Failures inside the window that eject an instance.

Rolling window, in milliseconds, that failures are counted over.

How long an ejection lasts, in milliseconds.

Ceiling on the percentage of a service's instances ejected at once.

A correlated failure — a bad deploy, a shared dependency — makes every instance report failures at the same time, and ejecting all of them turns a partial outage into a total one. An ejection that would push past this cap simply does not happen.