Designing for Failure Domains, Not Uptime Targets

"Five nines" is a marketing number until you define what fails, how far the failure spreads, and who feels it. Failure domains not aggregate uptime are the correct unit of resilience design.

We design every distributed system around explicit blast radius: what happens when this service degrades, and is that failure contained or does it cascade? The answer determines the entire topology.

The systems that survive a decade are not the ones that never fail. They are the ones engineered so failure stays small, visible, and recoverable.