Cells and stamps: limiting blast radius

A cell turns "every tenant is down" into "one cell's tenants are down".

Before you read: predict

A video platform hosts 120 publishers in 6 cells of 20. Each cell has its own API servers and database, and a router sends each publisher's requests to its own cell. A cell's database serves at most 130 requests a second; each publisher normally sends about 5. At 20:00 one publisher in cell 3 starts a live premiere that sends 20 times its usual requests for 10 minutes.

On this lesson's cell model, how many publishers' viewers get refused requests during the premiere?

The 30-second version

A cell is a complete copy of the workload, with its own servers and data, serving a fixed set of tenants behind a thin router. A fault inside a cell, a bad release, a poison request or one tenant's surge, reaches only that cell's tenants. The price: more copies to run, cross-cell reports and hard tenant moves.

A cell turns "every tenant is down" into "one cell's tenants are down".

How it works

Step 1 of 13

A cell is a complete, independent copy of the workload, servers and data, for a fixed set of tenants: residency step 12's stamp.

In the kitchen

each household has its own kitchen, lounge and staff team, and its own ten residents → a cell: a complete copy for a fixed set of tenants (steps 1–2)

Analogy: A care home run as six small households

Sixty residents live in six households of ten.

In the care home	In a system
each household has its own kitchen, lounge and staff team, and its own ten residents	a cell: a complete copy for a fixed set of tenants (steps 1–2)
a stomach bug closes one household's doors; the other five carry on	blast radius (step 3)
the reception list says which household each resident lives in, and visitors go there and nowhere else	the router and its table (steps 5–6)
moving a resident means moving her room, her records and her key worker	moving a tenant (step 11)

Breaks down when: residents visit each other's households for tea, while requests should almost never cross cells (step 2).

Contrasting case: one dining room and one staff team for all sixty residents: a bug in the food reaches the whole home.

In real terms: for each tenant, name its cell; for each component, say whether it sits inside a cell or serves them all.

Examples, run for real

4.1 ExamHall EXH-4960: ECON-201's start, before and after cells

ExamHall served 120 institutions from one stack, sized with a quarter of headroom over its normal load. At 09:00 ECON-201's start, at a smaller university, adds about 1,200 requests a second for 2 minutes. MR !5260 splits the platform into cells with the same headroom: the ministry in cell 1, the 114 smaller institutions in cells 2–5, and each of the five largest universities in a cell of its own.

4.1 before: one stack for 120 institutions · ECON-201's start adds about 1,200 requests a second for 2 minutes · institutions refused 120 of 120
4.1 MR !5260: 10 cells · institutions refused 29 of 120, all in cell 2 (29 institutions) · the ministry's cell 1 refused 0

ECON-201's university sits in cell 2, so its start now fills cell 2 alone: its 28 neighbours there are still refused, while the other 91 institutions, the ministry included, are not (steps 3, 6).

4.2 Moving a university out of a busy cell

Cell 2 runs close to its maximum, so one of its universities moves to cell 5. Writes keep arriving while its 1,200 records are copied.

4.2 copy once, then redirect: 1,200 records copied in 30 s · 174 writes made meanwhile stay in cell 2 · lost when cell 2's copy is forgotten 174
4.2 clone, flip, redirect, forget: 214 writes made meanwhile replayed · 8 held for the 1 s flip · lost 0 · 36 s

Copying once leaves behind what was written during the copy; cloning with those writes replayed, a one-second flip, then redirect and forget, loses none (step 11).

Try it

Answer first, then check. Nothing is saved.

Question 1 of 6

A ticketing platform serves 300 promoters, today from one stack. One promoter sends a tenth of all requests, about 300 a second of 3,000, and its biggest on-sale sends 8 times its usual load for 30 minutes. Each design below is sized at 1.5 times the normal load of the promoters it serves. The team needs: during that on-sale, no other promoter's request refused; any one database failing stops at most 60 promoters; at most 8 stacks to deploy and run.

On this lesson's cell model, which design meets all three?

Question 2 of 6

In a design round you put a payments platform's 60 merchants into 4 cells behind a router. The interviewer follows up: the control plane writes the merchant-to-cell table. It is down from 10:20 to 10:40, while object storage holding its last published copy stays up. One of the router's 3 instances is replaced at 10:30, as happens most hours. What does your router hold?

On this lesson's cell model, which answer survives, keeping every merchant's payments flowing from 10:00 to 11:00?

Question 3 of 6

A streaming platform runs 120 publishers in 6 cells of 20. Every playback start passes a licence check against the publisher's licence records. At 21:00 a publisher in cell 3 uploads a licence record with a malformed date, which crashes any licence check that loads it; it is found and deleted at 21:20. The team needs the bad record to stop playback for at most 20 publishers' viewers.

On this lesson's cell model, where should the licence check and its records live?

Question 4 of 6

A team-chat service runs 120 workspaces as two full copies, in eu-west-1 and eu-central-1, each serving every workspace's members from the nearer region, with every message copied to the other region within a second; the team calls them two cells. 12 workspaces have every member nearer eu-central-1; the other 108 have members near both. At 14:00 a member of one of those 108 posts a message whose formatting crashes any server that renders it; servers that crash retry it on their neighbours, and it is deleted at 14:20.

On this lesson's cell model, how many workspaces have members who lose chat before 14:20?

Question 5 of 6

An HR platform is moving 600 customers into cells. At peak they send 30,000 requests a second in all; the largest sends 4,000, and no customer is split across cells. A cell runs at up to 80% of the size it is load-tested at, and the test rig can drive at most 12,000 requests a second. The team needs every customer placed, any one cell's failure to take at most 15% of peak traffic, and every cell size testable on the rig.

On this lesson's cell model, which cell size meets all three?

Question 6 of 6

A streaming platform's cells are load-tested at 10,000 requests a second. One broadcaster has a cell to itself, and its peak has grown to about 13,000 a second across its four channels: about 4,000, 3,500, 3,000 and 2,500. In every channel, about 80% of the requests come from viewers in Europe and the rest from the Americas. The five shared cells each carry about 8,500 a second at that hour. The team needs: no cell running above the 10,000 it is tested at, no other publisher's request refused, and at most 1% of the broadcaster's requests refused.

On this lesson's cell model, which change meets all three?

Go deeper

Pro tips

If you adopt cells, run at least two from day one, and send a test tenant to each. When: a team plans "one cell now, more later" (steps 1, 12). With one cell, code and reports can assume "the" database without anyone noticing. Verify:
```
tip one cell: the report reads "the" database and counts 18,141 of 18,141 candidates · two cells: the same report counts 9,263; reading each cell and adding counts 18,141
```
Status: RAN.

Source

quote-check.mjs finds every passage below verbatim in its saved text. Every key is executed on the models; these passages are the design rationale the steps rest on. Valid as of 2026-10-17.

AWS Well-Architected, Reducing the Scope of Impact with Cell-Based Architecture (whitepaper; "Publication date: September 20, 2023"), the row's first source, read as its pages:
- What is a cell-based architecture? https://docs.aws.amazon.com/wellarchitected/latest/reducing-scope-of-impact-with-cell-based-architecture/what-is-a-cell-based-architecture.html (aws-cells-what-is.txt): "Each cell is independent, does not share state with other cells, and handles a subset of the overall workload requests." and "If a workload uses 10 cells to service 100 requests, when a failure occurs in one cell, 90% of the overall requests would be unaffected by the failure." Steps 1–3.
- A warning for all mapping approaches (aws-cells-mapping-warning.txt): "it's important to also use an override table to force specific keys to specific cells". Step 6.
- Why use a cell-based architecture? (aws-cells-why.txt): "Each cell, a complete independent instance of the service, has a fixed maximum size." Step 8.
- Cell sizing (aws-cells-sizing.txt): "Big enough to fit the largest workloads." and "Small enough to test at full scale". Step 9.
- Cell migration (aws-cells-migration.txt): "Clone the data from the current location into the new location, as a non-authoritative copy." Step 11.
- Cell deployment (aws-cells-deployment.txt): "deploy in waves, cell by cell or set of cells." Step 3.
- Best practices (aws-cells-best-practices.txt): "keep in mind from day 1 to have more than one cell." The tip. The abstract (aws-cells-abstract.txt), When to use, Cell placement, Know and respect your cell's limit, About resilience of the cell router, Cell observability and the FAQ are saved alongside and key nothing.
Azure Architecture Center, Deployment Stamps pattern, the row's second source: https://learn.microsoft.com/en-us/azure/architecture/patterns/deployment-stamp (azure-deployment-stamp.txt). Quoted: "A single geographic region might contain one stamp or multiple stamps that scale out horizontally within the region." and "Stamps run independently, but they aren't inherently redundant across regions." (step 13); "You might need to query each stamp and aggregate the results." and "which substantially increases the cost of operating your solution." (step 12); "When you use the Deployment Stamps pattern, deploy at least two stamps of your solution." (the tip).

Checked against the tools and docs as of 2026-10-17.

Predict first