---
id: ADR-PFM-DJE-013
title: Capacity decisions with hysteresis and an optional emergency switch
product_area: platform
module: data-job-engine
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  The minute sentinel derives protection with hysteresis, publishes through
  independent channels and honors expiring staff pins; emergency stage throttles
  require an explicit switch that defaults off.
constrains:
  - DOM-PFM-DJE-006
  - STATE-PFM-DJE-006
  - WF-PFM-DJE-015
  - WF-PFM-DJE-016
  - SVC-PFM-DJE-capacity
origin: >-
  services-platform:docs/proposals/api-workload-governance/README.md D1 to D10
  and brief 3.2 (approved 2026-10-17)
alternatives:
  - option: Change protection on every individual reading
    why_not: Individual spikes would cause unstable protection changes.
  - option: Retain protection indefinitely when metrics fail
    why_not: >-
      Signal loss would hold background work without evidence of continuing
      pressure.
  - option: Enable emergency stage throttles by default
    why_not: Stage-wide limits require an explicit operational choice.
consequences:
  - >-
    Three supporting readings can enter the highest supported non-emergency
    state directly; recovery uses calmer readings and spacing.
  - >-
    Without an active pin, the second failed metric read returns to normal;
    publication failure is a separate failure path.
  - >-
    Emergency throttles take effect only when enabled, and applied throttles are
    restored before a recovery state step.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a65:
    modules/capacity/services/capacity/decide-state.ts, run-sentinel.ts,
    apply-emergency-throttles.ts
---

# Capacity Decisions With Hysteresis And An Optional Emergency Switch

## Context

Background work should yield under sustained pressure without oscillating on isolated readings.

## Decision and Origin

The minute sentinel derives protection with hysteresis, publishes through independent channels and honors expiring staff pins; emergency stage throttles require an explicit switch that defaults off. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

## Alternative Comparison

Change protection on every individual reading: Individual spikes would cause unstable protection changes.

Retain protection indefinitely when metrics fail: Signal loss would hold background work without evidence of continuing pressure.

Enable emergency stage throttles by default: Stage-wide limits require an explicit operational choice.

## Consequences

Three supporting readings can enter the highest supported non-emergency state directly; recovery uses calmer readings and spacing.

Without an active pin, the second failed metric read returns to normal; publication failure is a separate failure path.

Emergency throttles take effect only when enabled, and applied throttles are restored before a recovery state step.