# e02 — control-policy decision (free verb order, baseline)

## Working (verbs run)

### match (retrieve)
Anchored the meta-model — *a local degradation amplified by a reinforcing feedback loop, in which corrective reactions (retries) add load back onto the failing element, propagating into total collapse* — via two retrieval calls.

- `search_prime` (semantic, meta-model query): top hits `cascade` (0.74), then a decay/criticality neighborhood (`threshold_and_criticality`, `critical_mass`, `systemic_risk`, `contagion`).
- `search_by_facets` (oblique, 5 facets: cascade-spread / reinforcing-loop / fault-isolation / global-cap / shared-resource-worsening): fused ranking surfaced `circular_causality`, `tragedy_of_the_commons`, `scarcity`, `cascade`, plus per-facet `bottleneck` + `load_balancing` for the global-cap facet, and `system_archetypes` / `propagation` for the loop facet.

Candidates recorded with source-prime overlap: **cascade** (failure mechanism), **circular_causality** (the retry feedback loop), **bottleneck/scarcity** (what a global cap actually is). ≥1 candidate with overlap → match post-condition met.

### salience-rank
- `circular_causality` — **load_bearing**. The outage is a *reinforcing (positive) loop*: slow node → retries → more load on that node → slower. This is the engine of the failure, not the trigger. Removing this reading changes the recommendation.
- `cascade` — **load_bearing**. The loop's output is a propagation that crosses a criticality boundary and sweeps the system. Its catalogued containment menu (cut coupling / raise thresholds / insert firebreaks) is exactly the design space of the two approaches.
- `bottleneck` / `scarcity` — **context**. Describes Approach B's nature (a single global constraint) but is not the disease.

### get_prime (deepen the two load-bearing primes)
- **circular_causality**: confirms the structural move — intervene at the *loop* and its *leverage point*, not at a surface-visible activity point. Names this exact case ("retry storms", "circuit-breaker patterns are explicit loop-interruption designs") as a reinforcing loop whose remedy is to break the loop / reduce gain.
- **cascade**: the decisive structural facts —
  - The outcome is governed by **coupling and thresholds, not by the trigger** ("how the coupling repaid it"). The modest spike is a near-irrelevant trigger; the retry coupling is what carries it.
  - **T5 (decisive):** the structurally decisive cure is to **stop re-emission**, not to block paths or shrink the input. Each struggling node *re-emitting* load (via clients hammering it) is what sustains the cascade. Circuit breakers + backpressure are precisely the "stop re-emission / cut the coupling edge at the flipping element" move.
  - **T3 / T4:** a global containment cap that holds the whole system sub-critical does so by *reducing throughput in normal operation* — it routinely wastes capacity, i.e. routinely degrades normal traffic, and its working silently hides the unaddressed loop.

### search_archetype
Query (transport the containment pattern): top hits `instability_dampening`, `multiscale_resilience_architecture`, `fault_tolerant_operation` ("detect, **isolate**, mask, bypass… failed components"), `oscillation_damping` ("tuning feedback"), `local_disturbance_global_effect_tracing`. The whole neighborhood is *localized isolation + feedback-damping*, not *global throttling* — it maps onto Approach A.

### reconcile (concrete model vs. meta-model)
- **Concrete read (the service):** A trips a breaker on the slow path and spreads/jitters retries → the slow node stops being hammered → its slowdown stays confined to that path; healthy paths are untouched. B caps total ingress below peak → backend never overloads globally, but every busy-but-normal period now sheds legitimate requests, and a *localized* stall occurring under the cap still gets retry-amplified because retries still pile on the one struggling node.
- **Meta-model read (loop + cascade):** A attacks the **leverage point** — it breaks the reinforcing loop and removes re-emission at the node that is flipping, keeping the system sub-critical *locally* while leaving global capacity intact. B raises a single global threshold without touching the coupling/re-emission; per cascade theory it changes the system-wide criticality margin at the cost of permanent throughput loss, and leaves the local positive loop intact below the cap.
- **Both views agree** (no collapse): A satisfies *both* success criteria; B buys "no full saturation" only by sacrificing "normal traffic not routinely degraded," and even then incompletely addresses localized loops. The meta-model is doing real work — it is what reveals that B's global cap never touches the re-emission that defines the failure.

### evaluate-fit (gate B)
B's anti-signature is tripped: a global cap set "well below peak" is a blunt constraint that disqualifies on the second success criterion (routine degradation of normal traffic) and is a hollow fix for the stated mechanism (it does not interrupt the retry loop locally). Drop B as "first to implement."

### STOP
Decision is sound: the failure is a reinforcing-loop-driven cascade whose decisive cure is to stop re-emission / cut coupling at the struggling element. Approach A is that cure and meets both criteria; Approach B addresses neither the loop nor the second criterion. No coverage component left unaddressed.

## Encyclopedia tool calls (8)
1. `search_prime` (semantic meta-model query)
2. `search_by_facets` (5 facets)
3. `get_prime` circular_causality
4. `get_prime` cascade
5. `search_archetype` (containment pattern)

(5 distinct calls; match/get/search verbs above.)

===DECISION_BEGIN===
DECISIVE_FACTOR: The outages are driven by a self-reinforcing retry loop that re-feeds load onto the one struggling node, so the fix must interrupt that local feedback at its source rather than throttle all traffic globally.
CHOICE: A
JUSTIFICATION: The failure is caused by callers piling retries onto an already-slow node, which is what turns a small local slowdown into a system-wide collapse; circuit-breakers, backpressure, and spread-out retries stop callers from hammering the struggling node, so the slowdown stays confined to that path while every healthy path keeps running normally. A global cap set well below peak avoids overload only by routinely rejecting or degrading legitimate traffic, and it still leaves the retry pile-on intact for any localized stall that happens under the cap. Approach A therefore satisfies both goals — localized faults stay localized and normal traffic is not routinely degraded — while Approach B trades away the second goal and does not actually break the amplifying loop.
===DECISION_END===
