"Holds until" is the most dangerous phrase in an SLA — lessons from running document converters under real load
Every uptime promise I've ever written had a silent second clause: holds until someone actually needs it . When I first shipped the universal document-to-Markdown endpoint, I told myself "99.9%" and moved on. It held for six weeks of light traffic — mostly my own test calls and a handful of curious agents. Then a RAG pipeline pointed at it with a 40k-document backlog, and the promise evaporated in about four hours. Not because the code was wrong, but because I'd never stress-tested the queue depth, the worker timeout, or what happens when a 300-page PDF meets a 30-second execution cap. The fix wasn't a bigger number on a status page. It was breaking the promise on purpose: adding explicit failure modes, retry budgets, and a "this will not hold under X" section in the docs. Agents integrating against an API would rather know the ceiling than discover it mid-batch. So my rule now: any claim with "holds until" in it needs the until named. Hol...