Skip to content

Arrest-and-Hold Protocol

Protocol — instantiates Mobile-Defect Reconfiguration

Halts an advancing defect on a trip condition and holds it in a safe, quarantined resting state until it is cleared to resume, reverse, or absorb.

Arrest-and-Hold Protocol is the emergency brake for a transition in motion. It defines the conditions under which an advancing defect must stop, brings it to rest at a valid resting point rather than wherever it happens to be, and quarantines it so a paused, half-migrated substrate stays safe and bounded for as long as the hold lasts. Its defining move is that stopping is a designed state, not merely an absence of motion: the protocol permits a halt only where the system can sit indefinitely without violating its invariants, and it isolates the frozen front so the pause doesn't leak inconsistency into the rest of the structure.

Example

A crew is running a backburn to widen a containment line ahead of a wildfire — a deliberate fire "front" advancing under control. The wind shifts and the spotting risk climbs past the burn boss's abort threshold. The Arrest-and-Hold Protocol takes over: the burn is not abandoned mid-slope (that would leave an unanchored edge that could run), it is walked to the next anchor point — a road, a creek, a rock face — where fire can be held indefinitely, and stopped there. The already-burned buffer becomes the quarantine: a black, fuel-free band that keeps the held edge from spreading while the crew waits out the wind. The invariant that must never break — the main fire never crosses the line — holds throughout. When conditions settle, the front resumes from the anchor, or the operation is reversed and mopped up from there.

How it works

  • Watch the trip conditions. Named thresholds — a safety metric, an error signal, an external hazard — that convert "something is wrong" into an unambiguous stop.
  • Halt at a valid resting point, not just anywhere. The front is brought to the nearest state the substrate can hold indefinitely; if it is mid-move, it is first walked to the closest safe boundary.
  • Quarantine the frozen front. The paused defect is isolated so a partially-migrated substrate can't spread inconsistency while stopped.
  • Hold the invariants and await disposition. Continuity and safety guarantees are maintained for the duration; the hold ends in a decision to resume, reverse, or absorb.

Tuning parameters

  • Trip sensitivity — how eagerly the arrest fires. A hair-trigger is safe but thrashes; a sluggish trigger risks holding too late.
  • Resting-point granularity — how many valid hold points exist along the route. Frequent safe anchors make arrest cheap; sparse ones mean a long walk to the nearest one.
  • Hold-duration budget — how long a quarantined pause may persist before it must escalate to resume, reverse, or absorb — since holding is rarely free.
  • Isolation strength — how hard the quarantine seals the frozen front against the rest of the substrate.

When it helps, and when it misleads

Its strength is that it turns a runaway or endangered transition into a bounded, survivable pause — buying time to diagnose without a panicked global cutover or an uncontrolled abort. It is what makes "stop" a real option in a path-dependent process.

Its danger is arresting into a state that is not actually safe to sit in — freezing wherever the front happened to be, so the "hold" is itself a half-migrated hazard.[1] A hold can also quietly become permanent: a paused transition no one dispositions rots into an indefinite mixed state worse than either endpoint. And an over-eager trip can thrash a system into never making progress. The discipline is to pre-define the valid resting states and verify the hold has actually reached one — and to pair every arrest with a disposition clock so a pause resolves rather than lingering.

How it implements the components

  • arrest_condition — the named trip thresholds that halt the advance.
  • quarantine_zone — the isolation that keeps the frozen front from spreading inconsistency during the hold.
  • continuity_and_safety_invariants — the guarantees the protocol keeps true throughout the pause, including the requirement that the resting state be one the substrate can hold indefinitely.

It stops and holds but does not undo: reversing the change is Counter-Defect Rollback Runbook, and final removal at journey's end is Terminal-Sink Handoff.

Notes

Not every point along a transition is a legal place to stop. The protocol's hardest design task is enumerating the valid resting states in advance; a system with few safe hold points can be arrested only rarely, which is itself a constraint on how the transition should be routed.

References

[1] Functional-safety practice — for example the "safe state" concept in IEC 61508 — treats the state a system falls back to on a fault as something that must be explicitly defined and validated, not assumed. An arrest-and-hold places the same requirement on its resting points. ↩