A flash sale hit us at 10x baseline RPS. Within four minutes, our Payment Service circuit breaker tripped to OPEN , error rate climbed to 92%, and p99 latency on the payment path went from 200ms to 14.2 seconds. Here's the part nobody tells you on the conference circuit: the circuit breaker didn't fail. It worked exactly as designed. The failure was everywhere else. This is a postmortem of what we saw, why Resilience4j's defaults weren't enough, and the four changes that made the next sale boring. The setup Standard Java microservices stack. Spring Cloud Gateway in front, JWT auth via Keycloak, Resilience4j wrapping every outbound call. Payment Service synchronously calls Stripe. Order Service synchronously calls Payment. PostgreSQL for orders, Redis for circuit breaker state, Kafka for the dead-letter queue. Six services. Five circuit breakers. One very stressed thread pool. What 10x RPS actually does Baseline was around 1,000 RPS. The flash sale pushed us to 10,243.…