What failure dynamics forbids, and six questions for any design
What this mechanism forbids, in total
- Capacity cannot buy stability. Stability is a ratio, and capacity is a level. When the branching factor R is above 1, the system diverges from any starting point.
- Aggregate metrics cannot detect this class. Livelock hides in utilization, and gray failure in success rate.
- Independence cannot be assumed. It is a physical and organizational property that must be purchased, and the purchase always shows up as idle capacity, version diversity, partitioned resources or staged rollout.
- Local correctness cannot produce global invariants.
- Recovery is not the reverse of failure. The thresholds differ by the factor k.
- Restart is not a reset. It is a move to the worst reachable state.
The transferable diagnostic
Use these six questions in this order:
- Where is the loop? Name the gain and the delay.
- What is k, the degraded-mode amplification? It sets the vulnerable band C/k < λ < C, and you can measure it while the system is healthy.
- What is shared? That names the correlation and caps availability at the least available common component.
- Who observes health, and are they inside or outside the boundary they certify?
- What work is deferred, and does its cost rise with the balance?
- What does recovery cost, and is anything provisioned for it?
Where this mechanism sits
Basic queueing and scaling mathematics is normally used as a capacity-planning tool. This mechanism used the same mathematics (1/(1−ρ), the retrograde term of the Universal Scalability Law, tail at scale) as a failure mechanism. That is the real reframe of this whole mechanism. Faults that come from outside (a disk dies, a network link drops) are handled by mechanisms that mask the fault: replication, retries, error correction. The faults here come from inside the system's own response, and the right mechanisms refuse work instead of masking it. Caches, memory management and admission control all reappear here as sources of gain, not as optimizations. And data-quality checks turn out to be the failure detectors of the data plane, the most useful connection this mechanism produced.