Capacity Protection State

The Lifecycle

Transitions Explained

Three supporting readings select their supported pressure level, so normal can move straight to critical. Emergency requires existing critical state and spacing. Five calmer readings recover one state at a time; when emergency stage limits stand, restoration occupies a separate tick first.

Pins can select any state immediately on evaluation. Without an active pin, one failed signal read holds protection and a second restores normal, including from critical or emergency.

What Cannot Happen

Automatic escalation cannot jump directly to emergency, and scaling alone cannot classify critical pressure. An active staff pin can still select emergency from any previous state.

Concurrency and Timing

The minute schedule and reserved concurrency serialize decision writers. Consumer caching adds propagation delay. Emergency API stage changes require their disabled-by-default switch and sustained critical assessments.