Five Seconds of Nothing

In a fault injection experiment you add 5 seconds of latency to calls from the checkout service to the recommendation service, which only decorates the confirmation page. Checkout p99 immediately climbs past 5 seconds, the request thread pool saturates, and checkout starts returning 503s. What has the experiment revealed?

The circuit breaker behaved as designed, opening and shedding checkout requests once the decorating dependency crossed its latency threshold

A non-critical dependency sits synchronously on the critical path with no timeout or isolation, so its slowness consumes checkout's threads

The recommendation service is under-provisioned and needs more instances to bring its latency back inside the budget checkout assumes for it

The checkout thread pool is sized too small for this traffic level and should be enlarged so it absorbs slow downstream calls without saturating