Cells: capping the blast radius

Five nines permits ~5 minutes of total outage a year — but the arithmetic softens enormously if failures are partial: a 10-minute outage of one-tenth of the market charges roughly one minute against a whole-market budget. That reframing is cell architecture: stop building one exchange with redundant parts, and build N small, complete, mutually-oblivious exchanges plus a thin routing layer. The 1.11 symbol shards were already half of this idea — they partitioned the core. Cells finish the job: partition everything.

flowchart TB
    RT["Thin routing layer — symbol → cell map, static and cached at every gateway"]
    RT --> C1 & C2 & C3
    subgraph C1["CELL 1 — symbols A–F"]
        A1["Own gateways, sequencer, engines, journals, feeds — full Part 2 + 3.2 stack"]
    end
    subgraph C2["CELL 2 — symbols G–O"]
        A2["Identical stack — shares NOTHING with cell 1: no queue, no database, no config service"]
    end
    subgraph C3["CELL 3 — symbols P–Z"]
        A3["Identical stack — cells cannot infect each other"]
    end
    

What cells buy, beyond the arithmetic:

• Poison isolation. The 2.2 nightmare — an input that crashes primary and standby in deterministic lockstep — now kills one cell. Symbols A–F halt (1.6 semantics, per-symbol); G–Z never learn it happened.
• A deployment gradient. Cells are natural canary units: new build → smallest cell → soak → next (3.6 builds its entire rollout scheme on this).
• Honest capacity math. A cell is load-tested as a unit; growth means adding cells, and each cell's worst day is bounded by its own symbols' worst day (a GME2 mania stresses its cell, not the market — sharpening 1.11's answer).

What cells cost: the cross-cell account problem from 1.11, now permanent — per-cell sub-balances with an asynchronous treasury rebalancer is the accepted price. And an organizational discipline that's harder than the technology: every convenience that spans cells — a shared metrics database, a global config service, one authentication cache — silently rebuilds the whole-market failure domain you paid so much to dismantle. The five-nines version of 2.1's audit question is: "what do all cells share?" The correct answer is: the routing map, the building, and nothing else.