Retry storm on a dependency that is already down
A bounded-looking retry has no budget across callers, so a single upstream outage multiplies into a self-inflicted load spike.
同一個缺陷，每一個視角
- 維運
Request volume to the failing dependency rises during the outage rather than falling.
- 架構
Each caller retries correctly in isolation. There is no shared budget, so correctness at each layer composes into failure.
判斷軌跡
- 狀態 · 開發者unresolved-by-design2026-08-02 08:40 → 至今信心 0.6
- 何事 · 維運load-amplification2026-08-01 15:20 → 至今信心 0.88
- 為何 · 架構retry-without-budget2026-08-01 15:40 → 至今信心 0.79
觀察記錄
- 2026-08-01 15:10已捕捉
Outage produced more traffic, not less.
- 2026-08-01 15:20已分流
Classified as load amplification.
- 2026-08-01 15:40調查中
Three retry sites found, no shared budget.
- 2026-08-02 08:40未解決
Left open deliberately — a local fix would relocate the problem.
可執行見證
尚無。這份案卷還沒有一個修正前失敗、修正後通過的測試，所以它不是已驗證知識。
假設
- open
Adding jittered backoff at the client resolves it.
Suspected insufficient: it slows the storm without bounding total attempts.
證據
- metric · 2026-08-01 15:18
Upstream request rate rose 6.2x during a 90-second dependency outage.
- observation · 2026-08-01 15:38
Three independent call sites each retry three times; none is aware of the others.
關聯
- co_occurs_withBC-0001