# Independent Coverage Verification — c11

## Problem (one line)
A modest load spike slows a few backend nodes; automatic client/internal retries re-emit load onto the struggling nodes (self-amplifying loop), tip more nodes, and the service flips into a saturated, metastable state that does not self-recover (manual near-total shedding is currently required). Design mechanisms that (a) keep a local slowdown sub-critical and (b) let the system recover on its own within minutes, without over-throttling normal traffic.

## Operative patterns (identified independently from the catalog)
Retrieval (search_archetype + search_by_facets, meta-model queries) converges on:
- **Instability Dampening** (top hit 0.79) — prevention half: stop the amplification before it tips.
- **Balancing Loop Stabilization** (0.73) — autonomous-recovery half: closed corrective loop returns state to viable range without a human.
- **Hysteresis Management** (surfaces strongly on the "tipped and won't self-recover" + "feedback controller returns to range" facets) — the load-bearing diagnostic for the metastable trap; its asymmetric entry/exit + recovery-path logic is the recovery mechanism.

These match the two patterns the design itself relies on; I treat A + B as the operative pair and fold the load-bearing hysteresis components into the recovery coverage.

---

## COVERAGE MAP

### Pattern A — Instability Dampening (components from prose_key_components)

- Perturbation Input Definition -> **instantiated** -> design names the perturbation class: "a few nodes slow" / latency-error climb under "a modest spike."
- Amplification Pathway Map -> **instantiated** -> "every failed call provokes automatic retries, and those retries land on the very nodes that are already struggling" — the retry-as-re-emitter loop is explicitly traced.
- Sensitivity / Gain Assessment -> **instantiated** -> identifies retry volume vs. successful-request volume as the gain, sets the budget "near ten percent" against it.
- Damping Rule -> **instantiated** -> proportional shed: "the guard sheds the excess" / adaptive concurrency rather than all-or-nothing.
- Buffer / Absorptive Capacity -> **instantiated (bounded)** -> "hold a little headroom and autoscale quickly... rather than... over-provision" (matches the no-indefinite-over-provision constraint).
- Gain Adjustment -> **instantiated** -> retry budget + exponential backoff with jitter + "never retry requests that aren't safe to repeat or are already almost certain to fail."
- Propagation Boundary -> **instantiated** -> per-dependency isolated connection/concurrency pools (bulkheads) + per-dependency breaker that "fails fast while open"; "a local problem is then walled off."
- Response Cadence Control -> **instantiated** -> backoff/jitter; half-open probe trickle; admission on a fast interval.
- Safe Fallback State -> **instantiated** -> reject immediately with a "retry after" signal instead of slow timeouts that pin resources; half-open probe is the reentry criterion.
- Residual Instability Monitor -> **instantiated** -> tracks goodput, shed rate, retry ratios, breaker state; alarms BOTH directions (runaway retries AND over-shedding) — directly answers the over-damping failure clause.

### Pattern B — Balancing Loop Stabilization (explicit component list)

- Target State / Viable Range -> **instantiated** -> keep node "within a healthy band"; setpoint = normal service.
- Deviation Signal -> **instantiated** -> each node "reports its latency, error rate, queue depth, and in-flight concurrency."
- Feedback Return Path -> **instantiated** -> health feeds the per-node admission controller + breaker; "without a human."
- Correction Rule -> **instantiated** -> additive-increase / multiplicative-decrease admission ("raises... gently... cuts it sharply").
- Corrective Actuator -> **instantiated** -> the admission guard / shed gate / breaker that moves admitted load.
- Loop Gain / Response Strength -> **instantiated** -> sharp decrease vs. gentle increase; "tune... the decrease factor."
- Delay Profile -> **instantiated** -> fast sense-act interval; half-open probe avoids acting on stale state.
- Stability Boundary -> **instantiated** -> breaker is the hard last-resort ceiling when adaptive control saturates.
- Effect Monitoring -> **instantiated** -> goodput / shed-vs-goodput watched; re-admission checked so it doesn't re-trip.
- Deadband / Tolerance Band (+ **Hysteresis Band**) -> **instantiated** -> the deliberate trip/re-arm asymmetry: "only relax it after pressure has fallen well below a second, lower level," plus "a small dead-band." This is the load-bearing recovery move and the answer to the metastable-trap (covers Hysteresis Management's Hysteresis Band + Exit Threshold + Recovery Path: gradual ramp through half-open probe).
- Saturation Limit -> **instantiated** -> hard admission ceiling identified as the limit of proportional correction.
- Disturbance Model -> **instantiated** -> tuned against the modest-spike + retry-amplification scenario.
- Manual Override / Escalation Path -> **correctly_declined (as primary)** -> success criterion is autonomous recovery; operator override kept "only as a last-resort backstop, never as the normal recovery path." Making it primary would reproduce the bug. Retained as backstop, so not missing.
- Anti-Gaming Safeguard -> **correctly_declined** -> cooperative client/internal caller population, not strategic actors gaming a metric; forcing it adds machinery the problem does not call for. Defensible.

### Diagnostic — Hysteresis Management (trap-specific)
- Asymmetric entry/exit (separate trip vs. re-arm thresholds) -> **instantiated** -> the deliberate two-threshold asymmetry.
- Recovery Path -> **instantiated** -> gradual ramp via breaker half-open probe, not all-at-once.
- State-memory rationale -> **instantiated** -> "the load needed to keep it jammed is far lower than the load that first jammed it" — names why reversal != entry-in-reverse. No hysteresis component left missing.

---

## Anti-signature gate (walked against this scenario)
- Instability Dampening anti-sigs: not "slow beneficial spread"; not "pure absence of capacity" (over-provision explicitly off-table, it's response dynamics); not "stable-but-inefficient/redistribution"; "disturbance already large -> recovery" partially true at peak — handled by carrying Pattern B recovery alongside; "should amplify for mobilization" — no. NOT disqualified.
- Balancing Loop Stabilization anti-sigs: not map-only; observable signal exists (good monitoring); actuator exists (can change client/server behavior, set limits); target not contested (normal service is a clear setpoint); recurring loop not one-off. NOT disqualified. Over-damping (its named failure mode) is explicitly mitigated by deadband + load-proportional shedding + two-direction monitoring.

No anti-signature trips.

---

## TALLY
- Instantiated: 23 (Pattern A: 10; Pattern B: 11 incl. hysteresis band; Hysteresis diagnostic: covered within these)
- Homolog: 0
- Correctly declined: 2 (Manual Override as primary; Anti-Gaming Safeguard)
- Missing: 0

## VERDICT: PASS
The structural runaway-failure essentials are all present and load-bearing: the amplification pathway is damped (retry budget, backoff, proportional shedding), the blast radius is contained (bulkheads + circuit breaker — the damping/circuit-breaker component is NOT dropped), and autonomous recovery is supplied by a closed balancing loop with an explicit hysteresis band (trip != re-arm), which is exactly the component that breaks the metastable trap that previously forced manual shedding. The over-throttle failure direction is guarded by two-sided monitoring. The two declines are genuine (cooperative population; autonomy-by-design). No component left missing.

## Missing components
None.
