On 16 September 2026, Salesforce went down across six countries for about ten and a half hours. The public explanation is one sentence long, and it describes the most common cascading failure in backend systems: requests piling up behind one slow internal service until no workers were left. Here is why timeouts alone do not save you, what bulkheads cost, and why recovery took far longer than the failure.
Treating LLM calls as just another upstream dependency. How to use Spring AI to build a multi-provider gateway with retries, circuit breakers, prompt versioning, and observability — the same hygiene you'd put around any external API.
A circuit breaker is supposed to mean the downstream is dead. Sometimes the downstream is fine — and the breaker is the problem. Three failure modes I learned the hard way, and what to do about each.