Problem · seen at 1 company
Mitigation scoped narrower than the failure
Every safeguard worked perfectly inside its own box, while the failure slipped through the gaps between them.
The wall
A failure propagates through interactions across components, but each defense measures and acts only within one component, so every mechanism can behave correctly while the failure spreads between them — and the containing move lies outside any single defense's reach. Boundary against retry-amplified overload: retry amplification is one specific transmission mechanism whose fix (budgets, jitter, backoff) is local to the retrying client; this class is about the scope mismatch between defense and failure, whatever the transmission mechanism.
Same wall, 1 system
DoorDash
DoorDash Engineering Blog
Failures spread through service interactions; every defense could see and act on one service. Read the breakdown →