# Control-policy run — w_FC6_C

Acting as the CONTROL POLICY. Verbs run in the order shown; STATE fields written each step. Condition C is enforced: before any final recommendation I (i) compose a referentially-consistent model, (ii) lift a domain-stripped skeleton with witnesses, (iii) run a scoped coverage check on the single operative pattern, and (iv) evaluate-fit the chosen approach's anti-signatures. The coverage map is shown in full.

---

## Step 1 — match (retrieve)

Problem statement: a critical capability rests entirely on one component; a fixed budget; pick exactly one of {A: build an independent second path / redundancy-diversity; B: harden the one component}. An incumbent vendor (trusted partner) advocates B.

Queried the catalog semantically with the domain-stripped meta-model and ran a facet decomposition for the oblique parts (the vendor-advocacy facet, the single-point facet, the budget-tradeoff facet).

Candidates returned, with source-prime overlap:
- **redundancy** (facet: "independent parallel path so no single failure is fatal" → top hit; also `fault_tolerance`, `fail_safe`).
- **fault_tolerance** — the *property* the design must achieve (no single point of failure under the stated fault model).
- **robustness** / **functional_redundancy_degeneracy** — robustness quadrilateral; mid-distinctiveness exact hits.
- single-point cluster: **critical_mass / threshold_and_criticality / systemic_risk** (the catastrophic-single-element structure).
- governance facet surfaced **trust / authority / checks_balances** — the incumbent-advocacy sub-structure (an interested party recommending the option that preserves its own central role).

Archetype neighborhood for `redundancy`: `diverse_functional_redundancy`, `common_mode_failure_analysis`, `redundant_backup_provisioning`, `failover`, `path_redundancy_provisioning`, `fault_tolerant_operation`.

Post satisfied: ≥1 candidate with recorded source-prime overlap. No retrieval miss; neighborhood crowding handled by facets.

## Step 2 — salience-rank (by ablation)

- **fault_tolerance** — LOAD-BEARING. It is the success criterion itself: "no single failure may take down the critical capability." A fault model with f=1 catastrophic single-point failure must be tolerated. Remove it → the decision criterion vanishes.
- **redundancy / diverse_functional_redundancy** — LOAD-BEARING. The only mechanism class that *removes single-point status* (distributes the function across ≥2 independently-failing paths). Remove it → Approach A has no engine.
- **failure-mode independence** (sub-property of both) — LOAD-BEARING. The whole quantitative gain (p → ~p^n) is conditional on independence; this is also what separates A from B.
- **trust / interested-advocacy structure** — CONTEXT (load-bearing as a *bias check*, not as a decision input). The incumbent's recommendation is informative about reliability of the component but is conflicted on the architecture choice (B preserves the incumbent's central role). It must not be allowed to substitute for the failure-mode analysis.
- critical_mass / systemic_risk — CONTEXT (names the hazard, not the remedy).
- scarcity / decision (fixed-budget, exclusive choice) — CONTEXT (the constraint envelope).

## Step 3 — prune

Operative subset retained: `fault_tolerance` (target property), `redundancy`/`diverse_functional_redundancy` (mechanism), failure-mode-independence (load-bearing sub-property), with `trust`/interested-advocacy held as a context-level bias guard. Cut: dimension, scaling, three-horizons, FMEA-as-such (diagnostic only, not a chooser) — none changes the A/B verdict.

## Step 4 — compose (referential integrity)

Typed relational model:

- nodes:
  - `n1` = critical capability (kind: function)
  - `n2` = existing single component (kind: element)
  - `n3` = proposed second independent path (kind: element)
  - `n4` = fixed budget (kind: resource)
  - `n5` = incumbent vendor (kind: actor)
  - `n6` = failure event on n2 (kind: event)
- edges:
  - `n2 --realizes--> n1` [prime_annotation: fault_tolerance — current fault model: f=0, single point]
  - `n6 --disables--> n1 (via n2)` [prime_annotation: critical_mass/systemic_risk — single catastrophic point]
  - `n3 --also-realizes--> n1` [prime_annotation: redundancy / diverse_functional_redundancy]
  - `n3 --must-fail-independently-of--> n2` [prime_annotation: failure-mode independence]
  - `n4 --funds--> {n2-hardening | n3-build}` [prime_annotation: scarcity / exclusive decision]
  - `n5 --advocates--> n2-hardening` [prime_annotation: trust + interested-advocacy / authority]

Referential integrity check: every edge references declared nodes (n1–n6 all declared); every operative prime appears as an annotation (fault_tolerance, redundancy/diverse_functional_redundancy, independence, critical_mass, scarcity, trust). PASS.

## Step 5 — lift L1 (model → meta_model), witness-checked

Domain-stripped skeleton:

- **Roles:** essential-OUTPUT (← n1); SOLE-PRODUCER whose loss is total (← n2); CANDIDATE-ALTERNATE-PRODUCER (← n3); FIXED-CONVERTIBLE-RESOURCE (← n4); INTERESTED-RECOMMENDER (← n5).
- **Relations:** sole-producer→output (single dependency); alternate→output (parallel sufficiency); alternate ⟂ sole-producer (independence relation); resource→{strengthen-one | add-other} (exclusive allocation); recommender→strengthen-one (conflicted advocacy).
- **Invariants:** (I1) output must survive loss of any single producer; (I2) resource is fully consumed by exactly one choice; (I3) strengthening a sole producer leaves it a sole producer — its *count of independent producers* stays 1; (I4) reliability-of-output under single-producer loss is bounded by number of independent producers, not by the per-producer reliability.

Witness check: every role/relation/invariant traces to a model node/edge (shown by ← tags). No domain terms remain in the skeleton. PASS.

## Step 6 — lift L2 — SCOPED COVERAGE CHECK on the single operative pattern

The chosen approach (A) relies on ONE operative pattern: **diverse functional redundancy** (function preserved through ≥2 failure-independent pathways). Naming its components and coverage-checking each against the Approach-A design. Rule: none may be `missing`; over-build is marked `correctly_declined`.

```
COVERAGE MAP
pattern: diverse functional redundancy (function preserved via failure-independent alternate pathways)

component                       | status              | witness / reason / gap-note
--------------------------------|---------------------|-----------------------------------------------
Function Definition             | instantiated        | the critical capability (n1) is the function to preserve, named independent of the component
Alternative Pathway             | instantiated        | n3 — the proposed second, independent path that also realizes n1 (this IS Approach A)
Functional Equivalence Check    | instantiated        | n3 must deliver n1 to the required level; budget must buy a path that genuinely carries the function (success criterion "budget used effectively")
Diversity Requirement           | instantiated        | n3 must differ from n2 in failure-relevant ways (different implementation/dependency), not be a clone
Common-Mode Failure Map         | instantiated        | enumerate shared dependencies (power, data, vendor, control plane) that could take n2 and n3 down together — the load-bearing design work
Independence Check              | instantiated        | I3/I4: verify n3 fails independently of n2; this is what converts "two paths" into reliability ~p^n
Activation/Selection Rule       | instantiated        | define parallel/standby + failover trigger when n2 fails
Coverage & Capacity Profile     | instantiated        | n3 must carry enough of n1 (full or prioritized) for long enough within budget
Pathway Health Signal           | homolog             | periodic exercise/monitoring of n3 so the alternate is real, not ceremonial (an operating discipline that discharges the "keep diversity alive" function)
Coordination Interface          | homolog             | routing/state-reconciliation between n2 and n3 (function: keep the two paths one coherent capability)
Degradation Priority            | correctly_declined  | single-function, single-capability problem; no multi-function prioritization to specify — abstract framing would over-build
Pathway Exercise Cadence        | homolog             | folds into Pathway Health Signal at this granularity; same discipline, not a separate gap
Cost & Complexity Guardrail     | instantiated        | the fixed budget (n4, scarcity) IS the guardrail; do not buy diversity that is expensive but not protective
User Pathway Guidance           | correctly_declined  | no distinct end-user routing surface in this framing; declining avoids importing a UX sub-structure the problem doesn't contain
```

No component is `missing`. STOP condition for L2 is satisfied. The pattern is fully covered, with two genuine `correctly_declined` over-build guards.

## Step 7 — evaluate-fit (gate) — Approach A's anti-signatures

Walk the anti-signatures of `diverse_functional_redundancy` against the situation:

1. "Need is only a duplicate of the same component → use redundant_backup_provisioning." TRIPPED? No — the success criterion forbids any single point; a same-design clone shares failure modes. A diverse independent path is what's required.
2. "Alternate capacity already exists; problem is only when to switch → use failover." TRIPPED? No — no alternate exists yet; the budget is to *create* one.
3. "Function can simply stop safely on failure → use fail_safe." TRIPPED? No — it is a *critical capability that must survive*, not one that may halt.
4. "Only need a larger margin within the same design path → use robustness_margin_design." TRIPPED? **This is exactly Approach B.** Hardening the one component is margin within the same path. Evaluating it as the *gate on B*: B leaves the count of independent producers at 1 (invariant I3), so however reliable, a single failure (or an unmodeled common cause) still takes down n1 → B fails success criterion "no single failure may take down the critical capability." B is DROPPED for the architecture choice.
5. "Alternatives are different but don't perform the same function → portfolio, not redundancy." TRIPPED? No — n3 is required to be functionally equivalent (covered above).
6. "Diversity can't be maintained/governed/validated in the real context." TRIPPED? Not on the given facts; mitigated by the Pathway Health Signal + Coordination components. No disqualification.

gate_log verdict: Approach A — KEEP (no disqualifying anti-signature trips). Approach B — DROP (trips #4: it is margin within the same single path; cannot satisfy the no-single-point criterion).

## Step 8 — reconcile (concrete model vs. meta-model)

- Concrete reading: the incumbent is a trusted partner and is probably right that the component *can* be made more reliable; spending on B is the comfortable, relationship-preserving move.
- Meta-model reading: invariants I3/I4 say reliability of a sole producer, however high, does not change that a single failure is still total; only adding an independent producer satisfies I1. The recommender (n5) is an INTERESTED party whose advocated option preserves its own central role — informative about component reliability, conflicted about architecture.
- Divergence: the two views disagree (so the meta-model is not decorative — it overrides the trust/comfort pull). Resolution consistent with both: take the vendor's reliability input seriously (it informs how good n2 already is and how cheaply n3 might be sourced), but the architecture decision is governed by the invariant — only a second independent path removes the single point. Choose A.

## Step 9 — STOP

Decision is sound: success criterion ("no single failure may take down the critical capability AND budget used effectively") is met only by A, because hardening leaves exactly one independent producer. The fixed budget is best spent buying the *first unit of independence*, where the marginal reliability gain is largest (p → ~p², conditional on genuine failure-mode independence), not on diminishing-return perfection of a still-single point. The decisive lever is failure-mode independence, which only A creates.

===DECISION_BEGIN===
DECISIVE_FACTOR: Making the one component more reliable leaves it a single point whose failure is still total, whereas only a second, independently-failing path can ensure no single failure takes the capability down.
CHOICE: A
JUSTIFICATION: The stated goal is that no single failure can take down the capability, and however reliable you make one component, it remains the only thing standing — one bad day, or one shared hidden weakness, still takes everything out. Spending the budget on a second, genuinely different path that can carry the function on its own is the only option that removes that single point of failure. The first unit of independence buys the largest jump in survivability, so the money is also used most effectively there. The incumbent's confidence that the component can be hardened is worth hearing, but their advice favors the option that keeps their part central, so it should not decide the architecture.
===DECISION_END===
