A service does not have to tip over when a dependency fails. Graceful degradation means answering with what you can still compute, missing exactly the piece that is broken, instead of returning nothing. The site stays useful even when a part of it is not. ...
A retry is another unit of work, not an automatic improvement in reliability. It can recover from a transient failure, but can also repeat an unsafe operation or add demand to an overloaded dependency. Decide whether the operation is eligible, how much total effort is allowed, and when that effort should happen before choosing a delay formula. ...
A circuit breaker decides whether a new call should reach a dependency that appears unhealthy. It can reject promptly instead of spending resources on another likely failure. It does not repair that dependency, cancel calls already running, or prove that rejected work would have failed. Its value depends on the failure signals and recovery policy it actually implements. ...
An error budget makes a reliability agreement usable during planning. Product and operations choose an objective, measure failures against it, and agree what changes when the allowance is exhausted. The number supports that agreement; it does not predict whether tomorrow’s deployment will cause an incident. Shipping a release creates risk, while observed bad events consume the measured budget. ...
A standby node only helps if you know how to switch to it and that the switch works. Failover is a decision, a procedure, and a rehearsal. Delegating it to a switch you have never thrown is how a graceful handoff becomes an outage. ...
A queue is a promise about delivery between a producer and a consumer. That promise can be “at least once” (never lose) or “at most once” (never duplicate), but never both for free. Choosing the guarantee is choosing which failure you can tolerate. ...
An idempotency key names an intended action, not a transmission attempt. When a service supports it, the client sends the same key when retrying that action after an uncertain result. Generating a new key for every retry tells the server something different: this is another action, which may legitimately produce another business effect. ...
Graceful shutdown is a transition in how a service accepts and finishes work. Receiving a signal is only the trigger. The useful guarantee is narrower than “nothing is lost”: stop admitting new business work, account for what was already accepted, allow bounded completion, and report honestly when that bound expires. ...