A finite work budget
100 work units every 100 ms. Handling an attempt costs 1 unit. Completing it costs 9 more. Maximum healthy capacity: 100 successes/second.
Handling comes first
All incoming handling spends the shared budget before useful processing. At 100 attempts in one interval, handling consumes everything.
Pre-handling drops are free
Attempts beyond that limit cost zero modeled service work. They count as traffic and become client timeouts. Network costs are excluded.
Empty is not recovered
Expired requests are lost outcomes. Full recovery requires every restoration-cohort request to succeed and a fully observed healthy fresh-traffic window.
Timing, fairness, and what “healthy” means
No server queue. One outstanding attempt per original. Every response or client timeout takes 100 ms. A success at the request deadline counts; other unfinished requests expire before another attempt can launch.
Originals and seeds are shared. Hash priorities depend on original identity and tick, not policy. Jitter keeps the same average wait as backoff. A healthy window contains 20 birth ticks; every expected original must succeed within 500 ms. The full 500 ms allowance is observed before declaring it healthy.
Traffic stops at its configured end; retries may continue. Observation ends at its explicit boundary. Pending work at that boundary is unfinished, not expired. After traffic ends, the last eligible health window remains the final evidence. An earlier healthy window does not guarantee later health.