Replica counts rise fastest in organisations that never agreed how long a request may live. Without a shared deadline, every layer retries, and retries multiply load precisely when systems are weakest.
Start with a client-visible budget, then carve it downward through gateways and downstream calls with idle and response timeouts that leave headroom for the outermost layer. Document the budget in the same place you document retry policy.
Often the cheapest “scale-up” is retiring unbounded waits. Machines free up when work is allowed to fail fast and clients stop holding sockets open for ghosts.
