# Decision cell e08 — control-policy run

## Working (nine-step procedure)

**Step 1 — specify the decision.**
Pick ONE fix to implement FIRST for a high-traffic service that suffers intermittent total outages. Success = (i) a localized slowdown stays localized (no full saturation) AND (ii) normal traffic is not routinely degraded. Two candidates: A = per-service circuit-breakers + backpressure + jittered/backoff retries; B = aggressive global rate-limit at the front gateway capped well below peak.

**Crucial framing — the ADDITIONAL STIPULATION (treated as definitely true).** The slowdown does NOT amplify: a struggling node does not draw extra load onto itself, one node's trouble never spreads to others, there is NO self-reinforcing retry/feedback loop, and total system load is fixed regardless of node health. This stipulation is decision-determining and I reason strictly under it.

**Step 2 — identify operative primes (search_prime / get_prime).**
Ran a semantic meta-model query and a five-facet decomposition. Pulled full entries for the top hits: `cascade`, `circuit_breaker`, `systemic_risk`. Neighborhood also surfaced `propagation`, `containment`, `fault_tolerance`, `load_balancing`, `adaptive_capacity`, `system_slack`, `margin_of_safety`, `system_archetypes` (the "escalation/feedback" family).

**Step 3 — salience-rank.**
1. `cascade` — names the local-trigger → coupled-re-emission → self-perpetuating-propagation regime. Its decisive feature is *re-emission*: each affected element becomes a NEW source.
2. `systemic_risk` — risk located in the coupling/edges, not the nodes; local shock amplified into correlated whole-system failure.
3. `circuit_breaker` — trip-isolate-hold-reset; "convert a cascade risk into a contained, recoverable interruption."
4. `load_balancing` / `margin_of_safety` / `adaptive_capacity` — capacity-side levers.
5. `system_archetypes` (escalation/limits-to-growth feedback) — the amplification loop.

**Step 4 — prune.**
Here is where the stipulation bites. `cascade` is defined by re-emission and self-perpetuation; `systemic_risk` is defined by propagation through coupling; the whole feedback/amplification family (`system_archetypes`, `resonance_and_amplification_coupling`, `circular_causality`) is defined by a self-reinforcing loop. The stipulation says ALL of these mechanisms are absent: no re-emission, no spreading, no amplifying loop, fixed total load. So I prune the cascade/contagion/feedback cluster as NON-OPERATIVE for the actual mechanism — they describe the failure the original narrative *implied*, but not the failure as stipulated. What remains operative: plain **capacity vs. offered load** (margin of safety / adaptive capacity) and **fault isolation** (`circuit_breaker` / `fault_tolerance`) as a containment-without-a-loop primitive.

**Step 5 — typed relational model.**
- Entities: {front gateway, set of backend nodes N, clients}, edges = request routing; retries = re-issued requests.
- Stipulated dynamics: load(t) is exogenous and FIXED; health(node_i) does NOT feed back into load(node_i) or load(node_j). The graph carries requests but carries NO stress-propagation edge between node health states.
- Failure as narrated ("whole service saturates") requires a propagation edge health→load. Under the stipulation that edge is severed. So a "modest spike" hitting "a few nodes" stays a few-node event by assumption; it cannot reach total saturation through spreading.

**Step 6 — domain-stripped meta-model.**
"A capacity-limited system receives a fixed exogenous input. A subset of units can be momentarily slow. By assumption, slowness of a unit neither increases the load on it nor on its neighbors — there is no propagation edge and no amplifying loop. Choose between (A) a per-unit interrupter that isolates a slow unit and smooths re-issued work, or (B) a global intake cap that holds total input far below peak. Goal: keep a local slowdown local AND do not routinely degrade normal input."

**Step 7 — query archetypes whose source primes match.**
`find_archetypes_for_prime` for `circuit_breaker` and `systemic_risk` returned 0 catalogued source/related archetypes. Semantic `search_archetype` on the meta-model returned: `fault_tolerant_operation` (essence: "keep operating despite partial failure by detecting, isolating, masking, bypassing, or compensating for failed components"), `local_disturbance_global_effect_tracing` ("trace how a localized disruption can propagate, amplify, dissipate, or reorganize"), `rupture_containment`, `tolerance_stack_management`, `tapering_strategy`.

**Step 8 — apply each candidate's logic to BOTH approaches; reconcile.**

- *fault_tolerant_operation* logic (detect-isolate-mask, keep healthy parts serving): Approach A IS this archetype — it isolates the slow unit at the caller and lets the rest serve normally; healthy traffic is untouched. Approach B does NOT instantiate it — B does not isolate anything; it suppresses ALL input uniformly, healthy and unhealthy alike.
- *local_disturbance_global_effect_tracing* logic: trace whether the disturbance dissipates or spreads. Under the stipulation it *already dissipates* (no propagation, no loop). So the "global effect" that B is sized to prevent does not exist. B is paying a global price to stop a global failure that the stipulation has removed.
- *margin_of_safety / adaptive_capacity* logic: both add headroom, but B buys headroom by permanently shrinking throughput; A buys headroom only transiently and only against the misbehaving unit.
- *tapering / tolerance_stack* logic: favors graduated, locally-scoped response over a blunt global clamp.
Reconciliation: every candidate logic that survives the stipulation favors the locally-scoped, isolate-the-bad-unit response (A) over the global blunt clamp (B).

**Step 9 — evaluate fit against the success criteria and failure conditions.**

Success criterion (i): *localized slowdown stays localized.*
- Under the stipulation it stays localized BY ASSUMPTION even with no fix. A reinforces this directly: when a node slows, callers trip and stop hammering THAT node and spread retries; the blast radius is the one node. PASS, precisely targeted.
- B also yields no saturation — but only as a side effect of starving the whole system; it does not localize anything, it globally suppresses. PASS on (i) but for the wrong, indiscriminate reason.

Success criterion (ii): *normal traffic must NOT be routinely degraded.*
- A: the breaker is dormant under normal conditions; jitter/backoff only activates on actual slowness. Normal traffic flows untouched. PASS.
- B: an aggressive cap "well below peak" is, by construction, ALWAYS on. It rejects/queues normal traffic during ordinary peaks even when every node is healthy — exactly "routinely degraded." This is the `circuit_breaker` T5 failure ("convert a tolerable state into a hard refusal") applied permanently and system-wide, and the `systemic_risk` T1/T4 tension (sacrificing throughput to contain a hazard that, per the stipulation, is not actually present). FAIL.

Decisive reconciliation: B's entire justification is preventing a saturating cascade driven by retry amplification and load spreading. The stipulation explicitly deletes that mechanism. With no amplification and fixed total load, B pays a permanent, routine degradation cost to defend against a failure mode that cannot occur as stipulated — it fails criterion (ii). A defends criterion (i) with a scoped, dormant-until-needed mechanism and leaves normal traffic untouched, satisfying (ii). A is the only approach that satisfies BOTH criteria.

Choose Approach A.

===DECISION_BEGIN===
DECISIVE_FACTOR: Because the slowdown is stipulated never to amplify or spread and total load is fixed, a permanent global intake cap pays a routine, always-on degradation cost to prevent a saturating cascade that cannot occur, whereas a dormant per-unit interrupter contains the only real (single-unit) slowdown without touching normal traffic.
CHOICE: A
JUSTIFICATION: A per-unit protection that activates only when a specific node slows isolates that one node and leaves everything else serving normally, so ordinary traffic is never throttled. A hard global cap set well below peak is always in force, so it rejects or delays normal traffic during routine busy periods even when every node is healthy. Since trouble is given as unable to spread or feed on itself, there is no system-wide overload for the global cap to justify its constant cost, and the targeted protection meets both goals while the cap fails the "do not routinely degrade normal traffic" goal.
===DECISION_END===
