RETRY STORMS — DEMOS

Retry stormsWhy does the service stay down after the spike that broke it has gone? A five-second traffic spike at 80% load. Without retries the service recovers; with them it never does, until a retry budget caps how much load retries can add. The demo needs JavaScript.The trigger leaves; the failure staysOnce the queue is full of requests whose clients have given up, every completion is wasted and every timeout sends more load. The spike can end and the service still serves nothing: a metastable failure.Retries multiply load exactly when there is none to spareAt 80% busy, one retry per timed-out request takes the offered load to 160%. Backoff and jitter spread retries out in time, but here they do not reduce how many there are, so the loop holds.Budget retries across the client, not per requestA retry budget caps retries as a share of all traffic, so retries help with scattered failures but cannot double the load in an outage. Server-side defences break the same loop from the other end.All demos