Buffers have location and recovery duties

A buffer should be designed around a service duty. A stockyard before the loader can allow vessel loading to continue while rail deliveries pause. A staging area before an inspection point can hold arriving vehicles without obstructing the public road. A spare locomotive can preserve movement after a particular equipment outage. Each example stores a different resource and protects a different boundary. Calling all of them resilience obscures the conditions under which they are usable and the losses they are intended to avoid.

The buffer record should name the interruption, protected customer commitment and duty boundary. State whether protection ends after a finite campaign or must continue for later commitments, and identify replenishment where that continuing duty requires it. The question is not simply how much material fits. It is how much eligible material or resource is available for the intended duty, how quickly it can be deployed and what happens when it is exhausted. A stockyard that contains the wrong grade does not protect a vessel expecting another cargo. A spare wagon that cannot operate on the allocated route does not protect the rail service. A buffer becomes useful capacity only through a feasible deployment path.

Location changes what a buffer can protect. Stock downstream of the railway can bridge a rail interruption but cannot help clear the mine if inland storage is full. Stock upstream of the loader can protect a vessel window while exposing cargo to storage loss or quality change. A buffer at the wrong side of a closed border may preserve local output yet fail to support destination delivery. The service map should therefore show which dependency each buffer lies before or after, rather than treating total corridor storage as interchangeable.

Buffers also require handling capacity. Receiving stock, segregating it, reclaiming it and transferring it to the next stage can compete for equipment or space. A nominal storage addition can reduce usable throughput if reclaim and receipt movements conflict. The design should describe how the buffer operates during normal conditions and during recovery. A drawing that shows a larger pile without its access routes, cargo eligibility and handling sequence is a storage concept rather than a demonstrated continuity solution.

The inventory ledger should separate physically present stock from stock available for the intended service. Material may be awaiting quality release, committed to a different vessel, inaccessible beneath another pile or subject to a documentary hold. These states should remain visible instead of being counted as a single available balance. The operator needs to know which transition can release each restricted quantity and who has the authority to make that decision.

A buffer can conceal a deteriorating upstream service. The loader continues to work while the yard draws down, giving the appearance that the corridor is stable. The relevant warning is the replenishment imbalance and the remaining service duty, not merely current equipment utilisation. A useful operating report should show whether the protected function is relying on stock that the upstream chain can restore under the current conditions. Otherwise a temporary bridge becomes an unnoticed depletion process that ends in a sudden service failure.

The opposite problem is accumulation. Cargo can arrive faster than the downstream stage can accept it, filling a yard until upstream movement is blocked. Additional storage may defer the failure without changing the persistent flow imbalance. It can still be valuable as a temporary measure if the interruption is finite and a recovery plan exists. It is less defensible as a permanent substitute for resolving a recurring downstream constraint. The design must distinguish a buffer for variability from storage used to hide an unresolved average-capacity gap.

Inventory can also carry economic and physical burdens. Cash may be tied up, material may degrade, access lanes may become crowded and grade separation may become harder to maintain. The annual app includes no inventory financing or loss mechanism. Its lower illustrative unit cost after a throughput intervention cannot establish whether additional stock is worthwhile. A buffer appraisal should connect the avoided service loss to holding, handling, quality and access consequences under the relevant operating scenario.

A repeating continuity plan is incomplete when it describes depletion but not the promised recovery. After the interrupted stage restarts, it must serve ongoing flow and rebuild the protective reserve if readiness for the next interruption is part of the service duty. That requires spare usable capacity somewhere in the chain or a temporary reduction in demand served. If every stage is already committed to the normal service, the buffer cannot be restored merely by declaring the incident closed. The plan should state the recovery sequence and the user commitments that may be affected while reserves are rebuilt.

Consider an expressly fictional finite loading campaign. Its opening eligible stock covers every promised accepted delivery; no inland replenishment is available during the campaign. Loading proceeds until the final promised delivery exhausts that stock. If the declared duty ends there and includes no later vessel commitment or restored reserve obligation, the campaign can satisfy its complete service promise. Rejecting it solely for lacking replenishment would impose a repeating-service condition on a finite duty. If the promise also includes readiness for a subsequent vessel or another interruption, the same exhaustion leaves an obligation unmet. The acceptance test therefore follows the declared boundary, while preserving eligibility, handling access and all closing commitments in either case.

Recovery can shift the bottleneck. A railway returning from interruption may deliver a concentrated backlog that exceeds yard receipt capability. A loader clearing a waiting vessel may consume stock faster than the inland chain can replenish it. The corridor coordinator should manage the recovery as a shared operating state rather than instruct each actor to maximise output independently. A surge rule must specify what the next stage can accept, how protected space is maintained and when the normal operating rhythm resumes.

The buffer itself can become unavailable during the same event it was intended to mitigate. Flooding can affect both the rail approach and adjacent storage; a power outage can stop both receiving and reclaim equipment; a documentary restriction can make physically stored cargo ineligible. This common-cause challenge matters because nominal reserve quantities may appear independent on a capacity table while sharing the decisive failure mechanism. The resilience test should ask whether the buffer survives and remains deployable under the declared interruption.

The commissioning plan should include a controlled demonstration of buffer transitions where safe and appropriate. It should test receipt, release, drawdown and the agreed closing condition, including restoration when a continuing reserve duty is promised, with clear quantity and custody records. The aim is not to manufacture a disruptive event, but to verify the interfaces that make the buffer usable. A stockpile capacity certificate cannot establish that the operator can deliver the right cargo from that stock during a restricted window. The evidence should follow the intended continuity duty.

Buffer design should compare operational alternatives. Better appointment discipline, earlier documentary release or a shared dispatch plan may reduce the variability that creates the need for stock. Additional buffer capacity may still be appropriate where those measures cannot protect the customer commitment. The comparison should ask whether the proposed buffer changes the service outcome, how it is replenished and what burden it creates elsewhere. Bigger storage is not automatically more resilient if it worsens segregation or recovery logistics.

The team should state a stopping rule for adding buffer. A storage increment that no longer changes the protected service under the declared disruption should require a separate justification. Likewise, a reserve resource that cannot be deployed because of access or handling constraints should not be credited as usable redundancy. The stopping rule protects the investment from becoming a general preference for more inventory. It also helps distinguish temporary operational accommodation from a permanent structural solution.

Apply the stopping rule to a hypothetical choice between another storage bay and earlier documentary release. If existing stock cannot be loaded because release is absent, the extra bay adds gross inventory without adding eligible reserve. Earlier release may increase the usable fraction while leaving physical stock unchanged. If stock is already eligible and the protected loading campaign exhausts it before inland replenishment can resume, a storage increment may address the real duty. The missing quantity is then the campaign's eligible demand trajectory, not the annual capacity minimum. These branches tell the designer which observation separates a release remedy from a storage remedy. They leave the required stock quantity unresolved until that trajectory is supported.

A reserve approval can therefore carry a consumption disposition as well as a stock target. In the repeating-duty branch, stock consumed during protection remains a restoration obligation, and normal dispatch must leave a feasible replenishment path. In the finite-campaign branch, exhaustion can be intentional if the closing delivery and cargo-disposition obligations are satisfied. A third branch rejects reliance where the same interruption prevents stock release or loading. Recording these dispositions prevents an operator from replenishing needlessly after an intentionally terminal campaign or declaring a repeating duty complete with its protection depleted. The annual app establishes none of these inventory trajectories; the proposed disposition is an operating design to be tested separately.