Shuffle Sharding

Assign each customer (or tenant, or resource) a virtual shard: a random combination of k workers drawn from a fleet of n, instead of a fixed physical shard. A poisonous or flooding customer still takes down their own combination, but because any two combinations overlap in at most a bounded number of workers, other customers lose at most part of their shard — and fault-tolerant clients that retry around a degraded worker ride through unaffected. Scope of impact drops from the shard fraction (1/shards) to roughly 1/(n choose k), which improves exponentially as the fleet grows.

The pattern converts blast radius from an infrastructure boundary into a combinatorial invariant, at usually no additional resource cost — the fleet stays fully shared; only the assignment scheme changes. It requires an assignment-aware routing layer and clients whose retries can absorb a partially degraded shard.