Graceful Degradation Lab (Interactive)
Knock out reviews, recommendations, and delivery estimates on a live product page and keep the Buy button green. A seven-service dependency board exercises the fallback hierarchy — stale cache, static defaults, feature omission — plus criticality-based load shedding when CPU spikes.
Graceful Degradation Board
Product page SKU-9942 renders from 7 services. Fail dependencies and watch the fallback hierarchy absorb them.
Fault injection (click to toggle outage)
CPU before shed
63%
CPU after shed
63%
UX quality
100/100
Revenue path
INTACT
Dependency board
Everything healthy. Amazon-style reality check: a real detail page calls 200+ services, so at any moment something is timing out — the hierarchy above is what keeps revenue at 100%.
Tier 0 (catalog, checkout) is never shed and never fails here by design — shedding the revenue path to save CPU is how outages become incidents.
How It Works Under the Hood
Amazon's product page fans out to hundreds of services, so the probability something is failing at peak is near one; graceful degradation is designing for that certainty. The fallback hierarchy walks down service criticality: stale-but-recent cache beats nothing, a static top-ten bestseller beats an empty shelf, silent omission beats a spinner, and read-only mode beats a white-screen 500. Under flash-sale CPU pressure the same classification drives load shedding: Tier 3 telemetry is dropped with 204s, Tier 2 features degrade, and Tier 0 checkout is never shed. Fallback paths rot unless chaos engineering exercises them continuously.
Core Architectural Principles
- Fault toggles route each dependency through stale cache, static default, generic text, or omitted states.
- CPU above the shed trigger drops Tier 3 telemetry first, then degrades Tier 2 to cheap cached paths.
- Turning off the fallback hierarchy converts one failing auxiliary service into a whole-page 500.
In high-traffic designs, walk fallbacks per dependency: reviews serve ten-minute-stale cache, recommendations fall back to precomputed popularity, chat silently disappears, checkout never degrades. Under load, name load shedding by criticality tier at the gateway. Close with chaos engineering — unexercised fallback code is the bug that turns a partial outage into a total one.
Degraded-but-available experiences preserve revenue and trust but require building and chaos-testing a second path per dependency.