The eighth re-freeze monitoring period found a precise failure mode. Total use of the 120-case cap stayed stable, yet the dynamic allocator repeatedly lent and reclaimed the same slots when a latency classifier moved across one threshold. That oscillation raised churn and concentrated fallback on cohort D without producing a dramatic utilisation alarm.
A ninth thaw should not reopen every part of Q17. The evidence names one bounded question: can a small amount of state memory prevent rapid reversals while preserving legitimate borrowing, useful early release and the protected outcomes that justified the eighth re-freeze?
The Gold Standard is to replay the same event tape through explicit state machines. Compare the frozen reference with hysteresis, deadband and cooldown challengers; measure both service and switching behaviour; change the arrival mix and capacity shape; and write a ninth re-freeze that remains reversible.
A practical orientation
Use this guide when release monitoring has identified periodic allocation reversals rather than a general capacity shortage. The worked replay follows 6,400 eligible arrivals, a 120-slot cap and four cohorts across eight service days.
Choose a reading route
Bound the ninth thaw
Read Chapters 1–3 to freeze Q17, define the oscillation signature and specify challengers with different mechanisms.
Build a faithful replay
Use Chapters 4–6 to preserve the event tape, model allocator state and choose service plus switching measures.
Choose with transferred evidence
Read Chapters 7–9 for the worked comparison, changed-context checks and protected-outcome review.
Write the re-freeze
Use Chapters 10–11 for gates, limits and the practical evidence checklist.
Continue the verified route
Use Chapter 12 for FAQs and links to the root, parent, hub and preceding specialist articles.
Chapter contents
- 1. Freeze Q17 and state the one permitted change
- 2. Define oscillation before trying to remove it
- 3. Specify challengers with different jobs
- 4. Replay one immutable event tape
- 5. Make memory, overrides and cap state explicit
- 6. Judge service and switching together
- 7. Worked replay: hysteresis reduces reversals without trapping capacity
- 8. Transfer check: change burst shape and observation cadence
- 9. Review displacement and override dependence
- 10. Write the ninth re-freeze as a reversible contract
- 11. Limits, misconceptions and evidence checklist
- 12. FAQs and the next reading route
1. Freeze Q17 and state the one permitted change
Q17 remains the reference: the same 120-slot cap, eligibility rules, cohort definitions, service calendars, early-release evidence and fallback path. The ninth thaw may change only the memory around the allocation threshold. It may not add capacity, redefine an arrival or use information that becomes available after the decision.
Write the permission as a state-machine interface. A challenger receives the same decision-time fields and current slot state as Q17, then may retain a small, declared memory of its previous classification or allocation. Every other input, clock and tie-break rule is fixed.
This boundary matters because many apparent cures make the comparison easier by changing demand or service. Increasing the cap would reduce fallbacks but would not show that oscillation was repaired. Smoothing the input with future values would remove the symptom by leaking hindsight.
- Reference: Q17 with cap 120.
- Permitted change: threshold memory only.
- Frozen: arrivals, eligibility, calendars, service, fallbacks and protected outcomes.
- Forbidden: future information and extra capacity.
2. Define oscillation before trying to remove it
An oscillation is a repeated, direction-changing sequence with a meaningful period, not every irregular fluctuation. For one slot, record the owner state through time; for the allocator, record transfer direction, interval and the classifier value that triggered each transition. A cycle is complete only when the state returns through the opposite transition.
Use three complementary measures: reversals per 100 eligible requests, median time between opposite transfers and the share of slot-minutes spent in short-lived loans. The first shows frequency, the second shows tempo and the third shows how much capacity is exposed. Keep random one-off corrections separate.
The ninth-thaw signature is pre-declared: at least four alternating transfers within 30 minutes, each driven by the same threshold band, with no comparable change in eligible pressure. This definition can be tested on the frozen log and replayed exactly.
| Measure | What it reveals | What it misses |
|---|---|---|
| Reversals / 100 requests | How often direction changes | Duration of each loan |
| Opposite-transfer interval | Cycle tempo | Number of slots affected |
| Short-lived loan share | Capacity exposure | Cause of the reversal |
| Pressure change | Demand alternative | Allocator internal state |
3. Specify challengers with different jobs
H2 uses two-observation hysteresis: the classifier must remain across the threshold for two consecutive decision ticks before ownership changes. D4 adds a symmetric deadband around the threshold, so small movements produce no transition. C5 permits a transition but prevents the same slot from reversing for five minutes unless a protected override fires.
An oracle uses the reconciled future latency to label which transfers would ultimately have been useful. It is diagnostic only because production cannot know that future. Its value is to estimate how much avoidable churn remains; it cannot win deployment.
Each challenger changes one mechanism. Combining hysteresis, deadband and cooldown at once would make a lower churn result hard to explain and could conceal excessive delay. The portfolio is small enough to audit and different enough to discriminate causes.
| Policy | Permitted memory | Primary risk |
|---|---|---|
| Q17 reference | None beyond current state | Rapid threshold reversals |
| H2 hysteresis | Two consecutive ticks | Delayed useful transfer |
| D4 deadband | Four-unit neutral band | Unresponsive near boundary |
| C5 cooldown | Five-minute reversal lock | Capacity trapped with borrower |
| Oracle | Future outcome label | Not deployable |
4. Replay one immutable event tape
The tape contains every arrival, decision-time cohort and latency field, service-capacity change, completion, cancellation and fallback. Events are ordered by the operational clock and ties use the same deterministic rule in every run. The reference replay must reproduce the released Q17 decisions before any challenger is interpreted.
Separate exogenous events from policy-generated events. Arrivals and service completions are exogenous for this comparison; slot transfers and early releases are generated by the policy. Feeding Q17 transfers into a challenger would force the challenger to inherit the reference path.
If service time depends on the policy decision, use common random numbers or recorded service outcomes under a declared assumption, then run a sensitivity analysis. Do not claim exact counterfactual truth where the historical path reveals only one realised outcome.
- Immutable exogenous event tape.
- Deterministic ordering and tie breaks.
- Reference replay must reproduce Q17.
- Policy-generated state recomputed in each run.
- Counterfactual service assumptions stated and tested.
5. Make memory, overrides and cap state explicit
A stateful challenger needs more than a formula. For every cohort-slot pair, record current owner, entry time, last classifier side, confirmation count, cooldown expiry and override state. A restart or missing tick must have a declared recovery rule; otherwise identical event tapes can produce different paths.
Protected overrides should be narrow. In the worked replay, an override can break hysteresis or cooldown only when a case is within two minutes of the protected service deadline and an unused transferable slot exists. It cannot exceed the total cap or displace another protected case.
Audit simultaneous transitions. If two cohorts qualify for one returned slot at the same tick, apply the frozen tie-break sequence and log the losing request. Hidden ordering is a common source of apparent policy improvement.
| State field | Purpose | Recovery rule |
|---|---|---|
| Owner and entry time | Measure loan duration | Restore from event log |
| Confirmation count | Implement H2 | Reset after missing tick |
| Cooldown expiry | Implement C5 | Use operational monotonic clock |
| Override flag | Protect deadline | Require reason code |
| Tie-break rank | Resolve simultaneous demand | Frozen deterministic order |
6. Judge service and switching together
Primary service measures are protected-deadline success, fallback rate and median time to useful information. Switching measures are reversals, short-lived loan share and slot-owner entropy. A challenger must reduce the targeted oscillation without purchasing the improvement through worse service.
Report results by cohort, latency band and cap-pressure state. An overall gain can hide that cohort D supplies stable capacity while another cohort receives most temporary loans. Use absolute counts beside percentages, especially for small protected groups.
Pre-declare a decision set rather than a weighted score. The worked rule requires non-inferior protected outcomes, no cohort fallback increase above 0.7 percentage points, and at least a 35% reduction in qualifying oscillation episodes. A score could trade away one of those gates invisibly.
| Family | Measure | Role |
|---|---|---|
| Service | Protected-deadline success | Non-inferiority gate |
| Service | Fallback by cohort | Displacement guardrail |
| Information | Time to useful fields | Benefit guardrail |
| Switching | Qualifying episodes | Target outcome |
| Switching | Short-lived loan share | Capacity-exposure outcome |
7. Worked replay: hysteresis reduces reversals without trapping capacity
On 6,400 arrivals, Q17 produces 186 qualifying oscillation episodes and 14.2 reversals per 100 eligible requests. H2 produces 92 episodes, D4 produces 111 and C5 produces 74. The oracle labels 61 episodes as avoidable, showing that none of the deployable challengers reaches the diagnostic floor.
C5 has the lowest churn but raises cohort D fallback by 1.1 percentage points because a five-minute lock sometimes traps a slot after the borrower’s evidence state changes. D4 remains within service limits but delays 8% of useful transfers near the band. H2 cuts episodes by 50.5%, keeps every cohort within the 0.7-point fallback limit and preserves protected-deadline success.
H2 therefore becomes the provisional winner. The conclusion is specific: two-tick confirmation fits this event tape and declared metrics better than the reference, deadband or cooldown. It is not yet a ninth re-freeze because transfer contexts remain untested.
| Policy | Oscillation episodes | Reversals / 100 | Largest cohort fallback change |
|---|---|---|---|
| Q17 | 186 | 14.2 | Reference |
| H2 | 92 | 7.6 | +0.4 points |
| D4 | 111 | 8.8 | +0.5 points |
| C5 | 74 | 6.1 | +1.1 points |
| Oracle | 61 | — | Diagnostic only |
8. Transfer check: change burst shape and observation cadence
First compress the same daily arrivals into sharper 20-minute bursts while holding volume and service capacity fixed. H2 still reduces oscillation, but confirmation delays more genuinely useful transfers. The protected override becomes more active, so its use rate is reported rather than treated as invisible rescue.
Second halve the classifier observation interval. Two ticks now represent half the elapsed time, so a literal H2 rule changes meaning. Re-express the challenger as a time-confirmation requirement and test one- and two-minute versions. This prevents a monitoring-frequency change from silently retuning policy.
Third remove one late-day service block. All policies face more cap pressure. H2 remains within fallback tolerances, while C5 worsens because locked loans persist into the tighter period. The mechanism-based result transfers; the exact headline percentages do not.
| Changed context | Held fixed | Question |
|---|---|---|
| Sharper bursts | Volume and capacity | Does confirmation block urgent useful transfers? |
| Faster observations | Event values and service | Is memory defined in ticks or elapsed time? |
| Removed service block | Arrivals and policy inputs | Does a challenger trap scarce capacity? |
9. Review displacement and override dependence
A challenger that succeeds only through frequent overrides is not behaving as its ordinary rule suggests. Report override count, affected cohorts, reasons and the counterfactual outcome without override. In the burst transfer test, H2 override use rises from 0.6% to 2.3% of eligible cases, still below the pre-declared 3% review threshold.
Inspect displaced cases on both sides of each transfer. A case that loses a slot may still receive timely service through fallback; a borrower may hold capacity without benefit. The relevant unit is the paired allocation consequence, not the borrower alone.
Reviewers should see decision-time evidence and the full state path. Reconciled labels can explain the outcome but must not be presented as inputs. This maintains the boundary between operational fairness and hindsight.
- Override rate and reason by cohort.
- Paired borrower and displaced-case outcomes.
- Decision-time evidence kept separate from reconciled labels.
- Short-lived loans reviewed for actual benefit.
10. Write the ninth re-freeze as a reversible contract
The re-freeze names H2’s time-based confirmation interval, reset rule, protected override, tie-breaks and deployment scope. Q17 remains the rollback reference. The total cap, eligibility and service definitions remain unchanged.
Release gates require exact reference reproduction, replay decision-set success, all transfer scenarios within tolerance, independent implementation review and a shadow period with state-path telemetry. Stop if fallback concentration, override dependence or unclassified reversals exceed declared limits.
The contract also defines the next monitoring question: whether confirmation memory remains calibrated when classifier latency and observation cadence drift. A re-freeze closes one comparison, not the need to observe the released system.
- Versioned H2 state machine.
- Frozen capacity and service contract.
- Q17 rollback path.
- Transfer and shadow gates.
- Stop limits for displacement, overrides and unexplained reversals.
11. Limits, misconceptions and evidence checklist
Hysteresis is not universally better than a memoryless rule. It deliberately resists change and can delay useful response. The right memory depends on event cadence, cost of reversal and cost of delay. A two-tick label has no stable meaning if the tick interval changes.
A replay cannot reconstruct unlogged informal triage or demand that abandoned the queue. It also relies on a model for policy-dependent service outcomes. State those limits and use shadow evidence before live re-freeze.
Preserve the event-tape hash, reference reproduction, state-machine code, scenario manifest, random seeds, case-level results, override ledger and signed decision. Recompute the decision set independently and verify every local navigation and ecosystem link before publication.
- No claim that hysteresis is always superior.
- Tick cadence included in the policy definition.
- Unlogged demand and informal triage acknowledged.
- Event tape, code, scenarios and decisions preserved.
- Independent rerun and case-level audit completed.
12. FAQs and the next reading route
The ninth thaw is useful because it is small. Monitoring has already ruled out a general capacity problem and identified threshold-driven reversals. The replay asks only how much state memory is needed to stabilise allocation without harming service.
Begin with the Queueing Theory root, then read the eighth-thaw scope article and eighth re-freeze monitoring article before this one. That sequence separates challenger selection, release monitoring and the new bounded comparison.
The parent Gold Standard and How X Works hub connect this method to a wider habit: preserve the reference, change one mechanism, test a different context and state the boundary of the conclusion.
Why not add a longer cooldown if it removes more reversals?
Because the worked replay shows that a long lock can trap capacity and worsen fallback for a protected cohort. Switching reduction must pass service guardrails.
Is two-tick hysteresis a permanent number?
No. Its meaning depends on observation cadence. The re-freeze should express memory in elapsed time or version the cadence with the rule.
Can the oracle be deployed?
No. It uses reconciled future information. It estimates the diagnostic floor but cannot win a production comparison.
Continue through the verified ecosystem
Sources and scope note
- NIST/SEMATECH e-Handbook — Assessing Process Stability — used for the distinction between stable and time-varying process behaviour.
- NIST/SEMATECH e-Handbook — EWMA Control Charts — used for monitoring gradual drift with explicit weighting and representative baseline data.
The queueing replay and all numbers are original teaching examples, not operational results from a real service. The sources support monitoring concepts; they do not select H2 or validate the worked thresholds.