Resilience: Circuit Breaker, Retry, Bulkhead

Outbox writes the event and the data in one transaction, sharding splits data by key across databases, retry only at the edge, and timeout every downstream call.

Fault tolerance comes from redundancy across independent failure domains plus a platform that automatically detects, replaces, and scales instances so losing some never means losing the service.

Backoff decides WHEN to retry; it never decides WHETHER to retry, WHO retries, or WHETHER the dependency can afford it -- and retries spend a finite capacity budget.

A circuit breaker trips open after too many failures so calls fail fast, Resilience4j runs it as a CLOSED-OPEN-HALF_OPEN state machine, Retry just re-attempts, and by default Retry wraps CircuitBreaker so it wastefully retries the open circuit's CallNotPermittedException.

A fallback runs exactly when the system is already in trouble, so an untested fallback often converts a small failure into a total outage.

Depend on a provider interface, not a vendor SDK, and always ask whether a failure is permanent or temporary before retrying.

Fault isolation means building firewalls into the system so a failure stays contained instead of taking everything down with it.