Retry load needs a budget

Immediate retries can extend caller waiting and worsen a persistent outage. Randomize backoff and consider shared retry accounting beyond per-call limits.

Book basis: B433, B933, B1033, B1233.

Failure it prevents

Bounded requests collectively flood a recovering dependency, or nested retries multiply attempts.

Our Effect 4.0.0 reading

Effect.retry and Schedule.exponential, Schedule.jittered, Schedule.recurs, and Schedule.upTo provide local policies. Shared budgets require an explicit owner and accounting scope34.

Source: packages/effect/src/Effect.ts, packages/effect/src/Schedule.ts.

How to check

Count attempts across the call path during a common outage. Check the declared total budget and caller deadline. This check is our proposal. The books do not prescribe it.

Continue with Circuit breakers have state10, Admission control protects recovery10.

Connect this to the existing rat-stack guidance23.

Use the durability skill for the full review. Return to the durability index34.

Sources

  1. Nygard, Michael T. Release It!: Design and Deploy Production-Ready Software. Pragmatic Bookshelf, 2007.. Pragmatic Bookshelf. §4.4 Unbounded Result Sets; Chapter 5 Stability Patterns: §5.1 Timeouts, §5.2 Circuit Breaker, §5.3 Bulkheads, §5.4 Steady State, §5.5 Fail Fast, §5.6 Handshaking, §5.7 Test Harness, §5.8 Decoupling Middleware. Accessed 2026-10-23.
  2. Sbarski, Peter; Cui, Yan; Nair, Ajay. Serverless Architectures on AWS, Second Edition.. Manning. Chapter 6, The New Search Microservice: Everything Fails, All the Time; Pay Attention to Retry Configurations. AWS-specific mechanisms are not universal runtime guarantees. Accessed 2026-10-23.
  3. Ousterhout, John. A Philosophy of Software Design. 2018.. John Ousterhout. §4.4 Deep Modules; §10.2 Too Many Exceptions; §10.3 Define Errors Out of Existence; §10.6 Mask Exceptions; §10.7 Exception Aggregation; §10.8 Just Crash?; §10.10 Taking It Too Far. Accessed 2026-10-23.
  4. Beyer, Betsy; Jones, Chris; Petoff, Jennifer; Murphy, Niall Richard, editors. Site Reliability Engineering: How Google Runs Production Systems. O’Reilly, 2016.. O’Reilly. Chapter 3 Embracing Risk; Chapter 22 Addressing Cascading Failures (Mike Ulrich); Chapter 26 General Principles of SRE as Applied to Data Integrity; Chapter 27 Reliable Product Launches at Scale. Section-only excerpts limit detailed attribution. Accessed 2026-10-23.
  5. Effect contributors. Effect 4.0.0. Effect.ts. Effect-TS. Pinned source for our Effect mapping, not a claim from the book. Accessed 2026-10-23.
  6. Effect contributors. Effect 4.0.0. Schedule.ts. Effect-TS. Pinned source for our Effect mapping, not a claim from the book. Accessed 2026-10-23.

Last changed 2026-10-23 in 58dc623. Source on GitHub. Change log.

Linked from

  1. Admission control protects recovery. Refuse or defer work that cannot be served usefully under current load.

    Continue with Retry load needs a budget, Backpressure reaches the producer.¶

  2. Agent guide. An Effect stack so pure (aspirational) Kit Langton will blush.

    Retry load needs a budget — One retry owner must control attempts, delay, and aggregate load.

  3. Change log. What changed in the files served here, newest first.

    Retry load needs a budget — new page: docs(lore): land the durability wiki pages and bibliography

  4. durability. Keep a rat-stack app standing when a provider, pool, or dependency slows down or a worker dies. Use at any I/O boundary, connection pool, provider call, shared waiter, fan-out, flag, gate, or work that can outlive a request, or when asked "what happens when this is slow", "add a timeout", "make this durable", or "what survives a crash".

    Retry needs idempotent effects and retry load needs a budget.¶

  5. Durability starts with a recovery record. A reading order for storage, replay, worker ownership, overload, and recovery tests.

    Retry load needs a budget: One retry owner must control attempts, delay, and aggregate load.¶

  6. Full agent guide. An Effect stack so pure (aspirational) Kit Langton will blush.
  7. HTTP success needs a status check and a decoder. Supply the client, check the response status, decode accepted data, and name failures at the adapter boundary.

    Measure the retry budget, the allowed attempts or time, and select the schedule.¶

  8. Rat Stack lore | rat-stack. Short, source-grounded notes on the ideas and decisions behind rat-stack.

    Retry load needs a budget — One retry owner must control attempts, delay, and aggregate load.

  9. Source change history (log.md). The generated change log as Markdown.

    Retry load needs a budget — new page: docs(lore): land the durability wiki pages and bibliography

  10. Timeouts bound waiting. A local timeout stops waiting; it does not prove the remote action never happened.

    Continue with Retry load needs a budget, Retry needs idempotent effects.¶