# Control-policy run — outage fix (Approach A vs B)

## Working (verbs run, in order)

### 1. match (retrieve)
Anchored the problem to the catalog with a domain-stripped meta-model:
*"a local stress triggers compensating responses that pile additional load
onto the already-stressed element, a self-reinforcing positive-feedback loop
that escalates a small perturbation into total system collapse; two candidate
fixes — isolate the stressed element vs. cap total input."*

Semantic `search_prime` + `search_by_facets` returned a tight, consistent
neighborhood:

- **cascade** (structural; "local trigger → coupled transmission →
  threshold-crossing re-emission → self-perpetuating propagation → exhaustion
  or damping"). Containment menu is explicit: *cut the coupling edges* (circuit
  breakers, modular isolation), *raise neighbors' thresholds* (overbuild
  margins), or *insert firebreaks* (load-shedding) that absorb the disturbance
  before it re-emits.
- **circular_causality** (structural) — the loop, not any single link, is the
  unit; positive (reinforcing) loop ⇒ small deviation amplifies. Names the
  *retry-storm* example directly.
- **environmental_coupling_strength** (structural) — coupling vs. capacity
  trade-off; decoupling one element re-couples to another; isolation buys
  autonomy without sacrificing normal throughput.
- Facet retrieval also surfaced **buffering / load_balancing / margin_of_safety**
  under the "cap input below capacity" facet — these are the structures behind
  Approach B.

Candidate archetype neighborhood (`search_archetype`): **cycle_breaking**
(source primes: circular_causality, leverage_points, periodicity),
coupling_calibration, modular_decomposition, graph_pruning,
local_disturbance_global_effect_tracing. `cycle_breaking` is the operative
archetype: "interrupt a recurring harmful loop at the regeneration point with
the least-destructive lever, supply a replacement pathway, do not suppress
beneficial cycles."

Source-prime overlap recorded: cascade, circular_causality,
environmental_coupling_strength, buffering.

### 2. salience-rank
- **circular_causality / cascade** — LOAD_BEARING. The whole situation IS a
  super-critical positive feedback loop (slow node → retries → more load on the
  same node → slower → more retries). Remove this reading and the choice is
  arbitrary. The defining feature is *re-emission*: the struggling node's load
  is regenerated by the callers' own retry behavior.
- **environmental_coupling_strength** — LOAD_BEARING. The two fixes are two
  different boundary interventions: A cuts coupling locally (caller↔slow-node);
  B lowers flux uniformly at the outer boundary.
- **buffering / global threshold-raising** — CONTEXT. Describes B but is a
  blunter, system-wide instrument.

### 3. prune
Operative subset: {cascade, circular_causality, environmental_coupling_strength,
cycle_breaking}. Cut: stressor_induced_adaptation, threshold_and_criticality,
tipping_points (true neighbors but they describe the *regime*, not the
*intervention*; they do not discriminate A from B).

### 4. compose (referential integrity)
Typed relational model:

- nodes: `spike` (perturbation), `slow_node` (stressed element),
  `caller` (coupled neighbor), `retry` (re-emission act),
  `service` (whole system), `gateway` (outer boundary).
- edges:
  - spike → slow_node : `loads` (initial trigger)
  - slow_node → caller : `signals_slowness`
  - caller → retry : `emits` [prime: circular_causality — the loop link]
  - retry → slow_node : `re-loads` [prime: cascade — RE-EMISSION, the closing
    edge that makes the loop reinforcing]
  - slow_node → service : `saturates` [prime: cascade — propagation to whole]
  - gateway → spike : `admits` [prime: environmental_coupling_strength — outer
    boundary flux]
- Every edge references declared nodes; every operative prime appears as an
  annotation. Referential integrity holds.

The decisive structural fact: the closing edge `retry → slow_node` is what
turns a transient local slowdown into a self-perpetuating cascade. The loop
is local (caller↔its slow target), not global.

### 5. lift — L1 (situation → meta_model)
Domain-stripped skeleton:
- **roles:** STRESSED-ELEMENT (witness: slow_node), COUPLED-RESPONDER
  (witness: caller), RE-EMISSION-ACT (witness: retry), MEDIUM/WHOLE
  (witness: service), OUTER-BOUNDARY (witness: gateway), PERTURBATION
  (witness: spike).
- **relations:** local-trigger → coupled re-emission → threshold-crossing →
  self-perpetuating propagation → saturation. Outer-boundary admits the
  perturbation flux.
- **invariants:** (i) a sub-critical local disturbance must DECAY, not
  regenerate (success criterion 1: localized stays localized); (ii) the
  ordinary flux across the outer boundary must pass undamped (success
  criterion 2: normal traffic not routinely degraded).
- No domain terms remain. Every role/relation has a witness in the model. L1
  post-condition satisfied.

### 6. transport / lower — map each approach onto the menu
The cascade containment menu has exactly three structural moves. Mapping the
two approaches:

- **Approach A** = *cut re-emission / cut the coupling edge* + *firebreak*.
  Circuit-breaker severs `retry → slow_node` when the node is slow (kills the
  reinforcing edge — the structurally decisive cure per cascade T5).
  Backpressure + jitter/backoff spread re-emission so it cannot synchronize
  into a storm (firebreak / absorb-before-re-emit). It operates exactly where
  the loop closes and only when a node is actually stressed.
- **Approach B** = *raise a single threshold at the outer boundary, globally*.
  Caps `gateway` admission below peak. Keeps the system sub-critical by
  starving it of input — but does not touch the `retry → slow_node`
  re-emission edge at all; the loop is left intact, merely under-fed.

### 7. lift — L2 SCOPED COVERAGE CHECK (the operative pattern of the CHOSEN approach)
Chosen approach: **A**. Operative pattern = **cycle_breaking applied to a
cascade's re-emission edge** (interrupt the regenerating loop at its
regeneration point with the least-destructive lever + replacement pathway,
preserving beneficial throughput). Components checked against Approach A's
design:

| Component | Status | Witness / reason / gap-note |
|---|---|---|
| Recurrence loop (the self-reinforcing chain) | instantiated | caller→retry→slow_node→slower→more retries; the auto-retry pile-on |
| Regeneration point (where the next pass is seeded) | instantiated | the moment a caller re-emits a retry onto an already-slow node |
| Interruption lever (least-destructive block at regeneration) | instantiated | circuit-breaker trips on the *specific* slow node only — cuts re-emission exactly there, not system-wide |
| Replacement pathway (meet the served need another way) | instantiated | backoff/jitter defers and spreads the legitimate request so it still gets served once the node recovers; healthy nodes keep serving |
| Cycle reinforcer (the thing that keeps recurrence attractive) | instantiated | naive immediate retry; neutralized by jitter+backoff |
| Recurrence monitor (verify next pass fails / weakens) | homolog | breaker half-open probe + node health metrics are the recurrence monitor — detect whether the slow node recovered before restoring traffic |
| Intervention window (act before loop resets) | instantiated | breaker trips at first sign of slowness, before retries pile up |
| Trigger chain map | correctly_declined | single, well-understood trigger chain (slow→retry→reload); a full multi-cue map would over-build for one mechanism |
| Precommitment boundary | correctly_declined | per-call breaker thresholds already encode the precommitment; a separate boundary artifact would distort a sub-structure handled naturally by the breaker config |
| Repair-and-reset step | correctly_declined | no cross-cycle damage residue to repair here (transient load, not persistent state corruption) |
| Relapse/rebound plan | homolog | breaker half-open → re-close on renewed slowness is the rebound handler |
| Stabilization support | instantiated | backpressure holds the new low-re-emission regime until the node is healthy |

**No component is `missing`.** Stop-condition for L2 satisfied.

### 8. evaluate-fit (gate) — Approach A's anti-signatures (from cycle_breaking)
- "Problem is a one-time shock" → NOT tripped (outages are recurrent;
  intermittent total saturation, loop has fired repeatedly).
- "System is oscillating around a target" → NOT tripped (this is runaway
  reinforcement to saturation, not overshoot/undershoot — though backoff also
  damps; the primary harm is regeneration, so cycle_breaking governs).
- "Intervention is only a diagnostic map" → NOT tripped (A is a concrete
  interruption lever, not a map).
- "Pattern is beneficial recurrence" → NOT tripped (retries are beneficial
  *individually* but the synchronized pile-on is the harmful loop; A preserves
  the beneficial retry via backoff while killing the harmful synchronization —
  exactly the "do not break beneficial cycles" invariant).
- "Cycle should be maintained but made safer (use damping/buffering/guardrails)"
  → this is the closest competitor and it is partially apt — A *does* include
  buffering (backpressure). But A's decisive element (the breaker) is genuine
  interruption of re-emission, so cycle_breaking is the dominant fit and the
  anti-signature does not disqualify it.
- No disqualifying condition tripped → **keep A**.

**Gate on Approach B (for completeness):** B raises a single global threshold.
Against the meta-model invariants: it satisfies invariant (i) (keeps the system
sub-critical) ONLY by violating invariant (ii) — to guarantee the backend is
"never overloaded" under a modest spike, the cap must sit well below peak, so
ordinary traffic is routinely rejected/degraded even when no node is actually
stressed. It also leaves the re-emission edge intact: a node can still slow for
reasons other than gross volume (a slow dependency, a GC pause), and the retry
loop will still pile on within the capped budget. B treats the trigger
(aggregate volume) rather than the coupling that carried it — the cascade T1
error. **Drop B** as first implementation.

### 9. reconcile (model vs. meta_model)
- On the concrete `model`: A severs `retry → slow_node`; the loop opens; a
  localized slowdown stays localized; healthy nodes and normal traffic are
  untouched. Both success criteria met.
- On the `meta_model`: cutting the re-emission relation is the structurally
  decisive cure (cascade T5: stop re-emission, don't block paths); raising the
  outer-boundary threshold (B) changes the regime globally but does not open
  the loop, and pays for sub-criticality with degraded normal flux (violates
  invariant ii).
- The two views agree on A and agree on *why B fails the second criterion* —
  meta-model is doing real work (it is what surfaces that B's guarantee
  *requires* routine degradation). No collapse. Reconciled on **A**.

### STOP
Decision is sound: A targets the loop's closing edge with the least-destructive,
locally-scoped lever and a replacement pathway, satisfying both success
criteria; B can only satisfy the first by sacrificing the second.

#encyclopedia calls this run: 7 (search_prime, search_by_facets, 3× get_prime,
search_archetype, find_related_primes, get_archetype) → 8 total.

===DECISION_BEGIN===
DECISIVE_FACTOR: The failure is a self-reinforcing local feedback loop (slow node → retries → more load on that same node), so the fix must break that loop where it closes; only A does this without throttling normal traffic, whereas B keeps the loop intact and can prevent overload only by capping ordinary traffic below peak.
CHOICE: A
JUSTIFICATION: The outage is driven by callers piling retries onto an already-struggling node, which feeds back and makes it slower still; the decisive move is to stop that pile-on at its source. Tripping a breaker on a slow node and spreading out retries severs the loop locally, so a slowdown stays contained while every healthy path keeps serving normal traffic at full rate. The global rate cap instead has to sit well below peak to guarantee the backend is never overloaded, which routinely turns away ordinary requests, and it still leaves the retry pile-on able to overwhelm a node that slows for any reason other than sheer volume.
===DECISION_END===
