Acting as the control policy, I executed the nine-step procedure once each, in order, using the encyclopedia tools. Working below.

---

**Step 1 — Specify the decision.**
Choose ONE fix to implement first for a service whose intermittent total outages arise as follows: a modest spike slows a few backend nodes -> clients auto-retry -> retries pile onto the already-struggling nodes -> the extra load slows them further -> more retries -> full saturation, until operators manually shed traffic. The two candidate fixes are (A) per-service circuit-breakers + backpressure + jittered/backoff retries, and (B) an aggressive global front-gateway rate-limit capping total intake well below peak. Success requires BOTH: (i) a localized slowdown stays localized — no full saturation — AND (ii) normal traffic is not routinely degraded.

**Step 2 — Identify operative primes (search_prime / search_by_facets).**
Semantic query with the domain-stripped meta-model ("a local degradation triggers compensating responses that amplify the degradation through a reinforcing loop until the whole system collapses; decouple/dampen the loop rather than just lowering total load") plus a facet decomposition. Surfaced and fetched (get_prime): `circular_causality`, `cascade`, `circuit_breaker`, `containment`. Supporting/neighbor hits noted: `systemic_risk`, `feedback`, `homeostasis`, `system_archetypes`, `escape_and_leakage`, `scalability`, `load_balancing`, `margin_of_safety`.

**Step 3 — Salience-rank.**
1. `circular_causality` — the failure IS a reinforcing loop (slowdown -> retry -> more load -> more slowdown). This is the generative mechanism, the thing that converts a small trigger into total collapse. Highest salience because the success criterion (slowdown stays localized) is exactly "the loop does not run away."
2. `circuit_breaker` — the named intervention that severs the loop at the re-emission point (caller stops hammering a slow node).
3. `cascade` — names why it goes system-wide: load redistributes onto coupled neighbors that then cross their own thresholds. Tells us the cure is to stop re-emission / cut coupling, not shrink the trigger.
4. `containment` — bounded isolation so a local fault cannot propagate; frames the "stay localized" half of success.
5. (lower) `scalability`, `margin_of_safety`, `homeostasis` — relevant but generic.

**Step 4 — Prune.**
Drop `homeostasis`, `scalability`, `margin_of_safety`, `system_archetypes` as too generic for the choice. Keep the four-prime spine: `circular_causality` (mechanism), `cascade` (propagation logic), `circuit_breaker` (loop-severing intervention), `containment` (locality goal).

**Step 5 — Build a typed relational model.**
- Elements: gateway G; backend nodes N1..Nk (coupled, each with a load threshold); clients C with a retry policy R.
- Loop L (reinforcing, per `circular_causality`): node_slow(Ni) -> retries(R) increase -> load(Ni) increase -> node_slower(Ni) -> retries increase further. Polarity = positive/reinforcing; this is a vicious cycle.
- Coupling edges (per `cascade`): a slow/failed Ni sheds load onto neighbors Nj, raising their probability of crossing threshold -> propagation -> system-wide saturation. Re-emission (each stressed node generating MORE retry load) is what makes it a cascade, not a one-shot.
- Trigger = modest spike (small, effectively random, NOT the decisive variable). Decisive variable = the coupling/gain of loop L.

**Step 6 — Domain-stripped meta-model.**
"A network of coupled elements each with a stress threshold. A small perturbation pushes one element past threshold; the system's automatic compensating response to that stress increases the stress on the same and neighboring elements, which re-emit still more stress, so a local excursion self-amplifies and percolates until the whole collapses. Goal: keep a local excursion local while not degrading normal operation. Question: is it better to (A) cut the re-emitting coupling at each element on a per-element trip so the loop cannot regenerate locally, or (B) globally throttle total input below the level at which any element is ever stressed?"

**Step 7 — Query archetypes whose source primes match (find_archetypes_for_prime / get_archetype).**
`find_archetypes_for_prime(circular_causality)` returned, among others, `cycle_breaking` (source) and `feedback_loop_redirection` (related). `find_archetypes_for_prime(cascade)` returned none catalogued. Fetched both candidates with get_archetype.
- `cycle_breaking`: "Interrupt a recurring harmful cycle at a point where the next recurrence can be prevented." Move: map the loop -> find the regeneration point -> apply the least-destructive interruption lever there -> supply a replacement pathway -> verify non-recurrence. Decision rules: "intervene at regeneration, not just manifestation"; "use the least destructive interruption that prevents recurrence"; "do not remove a cycle without replacing its function" (the replacement pathway = legitimate retries still allowed, just bounded). Invariant: "beneficial cycles remain intact."
- `feedback_loop_redirection`: rewire what a loop responds to. Failure modes flagged: overcorrection, runaway amplification, reduced throughput when the new rule is too strong. Most relevant as a caution against a blunt global rule.

**Step 8 — Apply each candidate's logic to BOTH approaches and reconcile.**

Apply `cycle_breaking`:
- The harmful loop's *regeneration point* is the moment a caller, seeing a slow node, re-issues load onto that same node. That is where the next pass of the cycle is seeded.
- Approach A acts *exactly at that regeneration point*: the breaker trips when a node slows, so callers stop hammering it; backpressure caps in-flight load; jitter/backoff spreads retries so they no longer synchronize into a pile-on. This is "the least destructive interruption that prevents recurrence" — it removes only the *excess* re-emission, leaving the beneficial cycle (normal serving, legitimate retries) intact. It supplies the replacement pathway (fail-fast/fallback) so callers aren't simply blocked.
- Approach B does NOT touch the regeneration point. The retry-amplification loop still exists unbroken behind the gateway; B merely lowers the *trigger* by holding total input low so the loop is rarely ignited. Per `cascade`, the decisive variable is the coupling/gain, not the trigger — so B leaves the system primed: any internal slowdown, a partial dependency failure, or a hot shard can still ignite the same runaway loop among nodes whose retries are unbounded, even while total intake sits under the cap. B is symptom-suppression by trigger-shrinking, not regeneration-point interruption.
- `cycle_breaking` clearly favors A.

Apply `circuit_breaker` (prime as its own intervention logic) + `containment`:
- A literally instantiates the circuit-breaker signature (monitor flow -> trip threshold -> isolate the slow node -> fail fast -> reset), with *narrow isolation scope* (per-service), which `containment` flags as precise rather than blunt protection: a fault in one node is firewalled before it re-emits to neighbors. This directly satisfies "localized slowdown stays localized."
- B is a single, maximally-broad throttle at the perimeter (`containment` T4: broad scope = blunt). It protects by starving the whole system of input rather than by isolating a fault, so it pays the cost on *all* traffic, all the time.

Apply `feedback_loop_redirection` (as caution):
- B is a blunt global response rule; its listed failure modes — overcorrection and reduced throughput — map onto B's core risk: a cap set "well below peak" routinely rejects or queues legitimate traffic during ordinary busy-but-healthy periods, i.e. it degrades normal traffic. A's per-service, threshold-triggered breakers are auditable and retunable and only engage under genuine stress.

Reconcile: All three lenses agree. The cascade analysis says the decisive lever is loop coupling, not the trigger; cycle-breaking says intervene at the regeneration point with the least-destructive lever and keep beneficial cycles intact; containment says prefer precise per-element isolation over a blunt global cap. A satisfies all; B addresses only the trigger and violates the "don't degrade normal traffic" criterion.

**Step 9 — Evaluate fit against the failure conditions and success criteria.**

Success criterion (i): a localized slowdown stays localized.
- A: PASS. The per-node breaker trips and isolates the slow node before retries pile on or load sheds to neighbors; the reinforcing loop cannot regenerate, so a local excursion stays local even at peak input.
- B: PARTIAL/FAIL. By capping intake, B reduces the *frequency* of ignition but does not localize an excursion once one starts — the retry-amplification loop and node-to-node coupling are untouched, so an internal trigger (a slow dependency, GC pause, hot key) can still cascade to full saturation while total intake is under the cap. The mechanism that produced the outage is still present.

Success criterion (ii): normal traffic is not routinely degraded.
- A: PASS. Breakers/backpressure are dormant under normal load and engage only when a node is genuinely stressed; healthy traffic flows unthrottled.
- B: FAIL (this is B's defining weakness). A cap set "well below peak" to guarantee the backend is "never overloaded" must reject or delay legitimate requests during ordinary peaks — degrading normal traffic by design and discarding the headroom the system actually has.

Conclusion: A satisfies both criteria; B fails criterion (ii) outright and only partially satisfies (i). Implement Approach A first. (Note: B can remain a later, much-less-aggressive global safety cap as a backstop, but it is the wrong *first* fix because it treats the trigger while leaving the amplifying loop intact and taxes all normal traffic.)

===DECISION_BEGIN===
DECISIVE_FACTOR: The outages are produced by a self-amplifying retry loop and node-to-node load spillover, so the fix that severs that loop locally (rather than merely lowering total input) is the only one that both keeps a local slowdown contained and leaves healthy traffic untouched.
CHOICE: A
JUSTIFICATION: The total outages happen because a slow node provokes retries that pile back onto it and spill load onto its neighbors, a runaway loop that a small spike merely ignites. Approach A stops that loop exactly where it regenerates — callers back off a struggling node, retries are spread out, and the slow node is isolated before its trouble spreads — so a local hiccup stays local. Approach B only shrinks the trigger by capping all incoming traffic far below peak, which leaves the amplifying loop intact for any internally caused slowdown and routinely turns away legitimate requests, degrading normal service by design. Therefore A is the right first fix and B is at best a later, gentler backstop.
===DECISION_END===
