Part III — Protective action and its consequences

DTM.8 - Compare Protective Actions against Continuing or Spreading Activity by Target and Remaining Effects

Type: Method Status: Stable

DTM.8:1 - Problem frame

Use this when several proposed protective actions promise a similar improvement but act on different parts of a continuing or spreading practice.

Reducing exposure does not necessarily stop an already established activity. Reducing its consequences does not necessarily stop its further transmission. Restoring a useful function does not necessarily restore the old arrangement. These differences determine what the action can accomplish and what must accompany it.

Start with the function and affected party to be protected, then locate what each feasible action changes. The first result is a comparison of intervention targets, their direct effects, important remaining effects and implementation conditions.

For an already understood isolated hazard with no continuation or transmission question, use the relevant subject protection method. This pattern does not supply clinical, biological or other technical intervention procedures.

DTM.8:2 - Problem

A single label such as prevention, resistance or resilience can hide several causal changes. A decline in observed damage can result from fewer new contacts, less continuing activity, lower consequences of the same activity, or faster restoration after damage.

Treating these as interchangeable produces false completion claims. A local improvement can leave the source of harm to others unchanged, and a restriction that stops one activity can also prevent a needed contribution.

DTM.8:3 - Forces

DTM.8:4 - Solution

Identify the protected function, separate the intervention targets, follow their remaining effects and compare feasible combinations.

DTM.8:4.1 - Restore the reference of protection

State which system or participant performs the relevant work, who receives its result, what adverse consequence is at issue and over what horizon. Use DTM.1 before treating an unfamiliar or dependent practice as harmful.

Ask separately about harm entering the considered system and harm its operation can impose on others. This directional contrast can help clarify a discussion of security and safety, but the two words have wider, context-dependent definitions. Accidental versus intentional action is another distinction; it does not follow from the direction.

A.6.P.RI restores the standpoint of the claim. A reduction in the operator’s cost is not automatically a reduction in harm to a customer, neighboring group or constituent participant.

DTM.8:4.2 - Locate each proposed change

Follow the current account from encounter through established activity to consequence and restoration. Distinguish four target kinds:

These targets distinguish causal changes. Their quantities come from the subject practice: failed executions, unauthorized operations, incompatible exchanges or another specified event. There is no universal scalar “burden” shared by all these cases.

One action can affect several targets. Record those actual connections rather than giving it one exclusive label.

DTM.8:4.3 - Construct the change and its residual effects

For each feasible action, specify which relation in DTM.2/.3 or the subject model changes. Keep the comparison at the same recipient, horizon and relevant initial conditions.

For reduced contact, retain what happens in already affected participants. For reduced established activity, retain earlier consequences and possible return. For reduced consequence, check whether the variant can still be transmitted. For restoration, compare the restored function with the continuing rate of new impairment.

When a numerical model is warranted, vary the corresponding parameters or operations rather than replacing every protective action with a common reduction factor. MMP supplies the model change and analysis. DTM.4 examines persistence or return; DTM.9 includes response formation and indirect effects.

DTM.8:4.4 - Check implementation across the method vertical

Recover the component operations, resources and capabilities needed while the protective action is performed, and the larger work it is meant to sustain. C.32.MWA supplies this simultaneous method-vertical question.

For example, “exclude an unreliable procedure” requires an available way to distinguish it under relevant conditions, authority to change admission, and an alternative means to continue needed work. A hypothetical perfect distinction is a model assumption, not an implemented capability.

Use the existing development and operational methods to obtain missing contributions. Restoring a capability can use a different tool, partner or division of work; C.36.RP helps avoid equating cultural recovery with a return to the old arrangement.

DTM.8:4.5 - Compare combinations and the unchanged option

Pass the distinct outcomes, costs, uncertainties and feasibility conditions to the existing portfolio and decision methods. Retain the unchanged option and a smaller bounded change.

Check combinations for shared resource use and inconsistent assumptions. A result-checking operation can both stop faulty work and consume capacity needed for valid work. A repair activity can fail to catch up if new impairment continues faster than it restores function.

The first sufficient result may be a justified exclusion: “reducing new encounters alone cannot meet this deadline because the affected work is already installed.” A complete population model is unnecessary when that conclusion follows from the established causal account.

DTM.8:5 - Archetypal Grounding

DTM.8:5.1 - Fewer contacts and fewer errors are different changes

Consider a hypothetical network in which 20 teams already use procedure B. Each performs 10 runs per week. Under the stated conditions, a run has probability 0.25 of producing an erroneous result. The expected number of new erroneous results is therefore 50 per week.

The following actions address different targets:

• Reducing recommendations may reduce new adopting teams. It does not by itself change the 200 weekly runs already performed.
• Stopping half of the established runs, with all other assumptions unchanged, reduces expected generated errors to 25 per week. The needed work those runs served must still be considered.
• An available independent review that catches 80% of generated errors before delivery reduces expected erroneous deliveries to 10 per week. It leaves 50 generated errors, consumes review effort and does not by itself change transmission of the procedure.
• Correcting earlier erroneous results reduces the unresolved stock. It does not by itself change the current rate of new errors.

Combining the halving of established runs with review of every remaining result leaves 100 runs, 25 expected generated errors and 5 expected erroneous deliveries per week. This requires capacity to review all 100 results at the stated performance without displacing other needed work. If capacity permits only 50 uniformly selected reviews, expected detections are 50×0.25×0.8=10, leaving 15 erroneous deliveries rather than 5. Use OPS to resolve that capacity question.

The error probability and review performance are assumptions for illustration, not empirical claims. If review changes future learning or recommendations, that additional feedback belongs in the model.

DTM.8:5.2 - The same unresolved stock can hide a different source

Let L be the expected number of unresolved erroneous results, e the expected arrival rate and r the resolution rate per unresolved result. Under the illustrative approximation L’=e−rL, the stationary stock is e/r.

At e=50 per week and r=1 per week, the stock is 50. Halving e or doubling r gives a stationary stock of 25, but through different actions. In the latter case 50 new erroneous results still arrive each week.

The approximation assumes the resolution capacity supports a rate proportional to L. If a fixed-capacity correction team becomes saturated, that assumption fails; an OPS model is needed. The equal stationary stocks do not establish equal cost, delay, external consequence or further spread.

DTM.8:5.3 - Protecting exchange without rejecting a useful new method

A group receives work represented in a new format. Restricting admission of incompatible records can preserve the current exchange function while also obstructing a useful method.

Possible changes include a verified adapter, a more informative compatibility check or a bounded migration of the receiving work. Their subject engineering methods establish whether exchange succeeds. DTM.2/.6 examine how compatibility affects adoption; DTM.9 becomes relevant if the checking response itself changes useful participation.

Calling the new format an infection would conceal the actual problem. Continuing the old arrangement, converting at the boundary and changing the arrangement are alternatives with different costs and consequences.

DTM.8:6 - Bias-Annotation

“More protection” can sound preferable without identifying a target. It may instead impose a costly restriction while leaving the relevant source unchanged.

A second bias treats restoration as making the participant self-sufficient. The required result may be dependable access to a contribution, not possession of every underlying method.

DTM.8:7 - Conformance Checklist

• Protection has a named function, recipient, comparison and horizon.
• Harm to the considered system and harm from its operation are not silently combined.
• Contact or admission, established activity, consequences and restoration are distinguished where they change the choice.
• Each proposed action changes an identified relation and retains material residual effects.
• Required recognition, authority, component operations and supporting capabilities are feasible or explicitly unresolved.
• Combinations are checked for resource conflicts and feedback; existing choice methods perform the comparison.

DTM.8:8 - Common Anti-Patterns and How to Avoid Them

Fewer new users means the established problem is gone. Keep the already installed activity in the account.

Less local damage means less transmission. Recover the actual link; it may be unchanged or even increase.

A successful repair ends the source. Compare ongoing impairment with restoration.

The model has a selective intervention, so we can implement it. Establish the distinction, means and authority used by that intervention.

DTM.8:9 - Consequences

Protective choices become comparable without pretending that they act in the same way. The method can reveal the need for a combination or a simpler sufficient action. It also exposes costs that a single protection score would conceal. Subject-specific feasibility and value judgements remain indispensable.

DTM.8:10 - Rationale

The location of an intervention determines which relations it can change. Keeping the locations distinct prevents an improvement in one observed result from being mistaken for removal of every relevant cause. Connecting them to transmission and the method vertical makes the distinction useful beyond its biological origins.

DTM.8:11 - SoTA-Echoing

Medzhitov, Schneider and Soares, Disease Tolerance as a Defense Strategy (2012) are a historical source for distinguishing reduction of an agent’s amount from reduction of its damaging consequences. This pattern adapts the causal distinction to named activities and functions; it does not equate disease tolerance with social tolerance.

Tang, Mou and Xu, Defense strategies for plant health: Disease resistance and tolerance (2025) also distinguish protective effects from damage caused by the response. That distinction informs the comparison of residual effects and response costs in :4.3–.5; the receiving practice must establish the effects of its actual actions.

Compared with one generic suppression target, the four-target account can show why a locally successful action leaves spread or impaired function unresolved. Compared with a complete protection model, it can stop after the smallest relation sufficient to distinguish feasible choices. Existing subject methods establish intervention effects; existing decision methods compare their outcomes.

DTM.8:12 - Relations

• DTM.1 supplies the consequence comparison; DTM.2/.3 locate transmission and established activity.
• DTM.4 investigates persistence and return; DTM.6 adds effects through other variants.
• DTM.7 identifies a diversion point when relevant; DTM.9 models the protective response and its feedback.
• A.6.P.RI restores the standpoint of protection; C.32.MWA recovers simultaneous method support.
• C.36.RP supports recovery through available cultural means; MMP and the existing portfolio methods retain modeling and choice.

DTM.8:End

DTM.9 - Model Damage and Feedback from Protective Responses to Continuing or Spreading Activity

Type: Method Status: Stable

DTM.9:1 - Problem frame

Use this when a protective response depends on the activity it encounters and, in turn, changes that activity, useful work or subsequent transmission.

A checking process may consume the capacity it protects. A rule triggered by visible use may restrict an easily recognized useful method more than a less visible faulty one. A learned warning may persist after conditions change. In each case, treating protection as a fixed beneficial reduction can reverse the predicted result.

Start by making the response itself part of the causal account. The first result is a conditional model of its formation, persistence, costs and differentiated effects, sufficient to compare the proposed change with a plausible alternative.

If a fixed external constraint has adequate subject evidence and its response dynamics do not matter to the receiving decision, retain that simpler model.

DTM.9:2 - Problem

Protection is often represented only by how much it removes. That omits the process that produces the response, what it costs, which useful activity it restricts and how the remaining variants change its future conditions.

An immediate decrease can therefore coexist with later release of another variant, loss of useful work or persistent restriction after the initiating condition has disappeared. The protective action can become part of the problem without ceasing to have a protective effect.

DTM.9:3 - Forces

DTM.9:4 - Solution

Model how the response is generated and sustained, how it acts on each relevant activity, and how those effects return to the conditions that generate it.

DTM.9:4.1 - Identify the response and its information

Use DTM.8 to name the protected function and target. Recover what generates the response: an observed event, accumulated evidence, a prediction, a standing rule or a participant’s judgement. Distinguish the actual condition from the signal used to recognize it.

Specify the operation that follows and the means needed to perform it. C.30.LCA supplies the relevant control relations; the technical or organizational practice supplies the detection and action method.

If recognition is uncertain, retain its consequential errors. An action that perfectly distinguishes useful and faulty variants is not available merely because the model assigns them different symbols.

DTM.9:4.2 - Choose the response state and time description

Represent formation, decay, persistence and capacity limits at the resolution needed by the question. A response may depend on current activity, past experience or prediction. Use a state or history sufficient to represent that dependence.

An algebraic response a=F(x,u) assumes that its adjustment is sufficiently fast for the receiving result, where x describes relevant activity and u the proposed change. A simple dynamic alternative is:

τa' = F(x,u) − a, with τ > 0.

This illustrative first-order adjustment does not automatically represent learning, saturation or several kinds of memory. Introduce those relations only where supported. MMP.11/.18 govern the state choice and any reduction.

Test the simplification against the decision. A stationary comparison can tolerate a reduction that would be unsuitable for startup, short disturbances or a deadline. Even a fast response can matter when a brief transient crosses an irreversible boundary.

DTM.9:4.3 - Follow effects on useful work, unwanted activity and transmission

For every variant that can change the conclusion, recover how the response changes execution, continuation or uptake. Use the different sensitivities or action conditions supplied by the subject account.

Then follow indirect effects through the relations identified in DTM.6: released capacity, lost prerequisite capability, changed compatibility or a changed audience. Connect resulting participant states to transmission with DTM.3.

Do not add a common resource or a biological mechanism merely to complete a familiar model. A compatibility restriction may operate through exchange opportunities alone; a checking process may instead share scarce staff time with the work it checks.

DTM.9:4.4 - Account for response costs and restoration

Name each material consequence and its recipient. Direct effort, delayed useful work, inappropriate restrictions and external harm need not share a unit or a scalar total. A.6.P.RI and the existing evaluation methods retain those distinctions.

If a local consequence accumulates and can be repaired, represent both its source and restoration. DTM.8 distinguishes changing the source from repairing its result. State which other participants’ consequences remain outside that local measure.

At the method vertical, verify that sensing, decision, action and restoration can operate together while supporting the containing work. A proposed response that consumes the only capacity needed for that work may be infeasible even if its isolated mechanism succeeds.

DTM.9:4.5 - Compare regimes, transients and changed variants

Compare the unchanged arrangement with the feasible response changes. Use DTM.4 for persistence and return, and the appropriate mathematical and computational methods for the calculation.

Where variants can change, examine a consequential alternative that differs in response sensitivity or continuation mechanism. Separate a possible variant from evidence that it will arise. DTM.2 supplies reconstruction or change; DTM.5/.6 explain differential continuation. Reuse the existing improvement and model-revision methods rather than adding an automatic escalation rule.

Return the condition under which the response helps, its adverse effects, sensitivity to uncertain relations and the observation that would change the choice. “Protection works” is too broad when the result holds only for one variant or one recipient.

DTM.9:5 - Archetypal Grounding

DTM.9:5.1 - A broad response releases the variant it was meant to limit

Continue the illustrative activity model of DTM.6. A is useful execution and B is execution producing specified errors inside a group. Both occupy limited execution capacity. Suppose the checking response is generated more strongly by visible A activity and also by B:

a = 2A + 0.5B + u
A' = A[2(1−A−B) − 0.2 − a]
B' = B[(1−A−B) − 0.3 − 0.2a − v].

Here u is additional broad checking and v selectively stops established B activity. A, B and remaining capacity are nonnegative. Time and activity are normalized; coefficients are chosen for this example. The equation for a assumes fast adjustment with no consequential memory.

With positive initial presence and the stated model, the stable stationary comparisons are:

Increasing broad checking removes the more sensitive A and releases capacity for B. The larger response therefore leaves more B. This conclusion follows from the stipulated resource and sensitivity relations; it is not an empirical claim about procedure catalogues or a general argument against checking.

Selective action succeeds here only if B can actually be distinguished and stopped at the assumed cost. It cannot be presented as an available improvement before that capability is established.

DTM.9:5.2 - A local consequence and further spread can move differently

Add an illustrative local consequence stock:

L' = hB + 0.1a + 0.05v − rL.

L measures a specified local impairment in normalized units; h is its rate per unit B activity and r its restoration rate. The other terms represent local costs of response and selective checking. Useful A remains a separate result, and harm to outside recipients is not included.

With h=r=1, the three rows above give stationary L of approximately 0.37778, 0.63182 and 0.105. Broad checking worsens both useful activity and this local consequence. These results do not collapse all affected interests into L.

If groups share the same settled internal regime and between-group spread is slower, an illustrative coupling is z’=βBz(1−z)−γz, with z the fraction of groups in which B is established. At β=2 and γ=0.5, the positive stationary fractions are approximately 0.19643 for the baseline and 0.55645 for broad checking. The zero state remains invariant without an introduction.

Reducing h or increasing r can improve the local consequence without changing B and therefore without changing this spread law. Conversely, reducing β can stop continued spread while leaving the established internal activity untouched. DTM.8 explains the distinct intervention targets. If affected groups differ materially or are still learning, use DTM.3 to repair the coupling instead of inserting an unsupported average B.

DTM.9:5.3 - A successful restriction may leave another continuation route

In the selective-action regime, A=0.45 and a=0.9. Consider a hypothetical rare alternative B* that is unaffected by v and has response sensitivity 0.1 instead of 0.2. Its initial growth rate under the same resource account is:

(1−0.45) − 0.3 − 0.1×0.9 = 0.16.

The positive value establishes a possible weakness of this intervention under those assumptions. It does not predict the appearance of B*, its frequency or an adversary’s intention. The next question is whether that alternative has a plausible construction and whether a feasible observation or action addresses it.

A changed variant may also be more useful rather than more harmful. DTM.1 must establish its consequences afresh; inherited suspicion is not an evaluation.

DTM.9:5.4 - Memory can outlast the condition that formed it

Suppose a receiving team keeps restricting an exchange format because earlier versions caused failures. The present format and conversion method have changed, but the restriction uses accumulated historical evidence.

The response state must then distinguish current compatibility from retained evidence. A comparison of current verified exchange and the rule’s update behavior can reveal whether the restriction still protects the intended work. A memory-free relation to current usage would miss that question.

For a small constructed case, let m be a retained warning score. The rule holds the format when m≥0.4, starts at m_0=0.8, and updates after an authorized exchange test by m_next=0.8m+0.2e, where e=1 for a failed test and 0 for a successful one. Four successful tests give scores 0.64, 0.512, 0.4096 and 0.32768. The rule therefore still holds the format after the first three tests and releases it after the fourth, although the latest observed outcome is the same throughout.

A rule based only on the latest outcome would release it after the first success. Neither rule is justified by this arithmetic alone: the subject engineering method must establish which exchanges were tested and what evidence warrants admission. If the restriction also prevents every new test and the score has no other update, m remains 0.8 and the restriction sustains its own lack of new evidence.

The subject control and learning methods define how evidence is updated.

DTM.9:6 - Bias-Annotation

A protective label can hide the response’s own consequences. Include useful work and affected recipients alongside the suppressed activity.

The opposite bias treats any costly response as unjustified. A response may remain preferable to the consequences it prevents; the comparison, conditions and alternatives determine that judgement.

DTM.9:7 - Conformance Checklist

• The response’s initiating information and performed operation are identified.
• Formation, decay, memory and time reduction match the receiving question.
• Consequential recognition errors and different effects on variants remain visible.
• Direct costs and indirect effects on capacity, useful work and transmission are traced.
• Local consequence measures do not silently stand for every recipient’s welfare.
• A selective action has an implementable distinction or remains a conditional alternative.
• Possible variant change is not reported as observed or inevitable change.
• The result states conditions and return observations, rather than recommending indiscriminate escalation.

DTM.9:8 - Common Anti-Patterns and How to Avoid Them

A stronger response is a stronger solution. Follow useful work and indirect release of other variants.

The equilibrium settles a deadline question. Restore response time and the relevant transient.

A perfect classifier is a harmless simplifying assumption. Test whether its errors and implementation cost could reverse the chosen action.

The first successful restriction is permanent. Revisit the continuation mechanism when conditions or variants change.

DTM.9:9 - Consequences

The model can expose protective actions that worsen the stated outcome and identify when a narrower or differently timed response could help. It also makes uncertainty costly in a visible way: lacking a reliable distinction may rule out the apparently best action. Added dynamics are worthwhile only when they change a consequential comparison.

DTM.9:10 - Rationale

A response belongs inside the model when it is produced by, and changes, the modeled activity. This closes a feedback relation that fixed suppression misses. Treating the response as an ordinary process with state, limits and consequences also prevents its protective purpose from being mistaken for proof of its effect.

DTM.9:11 - SoTA-Echoing

Ramesh and Hall (2025) examine competition with shared resources and responses in a biological setting. Their distinction between a variant’s effect on a limiting factor and its sensitivity to that factor informs :4.3 and :5.1: the same response can restrict the variants differently while their activity changes its formation. The engineering example uses stipulated coefficients; it does not reproduce the biological model.

Zilio et al. (2026) reinforce the need to distinguish interaction routes across scales. A changed local interaction therefore needs a stated connection to transmission, rather than an assumed population benefit.

Compared with a fixed suppression term, an endogenous response can reveal costs, differential sensitivity and memory. Compared with an unrestricted multi-process simulation, the method adds only relations that can change the receiving decision. MMP.18 supplies the reduction test, C.30.LCA the control distinctions and the subject practice the realizable response.

DTM.9:12 - Relations

• DTM.6 supplies the interaction relation; DTM.7 supplies a possible diversion point.
• DTM.8 distinguishes action targets before their response dynamics are compared.
• DTM.2/.3/.4 connect change, spread and persistence; DTM.5 distinguishes levels of continuation.
• MMP.11/.16/.18 provide state construction, discriminating evidence and justified coupling or reduction.
• C.30.LCA, C.32.MWA and A.6.P.RI retain control, simultaneous method support and reference distinctions.

DTM.9:End