Skip to content

Adaptive Stop, Reclosure, and Rescue Protocol

Safety protocol — instantiates Reopened Malleability Window

Holds the independent authority to halt a reopening, force the system back toward a stable state, and fall back to a rescue path when destabilization breaches its bounds.

Deliberately destabilizing a settled system is only defensible if someone can pull the plug and there is a way back. Adaptive Stop, Reclosure, and Rescue Protocol is that safety spine: it vests the authority to halt the reopening in a party independent of whoever wants the change, wires that authority to a boundary-violation signal, and holds a pre-built path back to a stable state — reclosure if the system can be re-settled, rescue if it cannot. Its distinguishing move is independence under pressure: it is built to fire against the operators' wishes, at the exact moment their momentum ("we're almost through") argues loudest for pressing on. It acts; it does not measure or verify — it consumes a monitor's alarm and executes the stop, the reclosure, or the fallback.

Example

An engineering org needs to reopen a long-frozen, deliberately-immutable production database schema to run a risky migration — unlocking on purpose something that had been locked for stability. Before the unlock, the protocol is armed. A release captain who is not on the migrating team holds a hard stop. Bounds are declared: data-integrity check failures, replication lag, error rate. Two paths are pre-built and rehearsed — reclosure (re-lock the schema, restore the last consistent snapshot) and rescue (route traffic to the read replica and defer the migration entirely). Mid-migration the integrity checks spike past the bound. Over the migrating team's objection that they are minutes from done, the captain calls the stop; the schema re-locks, the snapshot restores, traffic fails over to the replica. The change is deferred — but nothing is corrupted, and the system is back in a known-stable state. The value was entirely in the stop authority sitting outside the group with a stake in finishing.

How it works

The protocol turns a hazardous interval into a survivable one through three pre-committed provisions:

  • Independent halt authority — the power to stop is held by a party with no stake in completing the change, so momentum and sunk effort cannot veto a needed abort.
  • Pre-armed reclosure — the route back to a stable, re-settled state is built and tested before induction, with an explicit criterion for when to force it, so re-stabilization is not improvised in crisis.
  • Rescue fallback — a distinct compensation path for when the system cannot be returned to its prior state, protecting it in a safe, possibly-degraded configuration rather than leaving it stranded open.

Tuning parameters

  • Authority independence — how separated the stop-holder is from the operators. More independence resists rationalized continuation; too much distance can make the halt slow or uninformed.
  • Trip thresholds — how tight the boundary-violation triggers are set. Tight stops early and safe but aborts salvageable inductions; loose lets more finish but risks a late catch.
  • Reclosure aggressiveness — snap back hard versus re-settle gradually. Hard reclosure restores stability fast but can itself jar the system; gradual is gentler but slower to safety.
  • Rescue completeness — full restoration versus a degraded-but-safe fallback. Aiming for full recovery is better when reachable; a degraded safe state is the honest target when it is not.

When it helps, and when it misleads

Its strength is that it makes the whole hazardous pattern defensible — because a competent, independent party can halt the reopening and there is a rehearsed path back, the labile interval can be entered at all. It is the difference between a bounded risk and an open-ended one.

Its failure modes cluster on the independence and the rehearsal. A stop authority that is independent only on paper — really answerable to the people who want the change — will not fire when it must; this is the quiet, common way the safeguard fails.[1] Reclosure and rescue paths that were never tested may not restore stability when finally invoked. And an over-eager trip aborts good inductions, training the team to distrust and route around the stop. The discipline is to keep the authority genuinely separate, rehearse reclosure and rescue before induction, and set trip thresholds from the monitor's evidence rather than from the operators' confidence.

How it implements the components

The protocol realizes the archetype's safety-and-recovery spine — the components that govern getting out of the labile state:

  • independent_safety_stop_and_rescue_authority — it vests the halt-and-rescue power in a party independent of the operators, empowered to terminate even when they want to continue.
  • re_stabilization_and_reclosure_criterion — it defines the criterion for forcing a return to stability and executes the reclosure that re-settles the system.
  • rescue_fallback_and_compensation_path — it holds the pre-built fallback that protects the system when reopening fails and full re-stabilization is not reachable.

It does NOT measure the labile interval it acts on (Destabilization Depth and Breadth Monitor), test whether re-stabilization was durable and selective after the fact (Selective Re-stabilization Challenge), or gate eligibility upstream (Induction Eligibility and Contraindication Screen).

Notes

Independence is the load-bearing property, not a formality. A stop authority that reports to the people invested in completing the reopening is not a stop authority — it is a rubber stamp that will find a reason to keep going at exactly the moment stopping matters most. If only one design choice can be protected, protect the separation between who runs the induction and who can end it.

References

[1] A Data Safety Monitoring Board — an independent body empowered to halt a trial on safety grounds even against the investigators' wishes — is the canonical real instance of a stop authority deliberately placed outside the group with a stake in continuing. It is the model for why this protocol's halt power must sit apart from the operators. ↩