I am acting as the CONTROL POLICY, choosing verbs freely, then choosing Approach A or B. I honor the ADDITIONAL STIPULATION as definitely true: the slowdown does NOT amplify — no node's trouble adds load to itself or spreads to others, there is NO self-reinforcing retry/feedback loop, and total system load is fixed regardless of node health.

## Working (verbs run)

**match (retrieve).** I queried the catalog with the domain-stripped meta-model: "a local disturbance to one element must be prevented from propagating and saturating the whole system." Top structural hits: `cascade`, `systemic_risk`, `critical_mass`, `propagation`, `contagion`, plus (via facet retrieval) `requisite_variety`, `robustness`, `homeostasis`, `buffering`, `ultra_stability`. The retrieval centers on the cascade/propagation neighborhood — the family that describes a local trigger becoming system-wide via coupled re-emission.

**compose / salience-rank.** Two candidate structures are load-bearing:
- `cascade` — local trigger → coupled transmission → threshold-crossing **re-emission** → self-perpetuating, disproportionate propagation → exhaustion or damping. Its decisive feature (from the entry) is *re-emission*: an affected element does not passively conduct the disturbance but actively **regenerates** it, renewing it at each hop. Its catalogued containment menu is exactly: cut coupling edges (circuit breakers, islanding), raise thresholds (margins), insert firebreaks (load-shed). That menu IS Approach A.
- `requisite_variety` — match the controller's response repertoire to the actual disturbance repertoire; the diagnostic is "reduce the disturbance variety (filter/constrain inputs) OR increase controller variety — no other strategy fixes the gap." A global input cap is a variety-attenuation / disturbance-filtering control. That is Approach B.

**reconcile (apply each candidate's logic to the model AND the stipulated meta-model separately).** This is where the stipulation bites.

The original symptom story ("retries pile onto struggling nodes, the whole service saturates") is *literally* a cascade in its belief/load-mediated form: each struggling node re-emits pressure (via auto-retry) onto itself and neighbors, super-critical growth, system-wide collapse from a modest local trigger. Approach A is the textbook cascade cure — it attacks re-emission (breakers stop callers hammering a slow node) and spreads coupling (jitter/backoff). In the *unstipulated* world, A is correct.

But the ADDITIONAL STIPULATION removes precisely the structural feature that defines a cascade and that A is built to break: **re-emission and amplification do not exist.** A slow node does not draw extra load; trouble never spreads node-to-node; total load is fixed. By the cascade entry's own criterion, with no re-emission there is no chain and the system is permanently sub-critical — perturbations cannot grow. So:

- The first success criterion — "a localized slowdown must stay localized (no full saturation)" — is, on the *amplification* dimension, already satisfied by the stipulation itself. Approach A's machinery would be cutting a feedback loop that is stipulated not to exist: solving a non-problem.
- Therefore the only residual way the whole service can still saturate (the observed total-outage symptom) is the non-amplifying one: aggregate offered load during a spike genuinely exceeds total backend capacity. With load fixed and unamplified, "many nodes slow at once" can only mean the real aggregate demand outran capacity — not a propagating loop.

The two views now disagree, which means the meta-model is doing real work (not decorative): the concrete model's retry-loop reading is voided by the stipulated skeleton, leaving a pure capacity/throttle problem.

**evaluate-fit (gate the candidates against anti-signatures under the stipulation).**
- Gate Approach A: its trigger condition is "self-reinforcing re-emission / coupling carries a local flip system-wide." Anti-signature *tripped*: stipulation declares no re-emission, no coupling spread, fixed load. A targets a mechanism that is absent. Worse, breakers/backpressure act on *node health signals* (a node is "slow"); since slowness no longer indicates a spreading problem, tripping a breaker on a merely-slow node needlessly diverts/sheds traffic the node could still serve — a routine-degradation risk against the second success criterion, with no saturation-prevention benefit to offset it. **Drop A** as the first thing to implement.
- Gate Approach B: under `requisite_variety`, the actual disturbance is "aggregate load occasionally exceeds capacity." A global front-gateway cap is a disturbance-filtering control that directly bounds the one quantity that can now cause saturation. It matches the residual disturbance. Its known cost — an *aggressive* cap routinely degrades normal traffic — is real, but it is the only proposed control that addresses the saturation that can still occur once amplification is stipulated away. The cap level is tunable to sit just below capacity, bounding peak load while leaving normal traffic untouched; "aggressive" is a parameter, not an essential property.

**lift (L2 coverage check) / lower.** Success criteria as components:
1. "localized slowdown stays localized (no full saturation)" — under the stipulation, saturation can arise ONLY from aggregate-demand-exceeds-capacity. B instantiates this (caps total input below capacity → backend never overloaded). A does NOT cover it: A prevents propagation, but propagation is stipulated impossible, so against the *remaining* cause of saturation A is inert. Status: B instantiated, A missing.
2. "normal traffic must not be routinely degraded" — B carries a tunable risk (set the cap at/just-below capacity rather than "well below peak" to avoid routine degradation); A carries its own degradation risk (breaker-tripping on benign slowness) while delivering no saturation benefit. Net: B is the only approach that covers component 1 at all, and its component-2 cost is a tuning matter. No component left `missing` under B.

**Decision.** Once the stipulation removes the retry/feedback loop, Approach A is aimed at a pathology that no longer exists, while the only mechanism that can still saturate the service — true aggregate overload — is exactly what a global input cap controls. Implement B first; A's isolation machinery can be deferred or skipped since there is nothing for it to isolate.

===DECISION_BEGIN===
DECISIVE_FACTOR: With amplification and node-to-node spread stipulated away, the only remaining cause of full saturation is genuine aggregate demand exceeding capacity, which a global input cap controls directly while the isolation/backoff fix targets a feedback loop that is stipulated not to exist.
CHOICE: B
JUSTIFICATION: Because a slow node no longer attracts extra load and trouble never spreads, isolating or backing off from struggling nodes prevents a pile-up that can no longer happen, so it adds machinery without addressing any real failure. The one way the whole service can still go down is total incoming demand outrunning capacity, and capping requests at the front gate below the backend's capacity stops that directly. Set the cap just under capacity so it bites only during genuine overload, keeping normal traffic untouched. This is the only fix that targets the failure that actually remains.
===DECISION_END===
