29.9 What is graceful degradation?

Surviving the worst

At home: During a power cut, the inverter runs the lights and fans, not the AC and the geyser. Life goes on, a bit less comfortably.

In the system: When a part fails, keep the core working with less, instead of failing completely. Decide in advance what's essential:

• Recommendations down: show yesterday's cached picks, then a static bestseller list. In the chapter's code, the box falls back in exactly that order.
• Search slow: show cached results for popular queries, or a simpler search (Chapter 19).
• Reviews service down: hide the reviews section; the book page still sells the book.
• Payment gateway A failing: switch to gateway B, or offer other payment methods.
• Overloaded during a sale: turn off expensive extras (personalisation, "people also viewed"), serve more from cache, put a waiting room in front of checkout (Chapter 43).

Tools:

• Fallbacks in code next to each non-critical call, triggered by timeouts or open breakers.
• Feature flags (kill switches) to turn off expensive features instantly.
• Stale data over no data (stale-if-error, Chapter 26; stale cache entries, Chapter 13).
• Load shedding by priority: drop analytics before checkout.

Test the degraded modes. A fallback that has never run usually doesn't work when you need it.

Memory code: "When power is short, keep the lights on and the AC off."

---