean shape:

• the override event must carry the hash of the receipt it overrides. The rejection stays true forever; the deviation is visible, attributed, chained;
• every use auto-escalates - an override is a summons, not a convenience;
• the port carries a declared control posture, and there are exactly two, because there are two kinds of emergency.

Ex-ante controls (commercial: nothing is on fire, the cost of waiting is money):

ports:
  in  judgment.override  from buyer.attest-2 and supplier  payload signed-decision
                                            # dual-sign: BOTH parties own the deviation
cadence:
  at-most 2 judgment.override per 12 months # a fire extinguisher, not a door

rule on judgment.override:
  if payload.overrides is not a REJECTED receipt of this contract -> reject "nothing to override"
  if payload.amount > 100_000 SEK                                 -> reject "above override ceiling"
  disburse payload.amount from cap          # money moves ON the override event, chained to the rejection
  escalate level override-review            # every use summons the humans
  accept

Ex-post controls (emergency: something IS on fire, and you cannot rate-limit a life-threatening situation). The controls invert: invoking is deliberately easy; the accountability is mandatory, dated, and receipted afterward. This is the break-glass access in the patient-journal example, verbatim - it was this family all along:

rule on emergency.open:                     # break-glass: lift the block
  escalate level nod
  accept

escalation:
  level nod:
    widen journal.read scope all-units for 24h                  # declared disclosure widening
    due review by care-provider.lead within 5 working-days      # mandatory after-the-fact review
    notify patient                                              # the affected party always learns

The posture choice is itself a declared term: a port with neither posture does not lint. And note what both postures share - the override never makes the machine wrong. It makes the deviation legible. Override frequency, who overrides, what gets waived: that receipt sub-chain is precisely the drift signal an auditor wants. The concept stays clean; the receipts just happen to be readable.

4. Amend - already solved, but it is where overrides go to die

Nothing new: the transform mechanism is the amendment mechanism (a signed delta, guarded by the from-hash, adhered to per instance). The contribution here is only the routing: families 1-3 each contain a structural nudge (repeat-count alerts, mandatory reviews, auto-escalation) whose catch level is an amendment conversation. Overrides are pre-negotiated fast paths for anticipated exceptions; the unanticipated ones take the universal road that was always there: throw, suspend, humans negotiate, transform. The contract has no backdoor - it has override clauses, like every paper contract, plus one escape hatch that ends in signatures.

5. External authority - the court order as a signed fact

A court or agency is not a party, but its decisions poke contracts. The patient-journal example already did this (a destruction order from the supervisory authority - the only deletion path). Generalized: an authority is a genesis-declared binding - a key class plus the declared effects of events signed by it - exactly the pattern used for external facts: they are signed inputs, never live lookups.

parties:
  court:  authority  sign eIDAS-seal  role external-authority

ports:
  in  order.freeze  from court  payload signed-decision       # an interim injunction

rule on order.freeze:
  suspend ports disburse.*  until order.lift
  accept

The contract never obeys the court; it obeys its own declared rule about that key class. A court order arriving at a contract with no authority binding still binds the parties legally - they comply via amendment or termination - it just has no direct lever on the machine. Profiles decide which authorities are mandatory bindings (a health profile mandates the health regulator; a public-sector profile plausibly mandates the administrative court for review).

The transcription discipline

The translation layer gives prose three tiers: executable, soft, comment - and it is tempting to file force majeure under soft, whole. At clause granularity that is wrong, and the anatomy above shows why: exception clauses tier-split. Every exception clause decomposes four ways:

Component	Example	Transcribes to
the unjudgeable predicate	“beyond the party’s control”, “reasonable”	a soft term, hashed, prose governs - forever
the procedure	notice within 10 days, written, addressed to whom	ports + cadence
the consequences	obligations suspend, claims extinguish, access widens	declared effects (toll, extinguish, widen, suspend)
the accountability	review within 5 days, notify the counterparty	escalation levels + notify

The slogan: transcribe the procedure, not the storm.

The proposed fidelity rule: an exception clause transcribed as only a soft term is an under-transcription finding whenever the clause contains a date, a notice duty, or a stated consequence. The translator must either tier-split it or document why not. The reverse is also a finding: encoding the predicate itself as a guard is over-transcription - the machine pretending to judge “reasonable.”

Prior art

• NEC4 compensation events - construction’s closed, enumerated list of “reality intervened” categories, each with a notice bar (the famous 8-week guillotine) and a quotation procedure. A declared override taxonomy with cadence, in successful industrial use for decades. The closest single precedent for the force-majeure shape.
• CISG art. 79 - article 79(4) is the transcription argument in statute form: the party who fails to give notice within a reasonable time is liable for the damages resulting from the non-receipt - a mechanical consequence hanging off a missed event deadline.
• ISDA disruption events and fallback waterfalls - pre-agreed, enumerated responses to market breakdown, including the 2013 force-majeure termination event. The derivatives world does not improvise exceptions; it declares them.
• Break-glass access (healthcare, ops) - deliberately easy to invoke, always logged, alarmed, and reviewed after. The ex-post posture, verbatim.
• Accounting reversal entries - never erase, only reverse. The waiver semantics.
• Waiver-by-conduct doctrine - why waivers must be per-claim and countable: repeated non-enforcement can rewrite a contract in court. The alert turns the doctrine into an event-count predicate.

Honest creaks

1. A powerful override port is a governance hole wearing a receipt. If one role can override anything, the properties hold technically while the contract lies socially. The mitigations are structural (cadence, dual-sign thresholds, mandatory postures, auto-escalation) and they are good - but the standard must say plainly what it delivers: deviation made visible, not impossible.
2. Tolling needs first-class rigor. “Due-windows stretch by suspension duration” must be a pure function of the log, and it interacts with cadence buckets, expectation-ladder deadlines, working-day calendars, and heartbeats. Overlapping tolls, tolls spanning calendar boundaries, a toll on an obligation already breached - each needs a defined answer. This is a section’s worth of semantics, not a footnote.
3. The soft boundary will be gamed. Drafters will try to make the machine judge “material delay” by encoding thresholds that quietly claim to BE the legal test. The linter can warn when a guard sits adjacent to a soft term of the same clause; it cannot stop determined misuse. Prose governs on conflict is the backstop.
4. Ex-post review can be reviewed by the abuser. The break-glass reviewer may sit in the same organization as the invoker. A breached review obligation must itself escalate outward to a supervisory scope - the machinery supports it; profiles must mandate it, or the posture is theater.

Open questions for comment

These resolve against the standard’s compose, don’t extend principle: the default is to name a composition of the core verb set; a genuinely new core verb needs the rare gate. So the verb questions below start from “can this be composed?”, not “is it core?”

• Can toll be composed from the core verbs, or does it genuinely need to be a core primitive? (The due-window arithmetic is pervasive and subtle, which argues for core - but compose, don’t extend says attempt the composition first, and gate a new primitive only if it truly resists.)
• Is an override port a new port kind, or an ordinary input port plus a linted convention (payload must carry the overridden receipt hash; the port must declare a control posture; every accepting rule must escalate)?
• What does extinguish touch, given claims are derived views? (Leaning: nothing stored - claims are the breach receipts folded, minus the extinguishing events.)
• Does the translation layer adopt the exception-clause tier-split as a fidelity rule?