Capacity Decisions With Hysteresis And An Optional Emergency Switch

Context

Background work should yield under sustained pressure without oscillating on isolated readings.

Decision and Origin

The minute sentinel derives protection with hysteresis, publishes through independent channels and honors expiring staff pins; emergency stage throttles require an explicit switch that defaults off. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

Alternative Comparison

Change protection on every individual reading: Individual spikes would cause unstable protection changes.

Retain protection indefinitely when metrics fail: Signal loss would hold background work without evidence of continuing pressure.

Enable emergency stage throttles by default: Stage-wide limits require an explicit operational choice.

Consequences

Three supporting readings can enter the highest supported non-emergency state directly; recovery uses calmer readings and spacing.

Without an active pin, the second failed metric read returns to normal; publication failure is a separate failure path.

Emergency throttles take effect only when enabled, and applied throttles are restored before a recovery state step.