Nines You Never Own

Every request touches five components in series, each failing independently:

hop	availability
edge / TLS termination	99.99%
API service	99.95%
auth service	99.90%
feature-flag service	99.50%
primary database	99.95%

Compute the composed availability, then decide where a week of engineering time buys the most.

About $99.86%$ , the mean of the five hop availabilities, so the flag service is worth fixing mainly because it drags that mean down.

About $99.29%$ (roughly 62 hours a year). Taking the flag service off the critical path by serving cached flags and failing open lifts it to about $99.79%$ , more than any single upgrade elsewhere.

About $99.50%$ : a serial chain inherits the availability of its weakest member, so only the flag service matters and everything above it is already free.

About $99.29%$ . The largest win is a synchronous multi-AZ pair for the database, because it is the only stateful hop and the only one that can lose data.