---
id: TST-PFM-DJE-159
title: Decide state
kind: unit
product_area: platform
module: data-job-engine
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
repository: services-platform
files:
  - modules/capacity/tests/unit/services/capacity/decide-state.spec.ts
implements:
  - ATS-PFM-DJE-019-01
  - ATS-PFM-DJE-019-02
  - ATS-PFM-DJE-019-03
  - ATS-PFM-DJE-019-07
  - ATS-PFM-DJE-019-08
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: In-memory fixtures and restored dependency doubles.
evidence:
  - 'services-platform:modules/capacity/tests/unit/services/capacity/decide-state.spec.ts'
assertion_inventory:
  - capacity sentinel decision
  - one reading
  - is normal when every signal is inside its threshold
  - is constrained when ACU utilization is above 80 %
  - is constrained when DBLoad is above 1.5 × vCPU
  - is constrained when the proxy borrow latency p99 is above 1 s
  - is constrained when an API p95 is above twice its baseline
  - does not judge an API that has no baseline yet
  - 'is constrained during a scaling transition: ACU below its maximum and CPU rising'
  - 'is never critical while ACU is below its maximum, however high the CPU (scenario 14)'
  - does not read an idle cluster whose CPU ticks up as a scaling transition
  - is critical when ACU is at its maximum and CPU is above 85 %
  - is critical when ACU is at its maximum and DBLoad is above 2 × vCPU
  - is critical when the proxy borrow latency p99 is above 3 s
  - is only constrained when ACU is at its maximum but neither CPU nor load is saturated
  - the first decision
  - is normal over calm readings
  - records no change when it stays normal
  - entering a worse state
  - enters constrained on three constrained readings in a row
  - halves bulk and heavy in constrained and arms the read ceiling
  - stays normal on two constrained readings and a calm one
  - enters critical directly from normal on three saturated readings
  - moves from constrained to critical on three saturated readings once five minutes have passed
  - 'stops bulk and quarters heavy in critical, keeping writes and reads whole'
  - makes no second change within five minutes of the last
  - >-
    goes no further than constrained during a scaling transition, however long it lasts (scenario
    14)
  - the emergency timer
  - 'is not emergency three minutes into critical, because no two changes come within five minutes'
  - enters emergency once critical has held with saturated readings
  - 'halves writes and reads in emergency, with bulk at zero and heavy at a quarter'
  - does not enter emergency when the latest reading has eased below critical
  - enters emergency without the stage throttles
  - keeps the stage throttles off four minutes into emergency
  - applies the stage throttles after five further minutes of emergency without relief
  - never applies the stage throttles when the flag is off
  - does not apply the stage throttles when the readings have eased
  - leaving a state
  - returns from constrained to normal after five calm readings
  - restores every factor in normal and disarms the read ceiling
  - stays constrained when one of the last five readings is still constrained
  - steps down from critical to constrained on five readings below critical
  - 'steps down only one state at a time, even when the readings are calm'
  - 'restores the stage throttles first, before leaving emergency'
  - leaves emergency for critical on five readings below critical once the throttles are restored
  - 'does not leave a state entered less than five minutes ago, however calm the readings'
  - a flapping metric
  - never enters constrained when ACU crosses 80 % every other minute
  - never leaves constrained while the metric keeps returning
  - a pin
  - holds the pinned state over calm readings until it expires
  - 'takes effect at once, whatever the five-minute spacing'
  - is ignored once it has expired
  - restores the stage throttles at once when it pins a state below emergency
  - 'leaves the pinned state by the hysteresis once it expires, one step down'
  - a failed read
  - keeps the previous state for one tick
  - falls to normal on the second failed read in a row
  - restores the stage throttles when it falls to normal
  - counts the failures in its memory and clears them on the next good read
  - the memory a change leaves
  - records when the new state was entered and the change it was
  - keeps the time the state was entered when nothing changes
registration_note: Registration describes existing source; the suite is not executed by this documentation job.
---

# Decide state

## Verification Boundary

The suite checks an isolated production calculation, declaration or adapter. The structured assertion inventory records the checks present at the pinned revision.

## What This Suite Proves

The existing checks exercise decide state. The specification bindings identify the narrower outcomes supported by those assertions.

## What It Does Not Prove

An isolated check does not establish a deployed workflow, database enforcement or complete feature acceptance.

## Real Dependencies and Test Doubles

The production function or declaration is exercised with in-memory inputs and dependency doubles. This boundary does not require a live database.

## Must Not Be Doubled

The production function under examination and its returned decisions remain real; replacing their answers defeats the check.