Reliability and incident recovery

Choose failure behavior before the dependency slows down

A dependency that normally takes 200 ms begins taking two seconds. Slots stay occupied, queues grow, and retries add more attempts. Even after the dependency recovers, the service needs spare capacity to catch up.

Separate successful user work from attempts, calculate the error allowance, and bound admission and waiting. The local arithmetic and incident exercises supply reproducible inputs. Follow recovery until useful work is current again, not merely until one alert clears.