# Control-policy decision — e01 (ablation pilot)

Acting as the CONTROL POLICY. Free verb choice. I honor the ADDITIONAL STIPULATION as definitely true: the slowdown does NOT amplify — a struggling node does not draw extra load, trouble never spreads node-to-node, there is NO self-reinforcing retry/feedback loop, and total system load is FIXED regardless of node health.

## Verbs run

### 1. match (retrieve)
Domain-stripped meta-model query: "a local perturbation stays confined and does not propagate/amplify into systemic collapse; containment at a boundary vs. capping total input."
- Semantic `search_prime`: top hits `systemic_risk`, `perturbation`, `cascade`, `containment`, `escape_and_leakage`, `instability`.
- `search_by_facets` (5 facets). Per-facet:
  - "local failure must not propagate to whole system" → systemic_risk, propagation, **cascade**, fail_safe.
  - "capping total input to keep system below capacity" → **buffering**, load_balancing, network_flow, **bottleneck**.
  - "isolating a failing component at its boundary so callers stop depending on it" → **circuit_breaker**, modularity, impedance_mismatch.
  - "runaway feedback loop where retries amplify load" → ultra_stability(Ashby), system_archetypes, resonance/amplification, **cascade**, **feedback**.
  - "targeted containment fix vs blunt global throttle" → progressive_refinement, containment, requisite_variety, bottleneck.

Recorded source-prime overlap: the two proposed fixes map cleanly onto two distinct catalog patterns —
- **Approach A** = the protective-interruption pattern (`circuit_breaker`): monitor a flow → trip on threshold → isolate fault → reset. Its stated *raison d'être* is "convert a **cascade** risk into a contained, recoverable interruption" (FACT-D54-095) and "stop a fault in one part from **cascading** into ruin of the whole."
- **Approach B** = the capacity/throughput pattern (`bottleneck`/`buffering`): cap total input so the system is never driven past capacity. This is regime-setting on the *input*, not fault-containment.

### 2. salience-rank
- `cascade` — load_bearing. The whole failure mechanism described in the SITUATION (spike → slow nodes → retries pile on → saturation) is a textbook cascade: a local trigger that *re-emits* (retries become new load) and runs super-critical until manual shedding. THIS is the prime the original problem turns on.
- `circuit_breaker` — load_bearing for evaluating Approach A. Its function is precisely to cut re-emission and contain a cascade.
- `bottleneck`/`buffering` (capacity-capping) — load_bearing for evaluating Approach B.
- systemic_risk, perturbation, containment — context.

### 3. compose (typed relational model) — referential integrity check
Nodes: `spike`(trigger), `slow_node`(element), `caller`(element), `retry`(re-emission edge payload), `service`(system), `gateway`(input boundary), `rate_limit`(B mechanism), `breaker`(A mechanism).
Edges:
- spike →(loads) slow_node — prime_annotation: perturbation/local trigger
- slow_node →(induces) caller-retry — prime_annotation: **cascade** re-emission edge  ← *this edge is the crux*
- caller-retry →(adds load to) slow_node — prime_annotation: **cascade** self-perpetuating loop
- breaker →(cuts) [caller-retry → slow_node] — prime_annotation: **circuit_breaker** (isolate / stop re-emission)
- rate_limit →(caps) [total input → service] — prime_annotation: **bottleneck/buffering** (sub-capacity input)

Referential integrity: every edge references declared nodes; every operative prime (cascade, circuit_breaker, bottleneck) appears as an annotation. PASS.

**Stipulation applied to the model:** the two edges annotated `cascade` (slow_node → caller-retry → slow_node, the self-reinforcing loop) are DELETED by fiat. The stipulation says a struggling node does NOT draw extra load and total load is fixed. So the re-emission edge — the thing that makes this a cascade at all — is asserted absent.

### 4. lift — L1 (situation → meta_model), with witnesses
Meta-model roles/relations:
- R1 a SYSTEM with finite per-element capacity and finite aggregate capacity — witness: backend nodes, service.
- R2 a fluctuating INPUT whose peaks can exceed capacity — witness: request spikes; success criterion "normal traffic must not be routinely degraded."
- R3 a LOCAL OVERLOAD that must stay LOCAL — witness: success criterion "a localized slowdown must stay localized."
- R4 (under baseline reading) a RE-EMISSION/amplification coupling that turns local overload into total saturation — witness: "retries pile onto struggling nodes … whole service saturates." **INVARIANT OVERRIDDEN BY STIPULATION: R4 is declared FALSE — no amplification, no spread, fixed total load.**
No domain terms remain. L1 PASS. Critical output: the meta-model has TWO independent threat shapes, and the stipulation switches one of them off.

### 5. evaluate-fit (gate) on the chosen-approach anti-signatures + scoped coverage check

I evaluate fit for BOTH approaches' operative pattern, then commit.

**Anti-signatures / what-it-is-not for Approach A (circuit_breaker):**
- AS-1: pattern presupposes "flows can cascade" / its job is to stop a fault "cascading into ruin of the whole" (FACT-D54-092/095). TRIPPED — under the stipulation there is no cascade, no spread, no feedback loop. The mechanism's defining purpose has no referent here.
- AS-2 (T5, the prime's own tension): "A breaker can convert a tolerable degradation into a hard outage" — it refuses partial function and amputates a stressed-but-still-working node. TRIPPED against the success criterion "normal traffic must not be routinely degraded": without amplification, a single slow node is exactly a *tolerable, contained* degradation; tripping it converts contained slowness into denied service for that slice with no compensating cascade-prevention benefit.
- AS-3 (T1 sensitivity vs availability): false trips on harmless transients. Mildly relevant; not decisive.
Verdict on A: the load-bearing justification for A is cascade-containment, and the stipulation removes the cascade → A's central anti-signature is tripped. A solves a problem that, by stipulation, does not exist.

**Approach B (bottleneck/buffering — sub-capacity input cap):**
- AS-B1: a global cap below peak throttles healthy traffic at peak even when the backend as a whole is NOT overloaded. Does this trip "normal traffic must not be routinely degraded"? Examine under the stipulation: total load is FIXED and does not amplify, so aggregate demand is bounded and known. A cap set at/above true aggregate capacity but able to protect against the *spike* exceeding *aggregate* capacity addresses R2 directly. The failure the stipulation LEAVES STANDING is plain over-capacity at peak (R2 + R3 with R4 off): a spike can still push aggregate input past aggregate capacity, slowing nodes. Capping total input below the saturation point is the direct, on-target remedy for the one threat that survives.
- AS-B2 (over-build / blunt): an aggressive cap "well below peak" risks routinely degrading normal traffic (success criterion #2). This is a real cost — but it is a *tuning* cost (set the cap at capacity, not far below it), not a structural mismatch. The pattern's target (keep input ≤ capacity) is exactly the surviving threat.
Verdict on B: on-target for the surviving threat; its only liability is over-aggressive tuning, which is correctable.

### 6. SCOPED COVERAGE CHECK (lift L2) on the operative pattern of the CHOSEN approach

Chosen approach: **B**. Operative pattern = capacity-regime control via input cap (bottleneck/buffering): keep aggregate input at or below aggregate capacity so the protected system never enters the overloaded regime.

coverage_map:
| Component (of the input-cap / capacity-regime pattern) | Status | Witness / reason / gap |
|---|---|---|
| Protected flow with a finite capacity ceiling | instantiated | Backend aggregate throughput; the saturation point. |
| Sensed/known input level | instantiated | Total incoming request rate at the front gateway (single chokepoint). |
| Threshold = aggregate capacity (cap set ≤ it) | instantiated | The rate-limit value at the gateway. |
| Actuator that holds input ≤ threshold | instantiated | Gateway rate-limiter rejecting/queuing above the cap. |
| Guarantee the protected system never enters overloaded regime | instantiated | Stipulation: load fixed + no amplification ⇒ capping aggregate input below saturation makes overload impossible. This is the success criterion "localized slowdown stays localized" — with no spread, keeping aggregate ≤ capacity keeps every node un-saturated. |
| Avoid routinely degrading normal traffic | homolog (tuning) | Set cap AT true capacity, not "well below"; admit a headroom buffer. Witness: buffering pattern's headroom; satisfies criterion #2 when tuned. Liability noted, correctable. |
| Per-node fault isolation / re-emission cut | **correctly_declined** | Over-lift guard: this is the circuit_breaker/cascade-containment component. By stipulation there is NO re-emission and NO node-to-node spread, so building isolation would over-build against an absent dynamic. Declined, not missing. |
| Per-node graceful degradation (degraded-but-serving) | correctly_declined | Without amplification a single slow node is self-limited and harms only its own slice; no mechanism needed to stop it propagating. Declined. |

No component is `missing`. STOP condition satisfied.

### 7. reconcile (model vs meta_model)
- Concrete-model reading: the SITUATION narrative screams "retry cascade → use breakers (A)."
- Meta-model reading (with R4 overridden): the only live threat is aggregate input exceeding capacity (R2/R3); the amplification edge is deleted, so the breaker's target is gone.
- The two views DISAGREE (so the meta-model is not decorative): the surface narrative favors A; the lifted invariants under the stipulation favor B. Resolve toward the reading consistent with BOTH the model AND the stipulated invariants → the cascade edge is asserted absent, so the breaker-shaped fix has no work to do, and the surviving over-capacity threat is exactly what an input cap addresses. Prefer B.

## Decision rationale (plain)
The original outage story is a self-amplifying loop: slow nodes attract retries that make them slower until the whole thing saturates. A circuit-breaker / backpressure / backoff fix (A) exists specifically to break that loop. But the stipulation removes the loop entirely — by assumption a slow node never attracts extra load, trouble never spreads between nodes, and total load is fixed. With the amplification gone, the breaker is guarding against a danger that cannot occur, and its own downside (cutting off a node that is merely slow but still serving) would degrade normal service for no containment benefit. What remains is a simpler, non-amplifying problem: a traffic spike can still push the total load past what the backend can serve. Capping total incoming requests at the front gate so the backend is never driven past its capacity (B) is the direct fix for the one failure mode that survives the stipulation, and — tuned to sit at capacity rather than far below it — it keeps normal traffic intact.

===DECISION_BEGIN===
DECISIVE_FACTOR: Because the slowdown is stipulated not to amplify or spread, the only surviving failure is the total request load exceeding what the backend can serve, which a global input cap addresses directly while per-node fault-isolation guards against a feedback loop that no longer exists.
CHOICE: B
JUSTIFICATION: Without any self-reinforcing pile-on, a single slow node stays harmless on its own, so the machinery that trips and isolates struggling nodes would mainly cut off nodes that are merely slow-but-working, degrading normal service for no real protective gain. The one failure that can still occur is simply too much traffic arriving at once for the backend to handle. Capping total incoming requests at the front gate keeps the backend below its capacity so overload never starts, and setting that cap at true capacity rather than far below it avoids routinely throttling normal traffic. This is the targeted fix for the only problem that remains true under the given assumption.
===DECISION_END===
