Master

Shipping a system that can be stopped

The end state of a live system is not that it trades. It is that it can be stopped, and that stopping it is a decision someone made with a number. Everything else in this subject exists to make that state reachable.

What you will see

One line with both numbers and a date. That line is the whole record of the decision.

About 1 min of reading

Try It

Enforce a ceiling and prove the stop

1

Write the ceiling in the executor

printf 'max_portfolio_risk 120\n' > /tmp/ceiling.txt; cat /tmp/ceiling.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints
One line. The ceiling lives where the action happens, not in a note.
2

Attempt a book that breaches it

printf 'risk 150\n' | awk '{print ($1>120) ? "stop" : "trade"}'

Before you run it, say out loud what it will print. Then open the answer.

What it prints
stop. The stop came from the number, not from a person reading a note.
3

Name the cause of the stop

printf 'stop reason=portfolio-risk 150 over 120 date=2026-10-10\n' >> /tmp/stops.txt; tail -1 /tmp/stops.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints
One line with both numbers and a date. That line is the whole record of the decision.

Data Flow

A live system to a stoppable state
1 The ceiling is written in the executor
↓
2 The suite runs on every deploy
↓
3 Scores and open cases are stored
↓
4 A breach stops the system and names the cause
Why this works
Why the stop is enforced by the executor

The executor is the only component that acts. A ceiling enforced anywhere else is a request, and requests are not obeyed by bugs.

The honest end state of this subject

A system that refuses more than it trades. That is the state where a claim is a number, and it is the state most systems never reach.

Examples

The stop is a switch, not a discussion

A ceiling that the system enforces is a stop that happens. A ceiling that is remembered is a ceiling that will be exceeded.

The artefacts are the same four as security

Input list, test suite, last scores, open cases. The shape of a shippable system does not change with the subject.

Why the model is the last thing changed

Costs, data, and execution are changed first. A model changed on top of unknown costs is a model that cannot be judged.

Words this lesson uses

Each one is defined here on this site. Open the entry for the full definition and the other words it points at.

← Stress testing a book
Previous Lesson
Stress testing a book