Safe in Probability, Not in Size

24 September 2026 • Yuriy Polyulya •

#distributed-systems #control-theory #systems-thinking #queueing-theory

Dual Control and the Weaponized Probe ended with a design, not a resolution. The platform team’s admission-control layer no longer sits still and trusts history, and it no longer burns a two-week canary window hoping to catch the one regime it already suspects. It runs Cyclic Adaptive Regulation: a control action that treats its ordinary operation as a continuous measurement. It cycles between regulating and probing the way TCP BBR has been doing at internet scale since 2016. Proposition 2 said this is mathematically necessary. It said nothing about who signs off on it.

That silence has a name and an owner, stated explicitly at the time. A policy with no scheduled end is a fundamentally different kind of thing to ask an organization to approve than a two-week experiment with a rollback trigger. A reviewer can read a bounded proposal in ten minutes. A standing, perpetual probe has no such shape, because it is never done being reviewed. Loss aversion sharpens the asymmetry further: the reviewer is not miscalculating the statistics. They are weighing an open-ended downside against a bounded one, and the open-ended one loses every time, regardless of which one the expected-value arithmetic actually favors.

This post is the answer to that specific, named gap. Not a bigger probe, and not a better argument for why the probe is safe. It is a boundary a reviewer approves once, the way you approve a building code rather than every renovation built to it. That boundary makes the probe’s safety a property of its construction rather than a promise resting on trust. This series has not once let its apparatus pass a validation check for free, so this post asks the harder question of the boundary itself: bounded how, and bounded against what.

Notation used in this post. Where:

• $h$ and $\mathcal{C}$ are Definition 3’s barrier function and the safe region its sign defines
• $\epsilon$ is Definition 3’s probability tolerance for ever leaving $\mathcal{C}$
• $T$ is Definition 3’s decision horizon
• Pareto $\alpha$ is the tail-weight parameter in the severity table
• $\eta$ is Corollary 2’s CVaR tail fraction, and $\rho$ is the maximum tolerable severity within that tail, chosen independently of $\epsilon$
• Gunther’s USL $\sigma$ and $\kappa$ price ordinary contention and the coherency penalty; $\sigma$ is near zero for this post’s executors
• $s$ is one executor’s comfortable-load rate, $C$ the comfortable concurrency, and $P$ the executor pool size, 8
• $m_{\text{tot}}$ is the fixed control-authority budget Corollary 3’s frontier splits
• $M$ is the fleet size in “From Two Controllers to a Fleet” and Proposition 4, the number of controllers simultaneously facing the coordination-signal outage

The Trigger to Stop Simulating later uses $\sigma$ for a real-options value process’s volatility, a different quantity from this post’s USL contention parameter of the same name.

Why a Rulebook Cannot Do This Job

Picture the obvious alternative first. It is the one most organizations reach for, and seeing why it fails is most of the work of seeing why a control barrier function is the right shape for the job.

A rulebook approach writes down conditions by hand. Do not let the queue exceed 80 percent. Do not probe if downstream health has dropped in the last minute. Roll back if the retry rate crosses a threshold. Each rule, read alone, sounds reasonable. Taken together, they share a defect this series keeps finding under different names. A rulebook is congruent with whatever the engineer who wrote it happened to imagine going wrong. It enumerates the failure modes someone already thought of. It has no structural reason to cover the ones nobody did. The platform team’s postmortem, back in The Simulation Singularity, was already proof of the pattern: the failure modes worth worrying about are disproportionately the ones nobody thought to write a rule for.

A control barrier function is a different kind of object. Instead of enumerating bad states, it defines a function of the system’s state whose sign says whether the system is currently inside a declared safe region. It constrains the control action, at every single decision, to keep that function from crossing zero. The rule is to stay inside a declared region, however many ways there turn out to be of leaving it, not a fixed list of things to avoid. That shift, from listing failure modes to bounding a region, is the entire reason this approach can be reviewed once instead of forever. A reviewer does not have to imagine every way the system could misbehave. They only have to check that the region itself is the right one, and that the barrier genuinely keeps the system inside it.

Whether it actually does that is not a question to take on faith. The rest of this post spends its effort on how much that promise is worth, and where it runs out.

This system is 8 concurrent executors pulling from a Redis-style backlog, calling a downstream dependency directly. Below 75 requests per second, a health dip still costs a real, growing recovery delay as traffic approaches that line. The queue drains on its own, eventually. At or above 75, all 8 executors staying simultaneously saturated caps joint throughput below arrivals permanently. The queue then does not drain on its own at any Health setting. That is a genuine, derived threshold, not a tuned one.

Raising Rejection Sensitivity does not add capacity downstream does not have. It removes enough admitted demand that the executors stop being simultaneously saturated, which is the only lever in this model that touches the actual cause. That gate is this model’s literal instance of Definition 3’s filter: the threshold parameter is $\mathcal{C}$ ’s boundary, and Rejection Sensitivity is how hard the filter pushes back once the state gets close to it.

Notice the mechanism driving that behavior with the admission gate off, since Definition 3 is built specifically to bound it. Downstream health scales each executor’s clearing rate directly. A second, independent effect comes from how many of the 8 executors are simultaneously busy. At or below 4 concurrent requests, each executor clears at its full rate. Past that comfortable concurrency, real contention sets in: lock contention, connection-pool pressure, the kind of thing a shared, contended resource always produces past its comfortable load. That contention degrades every busy executor’s rate, not just the newest arrival’s.

L3 · Estimate Model that degradation the same way this post’s reference implementation does: per-executor rate proportional to $(C/n)^2$ once $n$ concurrent requests exceed the comfortable count $C$ . The joint, worst-case throughput at full saturation, all 8 executors busy at once, has an exact closed form:

$$\text{Rate}_{\max} = P \cdot s \cdot \left(\frac{C}{P}\right)^2 = \frac{s C^2}{P}$$

where:

• $s$ is one executor’s comfortable-load rate
• $C$ is the comfortable concurrency
• $P$ is the executor pool size

With this model’s numbers, $s=37.5$ , $C=4$ , $P=8$ , that ceiling is exactly 75 requests per second, verified directly against this post’s reference implementation, not asserted. Push Base Traffic below 75, and a health dip costs a real, growing recovery delay before the queue drains unaided. That delay runs from single digits (9.0 seconds at Base Traffic 55) well into the hundreds (386.1 seconds at Base Traffic 74.5) as traffic approaches 75. Push it to 75 or above, with the same health-dip schedule, and the queue does not drain at any Health setting. Base Traffic 75 itself is already pinned at the queue cap, 200 out of 200, after 400 simulated seconds, the same outright saturation Base Traffic 76 and above also reach. The widget above lets a reader trigger that same dip directly and watch the difference between recovering and pinning.

Nothing in the system is broken. Every rule fired as designed. The composition of two individually reasonable rules, health-scaled clearing and contention-scaled clearing, produces a real threshold neither rule alone predicts, which is the entire reason a rulebook approach cannot be trusted to catch it in advance.

Deeper: the 1/N shape is not an arbitrary choice. Gunther's USL forces a 1/N tail for any coherency-dominated system.

L1 · Bound The 1/N tail this model’s numbers show is not a power chosen to fit the data after the fact. Gunther’s Universal Scalability Law prices exactly this class of system: throughput as a function of concurrency $n$ , $X(n) = \gamma n / (1 + \sigma(n-1) + \kappa n(n-1))$ . Here $\sigma$ prices ordinary queueing contention and $\kappa$ prices a coherency penalty, the cost of cross-talk between concurrently active workers that grows with every additional pair of them[1] . A system where contention is negligible next to the coherency cost, $\sigma \approx 0$ , the case this model’s executors are in, degrades to $X(n) = \gamma n / (1 + \kappa n(n-1))$ . For large $n$ the $\kappa n^2$ term dominates the denominator, forcing $X(n) \to \gamma / (\kappa n)$ . Throughput falling as 1/N is not this model’s invention. It is the structural signature any bounded-capacity system with a genuine coherency penalty, and negligible contention, is required to show, regardless of its specific numbers.

L3 · Estimate What USL does not do is reproduce this post’s piecewise $(C/n)^2$ formula at every $n$ . The two curves share only the same asymptotic tail; they are not the same function. USL degrades smoothly starting at $n=1$ , where this model holds a full, undegraded rate up to $C$ and only bends past it, a modeling simplification of its own. A $\sigma \approx 0$ USL curve can be fit two ways, both stated exactly rather than left as “a fit”. First, $\gamma = 37.5$ , matching this model’s comfortable-load rate at $n=1$ . Second, $\kappa = 1/C^2 = 0.0625$ , chosen so USL’s peak-throughput concurrency, $\sqrt{1/\kappa}$ in the $\sigma=0$ case, lands on this model’s comfortable concurrency $C=4$ . That is the concurrency past which this model’s degradation starts. At $n=8$ , the concurrency this post’s reference implementation actually runs, that curve gives roughly 67 requests per second, not the 75 this post derives and verifies directly against its code. The 75 figure stays what it already was: this post’s reference implementation’s result, checked against its code, not re-derived from Gunther’s formula. What the formula licenses is narrower and still real. The shape of the collapse, decay as 1/N rather than some other exponent, is required of any coherency-dominated system in general. It is not a curve chosen because it happened to fit this one running case.

Naming the Shape: Metastability, Not an Invented Trap

L2 · Fit This section has called the queue’s stuck state “METASTABLE” since its first draft. That word turns out to have been earned rather than merely aspirational, once the underlying mechanism is built honestly. A metastable state, in the dynamical-systems sense, is a state whose relaxation time back to the one true equilibrium is anomalously long, not a second, permanent trap sitting next to it. It is long enough that a system observed only briefly looks stuck even though it is not.

That is what the recovery-time sweep above shows below the 75-per-second line. There is not a second fixed point, only a single fixed point approached at a rate that collapses toward zero as traffic approaches the ceiling. That is the same qualitative signature physics calls critical slowing down near a bifurcation. Above the line, the system genuinely does gain a second, permanent state, not metastability but real bistability. At that point it is the joint throughput ceiling itself, rather than the approach to a single equilibrium, that traffic exceeds.

Why Rejecting Early Is Not Merely a Good Idea, It Is the Coordinated Equilibrium

L1 · Bound The no-rejection baseline already has a name in game theory, and naming it matters for what follows. Eight executors independently pull from the same backlog, each accepting a job whenever one is available with no regard for how many others are already busy. That is a textbook congestion game: each player’s payoff, in this case an individual executor’s completion rate, depends on how many other players are simultaneously using the same shared, contended resource[2] .

The uncoordinated equilibrium, every idle executor pulls the instant a job is available, is the “no rejection” baseline above, and it is not the socially optimal outcome. An executor that pulls a tenth job while nine others are already contending for downstream lowers everyone’s completion rate, an externality its decision never has to price. The gap between that uncoordinated equilibrium and the coordinated optimum has a name and a literature: the price of anarchy[3] .

L3 · Estimate Measured directly against this post’s reference implementation, the uncoordinated baseline (Rejection Sensitivity 0) costs 24.7 percent more total backlog-time as the social cost. That is compared to the same traffic and health schedule run with Rejection Sensitivity at 100 percent and Rejection Threshold at 0.7, at traffic just past the ceiling (Base Traffic 76). The measure sums total queue depth over a 1,200-simulated-second run of the repeating health cycle, discarding the first 60 seconds as transient. That gap narrows to 14.3 percent at Base Traffic 120 and continues to shrink at yet higher traffic, since a large enough excess eventually saturates any admission policy’s ability to shed it. Both figures are this post’s reference implementation’s output, run once and reported here, not a number computed elsewhere and quietly substituted in. Rejection Sensitivity is this system’s coordination mechanism, not an ad hoc patch bolted onto the executor pool from outside. It is the thing a congestion game’s players would adopt if they could bind themselves to a joint policy instead of each pulling independently. It internalizes the externality each additional concurrent request imposes on every other request already in flight.

What makes this different from an ordinary buffer is the entire reason rejecting early helps here rather than simply losing work. Standard queueing theory says a bigger buffer only ever helps or is neutral to long-run throughput, converting a burst into delay rather than into loss. That is the reasoning behind sizing a buffer for expected variability in supply-chain and networking practice alike. It assumes the server’s service rate is fixed, a property of the server, independent of how many requests are currently waiting on it.

This model’s clearing rate is instead coupled to the queue’s occupancy, a stand-in for a shared, contended resource: connection or thread-pool exhaustion, memory pressure from holding a large backlog, duplicate retries still consuming downstream capacity while their originals also wait. A deeper queue makes the server itself slower for every request already in it, not only for the newest arrival. Once that coupling holds, admitting one more request when the queue is already deep spends a little of everyone else’s clearing capacity. It spends that capacity on a request that, at this occupancy, has a materially worse chance of clearing anyway, rather than storing it safely for later.

Reject that request early and every other request already waiting clears faster, which is the entire mechanism behind this model’s throughput numbers above. Remove the coupling, and this post’s argument for rejecting early removes itself along with it: with a decoupled server, that same request would have been free to admit, and shedding it would have been pure loss. The Model Scope table below states this condition explicitly rather than leaving it implicit in this model’s behavior.

Six disciplines carry the argument from here:

• Control theory for the barrier itself, the formal object that turns a probability-of-exit guarantee into something a reviewer approves once
• Risk and decision theory for the separate gap between bounding how often the barrier is crossed and bounding how badly, and the worst-case CVaR construction that closes it
• Distributed systems engineering for the actuator-inversion failure mode, the organizational precedent for bounded experiments, and the two impossibility results that say why a lost coordination signal forces a genuine choice rather than a compromise
• Game theory for naming the uncoordinated baseline as a congestion game and pricing what coordination actually buys, down to a fleet’s exact tipping point
• Cybernetics and verification theory for naming why a probability-only barrier is a real improvement on a rulebook and still a form of congruence in the one dimension it was never built to watch
• Practitioner systems literature for weighing this post’s barrier honestly against real, deployed admission-control systems that already solve problems it does not

The Ledger near the end of this post names all six again, with the specific sections each one grounds.

The Formal Apparatus

Definition 3 -- Discrete-Time Stochastic Control Barrier Function: a probability bound on ever leaving a declared safe region

Definition 3 (Discrete-Time Stochastic Control Barrier Function). Let $h : X \to \mathbb{R}$ be a function of the system’s state whose zero-superlevel set $\mathcal{C} = \{x : h(x) \geq 0\}$ defines a declared safe region. A control policy is a valid discrete-time stochastic control barrier function if, for a stated $\epsilon \in (0,1)$ and a finite horizon $T$ , the closed-loop trajectory $x(t)$ satisfies

$$\Pr\big[\exists\, t \leq T : x(t) \notin \mathcal{C} \;\big|\; x(0) \in \mathcal{C}\big] \leq \epsilon$$

where:

• $h(x)$ is chosen so its sign reads directly off a quantity an operator already tracks, queue occupancy relative to a declared capacity, in this series’ running case, rather than an abstract quantity requiring its translation layer
• $\epsilon$ is the stated, reviewable tolerance for ever leaving the safe region within the horizon, the number a reviewer actually signs off on, once, rather than trusting a probe’s good behavior indefinitely
• the bound is on a decision horizon $T$ , not asymptotically as $T \to \infty$ ; a longer horizon, all else equal, only ever loosens what a fixed per-step safety margin can guarantee over it, a point the Model Scope table below returns to directly

Cosner, Culbertson, and Ames give this bound its sharpest known form for discrete-time systems by way of Freedman’s inequality rather than the cruder worst-case bounds the barrier-function literature had relied on before[4] .

L1 · Bound Their result does not require $h$ to be bounded above. That matters directly for the running case. Queue occupancy has a hard ceiling, but the signed distance a barrier function uses to express “how safe” a state currently is does not need one. Forcing an artificial upper bound onto it, just to satisfy an older proof technique, would have thrown away useful structure for no safety benefit. Freedman’s inequality adapts the bound to the actual variance of the disturbance process the barrier is fighting. A distribution-agnostic bound like Ville’s inequality has to assume the worst case instead. That difference is what makes the resulting probability bound genuinely tighter, beyond being differently derived.

The word “tighter” is doing real work in that sentence, and it deserves unpacking rather than standing in for a specific mathematical claim left unchecked. Freedman’s inequality is a martingale-valued generalization of Bernstein’s inequality. It is the same family of results Dual Control and the Weaponized Probe leaned on implicitly when it distinguished a naive sample mean from a robust estimator under heavy tails.

A Hoeffding-style bound treats every step of a martingale as though it could swing across its full possible range, worst case, on every step. It charges that penalty regardless of how calm the process has actually been so far. A Bernstein-style bound, and Freedman’s inequality specifically, accumulates the actual observed conditional variance of the process step by step instead. It pays the worst-case-range penalty only for the tail of that accumulated variance, not for the whole horizon up front. A downstream dependency that has been quiet for the last several hundred decisions has already spent down most of what a Hoeffding-style bound would have charged it for merely existing. The barrier’s admission decisions can be less conservative as a direct, earned consequence, not a hopeful one.

This is the same shape of gain Dual Control and the Weaponized Probe found in replacing a plain sample mean with a median-of-means estimator under heavy tails. The naive approach prices the worst thing that could happen at every step. The sharper approach prices what has actually been happening, and only falls back to the worst case once the accumulated evidence runs out.

Proposition 3 (High-Probability Safety Filtration). Given a nominal, unconstrained controller optimizing for whatever objective the admission-control layer already has, a valid discrete-time stochastic control barrier function filters its proposed actions at every decision, modifying them only enough to keep Definition 3’s probability bound satisfied, and no more. Formally, the filter is a function $F: X \times A \to A$ , mapping the system’s current state and the nominal controller’s proposed action to the action actually taken:

$$F(x, a_{\text{nom}}) = \arg\min_{a \in A} \; \lVert a - a_{\text{nom}} \rVert \quad \text{s.t.} \quad \Pr\big[h(x_{t+1}) \geq 0 \mid x, a\big] \geq 1 - \epsilon$$

The per-step QP that Definition 3 and this proposition describe in prose is nothing more than one way of computing this function; the signature is the interface , not the solver.

• L1 · Bound Clark established the general framework for constructing control barrier functions under stochastic (Gaussian process and measurement) noise, including a reciprocal-barrier-function construction proven safe with probability one under stated conditions[5] . A specific caveat belongs here, not in a footnote. The same 2021 paper’s separate zero-control-barrier-function (ZCBF) theorem, claiming almost-sure safety by a different proof technique, was later shown to be false. So, Clark, and Fan exhibit an explicit counterexample, an uncontrolled one-dimensional Brownian motion for which the ZCBF theorem’s claim cannot hold[6] . The flaw sits in that proof technique specifically, not in the reciprocal-barrier-function result this post actually leans on. They also derive a corrected, modified ZCBF condition that does hold. Two things are worth separating here, because conflating them would be the kind of unverified paraphrase this series has already been burned by once this month: the flawed claim was for almost-sure safety, probability exactly one, $\epsilon = 0$ . Definition 3’s claim is for a stated, generally nonzero $\epsilon$ , a strictly weaker and different guarantee that the 2023 correction does not touch one way or the other. This post uses Clark’s reciprocal-barrier-function framework and the Freedman’s-inequality result built on top of it, not the corrected paper’s subject.
• L1 · Bound “Modifying them only enough” has an exact mathematical form, not a hand-wave. Ames, Xu, Grizzle, and Tabuada unified two things: a control barrier function’s safety constraint, and a control Lyapunov function’s performance objective[7] . Both fit inside one per-step quadratic program. The program minimizes deviation from whatever action the nominal controller would have taken. The barrier constraint is the one requirement it must hold. Proposition 3’s filter is this CBF-CLF-QP construction, applied to admission control. The nominal controller proposes an accept, throttle, or reject decision; that proposal plays the role of the unconstrained CLF-optimal action. The filter’s entire job is to find the closest action, in whatever metric the QP uses, that keeps $h(x)$ from crossing zero. “Closest” is the literal objective the quadratic program minimizes, not a figure of speech here. That is what makes “modifying them only enough” a provable property of the filter’s construction, not an intention behind it.
• L2 · Fit A safety filter of this kind, applied specifically to an admission-control layer’s accept/throttle/reject decision rather than to a robotic or vehicular actuator, the more common setting in this literature, is this post’s synthesis, without a direct precedent to cite for that exact application. This should be said plainly, rather than let the citations above imply someone has already proven this for a shadow-routing queue. The architecture itself, a learned or otherwise unconstrained policy wrapped by a barrier-function safety filter, is not new; it is the standard shape of safe reinforcement learning, and “What This Buys Over Deployed Overload Control” below both credits that lineage and states what a production overload-control system already has that this post’s barrier does not.
• L3 · Estimate At production request rates, solving a fresh quadratic program at every decision is not free. An admission-control layer making thousands of decisions per second cannot always afford one. Mestres and six coauthors solve this with a resource-aware implementation[8] . It partitions the state space in advance. Each region gets one closed-form solution, reused until the state crosses into a different region. The online solve only runs again at that boundary. Whether this platform’s state space is simple enough for that closed-form approach, or complex enough to need the full online solve, is an engineering question this post flags rather than answers.
• L1 · Bound $F$ ’s signature buys a systems architect something too, not only a control theorist. $F: X \times A \to A$ names a genuine interface boundary, not only a mathematical one: a regulator producing $a_{\text{nom}}$ and a downstream admission mechanism consuming $F$ ’s output can be built, tested, and reasoned about entirely separately, as long as both agree on $F$ ’s domain and codomain, the same separation of concerns this series already argued for by subsystem rather than by time. What the signature does not specify, by design, is which runtime enforces it or how $X$ and $A$ are represented in a given language; a function signature is the kind of object that stays silent on those choices, not a gap in the definition.

    
    %%{init: {'theme': 'neutral'}}%%
flowchart LR
    classDef term fill:none,stroke:#333,stroke-width:2px;
    A["Nominal controller proposes an action
whatever Cyclic Adaptive Regulation
currently wants to do"]:::term
    B["QP checks: does this action
keep h(x) >= 0?"]:::term
    C["Passes through unchanged
no correction needed"]:::term
    D["QP finds the closest action
that keeps h(x) >= 0"]:::term
    E["State updates
one decision later"]:::term
    A --> B
    B -->|"yes"| C --> E
    B -->|"no"| D --> E
    E --> B

What Proposition 3 Rules Out

Dual Control and the Weaponized Probe said plainly what Proposition 2’s intractability result did not claim, and Proposition 3 deserves the same treatment. It is not a claim that this filter makes the admission-control layer’s underlying decisions optimal. The nominal, unconstrained controller Proposition 2 already built, the one running Cyclic Adaptive Regulation, keeps making whatever decisions it was already making. The filter’s entire job is narrower and more mechanical: modify those decisions only when they would push the system outside $\mathcal{C}$ , and modify them as little as possible even then. A bad nominal policy filtered this way is still a bad policy, just a safely bad one. Proposition 3 buys safety. It does not buy competence, and this post makes no claim that it does. That distinction matters enough to keep separate.

It is also not a claim that this filter is the only safety mechanism a real deployment needs. Netflix’s account of automating chaos experiments in production describes the complementary role. It is a controlled, bounded fault-injection platform that checks whether a system tolerates degradation it was designed to tolerate, run continuously rather than once, with a human-approved blast radius[9] . A discrete-time stochastic control barrier function is the innermost layer of a defense-in-depth architecture, the one that acts automatically, at every decision, with no human in the loop. A chaos-engineering platform is an outer layer, exercised deliberately and reviewed explicitly, that catches whatever the inner layer’s disturbance model was never calibrated to expect. Neither replaces the other. This post is about the inner layer only.

This Model’s Own Barrier, Stated Explicitly

Leaving the mapping between this model and Definition 3 for the reader to infer would be the move this series keeps calling out in other people’s work, so here it is stated as a direct correspondence instead.

Definition 3’s object	This model’s version of it
State $x(t)$	Queue depth (0 to 200) and downstream health (0 to 100 percent), the quantities Base Traffic and Dependency Health parameterize directly
Barrier function $h(x)$	A signed distance from a declared occupancy ceiling, most naturally $h(x) = (\text{Rejection Threshold}) - (\text{queue depth}/200)$ , zero exactly at the Rejection Threshold parameter’s boundary
Safe region $\mathcal{C} = \{h \geq 0\}$	Queue occupancy at or below whatever Rejection Threshold is currently set to; crossing it bounds the chance the queue gets deep, which is a different fact from whether it then drains, the exact probability-versus-magnitude gap “The Boundary Only Watches Probability” states below
A filtered action	Literally the admission gate Rejection Sensitivity controls: at sensitivity 0, no fresh admission is ever filtered on account of occupancy, which is this model showing Definition 3’s absence, not its presence; raising sensitivity makes the gate reject a growing share of arrivals once $h(x)$ approaches zero, exactly “modifying actions only enough to keep the probability bound satisfied” from Proposition 3, made literal and computable rather than asserted
What the filter does not do	Fix downstream health, coordinate with any other service, or manufacture capacity downstream does not have: verified directly against this post’s reference implementation, at Base Traffic 80, above the executor pool’s 75-per-second joint ceiling, raising Rejection Sensitivity to 100 percent keeps the queue oscillating in a range of roughly 143.8 to 193.9 out of 200, well below the cap but never settling at a single level, and it does not drain to zero, versus 200 out of 200 with rejection off, because rejection can only shed admitted demand, and 80 exceeds what 8 executors can jointly clear even fully saturated regardless of admission policy

Return to this model once more with this table in hand. Every rule it encodes, health-scaled clearing, congestion-compounded clearing, retries re-entering as arrivals, was already justified on its own terms back in The Simulation Singularity and Dual Control and the Weaponized Probe. That last rule is doing more formal work than “retries happen” suggests. Base Traffic, the model’s external arrival rate, is not the only source of arrivals once the composed rules above are running: a request that fails downstream and retries re-enters the same backlog as a new arrival. That is the partly-open construction The Simulation Singularity cited to explain why a load test built on a closed or purely open generator cannot manufacture a correlated-retry regime[10] .

This model is a genuine instance of that construction in shape, beyond an analogy to it. Arrivals are open at the top, Base Traffic, and a request that fails downstream can re-enter the same backlog as a retry rather than simply leaving. That is the follow-up-request mechanism the partly-open model formalizes. This model’s retry probability could be constant, the way Schroeder’s $p$ is, or it could rise as Dependency Health falls, the way The Simulation Singularity’s opening incident describes. Either way, it is not a distinction this post’s worked numbers above turn on. Retries re-entering as arrivals is what turns an ordinary bounded-concurrency queue into one capable of the runaway feedback loop this post’s worked ceiling describes.

What a discrete-time stochastic control barrier function adds is a standing constraint that watches all of them at once and intervenes before their composition crosses a declared line, instead of after: not a new rule among these. Rejection Threshold and Rejection Sensitivity are that constraint made computable. At sensitivity 0 the composed rules above run away unfiltered. Raising it makes the same composed rules stop mattering, not because they changed, but because something now sits upstream of all of them, watching the same state, correcting the one thing they never priced.

Separating the Two Demands by Subsystem, Not by Time

The Simulation Singularity named a discipline for resolving an engineering trade-off by separation rather than compromise, borrowed from Genrich Altshuller’s study of tens of thousands of patent records[11] . It named three separating moves that discipline permits, without stating which, if any, this series would actually take. Validation scope, The Simulation Singularity argued, is asked to be two incompatible things at once: narrow, cheap, and shippable, and wide enough to cover regimes that have not yet occurred.

Dual Control and the Weaponized Probe separated those demands in time: a regulator for six round trips, an explorer for one, a debtor paying down the explorer’s cost for one, never asked to be both at the same instant. Separation by subsystem was the second of the three moves The Simulation Singularity left open. This post takes it, by subsystem. A policy layer stays free to be narrow and wrong while it learns, decoupled from a safety layer that cannot be wrong regardless of what the policy layer tries.

That separation buys something specific, worth stating outright, because this series has flagged more than once how easy it is to force a superficial resemblance into a claim of genuine sameness. This is not the same mechanism as Dual Control and the Weaponized Probe’s: its separation in time works because the same controller occupies both roles, sequentially, never both at once. Part 3’s separation by subsystem works because two different mechanisms occupy the two roles simultaneously, one unconstrained and free to be wrong, one constrained and unable to be. Cyclic Adaptive Regulation, the nominal policy Proposition 2 built, is still free to probe, still free to be occasionally miscalibrated, still free to be as exploratory as Dual Control and the Weaponized Probe argued it must be. Definition 3’s filter sits underneath it, watching the same state, correcting only the actions that would leave $\mathcal{C}$ . It is indifferent to whether the policy’s reasoning for proposing that action was sound.

That indifference is the entire source of the review-friction payoff Dual Control and the Weaponized Probe closed by naming. A reviewer approving Cyclic Adaptive Regulation directly has to trust every future decision that policy will ever make, including decisions under conditions nobody has anticipated yet. That is the standing, perpetual-review problem Dual Control and the Weaponized Probe identified and could not solve on its own terms. A reviewer approving Definition 3’s barrier instead has to trust one fixed, checkable object: the safe region $\mathcal{C}$ , the stated $\epsilon$ , and, once Corollary 2 below adds it, a magnitude bound $\rho$ . Once that object is approved, the policy layer underneath it can be replaced, retrained, or left to misbehave in ways nobody predicted. The review does not need to happen again, because the safety property was never a claim about the policy. It was always a claim about the boundary.

L3 · Estimate This carries the same retrospective-lens qualification The Simulation Singularity already stated in full. Nobody consulted Altshuller’s method to invent control barrier functions. Naming it here only explains why separation by subsystem was one of the moves this series’ opening framework left open.

The Cycle Finds Drift, the Barrier Has to Watch the Cliff

Dual Control and the Weaponized Probe drew a sharp distinction between what BBR-style persistent excitation actually identifies and what it does not. It identifies drift in a continuously-varying local parameter, not the discovery of a distant, discontinuous regime shift like the correlated-retry cascade this series opened with. That distinction carries over here, in a form specific to what a barrier function can certify.

Definition 3’s safe region $\mathcal{C}$ is calibrated against something: a model of the disturbance the barrier is defending against. In this running case, that means a model of how fast and how far downstream health can move, and how strongly the queue’s occupancy compounds that movement.

L2 · Fit A barrier calibrated correctly against every disturbance the historical record has produced is not automatically calibrated against a disturbance the record has never produced, The Simulation Singularity’s modeling tax, recurring here at the safety layer instead of the validation layer. A control barrier function certifies safety relative to the disturbance class it was built to defend against, not relative to every disturbance a system could in principle face. Nothing about Definition 3’s probability bound distinguishes a well-calibrated barrier from a badly-calibrated one facing a regime its calibration never covered. Both report a clean $\epsilon$ -bound right up until the moment the uncovered regime actually arrives.

Leaving this unstated would let a probability-of-exit guarantee read as “safe against anything,” and that reading is wrong. The guarantee is safe against the disturbance class the barrier’s construction assumed, and a barrier’s $\epsilon$ says nothing at all about how good that assumption was. Recalibrating the barrier as the system’s understanding of its disturbance evolves is the kind of thing Cyclic Adaptive Regulation was built to keep doing, not a one-time setup step. The barrier and the regulator it filters are not, in the end, two unrelated pieces of machinery: one needs to keep learning what the other one is defending against.

Reading this against The Simulation Singularity’s cybernetic parallel sharpens the shape further. Ashby’s Law of Requisite Variety says a regulator cannot drive outcome variety below the gap between disturbance variety and the regulator’s own variety[12] . That earlier post used it to explain why the platform team’s original simulator had a residual, unmodeled variety it could never have covered, the same The Simulation Singularity already linked above.

A barrier’s disturbance model is this kind of variety budget, stated for the safety layer instead of the forecasting layer. $\mathcal{C}$ is drawn wide enough to absorb every disturbance the model accounts for. Whatever disturbance variety the model does not account for does not vanish just because a barrier is now watching. It reappears, unabsorbed, as the same kind of residual The Simulation Singularity counted in bits. The consequence of that residual showing up now is an excursion the barrier had no way to see coming, not a wrong forecast. It is certified safe at $\epsilon$ right up until the moment it was not.

Calibrating a wider $\mathcal{C}$ is the direct analogue of increasing a regulator’s variety in Ashby’s original accounting, and it faces the identical limit. Variety bought by widening the safe region is variety the barrier can actually absorb; variety past that width is variety no barrier, however well constructed, was ever going to catch.

The Boundary Only Watches Probability

Everything so far has bounded the chance of the queue ever crossing 85 percent. Nothing so far has said anything about how bad it is if the barrier’s $\epsilon$ -tail event actually happens. Those are different guarantees, and Dual Control and the Weaponized Probe already proved, in a different part of this same series, that the difference is not academic.

Stating the Gap Precisely

Definition 3’s bound is this: $\Pr[\text{exit}] \leq \epsilon$ . It says nothing about $E[\text{cost} \mid \text{exit}]$ , the expected severity of an excursion given that one occurs. It also says nothing about the worst excursion a heavy tail can actually produce. Under a light-tailed disturbance, where no single excursion can be arbitrarily bad, this omission costs little: bounding the chance of a bounded-cost event is most of what a decision-maker needs. Not so here: Dual Control and the Weaponized Probe’s severity problem showed the correlated-retry regime’s severity is heavy-tailed, not light-tailed. A bounded number of observed occurrences systematically underestimates the true worst case, worse as the tail gets heavier. A probability-of-exit bound, sitting on top of a heavy-tailed severity distribution, certifies the wrong thing: how rarely the cliff is approached, never how far the fall actually goes once it is.

L3 · Estimate Make the gap concrete with a small, Node-verified illustration, not a restatement of any cited theorem. Three admission-control designs are each certified, by construction, to leave their declared safe region with the same probability, 5 percent, the $\epsilon$ a reviewer might reasonably approve. They differ only in how heavy-tailed the severity of an excursion is, once one occurs, modeled as a Pareto distribution with a fixed median so that a “typical” excursion looks the same size in all three:

All three pass Definition 3’s test identically: exactly a 5 percent chance of leaving the safe region, over however many trials a reviewer chooses to check. A control barrier function that only certifies $\epsilon$ would sign off on all three the same way, because $\epsilon$ is the only thing it measures. The worst excursion actually produced, across the same number of trials, differs by more than four orders of magnitude between the first design and the third. Whatever a reviewer thinks they are approving when they sign off on “5 percent chance of an excursion,” the number in front of them does not distinguish the two cases. It looks identical whether a system’s worst day is 202 times worse than typical, or nearly two million times worse than typical.

Shrinking $\epsilon$ Does Not Rescue This

The obvious objection is that a small enough $\epsilon$ should still make the expected cost of relying on probability alone acceptable. That is the same way this series has priced expected cost everywhere else. $\epsilon \cdot L$ , an approval probability times a severity, echoes The Simulation Singularity’s $N \cdot p \cdot L$ crossover exactly. Whether that objection holds depends entirely on whether $L$ , the expected severity given an excursion, is itself a finite number. A Pareto severity distribution’s mean is not always finite.

For a Pareto distribution with tail-weight parameter $\alpha$ and scale $x_m$ , the mean is $\frac{\alpha}{\alpha - 1}x_m$ for $\alpha > 1$ . It diverges entirely, verified directly rather than asserted, for $\alpha \leq 1$ . All three tail weights in the table above, 3.0, 1.5, and even 1.1, have $\alpha > 1$ , so their means stay finite. $\frac{\alpha}{\alpha-1}$ gives 1.5, 3.0, and 11 times the scale $x_m$ . Against the fixed median $x_m 2^{1/\alpha}$ the table is built on, that works out to the 1.2x, 1.9x, and 5.9x mean severities the table already reports. A genuinely heavier tail than any modeled above, $\alpha \leq 1$ , is not a hypothetical edge case this series needs to reach for. Real network and service-time distributions can sit in or near this regime, and Dual Control and the Weaponized Probe already cited the literature describing why[13] .

At that point, $\epsilon \cdot L$ is $\epsilon$ times infinity, for every $\epsilon > 0$ a reviewer could possibly approve. No probability bound, however small, rescues an expected-cost argument once the tail is heavy enough that the cost itself has no finite expectation. This is the sharpest form of the gap this section opened with: $\epsilon$ alone is answering a question that, past a certain tail weight, has no finite answer to give, not that $\epsilon$ is currently too loose.

A Second Bound, Not a Replacement for the First

L1 · Bound This is the gap Kishida’s worst-case Conditional Value-at-Risk control barrier function is built to close[14] . Rather than constraining only the probability of leaving a safe set, a worst-case-CVaR barrier additionally constrains the conditional expectation of severity in the worst tail fraction, for a stated risk level, the exact quantity Definition 3 is silent on. Computing it reduces to a quadratic program for half-space and polytopic safe sets, and a semidefinite program for ellipsoidal ones, at a cost of the same computational family Proposition 3 already leans on.

Corollary 2 (Worst-Case CVaR Extension: Bounding Excursion Magnitude). A control policy that is a valid discrete-time stochastic control barrier function under Definition 3, and additionally constrains the worst-case Conditional Value-at-Risk of $-h(x(t))$ at level $\eta$ to remain below a stated bound $\rho$ , bounds both the probability of an excursion, per Definition 3, and the expected severity of an excursion conditional on being among the worst $\eta$ -fraction of outcomes, per the added CVaR constraint, using a single, jointly-optimized filter rather than two independently reasoned-about mechanisms.

where:

• $\eta$ is the tail fraction the CVaR constraint prices, chosen independently of $\epsilon$ ; the two numbers answer different questions and do not have to agree
• $\rho$ is the maximum tolerable expected severity within that worst tail fraction, the number that actually prices what the table above shows a plain $\epsilon$ -bound cannot see
• the two bounds are not redundant with each other: a system can satisfy Definition 3 with a very small $\epsilon$ while still failing Corollary 2 badly, the moderate-versus-very-heavy-tail comparison above with $\epsilon$ held fixed at 5 percent throughout

L3 · Estimate Applied to the running case, $h(x)$ stays the queue’s signed distance from the declared Rejection Threshold line. $-h(x)$ in the worst tail is, concretely, how far past that line the queue is driven and for how long, before whatever downstream recovery eventually arrives. This post’s reference implementation now shows that duration can be seconds, hundreds of seconds, or never, depending on traffic relative to the executor pool’s joint ceiling, not a single fixed severity Definition 3 alone would ever imply. Corollary 2 does not change what Definition 3 already certifies. It adds a second, independent number a reviewer can also demand, and Falsification Criterion F10 below states what would show this addition is unnecessary.

The Two Bounds Trade Against Each Other, Not for Free

Corollary 2 states that both bounds can be jointly enforced. It does not, by itself, say enforcing both is free. This question needs the same tool Dual Control and the Weaponized Probe reached for the one other time this series priced two ways of spending a fixed budget against each other. That tool is an achievable-region model, not a claim that either bound is costless in isolation.

Corollary 3 (Joint Enforcement Cost Floor). Let a per-step quadratic program select the action closest to a nominal, highest-utility choice, subject to whichever barrier constraints are active. Enforcing Corollary 2’s CVaR constraint jointly with Definition 3’s probability constraint can only shrink the feasible set that program searches, never enlarge it, and shrinking the feasible region of a convex program can only raise, or leave unchanged, its optimal objective value, never lower it. So the cost of jointly enforcing both bounds, measured in forgone throughput relative to the nominal action, is never smaller than the cost of enforcing Definition 3’s probability bound alone, and is generically larger.

where:

• this is a property of adding any constraint to any convex program, not of Cosner, Culbertson, and Ames’s bound or Kishida’s CVaR construction specifically; it applies here because both cited mechanisms are stated as that kind of program
• Corollary 3 states only that a cost floor exists, not its exact shape or size: the achievable-region table below illustrates the shape with an explicitly stated, illustrative closed form, not a claim about either cited bound’s literal functional form

    
    %%{init: {'theme': 'neutral'}}%%
flowchart TD
    NOM["Nominal action u-nominal
Cyclic Adaptive Regulation
Proposition 2"]:::leaf
    DEF3["Definition 3
Probability constraint
P(exit safe region) less than or equal to epsilon"]:::leaf
    COR2["Corollary 2
CVaR constraint
bounds excursion magnitude by rho"]:::leaf
    QP["Per-step QP, Corollary 3
minimize distance to u-nominal
subject to both constraints"]:::branch
    FEAS{"Feasible set
non-empty?"}:::branch
    SAFE["Safe action u-star
both bounds honored"]:::ok
    EMPTY["No action satisfies both bounds
Corollary 3 prices this as costly,
not as impossible"]:::alt

    NOM --> QP
    DEF3 --> QP
    COR2 --> QP
    QP --> FEAS
    FEAS -->|yes| SAFE
    FEAS -->|no, F17| EMPTY

    classDef root fill:none,stroke:#333,stroke-width:3px
    classDef leaf fill:none,stroke:#4a90d9,stroke-width:1.5px
    classDef branch fill:none,stroke:#ca8a04,stroke-width:2px
    classDef ok fill:none,stroke:#22c55e,stroke-width:2px
    classDef alt fill:none,stroke:#aaa,stroke-width:1.5px,stroke-dasharray:4 4

Read the diagram. Figure 1 showed Proposition 3’s filter alone, a single barrier constraint, looping forever with no exit state. This figure is not that loop redrawn; it is what changes inside the QP box once Corollary 2 adds a second, independent constraint. Two constraints, one from Definition 3 and one from Corollary 2, feed into a single per-step optimization rather than two sequential checks, which is what “jointly enforced, not one substituting for the other” means as a computation, not only as a sentence. The dashed branch is the one Corollary 3 prices but does not resolve: a highly constrained state can leave no action satisfying both bounds at once, the exact gap “A Cost Floor Assumes a Solution Exists at All,” directly below, and Falsification Criterion F17 names. This post has not built the explicit backup policy that would close it.

L3 · Estimate The shape of the tradeoff is worth showing with a small, explicitly illustrative model, not a claim about either cited bound’s literal functional form. Let a fixed total control-authority budget $m_{\text{tot}}$ split between a probability-margin $m_p$ and a CVaR-margin $m_c$ , $m_p + m_c = m_{\text{tot}}$ . Model the achievable $\epsilon$ using the generic Bennett/Freedman-type tail form this whole family of concentration inequalities produces, $\epsilon(m_p) = e^{-m_p^2/2v}$ for a disturbance-variance proxy $v$ . Model the achievable severity bound using a generic diminishing-returns form, $S(m_c) = S_0 / (1 + m_c/k)$ . Sweep the split at a fixed $m_{\text{tot}}=4$ , verified directly rather than asserted:

Read the table’s shape, not its specific numbers, which are illustrative only. Moving margin toward tightening $\epsilon$ strictly worsens the achievable severity bound, and moving margin the other way strictly worsens $\epsilon$ , confirmed across the full sweep, not merely at the two ends. There is no split of a fixed budget that improves both numbers at once. This is the same achievable-region logic Dual Control and the Weaponized Probe used for a cost-over-time tradeoff, applied here to a cost-over-safety-dimensions tradeoff. The frontier this table traces is the lower envelope of what one fixed budget can jointly buy, not a claim that either bound alone was ever the full price.

The Reversal Condition already stated below is this frontier’s degenerate case, not a separate finding. Under a genuinely light-tailed disturbance, Definition 3’s probability bound and Corollary 2’s magnitude bound converge to saying nearly the same thing. That is the condition under which $\epsilon$ and the severity bound stop trading against each other, because tightening one no longer costs the other anything worth pricing. The achievable region collapses toward a single point rather than a genuine frontier. Falsification Criterion F16 states the testable form of whether this frontier has real bite in the running case, as opposed to being a theoretical possibility a heavy-tailed system never actually operates close enough to its constraints to feel.

A Cost Floor Assumes a Solution Exists at All

A sharper failure than “expensive” is worth naming, because Corollary 3 only priced the milder one. Everything above, the cost floor, the achievable-region table, treats the per-step QP as though it always has some feasible action to return, and asks only how costly that action gets as the feasible set shrinks. Shrinking a feasible set raises the optimum’s cost because the set is assumed to stay non-empty. Push two constraints hard enough at once, at a state where the disturbance is already severe, and the feasible set can do worse than shrink toward an expensive corner. It can vanish outright, and a quadratic program with an empty feasible set does not return a costly action. It returns no action at all.

L1 · Bound This is not a hypothetical defect specific to Corollary 2’s construction. It is a known, general property of stacking barrier constraints on a per-step QP without a separate feasibility guarantee. The control-barrier-function literature has its name and fix for it. Chen, Jankovic, Santillo, and Ames showed that an ordinary CBF-QP safety filter can lose feasibility as the state evolves[15] . Nothing in the filter’s per-step construction certifies in advance that a next feasible action will still exist. Their fix anchors the filter to an explicit backup policy, a known, pre-verified fallback trajectory. That anchor guarantees the QP’s feasible set stays non-empty by construction, not by assumption.

Proposition 3 and Corollary 2, as this post states them, have no such backup set. The QP they describe assumes, without proving, that a nearby feasible action exists at every state the barrier is asked to filter. In a highly constrained region, both constraints pulled tight by a disturbance already running hot, that assumption is the one this post’s achievable-region table shows getting more expensive to satisfy. The same table gives no reason to believe the feasible set stays non-empty rather than merely small right up until it empties out.

This post has not built the backup-policy machinery that would close this gap, and does not claim Corollary 3’s cost-floor argument does the job of a feasibility guarantee, because it was never built to. Falsification Criterion F17 below states the open, testable form of the claim.

Compute Your Own Boundary, a Checklist

Everything above is one worked instance, using this post’s executor pool. Here is the same procedure, stripped to five steps, for a reader building a barrier against their system rather than this post’s.

1. Name $h(x)$ and $\mathcal{C}$ . The signed-distance function should read directly off a quantity you already track: queue occupancy, error rate, whatever margin your system is actually trying not to run out of. Name the safe region it defines. If you cannot state $h(x)$ concretely, Definition 3 has nothing to filter yet.
2. Price $\epsilon$ , the probability tolerance a reviewer would actually sign off on. Not the smallest number you can compute. It is the number a reviewer would read once and trust, the way “Why a Rulebook Cannot Do This Job” describes a boundary being approved once rather than every action being re-approved forever.
3. Check whether excursion severity, conditional on leaving $\mathcal{C}$ , is heavy-tailed. If it is provably light-tailed, with a genuinely bounded worst case, stop here. The Reversal Condition above applies, and $\epsilon$ alone is close to the full guarantee. Most correlated-retry regimes are not this case.
4. If it is heavy-tailed, price $\eta$ and $\rho$ , Corollary 2’s CVaR tail fraction and its maximum tolerable severity within that fraction. The two numbers are chosen independently of $\epsilon$ , answering different questions on purpose.
5. Check the joint QP’s feasible set, not only its cost. Verify, empirically against your own reference implementation or by construction, that enforcing $\epsilon$ and $\rho$ together never empties the feasible set across your own operating envelope. This is per “A Cost Floor Assumes a Solution Exists at All” above. If you cannot verify this, build the backup-policy machinery this post has not. Otherwise, treat the resulting filter as unverified at your own system’s worst-case states, not just expensive there.

This checklist does not remove the judgment call in step 2, what a reviewer will actually accept, or the engineering work in step 5, an actual backup policy. It fixes their shape, so what remains is a specific boundary to defend, not a feeling that the system is probably safe enough.

When the Probe Causes the Cliff It Is Measuring For

Dual Control and the Weaponized Probe’s ProbeBW cycle is the concrete mechanism Cyclic Adaptive Regulation borrows to keep reading its regulation as measurement. It has eight round trips: six cruising at its current bandwidth estimate, one probing 25 percent above it, one draining 25 percent below it. That cycle’s drain phase carries an assumption worth stating outright, because this post’s reference implementation already shows the dynamic that can break it.

The Assumption the Drain Phase Actually Makes

The drain phase’s entire job is to pay down whatever queue the probe phase’s 1.25x pacing just built up, by pacing at 0.75x for one round trip afterward. That works, cleanly, if downstream capacity stays roughly where the current bandwidth estimate assumes it is across both phases. It is a stationarity assumption, made silently, about one full cycle’s worth of time, and The Simulation Singularity’s whole opening argument is that stationarity is the assumption a correlated-retry regime breaks.

L3 · Estimate A small worked model makes this precise, reusing the ProbeBW gains as Dual Control and the Weaponized Probe stated them, and this post’s health-scaled clearing-capacity mechanism from The Simulation Singularity. Suppose downstream capacity, normally matching the current bandwidth estimate exactly, collapses to some fraction of nominal as the probe phase begins. The bandwidth estimate itself, matching BBR’s deliberately slow, windowed-maximum filter on delivered rate, does not revise downward until the next cycle starts:

Read the middle row first. The drain phase stops draining, exactly, the moment downstream capacity falls to 75 percent of the nominal estimate the probe and drain gains are both computed against, because 0.75 times the estimate is no longer less than the collapsed capacity itself. Below that line, the drain phase does not merely fail to help. It actively adds to the queue, on top of what the probe phase already added, right when the system can least afford it.

One scoping note on the last column, so its numbers read as what they are. It sums the probe and drain rounds alone, because those two are the rounds whose cancellation the cycle’s design explicitly promises. The inversion of that promise is what this section is naming. A collapse that persists through the cycle’s remaining six cruise round trips builds more queue on top. Cruising at gain 1.0 against capacity $c$ adds $(1.0 - c)$ per round trip: another 1.5 queue-units at the 0.75 line and another 3.0 at 0.50. The cruise rounds fail for the ordinary reason, a stale estimate. The table isolates the two rounds that fail for the inverted one instead, and its totals are a floor on the full cycle’s damage, not the whole of it.

The Backlog Does Not Drain Itself Afterward

The one bad cycle is the smaller problem. What happens after it is the larger one. Model a second cycle, one full ProbeBW cycle later, in which downstream capacity has stabilized at its new, lower level and the bandwidth estimate has, in the best case for the system, fully caught up to it by then:

The same probe-and-drain scoping applies to this table’s “net” column as to the last one’s. A collapse persisting through cycle 2’s cruise rounds adds $0.5 \times 6 = 3.0$ more, leaving a scar of 4.0 rather than 1.0 before cycle 3 takes over. The direction of the argument only strengthens under the fuller accounting.

Cycle 3 is, on its own terms, correct: once the estimate has adapted, cruising and cycling at the new, lower capacity is stable and self-consistent. It is also, notice, net zero over the cycle, not net negative. Ordinary operation at a correctly adapted estimate holds a queue steady. It does not proactively pay down a backlog that arrived before the estimate adapted. The one bad cycle’s overshoot becomes a permanent scar, sitting in the queue indefinitely, not because anything afterward is misconfigured. It is because nothing in the ordinary cycle’s design is built to notice and repay a debt incurred before it started paying attention.

What This Means for the Barrier

L2 · Fit This is The Simulation Singularity’s metastable-collapse signature, reappearing inside the very mechanism Dual Control and the Weaponized Probe built to avoid repeating The Simulation Singularity’s mistake. A probe’s up-phase, landing on a downstream collapse already underway, can be the specific push that tips a system already near its edge into the regime this series opened by diagnosing. BBR’s real, documented windowed-maximum bandwidth filter makes this worse, not better: it is deliberately slow to revise downward, so a transient dip does not cause needless underestimation. That makes the mismatch window this section models longer in practice, not shorter.

A discrete-time stochastic control barrier function, as Definition 3 states it, bounds the probability of the queue itself leaving its declared safe region. It does not, by that statement alone, watch whether the probe currently in flight is the thing pushing it there. Closing this gap needs two things from the barrier. It has to observe a real-time rate-of-change signal, not only current occupancy. It also has to be willing to abort a probe phase mid-cycle, the moment downstream clearing capacity visibly decouples from the estimate the current cycle’s gains were computed against.

This post has not built that mechanism, though the next section sketches its formal shape rather than leaving the gap entirely unnamed. Falsification Criterion F11 states the testable form of the claim that it is needed; until it is built, or until F11 is shown false, treat the ProbeBW-style cycle as carrying a residual risk this post names rather than resolves: the probe that measures the cliff can, in the specific and now-quantified circumstance above, be the thing that causes it.

A Formal Sketch of the Missing Mechanism

L3 · Estimate The tool this gap actually needs already sits inside this post’s apparatus, cited above for a different purpose than the one it serves here. Proposition 3’s Layer 1 already reaches for the CBF-CLF-QP framework to unify a safety constraint and a performance objective in one per-step program. The same authors’ High-Order Control Barrier Function construction, cited again below in the Model Scope table for a different reason entirely, relative degree rather than rate-of-change, supplies the missing signal named above[16] .

The construction below is stated in enough detail to check, as a formal object in its own right rather than prose describing one.

Definition 4 (First-Order Rate-of-Closure Barrier Extension). Let $\varphi_0(x)$ be Definition 3’s barrier, the signed margin between current queue occupancy and the declared safe boundary. A first-order High-Order Control Barrier Function extension adds a second constraint on top of it,

$$\varphi_1(x) = \dot\varphi_0(x) + \alpha_0(\varphi_0(x)) \geq 0$$

for a class-$\mathcal{K}$ function $\alpha_0$ , enforced jointly with $\varphi_0(x) \geq 0$ in the same per-step quadratic program Proposition 3’s filter already runs.

where:

• $\dot\varphi_0(x)$ inherits Xiao and Belta’s continuous-time notation[16] , written for a system evolving as a differential equation; this post’s runtime is discrete and event-driven, so every occurrence of $\dot\varphi_0(x)$ below is read as the one-step drift the per-step QP can actually observe, $\dot\varphi_0(x) \approx \Delta\varphi_0(x_t) = \varphi_0(x_{t+1}) - \varphi_0(x_t)$ , not a literal time derivative no discrete controller could compute
• $\varphi_1$ is not a restatement of $\varphi_0$ : it bounds how fast the margin is closing, and not only whether it has closed yet, computed from the same bandwidth estimate the probe phase’s gain is already using, requiring no new instrumentation this post has not already assumed
• $\alpha_0$ is chosen to penalize fast closure more than slow closure, so the added constraint can bind, forcing the pacing gain down or aborting the probe outright, before $\varphi_0$ itself would cross zero, not after
• this is a candidate mechanism, not a proof that it closes the gap “What This Means for the Barrier” names: $\dot\varphi_0$ is computed from the same bandwidth estimate the actuator-inversion failure mode can itself corrupt, so the construction moves the blind spot one derivative rather than removing it, as stated below

Map Definition 4 onto the ProbeBW cycle directly. Read $\varphi_0$ as the queue’s margin below its declared safe threshold, and $\dot\varphi_0$ as that margin’s rate of consumption during the probe round trip specifically. The worked table above shows why $\varphi_1$ catches what $\varphi_0$ alone misses. At 0.75 nominal capacity, the queue-fraction $\varphi_0$ may still show comfortable margin one round trip into the probe, while its rate of consumption is already well past whatever a stationary, non-collapsing cycle would produce.

What Definition 4 genuinely buys is narrower than a full proof, and still real. It converts an unbuilt, unspecified mechanism into a specific, named formal object, with a specific, nameable residual gap. That is a real advance over leaving the whole problem as an open question with no candidate shape. Falsification Criterion F11 below tests a prior, narrower question: whether the underlying failure regime this construction targets occurs in production traffic at all. Whether Definition 4 itself, once built, actually closes the gap given that the failure regime is real, is a further question this post does not reduce to a single falsifiable criterion. The reason is specific. The construction’s stated residual gap, a stale bandwidth estimate corrupting $\dot\varphi_0$ the same way it corrupts $\varphi_0$ , is not itself something a falsification test against production traffic alone could cleanly isolate.

One more cost this construction carries is worth naming, because aborting is not a free action either. L1 · Bound A ProbeBW-style up-phase exists to generate one thing, and only that phase can generate it: a delivery-rate sample taken while sending at the elevated 1.25x gain. That sample is what tells the estimator whether more capacity than currently assumed is actually available. Dual Control and the Weaponized Probe’s account of the cycle is explicit that this is what the up-phase is for, not an incidental side effect of it.

L2 · Fit Aborting mid-cycle, the way $\alpha_0$ above is built to force, preserves $\varphi_0$ , the queue margin Definition 3 actually bounds, at the direct cost of that sample. An up-phase cut short before completing its round trip at the elevated gain never learns whether the collapse it reacted to has eased, only that it was underway at the moment of abort. The estimate $\dot\varphi_0$ itself depends on, already named above as this construction’s residual gap, is not just stale entering the next cycle. It is guaranteed to stay that stale, because the same action that protects the queue this cycle is the action that withholds the one measurement able to correct it.

The next cycle’s probe starts from the identical unrevised estimate, facing the identical choice, until some cycle is eventually allowed to run long enough to refresh it, or until the estimate is corrected by a channel this post has not specified. This is the same price BBR’s probe-drain-cruise design pays by construction, not a flaw specific to Definition 4. Any mechanism that protects a queue by declining to sustain the elevated rate a capacity sample requires is, by that same action, declining to learn whether the thing it is protecting against has actually ended.

Trusting the Estimate That Triggers the Boundary

One more piece of Dual Control and the Weaponized Probe’s apparatus needs re-examining before this post’s safety claims can stand on their own. It was verified once, under conditions this post’s subject matter makes newly relevant.

Definition 2’s ensemble is the interacting-multiple-model mechanism that lets Cyclic Adaptive Regulation notice a regime shift quickly instead of slowly. It needs a small, constant, ongoing mixing probability to stay willing to reconsider a confident hypothesis. That much Dual Control and the Weaponized Probe verified: it fixes a real failure mode, a naive ensemble that never revisits its confidence can fail completely, worse than a plain moving average. What Dual Control and the Weaponized Probe’s worked demonstration did not do is test that mixing probability against heavy-tailed background noise. That is the same kind of noise this post’s severity table takes as given.

L2 · Fit The tension is real. A mixing probability tuned high enough to unlock quickly from a stale hypothesis is also a mixing probability that treats an ordinary, if unusually large, heavy-tailed noise draw as evidence of a genuine regime shift. It does this more often than a light-tailed noise model would predict. Tuned low enough to avoid that false alarm, it reintroduces Corollary 1’s detection lag, the linear-regret cost The Simulation Singularity already priced. This is an untested interaction between two apparatuses this series built separately and verified separately: the ensemble against simple noise, the severity table against a heavy tail, without ever running the two together. It is not a flaw in Dual Control and the Weaponized Probe’s ensemble mechanism.

L3 · Estimate The interaction is worth testing directly rather than leaving it asserted. Reuse Dual Control and the Weaponized Probe’s two-hypothesis IMM construction: one hypothesis pinned to the true, unchanging regime, the other to a fixed alternate 3 standard deviations away. Mix them each step by a small, constant probability, in the same spirit as Dual Control and the Weaponized Probe’s mechanism. That earlier post states that probability must be small and constant, but never pins down a specific value. This table states its own value explicitly rather than implying an exact match to an unstated number: 0.02 per step.

Hold the true regime fixed for the entire run. Then any sustained shift in belief toward the alternate hypothesis is, by construction, a false alarm, not a genuine detection. “Sustained” means the alternate hypothesis’s posterior stays above 0.5 for at least 5 consecutive steps, over a 200-step run. Feed the identical ensemble Gaussian noise, then Student-t noise at two tail weights, all at the same scale parameter:

The same ensemble, the same mixing probability, the same absence of any real regime shift: a heavy tail alone raises the false-alarm rate by two to three orders of magnitude over the light-tailed baseline. The increase continues as the tail gets heavier still. Recall that Dual Control and the Weaponized Probe’s verification of this mechanism used noise closer to the first row. This series’ running case, a correlated-retry regime whose severity this post has already modeled as heavy-tailed, lives closer to the second and third.

Two different failure modes follow directly, for two different audiences. For this post’s safety filter, a false regime-shift signal can trigger an unnecessary, and therefore costly, intervention, tightening the barrier’s filtering action against a threat that was never real. For any future stopping rule built on the right to probe rather than the obligation to, a question this post flags rather than answers, such a rule’s value depends on trusting the signal that would trigger exercising it. If that signal is itself prone to mistaking noise for drift under the heavy-tailed conditions this series’ running case describes, the rule would be deciding when to act on a trigger this post cannot yet certify as trustworthy. Falsification Criterion F12 states this as a testable claim, rather than leaving it as an unquantified worry.

Bootstrapping the Boundary Before Any Telemetry Exists

Every piece of trust priced above assumes the mechanism doing the pricing is already running: Definition 3’s $\epsilon$ calibrated against a disturbance model, Definition 2’s mixing probability tuned against a noise process. Neither was ever going to be true on day zero, and the series has not yet said what happens before it is.

The problem sits underneath everything built so far rather than beside it. Cyclic Adaptive Regulation’s ensemble needs a running estimate of the environment’s noise characteristics before its mixing probability can be sanity-checked against anything real. Definition 3’s safe region $\mathcal{C}$ and disturbance bound need a calibration source before $\epsilon$ means anything at all. Recall that The Simulation Singularity spent an entire post arguing that historical validation is structurally blind to the regime that matters. A team deploying this apparatus for the first time has, by construction, nothing else to calibrate against.

L2 · Fit The honest answer does not escape this. The initial barrier and the initial ensemble prior are bootstrapped from history, or from a conservative engineering heuristic standing in for history, the kind of source this series has spent three posts distrusting for a different purpose. What changes is not the starting point; it is what happens after it. A system frozen at its historical validation, The Simulation Singularity’s subject, never gets a second, better estimate, because nothing about running it generates new information about a regime it never saw. Cyclic Adaptive Regulation’s cycle, once running, does that. Every round trip through Definition 2’s persistent excitation is a chance to notice the initial calibration was wrong and correct it, the property Dual Control and the Weaponized Probe built the mechanism to have.

That correction is not instantaneous, and pretending otherwise would be its own kind of congruence: a post that has spent this many pages naming other systems’ false confidence, quietly assuming its own mechanism starts out already calibrated. Between deployment and however many cycles it takes the ensemble to accumulate enough persistent excitation to trust its mixing probability against real, not assumed, noise, the barrier is running on the same kind of untested historical guess this series opened by diagnosing. Falsification Criterion F18 below states the condition under which that warm-up window is short enough not to matter, and the condition under which it is not.

What One Controller Does When the Coordinator Goes Quiet

The next several sections belong in a post about probability and magnitude, rather than reading as a detour into distributed-systems theory for its own sake, because the connection is load-bearing, not decorative. Several sections ahead, “The Fleet Question This Post Does Not Answer” considers extending Corollary 2’s magnitude bound to a fleet by feeding each node’s barrier a dynamic penalty weight built from the shared Kelly price, the same coordination signal named below. That candidate fix depends on the signal actually being there. Before asking whether it stabilizes a fleet’s joint safety, the narrower question has to be answered first. What does a single node’s magnitude bound do the moment that signal is stale or unreachable, not just imperfect? A CVaR constraint calibrated against a coordination signal that can silently disappear is exposed to the kind of gap this post has been naming under other names throughout. This section, and the two that follow it, answer that narrower question before the fleet-wide one gets asked at all.

Dual Control and the Weaponized Probe closed its game-theory section by naming what a shared Kelly-style pricing signal buys a fleet of simultaneously probing controllers. It buys convergence toward a declared-fair split, rather than the roughly 33.6-to-1 starvation split, 97.1 percent versus 2.9 percent, an uncoordinated fleet reaches on its own. That pricing signal needs its own control plane, its own telemetry aggregation, and its own consensus. This series has already established, twice over, that all three carry real, physical, nonzero latency.

The question that leaves open has an answer this post can actually give, at the single-agent level, without needing to resolve anything about the fleet as a whole. What does this controller do, on its own, the moment its input, the shared price, goes stale or becomes unreachable?

The Choice Is Consistency or Availability, Not Safety or Danger

That question already has a name, proven in a completely different corner of distributed systems engineering. A shared price signal is a consistency mechanism: it exists so every controller acts on the same, agreed view of how much capacity is actually available. Losing access to it, whether the control plane is down, the telemetry aggregation is stale, or consensus cannot currently be reached, is a network partition. Gilbert and Lynch formalized what that means when they proved Brewer’s conjecture. In an asynchronous network, a system cannot guarantee both strong consistency and full availability once a partition genuinely separates it from the source of truth it depends on[17] .

Read the two options this section already named against that theorem directly. They are the two sides of Gilbert and Lynch’s impossibility result, instantiated for this one controller, not two arbitrary engineering choices. Freezing chooses consistency: refuse to act on a price that might be stale, and accept the unavailability of continuing to adapt as the cost. Falling back chooses availability: keep adapting, keep serving the control objective, and accept that the view being acted on is no longer guaranteed consistent with what every other controller believes. There is no third option that keeps both. That is not because this platform’s engineers failed to design one, but because Gilbert and Lynch proved, for the general case, that none exists once the partition is real.

Naming the choice this way does not change which option this post recommends. It changes the status of the recommendation, from an engineering judgment call specific to this running case, to an instance of a proven theorem this series did not need to re-derive.

Deeper: knowing which branch you are in is its own unsolved problem. FLP's impossibility result means no failure detector can perfectly tell a slow coordinator from a dead one, so the freeze/fallback choice trades one error rate against the other rather than removing the error.

L1 · Bound The paragraph above already conflates three distinct causes into one: “the control plane is down, the telemetry aggregation is stale, or consensus cannot currently be reached,” treated as equivalent to a partition. That conflation is forced, not careless. It has a name older and more fundamental than Gilbert and Lynch’s theorem. Fischer, Lynch, and Paterson proved it[18] . In an asynchronous system, no deterministic protocol can guarantee consensus in bounded time, even against a single process that might simply be slow. The reason is silence. A slow, live process and a genuinely crashed one look identical from every other process’s local point of view, for as long as that other process is willing to wait.

The controller in this running case sits in that position with respect to the shared price signal. It cannot, from local observation alone, tell “the coordinator is dead” from “the coordinator, or the network between us, is merely slower right now than I expected.” No amount of additional waiting converts that uncertainty into certainty. It only converts it into a longer wait.

L1 · Bound FLP rules out doing this perfectly. What a real system does instead is implement an unreliable failure detector, Chandra and Toueg’s term for it[19] . It is a local oracle, typically a timeout, that outputs one suspicion: “I believe the coordinator has failed.” That suspicion can be wrong in either direction. It can falsely suspect a coordinator that is merely slow, or it can miss the detection and keep trusting a coordinator that is actually gone. Read “freeze” and “fall back” this way and the choice named above sharpens further. It is a decision about which class of failure detector to build, not a decision made once a partition is somehow confirmed.

Every real timeout-based implementation of one sits on the same shape of tradeoff this post has already met once, in a completely different subsystem. Definition 2’s ensemble, tuned to notice a regime shift quickly, pays for that speed with a higher false-alarm rate under heavy-tailed noise, verified in this post’s IMM table at 3.08 percent and 12.44 percent against a light-tailed baseline of 0.03 percent. A failure detector tuned to suspect quickly pays for that speed the same way. Tuning it to catch a genuinely dead coordinator fast, so a controller does not keep trusting it too long, buys a higher rate of freezing against a coordinator that was only ever slow. These are two independent instances, in two subsystems this post built separately, of one abstract shape, not the same mechanism. A local test, forced to decide under time pressure from incomplete information, cannot minimize both kinds of error at once. It can only trade one against the other.

This sharpens what it means for the recommendation above. Freezing is still the safer default this post recommends, conditional on a trust or monitoring mechanism, per Falsification Criterion F13 and the Stag Hunt’s trust condition. What FLP and Chandra-Toueg add is the reason no such mechanism, however carefully engineered, can be made perfectly accurate. The controller is choosing, permanently, which of two error rates to prefer, not choosing between a correct and an incorrect belief about the coordinator’s state. This is a family of tradeoff this series already named once, under a different discipline entirely, in The Simulation Singularity’s account of a positive test bought cheap at the price of telling two hypotheses apart.

Deeper: the same impossibility prices latency too, even without a partition. PACELC extends Gilbert-Lynch to the ordinary case, and a delayed Kelly price can lose stability outright rather than just arrive late.

Gilbert and Lynch’s theorem is a statement about what happens during a genuine partition. It has a natural extension to the ordinary, no-partition case this series has been pricing since Dual Control and the Weaponized Probe, where the price signal is merely slow rather than absent. Abadi names that extension directly: even when the network is not partitioned, a distributed system still trades consistency against latency, because waiting for a fully consistent view costs real, physical time[20] . Abadi’s compact form for it is: if there is a Partition, choose Availability or Consistency; Else, choose Latency or Consistency. That is PACELC, one acronym naming both tradeoffs instead of treating the ordinary case as a footnote to the partition case.

This is a name for a fact this series priced twice already, under two different vocabularies, not a new fact about this series’ running case. This post’s opening section already restated what Dual Control and the Weaponized Probe found: a shared Kelly-pricing coordination signal carries a physical latency floor. That floor is real, nonzero time consensus and telemetry aggregation cost even when nothing has failed. PACELC’s “else, latency or consistency” branch is that floor, formalized. A controller can wait for the fully consistent price, paying that floor’s latency, or it can act on a possibly-stale local view sooner, paying a consistency cost instead. This trade exists continuously, not only during the partition Gilbert and Lynch’s theorem addresses.

The freeze-versus-fallback choice named above is this series’ instance of PACELC’s partition branch. Likewise, Dual Control and the Weaponized Probe’s physical latency floor is this series’ instance of its else branch, arrived at independently, under different vocabulary, before this post named the theorem that unifies them. Naming both under one acronym does not change either finding. It shows they were never two separate observations, one about outages and one about ordinary latency, but the same underlying tradeoff. They are sampled at two different points on one axis: how stale is the view being acted on, and who pays for making it fresher.

This deepens the distributed-systems row of the Ledger below without needing a Falsification Criterion of its own. PACELC names a second instance of a tradeoff this series had already priced under a different vocabulary, in Dual Control and the Weaponized Probe’s latency-floor finding. It does not add a new claim this post did not already make under Gilbert and Lynch’s theorem alone.

Tighten this a step further. Latency so far has been priced only as a cost, how long a controller waits or how stale its view becomes, not as a threat to whether the shared price converges to a fair split at all. L1 · Bound A shared price fed back to every controller with a real, physical, round-trip delay turns Kelly’s proportional-fairness recursion into a delayed difference equation, not a slow one alone. Johari and Tan proved that distinction is not cosmetic. Past a delay-dependent threshold, and more sharply once round-trip delays across the fleet are heterogeneous rather than uniform, the equilibrium a synchronous analysis guarantees, Dual Control and the Weaponized Probe’s idealized limit above, loses local stability outright. The price settles into a sustained oscillation around the fair split rather than converging to it[21] .

That is a materially different failure than the convergence transient Dual Control and the Weaponized Probe’s slow-tracking simulation found. That transient is the roughly 2.9-to-1 residual split at 80,000 rounds, closing toward Kelly’s speed-independent equilibrium as the slow flow converges, independent of price-loop speed itself. A convergence transient is an efficiency cost: fairness reached late. A lost stability margin is worse: fairness never reached at all, replaced by a limit cycle a naive per-controller view cannot distinguish from ordinary price noise. This post has not measured whether this running case’s control-plane latency, or its heterogeneity across the fleet, sits above or below that threshold, and does not claim it does. What PACELC’s “else” branch prices above purely as a latency cost is doing double duty. The same physical delay this series already priced as a cost to efficiency is also, past an unmeasured threshold, a bound on whether the coordination mechanism is stable at all.

Is Freezing Even a Stable Choice?

Everything said so far treats “freeze” as though it were simply the cheaper of two private costs, decided once, by one controller, in isolation. That framing quietly assumes something worth checking rather than assuming: that freezing is a decision this controller can make without needing to guess what every other controller, facing the identical outage at the identical moment, is about to do. It cannot. This is the two-player game it actually is, illustrative and symmetric rather than a claim about the full fleet. It is worth checking whether “freeze” survives contact with a second rational agent making the same calculation.

L3 · Estimate Illustrative costs go on the four outcomes, using this series’ established facts wherever one is available rather than inventing a number where a citation already supplies it. Both freeze: each pays Corollary 1’s frozen-policy cost, normalized to 1. Both fall back: each competes uncoordinated against the other, and even a fair, symmetric split does not erase the risk this series opened with. Simultaneous uncoordinated adaptation against a downstream dependency already stressed by an outage can tip it into the metastable regime The Simulation Singularity diagnosed, so that shared risk is priced at 1.3 each, worse than mutual freezing.

One freezes while the other falls back: the lone defector, facing no competition for whatever headroom exists, does only slightly better than baseline, priced at 1.1. A lone uncoordinated probe against a recovering dependency still carries real risk the missing price signal would otherwise have priced. The lone freezer, its fixed rate now crowded out by a counterpart that is actively adapting and it is not, pays the worst cost in the table, priced at 2.0. Corollary 1 bounds what a frozen policy costs on its own terms, holding its share of traffic fixed. It was never a claim that a frozen share stays the same size while an uncoordinated neighbor is actively expanding into it.

What “crowded out” concretely means for the lone freezer is worth naming, rather than leave 2.0 justified only by an unweighted ratio lost to a bigger neighbor. L2 · Fit This post’s joint-clearing-rate model, named above for this shape of shared, contended resource, gives the mechanism a precise form. Throughput past a comfortable concurrency threshold $C$ falls as $sC^2/n$ , a decreasing function of concurrent load $n$ . It is not a fixed total two controllers are merely splitting unevenly.

An uncoordinated counterpart does not only claim a larger share of that total. Its own additional concurrent probing is the kind of load that pushes $n$ further past $C$ , so the total the two controllers are dividing is itself shrinking as the defector pushes into it. The lone freezer’s cost of 2.0 prices a collapsing denominator in the shared dependency’s throughput, not only a shrinking numerator, its share that a fixed neighbor happens to be claiming more of.

This is the same mechanism named at the top of this post, not a new one invented for the game. The specific $s$ , $C$ , and $n$ this Stag Hunt’s illustrative payoffs would need to reproduce 2.0 exactly are not claimed to match the executor pool’s worked values above. This table was built illustratively rather than derived from them. Only the shape of the collapse is claimed to match, not a different, unrelated cost the game invents on its own.

Two claims in this table are worth verifying directly, rather than taking on faith. Is mutual freezing a Nash equilibrium: facing a freezing opponent, is freezing my best response? Compare my cost if I freeze, 1, against my cost if I defect instead, 1.1. One is smaller, so freezing is a best response to freezing. Is mutual fallback also a Nash equilibrium: facing a defecting opponent, is defecting my best response? Compare my cost if I fall back, 1.3, against my cost if I freeze alone against them instead, 2.0. Fallback is cheaper, so fallback is also a best response to fallback.

Both $(\text{Freeze},\text{Freeze})$ and $(\text{Fallback},\text{Fallback})$ are Nash equilibria, verified directly from the table, not asserted. This is the textbook structure of a Stag Hunt: two self-reinforcing equilibria, one Pareto-dominant, $(1,1)$ beating $(1.3,1.3)$ . Both players would prefer that outcome if they could coordinate on it, but the coordination mechanism that would normally let them do so is the shared price signal this whole scenario assumes is unavailable.

Whether a rational controller actually lands on the good equilibrium depends on what it believes the other will do, and this is where the asymmetry bites. Savage’s minimax-regret criterion from The Simulation Singularity applies directly, rather than a new decision rule invented for this section. Regret compares my two choices against each other under one fixed state of the world, not one choice against itself across two different states.

If the other player freezes, my choices cost 1 (freeze) or 1.1 (fall back). Freezing is the best response to that state, so guessing fall back and being wrong there costs $1.1 - 1 = 0.1$ more than guessing right would have. If the other player falls back, my choices cost 2.0 (freeze) or 1.3 (fall back). Falling back is the best response to that state, so guessing freeze and being wrong there costs $2.0 - 1.3 = 0.7$ more than guessing right would have.

Freeze’s worst-case regret, 0.7, is seven times larger than fallback’s, 0.1. Fallback is the risk-dominant strategy, in the technical sense The Simulation Singularity’s minimax framework already established. It is the safer bet under genuine uncertainty about what a rational counterpart will do, even though it is not the jointly best outcome if trust could be established.

From Two Controllers to a Fleet: Where the Tipping Point Sits

The two-player illustration above is deliberately the simplest case that still makes the mechanism checkable. It generalizes one step further, because the generalization has an exact answer, not just a qualitative one, and it sharpens the trust condition the two-player case already named rather than replacing it. What this generalization is not matters, before stating it. It is narrower: an incentive question about which of the two Nash equilibria a fleet of individually-safe controllers actually lands in, holding each controller’s barrier as already valid. It is not a claim that a single controller’s safety boundary composes across a fleet, the control-theoretic question “The Fleet Question This Post Does Not Answer” below leaves open on purpose.

L3 · Estimate Consider $M$ controllers, each facing the identical outage, each choosing freeze or fall back. Let $f$ be the fraction of the other $M-1$ controllers a given controller expects to fall back. The illustrative payoffs above extend by linear interpolation on $f$ , the standard construction behind a threshold or tipping-point model of collective behavior[22] , pinned at the two-player corner cases already established rather than fit independently.

Proposition 4 (Fleet Defection Threshold). A controller’s cost from freezing rises linearly from 1, at $f=0$ , to exactly 2.0, at $f=1$ , as more of its counterparts fall back and crowd out its fixed rate as the lone-freezer cell in the two-player table already prices: $C_{\text{freeze}}(f) = 1 + f$ . Its cost from falling back rises linearly from 1.1 toward 1.3 over the same range, moving in the same direction rather than the opposite one, because more simultaneous fallback means more uncoordinated competition, not less: $C_{\text{fallback}}(f) = 1.1 + 0.2f$ . These cross at exactly one point,

$$C_{\text{freeze}}(f^\ast) = C_{\text{fallback}}(f^\ast) \implies f^\ast = \frac{1.1-1}{1-0.2} = \frac{1}{8} = 0.125$$

below which freezing is every controller’s individually rational best response, and above which falling back is.

where:

• $f^\ast$ depends only on the four illustrative payoff values already justified above (1, 1.1, 1.3, 2.0), not on $M$ itself: the threshold is a fraction of counterparts, so the same $f^\ast$ applies regardless of fleet size
• this is a claim about which of two Nash equilibria a fleet of already-safe controllers lands in, not a claim that a single controller’s safety boundary composes across a fleet, which “The Fleet Question This Post Does Not Answer” below leaves open on purpose

Sweep $f$ across the full range to see the crossing directly, not only at its single solved point:

A defection rate of exactly one in eight, under this post’s illustrative payoffs, is already enough to flip every remaining controller’s best response from freeze to fallback. That is the sharper, quantitative form of the same trust condition the two-player case already named. Freezing is not merely fragile in the abstract. It has a specific, computable breaking point, and a fleet does not need anywhere close to a majority of its members to defect before the mutual-freeze equilibrium stops being anyone’s best response. Falsification Criterion F15 states this threshold’s testable form.

Here is what this means, stated plainly, for the single-agent recommendation this section opened with. Freezing is still this post’s recommendation. It remains the Pareto-optimal choice if a controller has independent reason to trust that its counterparts will also freeze, a reasonable assumption for a small, known set of services operated by one team under one incident-response process. It is not a recommendation that survives being generalized to an arbitrary, uncoordinated fleet without that trust. The same minimax logic The Simulation Singularity used to price the cost of an unhedged bet says a controller genuinely uncertain about its peers’ behavior has a real, quantified reason to defect toward fallback instead. That is the risk that makes “all freeze” a fragile equilibrium rather than a foregone conclusion. Falsification Criterion F13 already stated the condition under which fallback should be preferred outright; F14 below states the sharper, game-theoretic version this section actually establishes.

The Fleet Question This Post Does Not Answer

This needs to be said plainly, rather than let the sections above imply more coverage than they actually have. Does a single controller’s discrete-time stochastic control barrier function compose safely when several such controllers, across a fleet, probe the same shared downstream dependency at once? That is a real, open question. This series has named it on purpose since Dual Control and the Weaponized Probe, and this post does not resolve it.

Resolving it would need a genuinely different formal object: not a bound on one controller’s worst-case behavior, but a result about the joint behavior of several barrier-filtered controllers sharing one dependency. That object plausibly needs its own game-theoretic layer on top of Corollary 2’s magnitude bound, applied per-agent and extended to a multi-agent safe set. The control-theory literature already has a name for that shape: a decentralized or distributed multi-agent control barrier function.

Naming the category is not the same as having a citation that closes this gap. The published work under that name is built for agents that endanger each other directly, spatial collision avoidance among multiple robots sharing physical space. This post’s agents endanger each other only indirectly, by jointly loading one contended resource none of them occupies physically. Reusing that machinery here would need the underlying safe-set coupling re-derived for a shared-capacity constraint, not a shared-space one, before any specific citation could honestly stand in this sentence.

That is a different, harder problem than the one this post was scoped to solve. Solving it here, on top of the magnitude bound, the actuator-inversion risk, and the heavy-tailed-noise tension already addressed above, would be the kind of conceptual overload this series has spent its review process learning to avoid. Falsification Criterion F8, stated back in Dual Control and the Weaponized Probe, remains the testable form of the claim that a fleet needs this coordination layer at all. This post neither answers it nor needs to, for everything above it to still stand.

State, briefly, why this is genuinely a different problem rather than a bigger version of the same one, since the difference is easy to elide. Definition 3’s probability bound is proven against a fixed disturbance process, one whose statistics do not change in response to the barrier’s filtering. That assumption holds for a single controller watching a downstream dependency it does not itself destabilize by watching. It stops holding the moment a second, third, and tenth controller are all filtering their actions against the same downstream dependency.

Each one’s filtered behavior changes the load that dependency experiences. That, in turn, changes the disturbance every other controller’s barrier is trying to bound. The disturbance stops being a fixed external process, becoming instead, in part, the aggregate output of the very mechanisms trying to bound it. That is the shift Dual Control and the Weaponized Probe named when it moved from a single dual-effect controller to a fleet of them sharing one bottleneck.

A single-agent probability bound is proven against a disturbance that does not react to the prover. A multi-agent bound is proven against one that does. These are different theorems about different kinds of object, not a smaller case and a larger case of the same one. This post has neither built that object nor claims to need it. Definition 3 and Corollary 2 hold at the scale they were actually proven for: one controller, one dependency, watched by a barrier that does not have to account for anyone else watching the same thing.

One direction is worth naming even though this post does not build it out. Recall that Dual Control and the Weaponized Probe’s Kelly-style pricing signal already fixes the fairness problem for a fleet of simultaneously probing controllers. Nothing about that signal is specific to the regulator it was built for. It is a plausible input to each node’s QP, not only to its regulator. It could enter as a dynamic penalty weight inside Corollary 2’s per-step objective. A node’s filter would then grow more conservative, tightening its admission margin, as aggregate fleet-wide contention for the shared dependency rises, not only as its local queue does. That would give each node a reason to throttle back before the disturbance it is jointly creating with its neighbors gets bad enough to test any one node’s barrier. It is the same coordination effect the price signal already buys for fairness, aimed at safety instead.

That is a plausible mitigation, not a proof, and the distinction matters here specifically. A dynamic penalty weight changes what each node’s QP optimizes. It does not, by itself, establish that the resulting fleet-wide system satisfies any stated probability bound analogous to Definition 3’s. The disturbance each node’s barrier faces is still the aggregate behavior of every other node’s filtered decision, now itself a function of the same shared price all of them are reading. Whether that closed loop is even stable, let alone provably safe at a stated $\epsilon$ , is the genuinely different formal object named above, not a question a penalty term answers by existing.

There is a specific reason “whether that closed loop is even stable” is not a rhetorical hedge: this post has already priced the failure mode that makes it a real one. The deep dive on “the same impossibility prices latency too, even without a partition” showed, via Johari and Tan, that the same shared price this mitigation proposes feeding into each node’s barrier can itself lose local stability under realistic, heterogeneous round-trip delay. It settles into a sustained oscillation around the fair split rather than converging to it.

A penalty weight built from a price that is oscillating is a periodic forcing term the barrier’s disturbance model was never calibrated to expect. It is layered on top of the disturbance the barrier already watches, not a stable, slowly-varying input tightening each node’s margin in step with genuine contention. Definition 3’s probability bound assumes a fixed disturbance process. Feeding it an oscillating coordination signal as a correction does not fix that assumption; it adds a second, self-inflicted way to violate it.

Falsification Criterion F8 still states the open, testable form of the claim. This paragraph narrows what a candidate fix would specifically have to survive, beyond simply staying stable in the absence of it, before it could close the gap it names.

The Boundary Is Congruence-Proof for a Reason Worth Naming

One more connection is worth making explicit before the closing apparatus, because leaving it implicit would waste the one piece of vocabulary this whole series has been building toward.

A rulebook, the alternative this post opened by rejecting, is congruent by construction. It only ever checks for the failure modes its author already imagined. It reports “no rule violated” with the same confidence whether that silence means genuine safety or an unimagined blind spot. A discrete-time stochastic control barrier function is a different kind of object specifically because it does not check a list. It checks a region, continuously, against the system’s actual current state. Its own $\epsilon$ is falsifiable in a way a rulebook’s silence never is: run the system long enough, and either it leaves $\mathcal{C}$ more often than $\epsilon$ allows, or it does not.

That is real, load-bearing progress, and it would be dishonest to bury it under the caveats this post has spent its length adding. It is also not a full escape from congruence, and this post’s argument is the reason why. A barrier certified only against Definition 3’s probability bound is never checked against Corollary 2’s magnitude bound. It agrees with its calibration in the same way The Simulation Singularity’s simulator agreed with its historical corpus: correct as far as it goes, and silently blind to the one dimension, severity, it was never built to watch. The fix is the same one this series keeps reaching for, not a different philosophy. Price the dimension the current check cannot see, explicitly, rather than let a passing grade on one axis stand in for safety on every axis nobody thought to check.

Model Scope and Failure Envelope

Claim. The discrete-time stochastic CBF bounds the probability of an excursion.

• Assumption: The disturbance model the barrier was calibrated against still describes the system’s actual current disturbance.
• Failure Mode: A regime shift outside the calibrated disturbance class, per “The Cycle Finds Drift, the Barrier Has to Watch the Cliff,” is invisible to $\epsilon$ until it has already happened.

Claim. Bounding $\epsilon$ is sufficient for operational safety.

• Assumption: Excursion severity, conditional on occurring, is not heavy-tailed.
• Failure Mode: Under a heavy tail, the worked table above shows the same $\epsilon$ certifying worst-case excursions differing by four orders of magnitude; Corollary 2’s CVaR extension is required, not optional, once severity is heavy-tailed.

Claim. A BBR-style probe cycle’s drain phase pays down what its probe phase built.

• Assumption: Downstream capacity is roughly stationary across one full cycle.
• Failure Mode: If capacity collapses below 75 percent of the estimate the cycle’s gains are computed against, the drain phase adds to the queue instead of draining it, and the resulting backlog does not clear itself once the estimate re-adapts.

Claim. Definition 3’s barrier construction applies directly to the admission-control layer’s dynamics.

• Assumption: The system has relative degree exactly one: the control input affects the barrier function’s rate of change directly, not only its higher derivatives.
• Failure Mode: A system where admission decisions only affect queue occupancy indirectly, through an intermediate state the controller cannot set directly, has higher relative degree. It needs High-Order CBFs instead[16] . Naively applying Definition 3 as stated would understate the control authority actually required to stay safe. A concurrent runtime’s connection pooling or lock contention is a concrete instance of this failure mode. The admission decision sets how many requests are let in, but that decision only reaches queue occupancy after passing through a pooled-connection state the controller does not set directly. This is the same relative-degree-two structure Definition 4 was built to handle, elsewhere in this post, for a different intermediate state entirely. Definition 4 as stated derives $\varphi_1$ from a bandwidth estimate’s rate of change. A connection-pool-mediated system would need $\varphi_1$ re-derived from the pool’s occupancy dynamics instead, not reused unchanged. The construction generalizes, even though the specific instance does not. A different failure mode is easy to conflate with this one, and it needs its name. Pure transit delay, network round trips, executor spooling, a downstream dependency’s response time, is neither a chain-of-integrator structure the control input passes through nor higher relative degree in Xiao and Belta’s sense. High-Order CBFs answer the first failure mode. They do not, by themselves, answer the second. Predictor-feedback control barrier functions are the correct tool for that second case[23] . They reconstruct the delayed state from the input history, rather than restructuring the barrier’s derivative chain. That is the right tool once delay itself, not intermediate structure, separates an admission decision from its effect on queue occupancy. This post’s admission-control layer sits close enough to its queue to treat network transit as negligible relative to the control loop’s cycle time. A control plane spanning a slower network path would not get to make that assumption for free.

Claim. Rejecting proactively reduces total backlog-time under sustained overload, and below the executors’ joint ceiling shortens a real, derived recovery delay, as this post’s reference implementation demonstrates.

• Assumption: The executor pool’s joint clearing rate is coupled to how many of its own members are simultaneously busy, not fixed independently of it: past a comfortable concurrency, real contention, connection or thread-pool exhaustion, lock contention, memory pressure, degrades every busy executor’s rate, not only the newest arrival’s, the specific relationship the widget’s per-executor rate function encodes.
• Failure Mode: In a classical decoupled buffer, where each server’s service rate is fixed and does not depend on how many peers are simultaneously busy, ordinary queueing theory holds instead: a larger buffer only ever helps or is neutral to long-run throughput, converting a burst into delay rather than loss, and proactive rejection would be pure throughput loss with no offsetting gain. This model’s result is conditional on the coupling above; it is not a general argument against buffering, and a system where servers genuinely do not contend with each other should size its buffer for its expected burst, not shed load early on this post’s authority.

Claim. The per-step QP jointly enforcing Definition 3 and Corollary 2 always returns some action, possibly an expensive one.

• Assumption: The joint feasible set stays non-empty across the running case’s operating envelope, the assumption Corollary 3’s cost-floor argument leaves unexamined.
• Failure Mode: Per “A Cost Floor Assumes a Solution Exists at All,” a highly constrained state can empty the feasible set entirely rather than merely shrink it; the QP then returns no action at all, a harder failure than the cost floor prices, and the fix, an explicit backup policy per Chen, Jankovic, Santillo, and Ames, is not something this post has built.

Claim. This model’s $(C/n)^2$ throughput collapse follows the correct asymptotic shape for a coherency-dominated system.

• Assumption: Queueing contention is negligible next to the coherency penalty, $\sigma \approx 0$ in USL terms, the condition under which USL’s asymptotic tail matches this model’s $1/N$ decay.
• Failure Mode: Gunther’s formula confirms only the tail exponent, not this post’s specific ceiling number: a $\sigma \approx 0$ USL curve fit to this model’s comfortable-load rate gives roughly 67 requests per second at $n=8$ , not the 75 this post derives and verifies directly against its reference implementation. The two curves are not the same function, only the same tail; the 75 figure was never re-derived from USL and does not depend on it.

Reversal Condition. This post’s central recommendation, that a discrete-time stochastic control barrier function with an explicit magnitude bound is required rather than a probability bound alone, reverses when the disturbance the barrier defends against is genuinely light-tailed, with a provably bounded worst case. Under that condition, Definition 3’s probability bound and Corollary 2’s magnitude bound converge to saying nearly the same thing, since no single excursion can be arbitrarily costly regardless of how the tail is modeled, and building the CVaR extension buys little beyond what $\epsilon$ alone already prices. Distributed admission-control systems facing correlated-retry regimes, the running case this entire series has priced, essentially never meet this condition, which is why the reversal is stated but not expected to apply here.

Falsification Criteria

A claim that cannot be wrong is not a claim. Parts 1 and 2 stated the conditions under which their central assertions would fail. This post continues that numbering rather than restarting it, and states the conditions under which its ten central assertions would fail:

• a probability bound requires an independent magnitude bound under heavy tails
• a probe cycle’s drain phase can fail to drain
• the ensemble’s regime-detection is untrustworthy under heavy-tailed noise until shown otherwise
• freezing is the safer single-agent default when the coordination signal is lost
• freezing is not a self-enforcing choice without a trust or monitoring mechanism
• a fleet’s tipping point away from mutual freezing sits at a specific, computable defection fraction rather than somewhere unknowable
• jointly enforcing a probability bound and a magnitude bound trades real control authority rather than costing nothing
• the per-step QP jointly enforcing both bounds can lose feasibility entirely, not just grow more expensive, without an explicit backup guarantee
• the barrier and ensemble both start from a historical prior and stay vulnerable until enough persistent excitation accumulates to correct it
• the 1/N throughput-collapse shape is structurally required for a coherency-dominated system, not an arbitrary curve fit to this one running case

The ten criteria in full

F10 (the magnitude bound is unnecessary), refining Dual Control and the Weaponized Probe’s F9 now that the mechanism it asked about actually exists.

• Condition: a discrete-time stochastic control barrier function satisfying only Definition 3’s probability bound, with no CVaR or other magnitude-aware extension, is shown to also bound expected excursion severity under a genuinely heavy-tailed disturbance, without Corollary 2’s added constraint.
• If confirmed: Corollary 2 is redundant, and this post’s central addition to Part 3’s original formal apparatus collapses to a restatement of Definition 3. Dual Control and the Weaponized Probe’s F9 asked this exact question prospectively, before Definition 3 was built; “The Boundary Only Watches Probability” above already tested it directly, with the severity table showing a probability bound alone does not bound magnitude, so F9’s condition is not confirmed as this post stands. F10 restates F9 against the actual, now-built mechanism, and remains open to the same reversal.

F11 (the drain phase never actually fails in practice).

• Condition: it is shown, empirically or by a tighter model than this post’s worked table, that BBR’s actual windowed-maximum bandwidth estimator adapts fast enough, or that real downstream capacity collapses are shallow enough, that the drain phase’s net-positive-queue regime identified above (capacity below 75 percent of the pre-collapse estimate) essentially never occurs in production traffic.
• If confirmed: the actuator-inversion risk this post names is a modeling artifact, not a real operational concern, and Part 3’s safety mechanism does not need the sub-cycle abort capability this section calls for.

F12 (the ensemble is trustworthy under heavy tails without modification).

• Condition: Definition 2’s interacting-multiple-model ensemble, tuned with a small, constant mixing probability in the same spirit as Dual Control and the Weaponized Probe’s mechanism, is shown not to increase its false regime-shift rate when tested against a genuinely heavy-tailed noise process matching this post’s severity model.
• If confirmed: the tension this post names between fast regime-detection and heavy-tailed false alarms does not exist in practice, and any future stopping rule built on this ensemble could trust its trigger signal without a separate heavy-tail-robustness argument.

F13 (falling back, not freezing, is the safer single-agent default).

• Condition: it is shown that a controller falling back to uncoordinated local dual control when the shared price signal is unreachable incurs a bounded cost, comparable to or better than Corollary 1’s frozen-policy cost, rather than the unbounded starvation dynamic Dual Control and the Weaponized Probe’s simulation demonstrates for the uncoordinated multi-agent case.
• If confirmed: this post’s recommendation to freeze rather than fall back should be reversed, or at minimum qualified to the specific conditions under which fallback’s cost stays bounded.

F14 (mutual freezing is the unique, self-enforcing equilibrium).

• Condition: the freeze-versus-fallback game named above is shown, under a realistic payoff structure rather than this post’s illustrative one, to have mutual freezing as its only Nash equilibrium, or to have fallback’s worst-case regret exceed freeze’s, contrary to the risk-dominance finding above.
• If confirmed: the single-agent recommendation to freeze needs no trust or monitoring qualification, and the Stag Hunt framing this section builds collapses to a restatement of Falsification Criterion F13.

F15 (the fleet’s tipping point sits somewhere other than a one-in-eight defection fraction).

• Condition: under a realistic payoff structure rather than this post’s illustrative linear interpolation, the fraction of other controllers a given controller must expect to fall back before fallback becomes its individually rational best response is shown to differ substantially from the $f^\ast = 0.125$ this post’s worked model finds, or the relationship is shown not to be well-approximated by linear interpolation between the two-player corner cases at all.
• If confirmed: the specific tipping-point number this post reports is an artifact of its own illustrative payoff choice, not a property of the underlying mechanism, though the qualitative finding, that some fleet-wide tipping point exists and is well short of a majority, would still need to be independently re-examined rather than assumed false.

F16 (jointly enforcing both bounds costs nothing in practice).

• Condition: in the running case’s actual operating envelope, Corollary 2’s CVaR constraint is shown to rarely or never bind against Definition 3’s probability constraint, so that tightening one bound’s margin does not measurably worsen the other, contrary to Corollary 3’s achievable-region illustration above.
• If confirmed: the Pareto-frontier framing in “The Two Bounds Trade Against Each Other, Not for Free” is a theoretical possibility without practical bite in this specific running case, and an operator can treat both bounds as effectively free to tighten simultaneously here, though the underlying constrained-optimization argument, that shrinking a feasible set cannot lower an optimum, remains true regardless.

F17 (the joint safety filter never actually loses feasibility in practice).

• Condition: it is shown, empirically against this post’s reference implementation or by a tighter argument than Corollary 3’s cost-floor one, that the per-step QP jointly enforcing Definition 3’s probability constraint and Corollary 2’s CVaR constraint always has a nonempty feasible set across the running case’s actual operating envelope, without requiring an explicit backup policy of the kind Chen, Jankovic, Santillo, and Ames construct.
• If confirmed: “A Cost Floor Assumes a Solution Exists at All” names a theoretical risk without practical bite in this specific running case, the same shape of resolution F16 states for the achievable-region frontier, and this post’s two-constraint filter can be trusted as stated without a backup-set extension. If disconfirmed, Proposition 3 and Corollary 2 as this post states them are incomplete as a safety filter, not just costly, at states where the joint feasible set empties out, and would need the backup-policy construction this post has not built.

F18 (the bootstrap window is short enough not to matter).

• Condition: it is shown, empirically or by a tighter argument than the qualitative one in “Bootstrapping the Boundary Before Any Telemetry Exists,” that Cyclic Adaptive Regulation’s ensemble and Definition 3’s barrier converge from a conservative historical prior to their stated guarantees, a trustworthy false-alarm rate and a calibrated $\epsilon$ respectively, within a number of cycles short enough that the system is not meaningfully exposed to the exact regime the initial, historically-calibrated prior was blind to.
• If confirmed: the bootstrapping vulnerability named above is a transient, boundable cost rather than an open-ended one, and a team can treat the warm-up period as a known, priced risk rather than an unquantified one. If disconfirmed, a genuinely novel regime arriving during the warm-up window is defended by the same historical prior The Simulation Singularity already showed fails, and this post’s safety claims hold only after that window closes, not from time zero.

F19 (the 1/N tail shape is not structurally required, and other exponents are equally plausible for a coherency-dominated system).

• Condition: a system with negligible queueing contention ($\sigma \approx 0$ in USL terms) and a genuine per-pair coherency penalty ($\kappa > 0$ ) is shown, empirically or by a tighter argument than Gunther’s rational-function derivation, to exhibit throughput decay asymptotically different from 1/N at large concurrency.
• If confirmed: this post’s reference implementation’s choice of $(C/n)^2$ decay would need to be re-examined as an unexplained empirical fit rather than a structurally required shape. The specific 75 requests-per-second ceiling this post verifies directly against its code would be unaffected either way, since that number was never derived from USL in the first place.

The Property Verdict Ledger, Continued

Discrete-Time Stochastic Control Barrier Function, with Worst-Case CVaR Extension

Formal Proposition: Proposition 3, High-Probability Safety Filtration, extended by Corollary 2, Worst-Case CVaR Extension.

Production Instance: this post’s reference implementation, the same contention-compounded, health-scaled admission queue this post opened with. It enters a genuinely non-recovering state, not a slow one, once traffic exceeds the executor pool’s derived joint ceiling while downstream health is degraded, the excursion a barrier calibrated to the queue’s threshold is built to prevent, and the excursion whose severity, once it happens, Definition 3 alone cannot price.

Exact vs. Approximate: Layer 1 exact for the discrete-time probability bound (Cosner, Culbertson & Ames) and for the worst-case CVaR magnitude bound (Kishida), each as proven in its cited setting; Layer 2 approximate for applying either bound to an admission-control queue specifically, a setting neither citation was proven for; Layer 3 approximate for the actuator-inversion and heavy-tailed-ensemble sections, this post’s worked constructions, not restatements of any cited theorem.

Verdict: a probability-only safety filter resolves the organizational half of Dual Control and the Weaponized Probe’s closing gap, giving a reviewer a boundary to approve once. It does not, by itself, resolve the statistical half. Under a heavy tail, bounding how often the boundary is crossed is a different, weaker guarantee than bounding how bad a crossing can be. This post’s worked comparison shows the gap between those two guarantees can span four orders of magnitude, at an identical, reviewer-approved $\epsilon$ .

Read this post’s sections as more than one discipline converging on the same requirement, the way Parts 1 and 2 read their ledger rows.

Discipline	What it contributes	Where it appears above
Control theory	Establishes the probability-of-exit bound, the CBF-CLF-QP mechanism that filters actions to it, a High-Order CBF sketch of the rate-of-change constraint the actuator-inversion gap needs, and the constrained-optimization fact that jointly enforcing a probability bound and a magnitude bound trades real control authority, not a free second guarantee	Cosner, Culbertson & Ames; Clark; Ames, Xu, Grizzle & Tabuada; Xiao & Belta; Mestres et al.; Definition 3, Proposition 3, Definition 4, Corollary 3
Risk and decision theory	Names the specific, formal gap between a probability bound and a magnitude bound, supplies the worst-case CVaR construction that closes it, and reuses The Simulation Singularity’s minimax-regret criterion to select between two self-enforcing equilibria	Kishida; Corollary 2; Wald and Savage, reused from The Simulation Singularity, in “Is Freezing Even a Stable Choice?”
Distributed systems engineering	Supplies the concrete actuator-inversion failure mode, the organizational precedent for bounded safety experiments, the formal impossibility result naming why a lost coordination signal forces a choice rather than a compromise, that same result’s extension to the ordinary, no-partition latency cost this series had already priced under a different name, the proven threshold past which that same latency stops being only a cost and starts eroding the shared price’s stability, and the deeper impossibility result explaining why a controller cannot even locally confirm which side of that choice it is on	Basiri, Hochstein, Jones & Tucker; Gilbert & Lynch; Fischer, Lynch & Paterson; Chandra & Toueg; Abadi; Johari & Tan; “When the Probe Causes the Cliff It Is Measuring For”; “The Choice Is Consistency or Availability, Not Safety or Danger”; “the same impossibility prices latency too, even without a partition” (deep dive); “knowing which branch you are in is its own unsolved problem” (deep dive)
Game theory	Names this model’s no-rejection baseline as a congestion game’s uncoordinated equilibrium, prices the resulting inefficiency directly as a price-of-anarchy gap, shows the single-agent freeze recommendation is Pareto-optimal but not uniquely stable, a Stag Hunt with two Nash equilibria rather than one dominant strategy, and generalizes the two-player case to an exact, computable fleet-wide tipping point	Rosenthal; Roughgarden & Tardos; Schelling; “Why Rejecting Early Is Not Merely a Good Idea, It Is the Coordinated Equilibrium”; “Is Freezing Even a Stable Choice?”; Proposition 4
Cybernetics and verification theory	Explains, in this series’ vocabulary, why a probability-only barrier remains a form of congruence even though it is a genuine improvement on a rulebook, and names this model’s recovery-time behavior directly, metastability and critical slowing down below a derived threshold, genuine bistability above it, not an invented trap	“The Boundary Is Congruence-Proof for a Reason Worth Naming”; “Naming the Shape: Metastability, Not an Invented Trap”
Practitioner systems literature	Credits the safe-reinforcement-learning lineage this post’s barrier-filtered-controller architecture belongs to, and weighs this post’s reviewable probability and magnitude bounds directly against three real, deployed admission-control systems that already solve problems this post’s barrier does not	Cheng, Orosz, Murray & Burdick; Zhou et al. (DAGOR); Cho et al. (Breakwater); Landau, Thurston & Bozarth; “What This Buys Over Deployed Overload Control”

This post’s six disciplines share the same standing property Parts 1 and 2 established for their six and five. None of these six needed the others to reach its conclusion. Five of them, borrowed from fields with nothing to do with software, converge on the same diagnosis independently. That convergence is closer to a property of what a boundary drawn once is actually for than an artifact of whichever field happened to describe it first. The sixth is not quite like the other five, and the difference is worth naming rather than smoothing over. It does not converge on the same diagnosis from an independent angle, the way the first five do. Instead it weighs this post’s diagnosis against a body of work that solved adjacent problems first, honestly stating where this post’s contribution stands relative to it rather than adding a sixth confirmation.

What This Buys Over Deployed Overload Control

Everything above has been argued against a hand-built rulebook, the strawman “Why a Rulebook Cannot Do This Job” opened with. That comparison is honest as far as it goes and incomplete in a way worth naming directly: production admission control did not stop at rulebooks. Real, published, deployed systems already run more sophisticated mechanisms than a rulebook. A reviewer who has actually operated one of them is entitled to ask what this post’s barrier adds over what they already have, not over a strawman built to lose.

DAGOR, WeChat’s overload-control system, is the sharpest comparison available. It targets this post’s layer: per-request admission decisions across a fleet of interdependent microservices, not a single-node control loop. Each service monitors its load in real time. Once overload is detected, services shed requests collaboratively with whatever they depend on, prioritizing by a business-assigned importance level rather than treating every request identically[24] . It has run in WeChat’s production backend since before its publication. That is the kind of battle-tested, priority-aware admission logic this post’s model does not have. Definition 3’s barrier treats every request identically once it decides whether to admit or reject, and says nothing about which request to shed first when shedding is required. A reviewer choosing between the two is not choosing between a real system and a toy. DAGOR already solves the priority-differentiation problem this post’s barrier is silent on.

Breakwater, built for microsecond-scale RPCs, solves a different piece of the same problem. It is a server-driven, credit-based admission scheme. Credits are sized to the server’s observed queueing delay, and the scheme converges to a stable operating point within milliseconds of a load surge, without a human choosing a fixed latency threshold in advance[25] . Read against Definition 3, Breakwater’s credits are themselves an admission filter, and its self-derived delay target is a self-calibrating disturbance model, the kind “The Cycle Finds Drift, the Barrier Has to Watch the Cliff” named this post’s barrier as lacking. $\epsilon$ here is fixed once, at review time. Breakwater’s credit target keeps re-deriving itself from the server’s observed queueing behavior instead.

Netflix’s adaptive concurrency limits are the production successor to the fixed limiter this post’s opening paragraph named as current practice. They derive their ceiling the same self-calibrating way. A gradient algorithm tracks divergence between a long-window and a short-window average of observed request latency, using the minimum observed round-trip time as a moving baseline, not a number an operator configures once and never revisits[26] . No $\epsilon$ , no reviewer sign-off, no probability bound. The limit adjusts continuously, and the guarantee it offers is empirical rather than stated in advance.

The comparison deserves to be plain, rather than let three citations imply more humility than the argument actually needs. What this post’s barrier adds, that none of the three above states as a first-class guarantee, is Definition 3’s $\epsilon$ . It is a number a reviewer can read once, before deployment, and hold the system to afterward, plus Corollary 2’s magnitude bound on top of it. DAGOR, Breakwater, and Netflix’s limiter all report how they behave. None of the three publishes a reviewable probability that a declared safe region will hold, or a bound on how bad an excursion can get conditional on leaving it. That is a real, specific gap between what this literature already deploys and what this post’s formalism offers, not a difference in maturity.

What the comparison does not buy this post is exemption from what those three systems already solved and this post has not: DAGOR’s priority-aware shedding, and Breakwater’s and Netflix’s self-calibrating disturbance models that need no separately maintained $\epsilon$ . In DAGOR’s case specifically, that also includes coordination across a fleet of interdependent services, the fleet-composition question “The Fleet Question This Post Does Not Answer” names as open here. A reviewer weighing this post’s barrier against an existing DAGOR-style deployment is weighing a reviewable, falsifiable safety number against a self-tuning, priority-aware, already-running system with none of that number. Neither dominates the other outright, and this post is not the one to adjudicate the trade for a specific fleet. Naming both sides of it honestly is what this section adds that the earlier rulebook comparison alone did not.

Credit the architecture’s lineage here, since Proposition 3’s scope-of-novelty bullet above deferred it to this section. Wrapping an otherwise-unconstrained learned or heuristic policy with a barrier-function safety filter is this post’s Cyclic-Adaptive-Regulation-plus-Definition-3 structure. It is the standard shape of safe reinforcement learning, established for continuous robotic control several years before this post’s running case[27] . This post’s contribution is not the wrapping pattern itself, which that literature already owns. It is the pattern’s transposition onto an admission-control decision, a discrete accept-throttle-reject choice rather than a continuous actuator command, and the specific composition with Corollary 2’s magnitude bound on top of it. A reader who already knows the safe-RL literature should read this post’s Definition 3 and Proposition 3 as an instance of a known pattern in a new setting, not as a new pattern.

What This Post Did Not Claim

Every worked model in this post is an illustration of a cited result, not a restatement of it, and none of its specific numbers generalize. The 5-percent-versus-four-orders-of-magnitude severity comparison, the 75-percent drain-failure threshold, the exact backlog left by one bad cycle: change the anchors, change the barrier function, change the disturbance model, and the numbers change with them. What survives a change of anchors is the shape each illustration makes concrete, the same standard this series has held itself to since The Simulation Singularity.

This post’s application of Definition 3 and Proposition 3 to an admission-control queue has not been claimed to have any precedent in the cited control-barrier-function literature. That literature is built almost entirely around robotic and vehicular actuation, and applying it here is this post’s synthesis, stated as such. Corollary 2, likewise, is not claimed to be anything more than this post’s combination of an existing probability bound and an existing magnitude bound. That combination is jointly stated for the first time in this series’ running case, not a result independently proven in the cited papers for this specific setting.

The actuator-inversion risk in “When the Probe Causes the Cliff It Is Measuring For” is not claimed to have ever been observed in a real BBR deployment. It is a worked consequence of BBR’s published gain structure and this series’ health-scaled clearing model, offered as a named, quantified risk, not a documented incident. Nor does the High-Order CBF construction in “A Formal Sketch of the Missing Mechanism” claim to resolve that risk. It names a specific formal object with a specific, stated residual gap: a sharper open question rather than a closed one.

The achievable-region table in “The Two Bounds Trade Against Each Other, Not for Free” does not claim to reflect the literal functional form of either Cosner, Culbertson & Ames’s or Kishida’s actual bound. Only the underlying constrained-optimization fact is a general claim: adding a constraint to a convex program cannot lower its optimum. Falsification Criterion F16 states the condition under which the tradeoff would have no practical bite in this specific running case regardless.

Fischer, Lynch & Paterson’s impossibility result and Chandra and Toueg’s failure-detector taxonomy are not claimed to have been applied here in the fully formal sense either paper proves results in. The deep dive on “knowing which branch you are in is its own unsolved problem” uses both to explain why the freeze/fallback choice cannot rest on a perfectly accurate local test. That is a structural point the cited theorems support directly, not a claim that this running case’s timeout logic has been formally verified against either paper’s model.

Freezing is not claimed to be the universally correct response to a lost coordination signal, or a strategy immune to unilateral defection. Instead, “What One Controller Does When the Coordinator Goes Quiet” states a specific, single-agent recommendation under this series’ priced alternatives, reversible under Falsification Criterion F13. Its own game-theoretic analysis names the exact condition, verified trust between controllers, under which that recommendation is stable rather than merely cheaper in isolation.

The $f^\ast = 0.125$ tipping point in “From Two Controllers to a Fleet” is not claimed to be a property of real fleets, rather than of this post’s illustrative, linearly-interpolated payoff structure. Falsification Criterion F15 states the condition under which the number itself would need revision, though not necessarily the qualitative existence of some tipping point well short of a majority. Nowhere in this post is it claimed that a single controller’s safety boundary composes across a fleet of simultaneously probing services. That question is named, on purpose, as unresolved, in “The Fleet Question This Post Does Not Answer,” not answered by implication anywhere else in this post.

Read the Cognitive Map as plain text

A Boundary Instead of a Rulebook

1. A rulebook enumerates failure modes someone already imagined. A discrete-time stochastic control barrier function bounds a region instead, which is what lets a reviewer approve it once rather than trusting every experiment it permits.
2. Definition 3’s probability bound, sharpened by Freedman’s inequality, is a genuine improvement over older, worst-case barrier constructions, and does not require the barrier function itself to be bounded above.
3. A real correction exists in this literature, and it is precisely scoped. Clark’s 2021 zero-CBF almost-sure-safety theorem was shown false in 2023, but the flaw is specific to that theorem. It does not touch the reciprocal-CBF construction, or the weaker, $\epsilon > 0$ probability bound, this post actually relies on.
4. This model’s congestion-compounded clearing rate shows a rulebook’s blind spot directly: two individually reasonable degradation rules, health-scaled and occupancy-scaled, compose into a self-sustaining lock-in neither rule alone predicts.
5. A barrier calibrated against a historical disturbance model is not automatically calibrated against a disturbance the historical record never produced, the same modeling tax The Simulation Singularity priced, recurring at the safety layer.
6. This model’s $(C/n)^2$ throughput collapse is not a curve chosen to fit the data. Gunther’s Universal Scalability Law, reduced to the case where contention is negligible next to the coherency penalty, forces throughput to fall as 1/N for any such system. It confirms only the tail exponent, not this post’s specific ceiling number. A $\sigma \approx 0$ USL curve fit to this model’s comfortable-load rate gives roughly 67 requests per second at $n=8$ , not the 75 this post derives and verifies directly against its code.

Probability Is Not Magnitude

7. Probability and magnitude are different guarantees. This post’s Node-verified comparison shows three designs, identically certified at a 5 percent chance of an excursion, whose worst observed excursion differs by more than four orders of magnitude once severity is heavy-tailed.
8. Kishida’s worst-case CVaR control barrier function is the existing, verified literature bridge from a probability bound to a magnitude bound. Corollary 2 states the combined guarantee precisely: both bounds, jointly enforced, not one substituting for the other.
9. Jointly enforcing both bounds is not free. Shrinking a convex program’s feasible set can only raise its optimal cost, never lower it, so a fixed control-authority budget traces a genuine achievable-region frontier between how tight $\epsilon$ can go and how tight the severity bound can go. That is the same lower-envelope logic Dual Control and the Weaponized Probe used for its cost-over-time tradeoff, applied here to a tradeoff over safety dimensions instead.
10. A cost floor is not a feasibility guarantee. The per-step QP enforcing both bounds can lose its feasible set entirely at a highly constrained state, not just grow more expensive. This post has not built the explicit backup policy the control-barrier-function literature uses to rule that out.
11. BBR’s drain phase assumes downstream capacity is stationary across one cycle. This post’s worked table finds the exact threshold at which that assumption fails. Capacity at or below 75 percent of the estimate the cycle’s gains were computed against is the point where the drain phase adds to the queue instead of paying it down.

Where the Boundary’s Own Machinery Breaks

12. The backlog from one such cycle does not clear itself afterward, even once the bandwidth estimate correctly adapts to the new, lower capacity. Ordinary operation at a correctly adapted estimate holds a queue steady; it does not repay a debt incurred before the estimate adapted.
13. The actuator-inversion gap has a candidate formal fix, not yet a proof. A High-Order CBF constraint on the margin’s rate of consumption, not only its current value, would catch a probe phase collapsing capacity before the margin itself hits zero. The fix inherits the same stale-estimate blind spot one derivative removed rather than resolved.
14. Definition 2’s ensemble, verified once against simple noise, has a genuine tension under heavy-tailed noise between fast regime-detection and false alarms. This post’s IMM table quantifies it directly: a false-alarm rate near zero under light-tailed noise rises to single digits under a heavy tail and higher still under a very heavy one. That has consequences for this post’s safety filter and for any future rule that would trigger on the same signal.
15. A controller cannot even locally confirm which side of the freeze/fallback choice it is on. Fischer, Lynch, and Paterson proved a slow, live coordinator and a genuinely dead one are indistinguishable from local observation alone. Any real implementation is necessarily an unreliable failure detector in Chandra and Toueg’s sense, trading false suspicions against missed detections in the same shape this post’s ensemble already traded fast detection against false alarms.
16. When a shared coordination signal is lost, a single controller faces the choice Gilbert and Lynch proved is unavoidable under a genuine partition: consistency (freeze) or availability (fall back), never both. PACELC extends the same impossibility to the ordinary, no-partition case, naming the physical latency floor Dual Control and the Weaponized Probe had already priced under different vocabulary. Modeled as a two-player game against another controller facing the same outage, both mutual freezing and mutual fallback are Nash equilibria, a Stag Hunt. Freezing is Pareto-better if trust holds, but fallback carries seven times less worst-case regret under The Simulation Singularity’s minimax criterion. That makes fallback the risk-dominant, not the recommended, choice once that trust cannot be verified.

The Fleet, and What’s Still Unverified

17. Generalized to a fleet, the same game has an exact tipping point. Under this post’s illustrative payoffs, once more than exactly one in eight of a controller’s counterparts is expected to fall back, falling back becomes every remaining controller’s individually rational best response. That is a small threshold, not a majority-defection one.
18. Whether one controller’s safety boundary composes across a fleet of many, sharing one downstream dependency, remains the open question Dual Control and the Weaponized Probe named it as. This post does not answer it, on purpose, to avoid collapsing under a payload no single post should carry.
19. A candidate fix feeds the shared Kelly price into each node’s barrier as a dynamic penalty weight. It has a specific failure mode this post has already priced under a different name: Johari and Tan’s delay-induced instability means that price can itself oscillate rather than converge. That turns the proposed fix into a periodic disturbance the barrier’s calibration never accounted for.
20. A probability-only barrier is real progress over a rulebook, and it is still a form of congruence: it agrees with its calibration, correctly, right up until the one dimension, severity, it was never built to check.
21. Both the ensemble and the barrier must start from a historical prior on day zero, the same kind of source this series has spent three posts distrusting. What makes this different from the failure diagnosed in The Simulation Singularity is that Cyclic Adaptive Regulation’s cycle keeps generating new information to correct that prior, where a frozen simulator never did. The correction takes real cycles to arrive, though, not zero.
22. DAGOR, Breakwater, and Netflix’s adaptive concurrency limits are real, running admission-control systems, not strawmen. Each already solves something this post’s barrier does not: priority-aware shedding, a self-calibrating disturbance model, or both. What this post’s barrier adds over all three is a reviewable epsilon and a magnitude bound stated in advance. What it does not have is any of their own already-solved machinery, and a reviewer weighing the two is weighing a falsifiable number against an already-running system, not choosing a strictly better option.

Compute it. Before approving a control barrier function as the safety layer for a probe that never stops, ask two separate questions, not one: what is the stated $\epsilon$ , the probability of ever leaving the safe region, and separately, what is the worst excursion the barrier’s disturbance model allows for, conditional on that $\epsilon$ -event actually happening. A barrier can report an excellent answer to the first question and an unbounded answer to the second, and under a genuinely heavy-tailed disturbance, both of those things are true at once far more often than a single clean $\epsilon$ would suggest.

This post replaced a rulebook, congruent with whatever its author happened to imagine, with a boundary that is falsifiable against the system’s actual behavior. That boundary is still congruent with one thing: the disturbance model it was calibrated against, and the one dimension, magnitude, its probability bound alone was never built to see. Corollary 2 prices that second dimension explicitly, rather than letting a passing $\epsilon$ stand in for a safety claim it was never measuring.

What remains, once probability and magnitude are both priced and the boundary itself is drawn, is the question this series has been building toward from its first page.

Given all three, exactly when does the model stop being the cheaper choice and the probe become the required one. That question is still open when this post ends.

---

^[1] Gunther, N.J. (2008). A General Theory of Computational Scalability Based on Rational Functions. arXiv:0808.1431.

^[2] Rosenthal, R.W. (1973). A class of games possessing pure-strategy Nash equilibria. International Journal of Game Theory, 2, 65-67.

^[3] Roughgarden, T. & Tardos, E. (2002). How bad is selfish routing? Journal of the ACM, 49(2), 236-259.

^[4] Cosner, R.K., Culbertson, P. & Ames, A.D. (2024). Bounding Stochastic Safety: Leveraging Freedman’s Inequality with Discrete-Time Control Barrier Functions. IEEE Control Systems Letters, 8, 1937-1942.

^[5] Clark, A. (2021). Control barrier functions for stochastic systems. Automatica, 130, 109688.

^[6] So, O., Clark, A. & Fan, C. (2023). Almost-Sure Safety Guarantees of Stochastic Zero-Control Barrier Functions Do Not Hold. arXiv:2312.02430.

^[7] Ames, A.D., Xu, X., Grizzle, J.W. & Tabuada, P. (2016-17). Control Barrier Function Based Quadratic Programs for Safety Critical Systems. IEEE Transactions on Automatic Control, DOI 10.1109/TAC.2016.2638961, arXiv:1609.06408.

^[8] Mestres, P., Mousavi, S.S., Ong, P., Yang, L., Das, E., Burdick, J.W. & Ames, A.D. (2025). Explicit Control Barrier Function-based Safety Filters and their Resource-Aware Computation. arXiv:2512.10118.

^[9] Basiri, A., Hochstein, L., Jones, N. & Tucker, H. (2019). Automating Chaos Experiments in Production. Proceedings of the 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), arXiv:1905.04648.

^[10] Schroeder, B., Wierman, A. & Harchol-Balter, M. (2006). Open Versus Closed: A Cautionary Tale. NSDI ’06: 3rd USENIX Symposium on Networked Systems Design and Implementation, 239-251.

^[11] Altshuller, G.S. (1984). Creativity as an Exact Science: The Theory of the Solution of Inventive Problems. Gordon and Breach.

^[12] Ashby, W.R. (1956). An Introduction to Cybernetics. Chapman and Hall (Chapter 11, The Law of Requisite Variety).

^[13] Resnick, S.I. (1997). Heavy tail modeling and teletraffic data. Annals of Statistics, 25(5), 1805-1869.

^[14] Kishida, M. (2023-25). A Risk-Aware Control: Integrating Worst-Case CVaR with Control Barrier Function. arXiv:2308.14265; published as Risk-Aware Control: Integrating Worst-Case Conditional Value-At-Risk With Control Barrier Function, IET Control Theory & Applications, 19, e70024.

^[15] Chen, Y., Jankovic, M., Santillo, M. & Ames, A.D. (2021). Backup Control Barrier Functions: Formulation and Comparative Study. arXiv:2104.11332.

^[16] Xiao, W. & Belta, C. (2022). High-Order Control Barrier Functions. IEEE Transactions on Automatic Control, 67(7), 3655-3662.

^[17] Gilbert, S. & Lynch, N. (2002). Brewer’s Conjecture and the Feasibility of Consistent, Available, Partition-Tolerant Web Services. ACM SIGACT News, 33(2), 51-59.

^[18] Fischer, M.J., Lynch, N.A. & Paterson, M.S. (1985). Impossibility of Distributed Consensus with One Faulty Process. Journal of the ACM, 32(2), 374-382.

^[19] Chandra, T.D. & Toueg, S. (1996). Unreliable Failure Detectors for Reliable Distributed Systems. Journal of the ACM, 43(2), 225-267.

^[20] Abadi, D.J. (2012). Consistency Tradeoffs in Modern Distributed Database System Design: CAP is Only Part of the Story. IEEE Computer, 45(2), 37-42.

^[21] Johari, R. & Tan, D.K.H. (2001). End-to-end congestion control for the internet: delays and stability. IEEE/ACM Transactions on Networking, 9(6), 818-832.

^[22] Schelling, T.C. (1978). Micromotives and Macrobehavior. W.W. Norton & Company.

^[23] Molnar, T.G., Kiss, A.K., Ames, A.D. & Orosz, G. (2023). Safety-Critical Control with Input Delay in Dynamic Environment. IEEE Transactions on Control Systems Technology, 31(4), 1507-1520.

^[24] Zhou, H., Chen, M., Lin, Q., Wang, Y., She, X., Liu, S., Gu, R., Ooi, B.C. & Yang, J. (2018). Overload Control for Scaling WeChat Microservices. Proceedings of the ACM Symposium on Cloud Computing (SoCC 2018), 149-161.

^[25] Cho, I., Saeed, A., Fried, J., Park, S.J., Alizadeh, M. & Belay, A. (2020). Overload Control for microsecond-scale RPCs with Breakwater. 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20).

^[26] Landau, E., Thurston, W. & Bozarth, T. (2018). Performance Under Load. Netflix Technology Blog, March 23.

^[27] Cheng, R., Orosz, G., Murray, R.M. & Burdick, J.W. (2019). End-to-End Safe Reinforcement Learning through Barrier Functions for Safety-Critical Continuous Control Tasks. AAAI 2019, arXiv:1903.08792.

---

Back to top