What overload defences forbid
Why does every defence cost work, optimality or fairness, and why is each one a new loop?
What this article forbids
- It forbids a defence that preserves full service. Every mechanism costs work, optimality or fairness.
- It forbids defence by capacity. Every pathology here is a ratio, and capacity is a level.
- It forbids purely local defence. The three most valuable mechanisms (deadlines, retry budgets, priority) are global invariants that need in-band carriage. This is the third confirmation of the global-invariant principle.
- It forbids leaving defences untested. Each is a rarely run path whose first real execution happens during an incident.
The defences as one table. The comparison is the point.
| Defence | Attacks | Time scale | Cost |
|---|---|---|---|
| Load shedding | Store (excess demand) | ms | Rejected users; needs classification |
| Concurrency limit | Store (L, hence W) | ms | Capacity must be known or adapted |
| Backpressure | Store (moved upstream) | ms to s | Needs a producer that can slow down and a complete chain |
| Retry budget | Gain | s | Shared state; some valid retries denied |
| Circuit breaker | Gain + caller resources | s | Binary; synchronized across clients |
| Jitter | Correlation | s | Added latency |
| Deadline propagation | Wasted work | per request | Viral; conjunctive correctness |
| Hedging | Tail (not overload) | per request | About 5% load; must disable under overload |
| Brownout | Cost per request | s to min | Pre-built degraded paths |
| Autoscaling | Capacity | min | Too slow to be a defence at all |
Keep the time-scale column in mind. Overload dynamics run in seconds. Anything in the "minutes" row is a cost mechanism wearing a defence's clothing.
Mitigations as new loops. Every defence is itself a control loop, so every defence has gain, delay and a failure mode:
- Shedding generates retries unless clients respect the signal.
- Breakers synchronize and starve a recovering callee.
- Health-check ejection reduces capacity and so causes more ejection.
- Hedging adds load in the conditions where it fires most.
- Autoscaling is briefly negative capacity.
- Backpressure plus a durable broker turns latency into retention debt.
The general rule: every defence must be analysed with the same tools as the pathology it treats. A system with many independently designed defences is a system with many interacting controllers, and usually nobody has checked their composition.
The discard principle, confirmed. Work is always discarded by someone. You can discard it at admission, cheaply and by policy. The client can discard it at timeout, expensively and at random. Or the failure can discard it. Shed early costs about 0. Shed at timeout costs the full service cost. Shed by collapse costs everything. The only choice is who decides and what it costs.