Pattern · seen in 1 breakdown across 1 company

Throttled Readmission

resilience

Definition

After an extended outage, reintroduce load in small, controlled increments rather than reopening the gates — admitting a percentage of users or traffic at a time (via DNS steering, load-balancer weights, or feature gates), verifying key health signals at each step, and holding or backing off if they degrade. A system recovering from a full stop is not the system that ran yesterday: caches are cold, autoscaling history is gone, and dependencies are freshly restarted, so the load it handled routinely can now push it straight back into collapse.

The pattern treats recovery as its own operating regime with its own capacity curve, and converts the question 'is it safe to reopen?' — unanswerable in one step — into a sequence of small questions the system answers with live evidence.

When it applies

01Returning to service after a full or near-full outage, especially with cold caches or freshly bootstrapped dependencies
02Any system whose steady-state capacity depends on warmed state (caches, JITs, connection pools, autoscaler history) that an outage destroys
03Recovery of systems where a relapse would be costlier than a slower reopening — reputationally or operationally

Tradeoffs

Extends visible downtime for the users still held out — the safety margin is paid in customer-minutes and communication burden
Requires an admission mechanism (DNS steering, weighted routing) that itself must work while the system is fragile
Percentage gates admit randomly, not fairly — determined users may game the mechanism, and priority classes need explicit design

The same move, 1 ways

Every row is a production system that bet on this pattern — the note says how, in that system's own terms.

Roblox
Roblox Blog
2022
The final twelve hours are this pattern in pure form: with the caches cold and confidence only partial, DNS steering let players back in about 10% at a time, checking database load, cache performance, and stability at each step. The slow ramp was the whole point, because a sudden flood of full traffic could have pushed the barely-healed system straight back into failure. Read the breakdown →

Problems this pattern answers

The walls where its breakdowns live — each opens the cross-company comparison.

Observer shares fate with observedROBLOX →