Debug hangs, OOMs, and accidental cloud calls

Map failure classes for POST http://127.0.0.1:11434/api/generate: retryable vs fatal vs needs-human. Retries need budgets, jitter, and idempotency rules aligned to cloud fallback requires explicit policy flag + redaction pass; local p95 ≤ 6s for 512 tokens. The chapter’s signature failure — fallback silently ships full NDA text to cloud when Ollama is down — must take a deliberate branch, not a generic catch-all.

Implement the degrade/rollback/refuse behavior legal analyst summarizing NDAs that must not leave the laptop by default needs when LOCAL-FALLBACK-PII-03 repeats. Prefer scoped controls (one flag, one weight, one tenant, one secret version) over fleet-wide restarts. Preserve evidence; do not delete logs to “clean the demo.”

After containment, check local_share ≥ 0.8 and cloud_fallback_with_pii == 0 moves in the safe direction and watch for retry amplification. Write the stop condition that ends the incident response for this lab.

Chaos note: inject only one fault class at a time and restore fixtures after. Watch for dual failures — dependency down and retry amplifier — which is how fallback silently ships full NDA text to cloud when Ollama is down becomes an outage. Customer communication templates (even if only for the drill) beat silence. If you queue deferred work, define poison-message handling. Budget documents should state the maximum extra spend allowed during retries. Close the loop by linking the containment action to a dashboard panel for local_share ≥ 0.8 and cloud_fallback_with_pii == 0.

Draw a state diagram for degrade modes and put it in the repo as ASCII if needed. Cap concurrent retries across the process, not only per request. Ensure cancellation propagates to downstream HTTP clients. When failing closed, choose a user-visible message that does not leak internals. Practice the single command that flips the kill switch or weight to zero. After recovery, drain or inspect deferred work before declaring green. In this chapter the product is Ollama-backed local router with policy-controlled cloud fallback, the human stakeholder is legal analyst summarizing NDAs that must not leave the laptop by default, and the incident id you design against is LOCAL-FALLBACK-PII-03. Re-state the oracle in your notes — local llama3.2:3b answers fixture brief at ≥ 25 tok/s; fallback path logs reason=local_timeout — and keep the invariant visible: cloud fallback requires explicit policy flag + redaction pass; local p95 ≤ 6s for 512 tokens. Track local_share ≥ 0.8 and cloud_fallback_with_pii == 0 as the scoreboard. Surface under change control: POST http://127.0.0.1:11434/api/generate. If you only have forty minutes, finish the fixture for fallback silently ships full NDA text to cloud when Ollama is down before polishing UI. Promotion language stays ternary: promote, hold, or roll back based on evidence, not hope.