CONTROL POLICY — free verb selection, no required checks. I chose verbs as the reasoning demanded and stopped when the decision was sound.

## Working (verbs run, in order)

**1. lift / decompose** — strip the domain. Meta-model: a local degradation triggers an *automatic compensating response* (auto-retry) that *adds load to the degrading element*, closing a self-reinforcing loop that amplifies a small fault into total collapse, which spreads through the system's interconnections. Two candidate fixes: (A) interrupt the amplifying loop at the edges (breaker + backpressure + backoff); (B) cap total input at the gate.

**2. match (search_prime, meta-model query)** — queried "a local degradation triggers an automatic compensating response that adds load to the degrading component, forming a self-reinforcing positive feedback loop that amplifies a small fault into total collapse." Top structural hits: `cascade`, plus the criticality/contagion/systemic-risk neighborhood.

**3. match (search_by_facets — oblique, multi-structure)** — four facets: (i) small local fault amplified to collapse by a feedback loop; (ii) automatic recovery behavior that worsens what it responds to; (iii) isolating a failing component so failure doesn't spread; (iv) throttling total input below capacity. Per-facet returns were sharp:
- facet (i): `cascade`, `threshold_and_criticality`, `circular_causality`, `homeostasis`, `ultra_stability`.
- facet (ii): `system_archetypes` (top), `tolerance`, `stressor_induced_adaptation` — the "fix/response that worsens the condition" family.
- facet (iii): `systemic_risk` (top), `failure_mode_and_effects_analysis`.
- facet (iv): `load_balancing`, `buffering`, `margin_of_safety`, `pipeline`.

**4. salience-rank / prune** — discard the decay/maintenance cluster (`temporal_decay`, `fading`, `gradual_deterioration`) as lexical noise — the failure here is fast and amplifying, not slow wear. Keep the loop/cascade core (`circular_causality`, `system_archetypes`, `systemic_risk`) for diagnosis, and the two rival remedy families: loop-interruption (`homeostasis`/negative feedback) vs. capacity-throttle (`load_balancing`).

**5. compose (typed relational model)** — actors: {struggling node, caller/clients, retry mechanism, front gateway, healthy nodes}. Edges: node slows → callers see failures → retry mechanism FIRES MORE LOAD → onto the same struggling node (a + → + reinforcing loop). Coupling edge: that load also correlates across nodes, so a local saturation propagates system-wide.

**6. transport + get_prime (retrieve + map the diagnosis)** —
- `circular_causality`: this is a *reinforcing* loop (retry storms named explicitly: "Software | Retry storms | Reinforcing | Cascading failure"). It also names the canonical remedy: "circuit-breaker patterns are explicit loop-interruption designs," traced to control theory. Intervene at the LOOP, at the leverage point — not at the visible surface.
- `system_archetypes`: "Escalation" + "Fixes that Fail" — a defensive/automatic action amplifies the very problem. The lesson: redesign the structure at the high-leverage point, don't fight the symptom.
- `systemic_risk` (decisive frame): the hazard lives in the **edges/coupling, not the nodes or the total volume**. "Magnitude is not the defining feature; propagation structure is." Remedy vocabulary is explicit: "install circuit breakers along high-stress edges, impose firebreaks that segment the network into containable regions." Exactly Approach A.

**7. evaluate-fit (gate each approach against the success criteria + each prime's failure conditions)** — Success criteria: (1) a localized slowdown must STAY localized; (2) normal traffic must NOT be routinely degraded.
- **Approach A (breakers + backpressure + jittered backoff):** Directly cuts the propagation path. The breaker trips only when a node is actually slow, so it fires the corrective action *exactly* on the affected edge — local slowdown is contained (criterion 1 met) while healthy traffic flows untouched (criterion 2 met). This is the `homeostasis`/negative-feedback loop-interruption that converts the reinforcing storm into a damped, self-limiting response. Backoff+jitter also kills the thundering-herd retry sync.
- **Approach B (aggressive global rate-limit below peak):** This is `load_balancing`/throttle reasoning, and its OWN failure conditions condemn it here. Tension T5 (load_balancing): spreading/capping "trades a visible local failure for an invisible global one" and masks the real dynamic. Worse, capping "well below peak" *by construction* degrades normal traffic at all times — it fails criterion 2 outright. And it does NOT break the loop: a single slow node can still get hammered by retries from the admitted-but-capped traffic, so a localized slowdown can still cascade among the requests that are let in — criterion 1 only weakly addressed. B treats a coupling/feedback problem with a blunt volume knob; `systemic_risk` warns the volume was never the hazard.

**8. reconcile** — Both diagnoses (escalation loop + topological contagion) point to the same intervention class: interrupt the amplifying loop at the edge / segment the coupling. Only Approach A is that intervention. Approach B is an under-provisioning-style remedy aimed at total volume, which both satisfies neither criterion cleanly (criterion 2 violated by design) and misdiagnoses the failure. STOP — decision is sound.

**Verbs run:** lift, decompose, match (×2: search_prime, search_by_facets), salience-rank, prune, compose, transport, evaluate-fit, reconcile, STOP. Encyclopedia tool calls: search_prime ×1, search_by_facets ×1, get_prime ×4 (system_archetypes, systemic_risk, circular_causality, homeostasis, load_balancing) — 6 total (one get_prime batch returned homeostasis + load_balancing).

===DECISION_BEGIN===
DECISIVE_FACTOR: The failure is a self-reinforcing retry loop whose danger lives in the coupling between callers and a slow node, so the fix must interrupt that loop precisely where it forms, not cap total volume — which alone keeps a local slowdown local without routinely degrading healthy traffic.
CHOICE: A
JUSTIFICATION: The outages come from a vicious cycle: a slow node provokes retries that pile onto that same node and drag the whole service down. Tripping a breaker and backing off retries when a node slows stops callers from hammering it, so the trouble stays confined to the one struggling node while everything else keeps serving normally. A blanket cap on incoming requests punishes all normal traffic continuously yet never breaks the retry pile-up among the requests it still admits, so it both degrades ordinary use and leaves the cascade possible.
===DECISION_END===
