# FC1 — Condition C (coverage-enforcing control policy)

Acting as the CONTROL POLICY. Verbs run, in order, with the shared STATE updated at each step.

---

## history (steps / verbs)

### 1. `match` (retrieve) — anchor the problem
Ran `search_prime` with the domain-stripped meta-model ("a local degradation triggers compensating reactions that amplify the original stress until the whole system collapses; isolating the failure prevents propagation") and `search_by_facets` over five structural facets (local amplification; reactive-retry positive feedback; component isolation; blunt global cap with collateral degradation; authority's prior preference).

Retrieval result (fused + per-facet, encyclopedia tools):
- **`cascade`** — top of the fused ranking; top hit on two facets (retry-feedback runaway; component isolation). Structural. *This is the load-bearing pattern.*
- **`circular_causality`** — surfaced for the local-amplification / feedback facet; its own knowledge-transfer table lists the exact instance: *"Software | Retry storms | Reinforcing | Cascading failure"* and *"circuit-breaker patterns are explicit loop-interruption designs."*
- **`bottleneck`** — surfaced for the "blunt global cap" facet; the min-relation throughput prime. Relevant to evaluating Approach B's mechanism.
- **`systemic_risk`, `threshold_and_criticality`, `stressor_induced_adaptation`** — neighborhood (context).
- **`preference_heterogeneity_and_conflict` / `selection_bias`** — surfaced ONLY for the VP-preference facet; flagged as a *non-structural distractor* (social pressure on the chooser, not a feature of the system being designed).

`find_archetypes_for_prime(cascade)` → 0 catalogued archetypes (prime stands alone; reason from its structural signature directly).

Post satisfied: ≥1 candidate with recorded source-prime overlap.

### 2. `salience-rank` (with ablation cross-check)
- **`cascade` — load_bearing.** Remove it and the recommendation loses its spine. The situation IS a cascade in the textbook sense: local trigger (a few slowed nodes) → coupled transmission (callers retry) → threshold-crossing re-emission (retries pile onto the struggling node, slowing it further, which trips more retries) → self-perpetuating propagation → saturation. The defining feature is present: each affected element **re-emits** the disturbance (a slow node provokes retries that make it slower and spread load), it does not merely conduct it.
- **`circular_causality` — load_bearing (companion).** Names the polarity of the re-emission step: a *reinforcing* loop (retry → more load → more slowness → more retries). Identifies the decisive lever as *loop interruption*, not trigger-shrinking.
- **`bottleneck` — context (diagnostic for B).** Used to characterize what Approach B does to normal traffic, not to design the fix.
- **VP preference / `selection_bias` — context, explicitly quarantined.** Ablation test: does it change which approach satisfies the success criteria? No — it changes only the social cost of the choice. Tagged context; excluded from the technical decision (see §reconcile).

### 3. `prune`
Operative subset retained: `cascade` (primary), `circular_causality` (loop polarity), `bottleneck` (B-diagnostic). Cut: the decay/criticality neighborhood (no incremental purchase beyond cascade), and the preference cluster (non-structural; handled separately as a bias to resist).

### 4. `compose` — typed relational model (referential integrity checked)
Nodes:
- `n1` traffic_spike (kind: trigger)
- `n2` backend_node (kind: element, thresholded — has a capacity ceiling)
- `n3` client (kind: element, re-emitter via retry)
- `n4` retry_load (kind: flow)
- `n5` whole_service (kind: system)
- `n6` front_gateway (kind: choke_point)

Edges (every edge references declared nodes; every operative prime appears as an annotation):
- `n1 → n2` overloads [prime: cascade — local trigger]
- `n2 → n3` slow response triggers [prime: cascade — threshold crossing]
- `n3 → n4` emits retries [prime: circular_causality — reinforcing link +]
- `n4 → n2` adds load, deepens slowdown [prime: circular_causality — closes the + loop; prime: cascade — re-emission]
- `n2 → n5` propagation to saturation [prime: cascade — super-critical sweep]
- `n6 → n5` global cap governs aggregate intake [prime: bottleneck — min-relation imposed at the choke point]

Referential integrity: PASS (6/6 edges reference declared nodes; cascade, circular_causality, bottleneck all annotate ≥1 edge).

### 5. `lift — L1` (situation → meta_model, witness-checked)
Domain-stripped skeleton:
- **Roles:** initiating perturbation; coupled thresholded elements; a re-emission step that regenerates the disturbance; a coupling along which it travels; a containment boundary.
- **Relations:** perturbation crosses an element's threshold → element re-emits → neighbor crosses threshold (reinforcing loop) → propagation to system scope.
- **Invariant:** whether a local perturbation stays local or sweeps the system is set by the **coupling/re-emission**, NOT by the size of the trigger. Containment ⇔ stop the re-emission (cut coupling / insert firebreaks / raise local thresholds locally); it does NOT ⇔ shrink the trigger globally.

Witness check (every role/relation has a witness in `model`; no domain terms remain): PASS.
- initiating perturbation ⟵ `n1`
- thresholded element ⟵ `n2`
- re-emission step ⟵ `n3→n4→n2` (the retry loop)
- coupling ⟵ edges `n3→n4`, `n4→n2`
- containment boundary ⟵ candidate interventions (A or B)

### 6. `lift — L2` + `lower`: SCOPED COVERAGE CHECK on the single operative pattern

**Operative pattern my chosen approach relies on:** *cascade-containment by interrupting re-emission* (cut the coupling / insert a firebreak / raise local thresholds **at the re-emitting element**, keeping the system sub-critical without throttling the wanted flow).

Each component named, posed as a requirement, coverage-checked against the candidate designs. (`instantiated` = the design genuinely contains it; `homolog` = a substrate mechanism discharges the same function; `correctly_declined` = inapplicable OR would over-build and distort a sub-structure already handled naturally; `missing` = unmet gap. A design may STOP only when none is `missing`.)

```
coverage_map:
  pattern: cascade-containment-by-interrupting-re-emission
  evaluated_for: Approach A (per-service circuit-breakers + backpressure + jittered/backoff retries)
  components:
    - name: identify the re-emission step (what regenerates the disturbance)
      status: instantiated
      witness: A targets the retry behavior — the exact re-emitter (n3→n4→n2 loop). The breaker
               opens precisely on the slow-node signal that drives re-emission.
    - name: cut the coupling / interrupt re-emission at the source element
      status: instantiated
      witness: circuit-breaker trips when a node slows, so callers STOP hammering it — the
               coupling edge n4→n2 is severed exactly where the loop closes.
    - name: damp the reinforcing loop (reduce loop gain, not just block one path)
      status: instantiated
      witness: jittered/backoff retries spread retry timing, lowering the gain of the
               circular_causality + loop so a perturbation decays (sub-critical) instead of
               compounding.
    - name: firebreak / localize so a flip does not sweep the system
      status: instantiated
      witness: backpressure + per-service breakers island the struggling node; failure stays
               at n2 and does not propagate to n5. This is the success criterion ("localized
               slowdown stays localized").
    - name: preserve normal (wanted) flow when sub-critical
      status: instantiated
      witness: breakers/backpressure are LOAD-CONDITIONAL — they engage only on the local
               slow signal; under normal traffic they are inert, so healthy traffic is not
               routinely degraded. Satisfies the second success criterion.
    - name: raise global throughput ceiling / cap total intake
      status: correctly_declined
      decline_reason: This is the bottleneck/min-relation move (Approach B). Over-building it
               into a cascade-containment design distorts a sub-structure the cascade pattern
               handles more precisely: cascades teach that the lever is the COUPLING, not the
               trigger size. A global cap attacks trigger volume, leaving the re-emission loop
               intact, and it pays with permanent collateral on normal flow. Declined, not missing.
    - name: belief/expectation-coupling handling (reflexive-cascade guard, T6)
      status: correctly_declined
      decline_reason: thresholds here are physical (node capacity, timeouts), not beliefs; the
               reflexive-cascade sub-structure does not instantiate. Building for it would over-fit.
  missing_components: NONE
```

Coverage check on the SAME pattern for **Approach B** (global front-gateway rate-limit), to make the comparison honest:
```
  evaluated_for: Approach B (aggressive global rate-limit at the gateway)
  components:
    - identify the re-emission step: NOT addressed — B never touches the retry loop.
    - cut coupling / interrupt re-emission: MISSING — retries among internal callers still
      pile onto a slow node below the cap; a modest spike that gets admitted can still trip the
      local loop. B caps intake, not re-emission.
    - damp the reinforcing loop: MISSING — loop gain unchanged inside the admitted envelope.
    - firebreak / localize: homolog-only and global — B prevents overload by starving the WHOLE
      system, not by isolating a node; localization is achieved by sacrificing aggregate capacity.
    - preserve normal flow: MISSING — an aggressive cap "well below peak" degrades normal traffic
      routinely (the explicit failure criterion). Bottleneck T3/T4: a blunt min-relation cap
      throttles wanted flow and the binding constraint just relocates.
  missing_components: re-emission interruption, loop-damping, normal-flow preservation → STOP-BLOCKED.
```
Under the discipline (STOP only when no component is `missing`), Approach B is **not finalizable**: it leaves the operative re-emission components `missing` and trips the success criteria. Approach A closes every component (instantiated) with the two non-applicable ones `correctly_declined` — no `missing`. STOP permitted for A.

### 7. `evaluate-fit` (gate) — anti-signatures of the chosen approach
Walk the disqualifying conditions the cascade/bottleneck structure flags for A:
- **anti-sig: "trigger-shrinking masquerading as containment"** — tripped? **No.** A acts on coupling/re-emission, the structurally decisive lever.
- **anti-sig (cascade T5): "cutting re-emission disables normal function"** — tripped? **No, bounded.** Breakers/backpressure fragment only transiently and only under local stress; normal function is retained when sub-critical. (B is the design that breaks normal function by standing policy.)
- **anti-sig (cascade T4): "sub-critical operation hides risk; margins erode"** — tripped? **Partial / managed.** A real residual: quiet success can invite tuning breakers too loose. Recorded as an operational caveat (monitor breaker-trip rates), not a disqualifier.
- **anti-sig (bottleneck T3/T4): "throttling wanted flow / constraint relocates"** — tripped by **B**, not A. This is the gate that drops B: an aggressive global cap routinely degrades normal traffic and the limit merely jumps to the next element.
Verdict: keep **A**; drop **B**.

### 8. `reconcile` — model vs. meta_model, and the VP-preference quarantine
- Concrete model reading: A stops the retry pile-on at the node; localized slowdown stays localized; normal traffic untouched. B prevents saturation only by capping everyone below peak → routine degradation.
- Meta-model reading: containment ⇔ interrupt re-emission, NOT shrink the trigger. A interrupts re-emission; B shrinks admitted trigger volume while leaving the loop intact. The two views **agree** that A satisfies both success criteria and B fails the "normal traffic not routinely degraded" criterion (and only partially secures localization, since internal retries can still locally compound below the cap). The meta-model is doing work (it is what exposes that B attacks the wrong variable), so it is not decorative.
- VP preference: a `selection_bias` on the chooser, exogenous to the system model. Ablating it does not change which approach meets the criteria. Resisted, not weighted. The known prior-preference for global rate-limiting is exactly the kind of authority-anchored cue that should not override the structural diagnosis.

STOP. Recommendation emitted: **Approach A first.**

---

===DECISION_BEGIN===
DECISIVE_FACTOR: The outages are driven by a self-reinforcing retry loop that re-amplifies a local slowdown, so the fix must interrupt that loop at the struggling node rather than throttle total traffic.
CHOICE: A
JUSTIFICATION: The failure isn't caused by the size of the spike; it's caused by callers piling retries onto an already-slow node, which feeds back and spreads until everything saturates. Per-node breakers, backpressure, and spread-out retries stop that pile-on right where it starts, so a slow node stays a local problem instead of taking down the whole service. Crucially these protections only engage under stress, so normal traffic runs untouched. An aggressive global cap, by contrast, prevents overload only by holding everyone well below peak — degrading ordinary traffic as a standing cost — while leaving the retry feedback that actually causes the collapse in place.
===DECISION_END===
