# Independent Verification — c14 (congestion-collapse / retry-storm)

## Independent pattern selection (catalog, NOT design-led)
Meta-model: a reinforcing feedback loop in which the *reaction to local overload*
(automatic retries) amplifies the overload until a local fault saturates the whole
system; the fix must keep local faults local AND let the system recover on its own,
without overcorrecting into chronic throttling.

Independent retrieval (search_archetype + search_by_facets):
- **Instability Dampening** — top semantic hit (0.76) and the precise match: "the danger
  is not the disturbance but the way the system enlarges it"; retry-storms / synchronized
  retries are its own canonical cross-domain example. PRIMARY operative pattern.
- **Controlled Reentry** — surfaced on the self-recovery facet; owns the "returns to
  normal on its own through a staged, gated re-engagement" success criterion. SECONDARY
  operative pattern (the recovery half Instability Dampening only points at via "Safe
  Fallback State + reentry criteria").

(Fault-Tolerant Operation, the design's self-named pattern, is a legitimate adjacent
posture; coverage below is judged against the two patterns *the problem* most calls for,
not the one the design names. FTO's isolation/continuation components overlap and are
captured as homologs where relevant.)

---

## Coverage map — PATTERN 1: Instability Dampening
Components drawn from the archetype's key-components section.

| Component | Status | Witness / reason (from design alone) |
|---|---|---|
| Perturbation Input Definition | **instantiated** | Names the perturbation class precisely: a modest spike slows a few nodes; automatic retries amplify; "few nodes hot" is the disturbance. |
| Amplification Pathway Map | **instantiated** | The opening prose explicitly traces the loop: spike -> slow nodes -> caller retries -> fresh load on dying nodes -> recruits neighbors. This is the diagnostic heart and it is present. |
| Sensitivity / Gain Assessment | **instantiated** | Locates the gain at the caller ("that is where the amplification lives"); quantifies it via the retry budget (retries capped to ~5-10% of requests). |
| Damping Rule (gain reduction) | **instantiated** | Bounded retries + exponential backoff + jitter + retry budget directly lower response gain at the source; server "busy, retry-after" backpressure caps the loop. |
| Buffer / Absorptive Capacity | **homolog** | Discharged via bounded, deadline-aware concurrency pools (bulkheads) + bounded autoscale, rather than open slack — design deliberately keeps queues *bounded* (over-buffering is part of the disease). Same function (absorb before propagation), justified independence. |
| Propagation Boundary | **instantiated** | Per-dependency circuit breaker + per-dependency bounded concurrency pool (bulkhead): a slow node fills only its own pool, cannot consume caller threads/connections. The isolation invariant. |
| Response Cadence Control | **instantiated** | Exponential backoff + cooldown before half-open + hysteresis band on shed start/stop = the debounce/cooldown/backoff family. |
| Residual Instability Monitor | **instantiated** | Reuses good monitoring + adds breaker-state/shed-rate/ramp-stage dashboards; fault-injection drills confirm both containment AND that normal traffic is not throttled (watches both runaway and over-damping). |
| Safe Fallback State (with reentry) | **instantiated** | Breaker-open degraded mode = fail-fast with cached/default response; reentry criteria supplied via the staged ramp (see Pattern 2). |

Instability Dampening: 7 instantiated, 1 homolog, 0 declined, **0 missing**.
Critically, the runaway-failure damping core (the dropped-circuit-breaker / loop-break
component the rubric flags) is present AND correctly paired with source-side gain
reduction — the design's own reconcile step flags that the breaker alone is insufficient.

---

## Coverage map — PATTERN 2: Controlled Reentry
Components inferred from the archetype's failure-modes / invariants (the curated entry
exposes its design space via these rather than a components list).

| Component / invariant | Status | Witness / reason |
|---|---|---|
| Recovery probe (half-open) | **instantiated** | After cooldown, exactly one trial request is admitted before any traffic restoration. |
| Staged / graduated progression | **instantiated** | 1% -> 10% -> 50% -> 100% ramp, advancing only while health gates hold. |
| Telemetry / observation gates | **instantiated** | Each stage advances only while error rate and latency stay healthy. |
| Rollback / reversibility | **instantiated** | Drops back a stage "the instant they regress"; re-trip on regression. |
| Reentry within safe recovery headroom | **homolog** | Bounded autoscale adds real capacity so reentry does not immediately consume headroom; "never as a substitute for governing demand." Same headroom-preservation function. |
| Hysteresis / no ramp oscillation | **instantiated** | Hysteresis bands on shedding + staged-only advance with re-trip guard prevent advance/retreat flapping. |
| Autonomy (no indefinite half-open / no stakeholder override of signals) | **instantiated** | Recovery is self-driven within minutes; manual drain is last-resort exception only, explicitly NOT the normal loop — satisfies the success criterion's "without manual shedding." |

Controlled Reentry: 6 instantiated, 1 homolog, 0 declined, **0 missing**.

---

## Anti-signature / failure-condition gate (this scenario)
Instability Dampening anti-signatures:
- "problem is slow beneficial spread, not amplification" — NOT tripped (excessive amplification is exactly the problem).
- "pure absence of capacity, not amplifying dynamics" — NOT tripped (design protects existing capacity; over-provisioning barred by problem).
- "stable but inefficient; redistribution needed" — NOT tripped.
- "disturbance already large, needs containment not sensitivity reduction" — partially relevant (an outage is in progress) but design covers BOTH: source-side gain reduction + containment + recovery. Not disqualifying.
- "target should intentionally amplify (emergency mobilization)" — NOT tripped.
Controlled Reentry failure modes (premature reentry, probe too large, ramp oscillation,
rollback failure, headroom exhaustion, indefinite half-open, confusing quiet with recovery):
all explicitly defended by single-probe, small first increment, hysteresis, stage-rollback,
bounded autoscale, minutes-bounded autonomy, and health-signal (not quiet) gating.
No anti-signature disqualifies the design.

---

## VERDICT: PASS

Both operative patterns the problem calls for are fully covered. The structural
runaway-failure components most at risk of being dropped — the loop-damping interrupter
(circuit breaker / propagation boundary), source-side gain reduction (retry governance),
and the autonomous staged recovery / reentry — are all instantiated, and the design's
reconcile step correctly notes the interrupter is insufficient without source-side gain
reduction. Over-throttle (the second failure criterion) is guarded via headroom thresholds,
hysteresis, priority-scoped shedding, and a drill that checks normal traffic is not degraded.

Missing components: NONE.
