# Workload and Capacity

## Start from the execution model

| Workload | Primary risks |
| --- | --- |
| synchronous request | end-to-end latency, fan-out, pool wait, overload rejection |
| asynchronous consumer | loss, duplication, backlog, throughput, recovery time |
| scheduled work | re-entry, multi-instance duplication, resource contention |
| batch | data size, pagination, memory peak, checkpoint, restart |
| stream | ordering, state growth, partition skew, replay |
| fan-out | amplification, partial failure, maximum concurrency |

Record trigger, steady and peak input, burst shape, item size, duration, downstream calls, and shared resources. Averages alone are insufficient.

## Label evidence

- `declared`: explicit user target;
- `observed`: production or trusted test evidence;
- `derived`: calculated from other evidence;
- `assumed`: reversible design assumption;
- `unknown`: missing and not safely inferred.

Also distinguish a design target, local benchmark, controlled load test, and production observation. Report conflicts rather than choosing the most precise-looking number.

If exact targets are missing, continue with representative steady, peak, burst, and degraded scenarios. Ask only when the answer changes loss, ordering, consistency, partitioning, storage, irreversible data choices, or material cost.

## Useful derivations

```text
in-flight work ~= throughput * processing time
downstream load ~= business throughput * calls per operation * fan-out * retry amplification
service capacity ~= instances * concurrency per instance / task duration
backlog growth = input rate - processing rate
drain time = backlog / (capacity - normal input rate)
```

Use tail or degraded latency, including queue, pool, serialization, and logging costs.

## Bound every growing resource

For threads, goroutines, tasks, connections, files, queues, batches, memory, retries, logs, CPU, disk, network, and downstream quota, define:

1. what drives growth;
2. the hard or soft limit;
3. the saturation signal;
4. reject, degrade, drop, queue, or backpressure behavior at the limit;
5. the recovery condition.

Check tenant, key, partition, task, and payload skew. Use quotas, isolation, fair scheduling, or separate pools when one actor can exhaust shared capacity.

Validate configuration units, ranges, and relationships. Define whether zero means disabled or unlimited. Record the effective configuration without secrets and fail clearly on invalid critical values.