Function error_backoff 

pub fn error_backoff() -> Action

The “back off after a reconcile error” requeue action — after_secs(ERROR_BACKOFF_SECONDS).

The ONE substrate owner of the “re-enqueue after an error_policy sink caught a reconcile failure” requeue intent. Pre-lift bound at 2 workspace-wide error_policy return-sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold across one crate:

• tatara-pool-reconciler::controller_pool::error_policy — the EphemeralPool reconciler’s failure sink; a bare 15 literal fed after_secs.
• tatara-pool-reconciler::controller_allocation::error_policy — the EphemeralAllocation reconciler’s failure sink; a bare 15 literal fed after_secs.

Post-lift each callsite reads tatara_process::requeue::error_backoff(). Peer to tick, short_retry, and heartbeat on the “named requeue intent” axis; the pool-reconciler’s error_policy deliberately chose a backoff shorter than its own heartbeat_seconds slot (see ERROR_BACKOFF_SECONDS for the “pool-failure signals stale desired-count / claim” rationale). tatara-reconciler’s two error_policy sinks fall through to heartbeat directly because a Process-reconcile failure holds its own retry budget in the FSM handlers themselves — so the two intents are named separately on purpose rather than folded.

A future normalization on the error-backoff intent alone (an exponential-backoff overlay bounded by HEARTBEAT_SECONDS, a per-reconciler injectable ceiling for a mis-configured pool, a jitter overlay to avoid a thundering herd of pool + allocation error retries) lands at THIS ONE substrate primitive and both downstream error_policy sites inherit the upgrade mechanically. No per-site edit at either of the 2 listed callers or at future consumers (a new pool-adjacent controller, a new failure-sink axis).

Theory anchor: THEORY.md §VI.1 (generation over composition — the intent recurred at 2 hand-authored production sites past the PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the intent → second-count mapping lives at ONE typed algebra projection; a regression that drifted the second-count would fail at the byte-shape pin below rather than as silent operator-visible cadence skew across both downstream error_policy return-sites).