I am the control policy of a reasoning engine deciding between two resilience approaches. I choose verbs freely from the library and stop when the decision is sound. I worked Approach A (run verbs against the catalog, then decide).

# Working

## match (retrieve)
Anchored the problem to the catalog with two retrievals.

Semantic (meta-model query: "a critical function depends on a single element whose failure is catastrophic; a fixed budget can either add an independent parallel path or strengthen the one element"):
- top exact hits: `resilience` (distinctive), `functional_redundancy_degeneracy` (mid), `margin_of_safety`, `antifragility`, `systemic_risk`.

Facet decomposition (oblique, multi-structure problem):
- "single point whose failure takes down the whole system" → systemic_risk, fmea, fail_safe
- "adding an independent parallel path so no one failure is catastrophic" → **redundancy (0.69)**, robustness, fail_safe, load_balancing
- "improving reliability of a single component vs diversifying" → synergy_and_antagonism, **redundancy (0.76)**, refinement, adaptive_capacity
- "common-mode failure that defeats redundancy" → **redundancy (0.75)**, fmea, **fault_tolerance**, fail_safe
- "an incumbent insider advocates the option that benefits them" → signaling, trust, **adverse_selection**, mechanism_design

Fused ranking: redundancy, fmea, fail_safe, robustness, systemic_risk.
Post: ≥1 candidate with recorded source-prime overlap. ✓

## salience-rank
- **redundancy** — load_bearing. Directly names the A-vs-B choice. Its core: reliability improvement of one component is bounded; the probability of simultaneous *independent* failure of N paths shrinks exponentially in N. A single path, however perfected, has non-zero failure probability and remains a single point whose failure is catastrophic. Removing this prime changes the recommendation → load_bearing.
- **systemic_risk** — load_bearing. States the structural fact that "is each part safe?" is the wrong question when one node's failure takes down the whole; component soundness does not equal system soundness. This is exactly the failure mode Approach B leaves intact.
- **functional_redundancy_degeneracy** — context/load_bearing. Confirms the cost argument: distributing function across diverse-but-imperfect paths achieves higher reliability at lower total cost than perfecting one path, and reliability of a single path becomes "prohibitively expensive as reliability targets tighten." This directly addresses the "use the budget effectively" success criterion.
- **adverse_selection / signaling / trust** — context. Frames the incumbent vendor's advocacy: the trusted partner advocates the option that maximizes their own continued sole-supplier position. This is an interested signal, not a disinterested assessment, and must be discounted — it does not change the structural answer but explains why the cheaper-looking B is being pushed.
- **margin_of_safety** — context, and explicitly *orthogonal* (per redundancy's entry): margin absorbs demand variation above one component's capability; it does NOT handle component *failure* via an alternate pathway. So spending on margin/reliability (Approach B) is a different axis from the one the success criterion demands.

## prune
Operative subset: redundancy, systemic_risk, functional_redundancy_degeneracy, adverse_selection (vendor signal). Cut margin_of_safety as load-bearing (kept as the discriminator showing B is the wrong axis), antifragility/fmea/load_balancing as non-decisive here.

## compose (typed relational model)
- nodes: capability (critical function), component_X (incumbent single path), path_2 (proposed independent path), budget, vendor (incumbent).
- edges: capability —depends_on→ component_X (annotation: single point of failure / systemic_risk); approach_A: budget —funds→ path_2 —provides→ capability (annotation: redundancy, independence-required); approach_B: budget —funds→ reliability_of(component_X) (annotation: margin/reliability, NOT alternate pathway); vendor —advocates→ approach_B (annotation: adverse_selection / interested signal).
Referential integrity: every edge references declared nodes; every operative prime appears as an annotation. ✓

## lift (L1) — situation → meta-model
Roles: SINGLE-NODE on which WHOLE-FUNCTION depends; FIXED-RESOURCE; option DIVERSIFY (add independent parallel node) vs option PERFECT (strengthen the single node); INTERESTED-PARTY advocating PERFECT.
Invariant / success predicate: "no single failure may take down the whole" — a predicate that quantifies over *every* single node. PERFECT reduces the failure probability of the single node toward but never to zero, so the predicate "∄ single failure that is catastrophic" remains FALSE under B for any finite reliability. DIVERSIFY (with independent failure modes) makes the predicate TRUE: the function survives loss of either node.
Witness check: every role has a witness in the model. No domain terms remain. ✓

## evaluate-fit (gate) — anti-signatures
- Redundancy's load-bearing caveat: it is "not unconditional insurance — correlated failures defeat redundancy." Anti-signature for A = common-mode dependency (shared power, shared link, same buggy implementation) across the two paths. Tripped? Not necessarily — but it converts into a *design requirement on A*: the second path must be genuinely independent (diverse implementation / separate dependencies), or A degrades toward B. Verdict on A: keep, conditioned on engineered independence.
- Approach B anti-signature: it cannot satisfy the stated success criterion at all (single point of failure persists by construction). Verdict on B: drop against the success criterion.

## reconcile (concrete model vs meta-model)
Concrete reading: the trusted vendor is competent and the existing component could be made very reliable — emotionally and relationally B is attractive. Meta-model reading: the success criterion is a universal over single nodes; reliability of one node cannot satisfy it. The views diverge (so the meta-model is not decorative), and I prefer the reading consistent with both: the relationship is real but the criterion is structural. Resolution: fund A; preserve the vendor relationship by having them build/operate one of the two independent paths (turning an interested objection into aligned incentive), and spend a slice on verifying failure-mode independence rather than perfecting a single point.

## STOP
Coverage: the success criterion's two clauses are both addressed — (1) no single failure is catastrophic → satisfied only by an independent second path; (2) budget used effectively → diversification reaches the required reliability more cheaply than perfecting one path as targets tighten. No component of the decision is missing. Decision is sound.

===DECISION_BEGIN===
DECISIVE_FACTOR: The success criterion forbids any single failure from taking down the capability, and no amount of reliability investment in one component removes that single point of failure — only an independent second path does.
CHOICE: A
JUSTIFICATION: Making the one component more reliable lowers its odds of failing but never eliminates the fact that its failure alone still takes down everything, so it cannot meet the requirement that no single failure be catastrophic. A second, genuinely independent path lets the capability survive the loss of either one, and because failures of independent paths rarely coincide, this reaches the needed reliability far more cheaply than chasing perfection in a single part. The incumbent's preference for the single-component option reflects their stake in remaining the sole supplier and should be weighed as an interested view, not a neutral one; they can instead be enlisted to build or run one of the two paths. The only real condition is ensuring the two paths share no hidden common dependency, since correlated failure would undermine the benefit.
===DECISION_END===
