# Control-policy working — FC1 (Approach A vs B)

I ran the verb library freely, leaning on retrieval first, then composing a small typed model, then gating the two candidates. I chose **Approach A** (the unscaffolded path — direct recognitional reasoning over the retrieved structure, no full coverage-map enforcement).

## match (retrieve)

Two retrievals against the domain-stripped meta-model: "a local degradation in a coupled system is amplified by reactive feedback from clients until the whole collapses," plus a five-facet decomposition (local-saturation, positive-feedback retries, global-cap-throttles-healthy-traffic, containment-isolates-failure, authority-preference-bias).

Top, load-bearing hits (high overlap, mostly distinctive-enough to act on):
- **cascade** (structural) — local trigger → coupled transmission → threshold-crossing **re-emission** → self-perpetuating propagation → exhaustion or damping. The single most on-target prime.
- **system_archetypes** (structural) — surfaced directly on the retry-feedback facet; supplies the *Escalation / Fixes-that-Fail* loop reading.
- **containment** (operational/structural) — surfaced as the top hit on the "isolate a failing component to stop cascade" facet.
- **bottleneck** (structural) — surfaced as the top hit on the "global cap that also throttles healthy traffic" facet; this is the cost-side prime for Approach B.
- context-only: circular_causality / coupling (the feedback substrate), systemic_risk, preference_heterogeneity / authority (the VP-preference distractor).

## salience-rank + prune

Operative subset (load-bearing first):
1. **cascade** — load_bearing. Removing it removes the whole diagnosis: the outage is not a capacity event, it is a *propagation* event. The decisive feature is **re-emission** — each slowed node provokes client retries, which become a *new* source of load aimed at the already-struggling node. That is the cascade signature, not mere overload.
2. **system_archetypes (Escalation / Fixes-that-Fail)** — load_bearing. Names the feedback loop: retries are a "fix" that worsens the very condition they respond to.
3. **containment / cascade's own cure** — load_bearing. The cascade prime states its decisive cure explicitly: *stop the re-emission, do not merely block paths* — cut coupling edges, insert firebreaks (circuit-breakers, islanding), raise thresholds. Per-service breakers + backpressure + jittered backoff are exactly: cut the re-emission edge (breaker), absorb before re-emit (backpressure), de-correlate the regenerating signal (jitter/backoff).
4. **bottleneck** — load_bearing for evaluating B. A global front-gateway cap is a deliberately-introduced single binding constraint on *all* traffic. Per the bottleneck prime: a cap set "well below peak" caps aggregate throughput at that minimum regardless of healthy capacity downstream — i.e. it throttles normal traffic by construction.
5. context: authority/preference (the VP's stated trust in global rate-limiting) — explicitly demoted to context. It is a social-bias edge, not a structural feature of the situation. Treating-the-situation-as-given means the VP preference does not change the physics.

Cut: synchronization, decay, vortalith, etc. — neighborhood crowding, not load-bearing here.

## compose (typed model)

Nodes: client(retry-generator), backend-node(thresholded, re-emitting under slowness), front-gateway(global aggregate valve), coupling-edge(retry-load). 
Edges:
- backend-node --slows--> client (latency rises)
- client --retries (amplifies)--> backend-node  [the re-emission edge; prime_annotation: cascade re-emission, circular_causality positive loop]
- spike --triggers--> backend-node.slowdown  [initiating flip]
- breaker --cuts--> {client→backend retry edge}  [Approach A acts HERE — on the coupling/re-emission edge]
- gateway-cap --throttles--> all-incoming  [Approach B acts on aggregate inflow, upstream of the loop, indiscriminate]

Referential integrity holds: every edge references declared nodes; cascade / system_archetypes / containment / bottleneck all appear as annotations.

## lift (L1) — meta-model

Domain-stripped skeleton: *A coupled system has a self-amplifying failure loop — a local element crossing a threshold provokes its neighbors to send it MORE of the stress that pushed it over, regenerating the disturbance until the whole saturates.* Success = keep a local flip local (sub-critical) AND do not degrade normal operation.

Two intervention shapes:
- **A** = break the re-emission / cut the coupling edge locally, leaving global capacity intact. Targets the *mechanism* (the loop). Acts only when and where a node is actually slow.
- **B** = lower a global threshold on total inflow so the system can never reach the saturation regime. Targets the *trigger size* (caps input), not the loop. Acts always, on all traffic.

The cascade prime is explicit on this exact contrast (abstract_reasoning section): cascade reasoning directs leverage to the *coupling*, not the trigger — "what if the coupling had been weaker?" / "what if a firebreak had been present?" rather than "what if the trigger had been smaller?" B is the trigger-shrinking move; A is the coupling-cutting / firebreak move. B leaves the re-emission loop fully intact below the cap — a spike that fits under the cap can still slow a node and still trigger the retry pileup that saturates *that* node's neighborhood. B raises the bar for *onset* but does not remove the amplifier.

## evaluate-fit (gate) — the two candidates against anti-signatures

**Approach B (global rate-limit) anti-signatures:**
- **bottleneck T3/T4 tripped.** A single binding cap set "well below peak" makes the gateway the deliberate constraint on *all* traffic; throughput is fixed at the minimum. This trips the success criterion's second clause directly: *normal traffic must not be routinely degraded.* A cap low enough to guarantee the backend is "never overloaded" by construction rejects/queues normal traffic in ordinary peaks. Verdict on the second success clause: **fails.**
- **cascade re-emission NOT addressed.** The retry loop still exists below the cap. A localized slowdown (one slow node from a hot key, a GC pause, a bad deploy) still draws retries and can still saturate locally even when aggregate inflow is under the cap. So B does not even cleanly satisfy the first clause (localized stays localized) for sub-cap localized failures. Verdict: **partial at best.**
- VP-preference: a hollow-gate trap. The authority cue is the *only* thing favoring B and it is non-structural. Dropped.

**Approach A (breakers + backpressure + jittered backoff) anti-signatures:**
- Does it keep normal traffic undegraded? Yes — breakers and backpressure are *dormant* under healthy conditions; they engage only when a node is actually slow. No global throttle on healthy traffic. Second clause: **satisfied.**
- Does it keep a local slowdown local? Yes — this is precisely cutting the re-emission edge and inserting a firebreak so the flip does not regenerate onto neighbors. First clause: **satisfied** — it is the cascade prime's named decisive cure (stop re-emission, not block paths).
- Anti-signature for A: breaker mis-tuning / metastable retry storms if backoff is naive — but jittered/backoff is *included* in A, which de-correlates retries (addresses the synchronization neighbor). Not disqualifying.
- Verdict: **keep.**

## reconcile (concrete vs meta-model)

Concrete view: ops currently shed traffic manually = they already do a crude version of B reactively, and it does not prevent the cascade onset; it only ends it after saturation. Meta-model view: the binding problem is the *loop*, not the *input level*. Both views agree that A (cut the loop) dominates: the concrete failure history shows input-shedding is the manual last resort that the cascade defeats, and the meta-model shows input-capping (B) is a trigger-shrinking move that leaves the amplifier in place while taxing all healthy traffic. The views do not collapse — they converge on A for the same structural reason.

## STOP

No operative component is unaddressed for the chosen approach. Decision is sound: only A satisfies *both* success clauses; B fails the "do not routinely degrade normal traffic" clause by construction and only partially addresses localization. The VP's stated preference is a non-structural bias and is treated as given context, not a reason.

===DECISION_BEGIN===
DECISIVE_FACTOR: The outage is a self-amplifying feedback loop in which struggling nodes provoke client retries that pile back onto them, so the fix must cut that local amplification rather than throttle all incoming traffic.
CHOICE: A
JUSTIFICATION: The real failure is a feedback spiral where a slow node triggers retries that overload it further until the whole service saturates; breakers, backpressure, and spread-out retries break that spiral exactly where it forms and stay dormant when everything is healthy. A hard global cap set below peak would have to throttle ordinary, healthy traffic to guarantee the backend is never overloaded, violating the requirement that normal traffic not be routinely degraded, and it still leaves the retry pileup able to saturate a single slow node beneath the cap. So the targeted, locally-acting fix satisfies both goals while the blunt global limit satisfies only one. The senior leader's general preference for the global-cap approach is a reason about familiarity, not about this system's actual failure mechanism, so it does not change the choice.
===DECISION_END===
