# Facility incidents & credits

Three fault domains, one principle — you pay for physics, not for our hardware.

A physical facility fails in physical ways: an actuator throws a fault code,
a calibration drifts mid-run, a reset fixture jams. The billing question is
settled by one principle, stated here and everywhere this policy appears:
**You pay for physics, not for our hardware.**

## The taxonomy

| Fault domain | Examples | Who pays | What happens |
| --- | --- | --- | --- |
| **Policy faults** | grasp slip, `policy_deadline_missed`, contract halt | you — billable | this is the data you bought: the episode counts, its cluster ships in the result, its MCAP shows why |
| **Facility faults** (`cell_fault`) | hardware failure, calibration drift detected mid-run, reset fixture jam, facility power/network | never billed | the episode is **excluded from statistics** and auto-requeued on the same or an equivalent qualified cell — or credited if capacity isn't available within the run's window |
| **Ambiguous** | a collision that may be either | defaults in your favor | adjudicated from the episode's own MCAP within 2 business days; pending adjudication the episode is treated as a facility fault |

## Detection is instrumented, not claimed

A `cell_fault` is not an operator's opinion. Calibration age, watchdog
events, actuator fault codes, and reset telemetry ship in every episode's
`/meta` channel; an episode marked `cell_fault` carries the trigger that
marked it. The same evidence trail we sell is the one we're judged by — pull
the MCAP and check.

## Statistics integrity

Excluded episodes never enter n. Requeued replacements are ordinary episodes
and enter n when they run. If exclusions push a run below its requested
precision — an `auto(ci, moe)` target the remaining episodes can't meet —
the run auto-extends at our cost, or reports the achieved interval with the
shortfall flagged. Never silently.

## Mid-run halts

An emergency stop or facility halt ends the run the same way a budget stop
does: partial results with a Wilson interval on the completed episodes,
status `halted_facility` — the same shape as `halted_budget`, a different
payer. The remainder is requeued or credited; completed episodes keep their
statistics and their artifacts. The error codes involved —
[`cell_fault`](/docs/errors/#cell_fault),
[`run_requeued_facility`](/docs/errors/#run_requeued_facility),
[`run_credited_facility`](/docs/errors/#run_credited_facility) — are on the
[error codes](/docs/errors/) page like every other code.

## Try it — the policy is testable

In [test mode](/docs/test-mode/), `X-Roborama-Force: cell_fault` on
`POST /v1/runs` demonstrates the whole flow: the episode appears in the
listing as `cell_fault` with its trigger, the recomputed statistics exclude
it (n stays at the requested count — the replacement ran), the result
carries a `facility_incidents` block with `billed_usd: 0`, and a
`run.requeued` webhook fires. The policy you're reading is the behavior you
can curl.

> **Pilot-era honesty:** These are commitments of conduct, not yet SLAs with uptime numbers.
> Qualified-cell availability targets will publish with the pilot's measured
> data — we won't invent a percentage before the fleet has earned one.