Figure 9: The controller is a state machine, not a retry loop. It escalates only as severity demands, Maintaining → Conserving → Pausing, and can recover back down when health returns (dashed). Crucially, Diagnosing is an absorbing state: once the systemic fault repeats, the loop halts and hands off to a human rather than burning budget on more retries.