Origin-shield saturation
on a correlated cache-miss storm.

GET /live/event/stream.m3u8 HTTP/1.1
host: cdn.example.com
accept: application/vnd.apple.mpegurl

----- cycle 0 (T+0m, before shed_correlated_cache_misses_to_warm_pops + fail_open_on_shield_ceiling) -----
# manifest returned clean by the shield tier, queue depth climbing — UPSTREAM-driven
HTTP/2 200
content-type: application/vnd.apple.mpegurl
server-timing: manifest-fetch;dur=58
x-cdn: cdn-A/atl01                          ← affected tier (origin-shield target)
x-packager: pkg-prime-04
x-shield-tier: shield-NA-3                  ← the affected replay-origin tier
xo-content-digest: sha256=...

#EXTM3U
#EXT-X-VERSION:9
#EXT-X-TARGETDURATION:6
#EXT-X-MEDIA-SEQUENCE:84217
#EXT-X-MAP:URI="init.mp4"
#EXTINF:6.000,
084217.ts

# origin.replay_origin_origin_fetch_qps:    4.2×  (correlated cache-miss storm uphill into the tier's pre-provisioned ceiling)
# cdn_shield.origin_segment_cache_miss_fanin: 0.62  (vs 0.11 pre-event baseline — correlated fan-in
#                                                       from the warm edge POPs into the replay-origin)
# cache.eviction_posture on warm edge POPs:   fail  (correlated eviction posture across the warm cohort;
#                                                     segment-leg cache-hit failing on the SAME tier the shield is queueing on)
# cdn_shield.queue_depth_concurrent:         1.00  (slot ceiling — vs 0.41 pre-event baseline)
# cdn_shield.queue_p99_wait_ms:              4.21  (vs 0.21s baseline; exceeds the 1.5s slot budget)
# cdn_shield.queue_concurrency_ceiling_pct:   1.00  (the shield has stopped accepting fan-in)
# origin.replay_concurrency_ceiling_pct:     0.94  (replay-origin playing out — JUST UNDER ceiling;
#                                                     upstream is queueing, replay-origin is hot)
# cdn_shield.warm_edge_pop_segment_leg_cache_hit: fail  (warm edge POPs' segment-leg green fails
#                                                            on the same tier — the warm cohort shares the fate)
# edge.egress_kbps:                          8214  (FLAT at expected baseline — cohort IS delivering traffic)
# edge.manifest_route_5xx_ratio:             0.000 (no 5xx; the shield is queueing, not erroring)
# cohort.cohort_join_stall_ratio:            0.094 (vs 0.018 baseline, 90s cohort window — late-join
#                                                     stalled behind the queue tail on the affected tier)
# cohort.cohort_rebuffer_ratio:              0.062 (vs 0.012 baseline — playback stalled on the affected tier)
# cohort.cohort_startup_time_p95_ms:         7430  (vs 1840 baseline — cohort start-up time hitting the 8s threshold)
# cohort.reconnect_storm_ratio:              0.04  ← BASELINE — NOT a viewer-driven storm. The cohort is calm.
# cohort.demand.in_window_constraint:        true  (cohort is in the marquee broadcast window — demand is constrained)
# encoder.bitrate_target_delta_pct:          0.18  (within baseline — encoder profile reads clean)
# origin.replay_orig_egress_kbps:            4211  (stable; origin egress not the pinch — shield queue is)
# cdn_pop.partial_segment_warmup_state:      fail  (warm edge POPs NOT primed on this tier — eviction posture
#                                                     is the correlated upstream pressure)
# cdn_pop.affected_region_pop_id:            cdn-A/atl01
# isp.cell_load.on_affected_region:          pass  (cell-load 0.43 vs 0.51 baseline reference)

----- cycle 1 (T+~3m, after shed_correlated_cache_misses_to_warm_pops_via_origin_failover) -----
HTTP/2 200
content-type: application/vnd.apple.mpegurl
server-timing: manifest-fetch;dur=32
x-cdn: cdn-A/atl01
x-shield-tier: shield-NA-3-shedded          ← correlated fan-in routed to a warm POP
xo-content-digest: sha256=...

#EXTM3U
#EXT-X-VERSION:9
#EXT-X-TARGETDURATION:6
#EXT-X-MEDIA-SEQUENCE:84221
#EXT-X-MAP:URI="init.mp4"
#EXTINF:6.000,
084221.ts

# origin.replay_origin_origin_fetch_qps:    0.91×  (correlated cache-miss storm at bay — fan-in routed
#                                                      to a warm edge POP that has the segments cached)
# cdn_shield.origin_segment_cache_miss_fanin: 0.18  (within pre-event baseline)
# cache.eviction_posture on warm edge POPs:   pass  (correlated eviction posture cleared on the warm cohort)
# cdn_shield.queue_depth_concurrent:         0.41  (within the slot's pre-event baseline)
# cdn_shield.queue_p99_wait_ms:              0.32  (within slot budget)
# origin.replay_concurrency_ceiling_pct:     0.62  (replay-origin playing out — within ceiling)
# cdn_shield.warm_edge_pop_segment_leg_cache_hit: pass  (warm edge POPs' segment-leg green once routed)
# edge.egress_kbps:                          8214  (FLAT at expected baseline — cohort continues to deliver traffic)
# cohort.cohort_join_stall_ratio:            0.022 (within baseline tolerance — within cohort_baseline)
# cohort.cohort_rebuffer_ratio:              0.013 (within baseline tolerance)
# cohort.cohort_startup_time_p95_ms:         2010  (within startup_time baseline tolerance)
# cohort.reconnect_storm_ratio:              0.04  ← STILL BASELINE — the cohort has not changed shape;
#                                                     it was never the driver
# cohort.demand.in_window_constraint:        true  (still in marquee broadcast window)
# governed_action_emitted:                   shed_correlated_cache_misses_to_warm_pops_via_origin_failover,
#                                             fail_open_on_shield_ceiling_via_origin_circuit_breaker,
#                                             surface_origin_shield_quota_codification_to_operator_team

{
  "stream_id": "ckshieldsatcorrcachemiss6185",
  "source": "https://cdn.example.com/live/event/stream.m3u8",
  "protocol": "HLS / CMAF / shield-tier / replay-origin / warm-edge-POP cache layer",
  "checked_at": "2026-08-20T18:42:11Z",
  "ranked_hypotheses": [
    {
      "rank": 1,
      "hypothesis": "origin_shield_saturation_under_correlated_cache_miss_storm",
      "tag": "dominant",
      "confidence": 0.84,
      "evidence_signals": [
        "origin.replay_origin_origin_fetch_qps → fail (4.2× the tier's pre-provisioned ceiling — correlated cache-miss storm fan-in uphill into the replay-origin)",
        "cdn_shield.origin_segment_cache_miss_fanin → fail (0.62 vs 0.11 pre-event baseline — CORRELATED fan-in across the warm edge POPs into the replay-origin)",
        "cache.eviction_posture on warm edge POPs → fail (correlated eviction posture across the warm cohort — segment-leg cache-hit failing on the SAME tier the shield is queueing on)",
        "cdn_shield.queue_depth_concurrent → fail (1.00 of slot ceiling vs 0.41 pre-event baseline — the shield has stopped accepting fan-in)",
        "cdn_shield.queue_p99_wait_ms → fail (4.21s vs 0.21s baseline; exceeds the 1.5s slot budget)",
        "cdn_shield.queue_concurrency_ceiling_pct → fail (1.00 — slot reads at ceiling; origin-failover eligible)",
        "origin.replay_concurrency_ceiling_pct → warn (0.94 — replay-origin playing out — JUST UNDER ceiling; upstream is queueing, replay-origin is hot)",
        "cohort.cohort_join_stall_ratio → fail (0.094 vs 0.018 baseline, 90s cohort window — late-join stalled behind the queue tail)",
        "cohort.cohort_rebuffer_ratio → fail (0.062 vs 0.012 baseline — playback stalled on the affected tier)",
        "cohort.cohort_startup_time_p95_ms → fail (7430ms vs 1840ms baseline — start-up time hitting the 8s threshold)",
        "cohort.reconnect_storm_ratio → pass at 0.04 (BASELINE — discriminator against a viewer-driven reconnect storm; the cohort is calm, the upstream origin is the driver)",
        "edge.egress_kbps → pass at 8214 Kbps (FLAT at expected baseline — discriminator: cohort IS delivering traffic; the upstream origin-shield fan-in is the pinch, NOT the cohort's egress)",
        "edge.manifest_route_5xx_ratio → pass (no 5xx — the shield is queueing, not erroring)",
        "encoder.bitrate_target_delta_pct → pass (0.18 within baseline — encoder profile reads clean; failure is upstream)")
      ]
    },
    {
      "rank": 2,
      "hypothesis": "cdn_edge_pop_warmup_under_eviction",
      "tag": "ruled_out_by",
      "confidence": 0.31,
      "evidence_signals": [
        "warm edge POPs' cdn_shield.segment_leg_cache_hit reads pass AT BASE TIER (the warm cohort has the segments in cache)",
        "correlated eviction posture on the warm edge POPs is a STAGE-shaped signal — but on backend warm edge cohorts, segment_leg cache-hit is GREEN at the ladder, so the failure cannot be a fresh-cache warm-up on the warm cohort's ladder",
        "the segment-leg cache-hit posture on cdn_pop.partial_segment_warmup_state is fail (warm edge POPs NOT primed on this tier — eviction posture is the correlated upstream pressure, NOT a clean cache eviction on the warm cohort)"
      ]
    },
    {
      "rank": 3,
      "hypothesis": "viewer_driven_reconnect_storm_saturation",
      "tag": "alternate",
      "confidence": 0.22,
      "evidence_signals": [
        "cohort.reconnect_storm_ratio reads at 0.04 — BASELINE, NOT 1.00 like the marquee live-event viewer-storm page",
        "edge.egress_kbps reads 8214 Kbps FLAT at expected baseline — the cohort is NOT feeding the queue",
        "if a viewer-driven reconnect storm were stateful, the late-join cohort on the affected tier would also misfire — it is not; the cohort reconnect-storm ratio is at baseline, the cohort_join_stall_ratio is high because of the shield queue tail (NOT a viewer-side reconnect storm)"
      ]
    }
  ],
  "governed_actions": [
    {
      "action":      "shed_correlated_cache_misses_to_warm_pops_via_origin_failover",
      "decision_lane": "autonomous",
      "authorization_tier": "Tier 0",
      "account_name": "who can shed traffic",
      "type":        "governed",
      "gating":      "top_confidence >= 0.80 AND cdn_shield.origin_segment_cache_miss_fanin >= 0.35 AND cohort_demand.in_window_constraint == true",
      "evidence":    "top-hypothesis confidence 0.84; cdn_shield.origin_segment_cache_miss_fanin 0.62; cohort.demand.in_window_constraint == true (marquee broadcast window shape); origin.replay_origin_origin_fetch_qps 4.2x (correlated cache-miss storm uphill into the tier's pre-provisioned ceiling)",
      "expected_effect": "replay_origin_origin_fetch_qps drops below 1.0x (within pre-provisioned envelope); cohort_join_stall_ratio collapses below 0.05 within ten consecutive 30s windows; the correlated cache-miss storm fan-in routes to a warm edge POP that has the segments cached"
    },
    {
      "action":      "fail_open_on_shield_ceiling_via_origin_circuit_breaker",
      "decision_lane": "surfaced_to_humans",
      "authorization_tier": "Tier 1",
      "account_name": "who can fail open",
      "type":        "governed",
      "gating":      "cdn_shield.queue_concurrency_ceiling_pct == 1.00 AND viewer_visible_config_change_required",
      "evidence":    "cdn_shield.queue_concurrency_ceiling_pct pegged at 1.00 on the affected tier; the circuit-breaker trip thresholds are operator-team-owned config, NOT probe-driven; the agent holds off emitting and surfaces the fail-open posture to on-call + reliability team",
      "expected_effect": "on-call + reliability team code-approve the fail-open posture on the shield's circuit-breaker; the shield's queue_concurrency_ceiling_pct re-anchors below 1.00 on the next triggered probe cycle"
    },
    {
      "action":      "escalate_origin_shield_quota_codification_to_playbook",
      "decision_lane": "surfaced_to_humans",
      "authorization_tier": "Tier 2",
      "account_name": "who can escalate",
      "type":        "governed",
      "gating":      "incident_resolved AND cohort_side close-out signals cleared",
      "evidence":    "cohort.cohort_join_stall_ratio + cohort.cohort_rebuffer_ratio + cohort.cohort_startup_time_p95_ms within tolerance over the next same-length cohort window; the operator-team codifies the new origin-failover policy into the playbook after the close-out probe lands; THIS IS THE LEARN-LOOP ACT",
      "expected_effect": "operator-team signs off on pinning the new origin-shield quota policy (correlated cache-miss-storm fan-in handling + replay_origin_origin_fetch_qps ladder ceiling + warm-edge-POP failover policy) into the cohort probe fan-in for future correlated cache-miss storm windows; the false-positive rate is measured over the next four weekday primetime windows before promotion"
    }
  ],
  "verification_window": {
    "close_out_signal": "staged gated verification — T+30 s edge POP cache-hit re-anchor · T+2 m shield queue depth collapsed · T+5 m cohort close-out probes within tolerance · T+15 m full cohort re-anchor + replay-origin concurrency back to baseline",
    "close_out_probes": [
      "cohort.cohort_join_stall_ratio within tolerance over the next same-length cohort window",
      "cohort.cohort_rebuffer_ratio within tolerance",
      "cohort.cohort_startup_time_p95_ms within tolerance",
      "edge.egress_kbps flat at expected baseline (CORRELATED fan-in did NOT alter cohort shape)"
    ],
    "NOT_close_out_signal": [
      "cdn_shield.queue_depth_concurrent returning to baseline alone — PASSES geometrically, does NOT pass cohort-side",
      "origin.replay_concurrency_ceiling_pct returning below 1.00 alone — same caveat",
      "edge.egress_kbps staying FLAT at expected baseline — this discriminator is "what we expected", NOT "what is closing out" (cohort is calm by definition)"
    ],
    "explicit_note": "'replay-origin queue normalized' != 'cohort is delivering green playback'. Recovery is verified cohort-side + shield-side — staged T+30 s → T+15 m. NOT infrastructure-green alone."
  },
  "surfaced_to_humans": [
    {"owner": "on-call",                   "task": "approve the fail_open_on_shield_ceiling_via_origin_circuit_breaker posture before the next correlated cache-miss storm window"},
    {"owner": "reliability team",          "task": "page for the origin-shield saturation root-cause review"},
    {"owner": "operator team",             "task": "codify the new origin-failover policy + warm-edge-POP cache-routing logic into the playbook (Tier 2 · operator-team sign-off forward)"},
    {"owner": "reliability team",          "task": "assign the public postmortem write-up (this page)"}
  ]
}