Autoscaling Controller

What sits inside the controller's boundary, what feeds it, and what it is allowed to change.

Six stages: observe, decide, declare, converge, serve, explain — and one feedback edge that matters.

The six steps of one 15 second interval, and the fact that it closes.

Seven layers, and the one rule about which way they may call.

The decision plane never calls a capacity API. The red arrow is the path the architecture forbids.

Every deployable unit, and the regional state it is allowed to touch.

Four classes of source, one common shape, and a gate that qualifies every sample.

Sharded with a lease per shard, and what one shard does in one interval.

Converge actual towards desired, and survive a capacity API that is rate-limited and failure-prone.

Five inbound interfaces, five outbound, and the rule that separates them.

A workload policy, a schedule, a forecast and a human can all target the same fleet. One of them wins, and it is decided in one place.

Two stores whose loss is loss of control, and two whose loss is only loss of explanation.

The registry: what a target is, what may constrain it, and what expires.

What has to be recorded for "why did this target have this much capacity?" to be answerable without replaying a metric.

A sample from emission to decision input, and the three ways it can fail to get there.

The contract each store signs, side by side.

Every store partitioned by region, and nothing on the control path crossing one.

Tick to actuation call, with the two halves meeting only at the record.

A declared hierarchy, and how conflicting signals are reconciled inside one interval.

Three policy forms plus a forecast, one proposed number, then the clamps.

Five mechanisms in series, and the record that every suppression leaves behind.

A sustained backlog breach, through the warm pool and past it, to registered capacity.

How removal is made safe, and the instance that is allowed to say no.

Size, warm, hold, attach, measure, recycle — and what it costs to hold it.

The same loop, four driving signals, four definitions of "serving".

Stockout, quota and scarcity are one problem; throttling is a different one.

One region, three zones, and what surviving the loss of one of them actually means.

Two identical control planes that share intent and nothing else.

Two things ship here — the controller, and the rules it decides by — and only one of them can move a fleet.

Signal type by loop stage, and the alerts an operator can actually act on.

Attribution, efficiency, and the one number a policy is actually tuned against.

Alert, ask the journal, buy time, propose a policy, prove it, promote or discard.

Five zones, and every crossing authenticated and labelled.

Three workload identities, federated, short-lived, and scoped to the capacity groups they manage.

Four roles, one change path, and the two things that need a second pair of eyes.

Fail static, then — only if declared — decay towards a schedule.

Twelve classes assumed to occur, each with its named handling.