What cascading failure forbids

What this article forbids

It forbids buying availability past your most-shared component. Replicas, retries and failover all stop paying at that ceiling.
It forbids assuming independence you did not deliberately engineer. Independence is a physical and organizational property, never a software one.
It forbids maintaining a global invariant through local configuration. Timeout coherence, retry budgets and deadline discipline cannot be achieved by asking each team to be careful.

Escapes and costs

Escape	Removes	Paid in
Soften dependencies (fallback, cache, degrade)	Terms from the a^N exponent	Fallback paths that must be exercised, or they do not exist
Bulkhead (a pool per dependency)	Resource-mediated coupling	About √k loss of multiplexing
Deadline propagation / shared RPC layer	Timeout incoherence	Viral plumbing; a mandated shared runtime
Cells	Correlated global change	k× loss of multiplexing; no cross-cell operations; a new router
Shuffle sharding	Tenant-to-tenant correlation	Requires retryable, stateless requests; no capacity isolation
Static stability	Control-plane dependency on the hot path	Staleness; pre-provisioned idle capacity

Case, resolvedConstructed case · Selin at Wayhop

An optional call took booking down

An optional recommendations call slowed to 10 seconds and took booking down, a config push and an expired certificate failed all 40 cities at once, and autoscaling after a zone loss failed. Where it started: Cascading failure →

Recommendations. The call was hard by accident. Selin gives it a 50 ms timeout and a default list as fallback, then runs a monthly test that turns recommendations off in production, to prove the fallback works. She gives each dependency its own thread pool (a bulkhead). With a 200-thread shared pool at 100 req/s the exhaustion time was P/λ = 2 seconds; now a slow recommendations service can exhaust only its own 20 threads.
Config push and certificate. Wayhop splits into cells (a group of cities each), pushes changes one cell at a time with a 30-minute canary and an automatic abort, and keeps the cell router tiny and static. Certificates get staggered expiry dates and an alert 30 days ahead. She also notes the honest arithmetic: cells will not reduce the expected downtime; they turn a 100% outage into a 5% one, and the benefit comes from the staged rollout.
Zone failure. The runbook changes from "autoscale in the surviving zones" to "run at 2× in three zones, so the loss of one zone needs no action" (static stability), and the data plane keeps using the last-known-good routing table when the control plane is down.