2020: When a platform becomes infrastructure

This final case uses 2020 as a thematic point in an ongoing history, not as the date when platforms first became important infrastructure. A service becomes difficult to avoid when many organizations depend on its identities, interfaces, data, distribution, or communication paths. The engineering question then expands: who may change the contract, how failures propagate, and whether users can move without losing essential capabilities.

Start with a dependency graph. A small business might rely on one platform for customer discovery, login, payment, and messaging. Four product names do not establish four independent services if one account suspension disables them all. Conversely, a system can have one public interface while several independently operated implementations provide resilience. Count authority and failure domains, not logos.

Consider a fictional firm receiving 100 daily orders, with 80 discovered through one marketplace. If the marketplace is unavailable for a day and no customers reroute, the firm loses access to 80 expected orders. Exporting a customer list may help future recovery, but it does not instantly reproduce search ranking, buyer trust, payment authorization, or consent to contact. Data portability and effective substitutability are distinct properties.

Interoperability can lower exit costs when another provider can implement the same contract. It also introduces hard questions: versioning, authentication, abuse prevention, privacy, and liability for incorrect messages. A poorly specified interface can spread failures; an excessively restrictive interface can preserve dependence. The design problem is to define safe, testable participation rather than assuming either maximum openness or maximum control is automatically sufficient.

The Microsoft findings of fact provide a dated primary record of a particular platform conflict. They should be read as findings about that case, not as a timeless legal rule for every technology business. The W3C Process Document supplies a different institutional artifact: explicit procedures for technical development and decision-making. Comparing them reveals how control over defaults and implementation differs from authority negotiated through a standards process.

Governance should be tested through cases. A user is excluded by mistake. An interface changes without enough migration time. A security incident requires an emergency restriction. A dominant participant proposes an extension that competitors cannot implement. For each case, identify notice, evidence, decision-maker, appeal, time limit, and recovery path. A written appeal process without an actor able to reverse a decision is not meaningful recourse.

A counterfactual design must state sacrifices. Requiring portable formats can impose implementation cost. Independent implementations can create inconsistent behavior. Faster emergency action can reduce prior review. Strong privacy restrictions can limit convenient data transfer. Evaluate the alternative against named outcomes and failure assumptions rather than treating reform as costless.

The capstone is a technical and institutional specification: map dependencies, state invariants, calculate a failure impact, define an exit path, and propose a governance change with measurable consequences. History supplies evidence about possible arrangements. The learner's job is to explain a concrete mechanism and identify what new evidence would overturn the recommendation.

Reconstruction exercise

A firm receives 100 daily orders,80 through one platform. Estimate the immediate order exposure to a one-day outage under the stated no-rerouting assumption. Design an exit drill that tests more than exporting data, and propose an appeal process for an incorrect account suspension. State one cost of your design and one measurable observation that would falsify the claim that it improves resilience.

Worked solution

The immediate exposure is 80 expected orders, not a guaranteed loss because actual demand can vary and the estimate assumes no rerouting. An exit drill should restore catalog meaning, identities or lawful reauthentication, payment workflow, customer communication, and order reconciliation on an alternative path, then complete a test transaction. An appeal process needs notice of the affected rule, a way to submit evidence, an accountable reviewer, a response deadline, and authority to restore access. Maintaining the alternative incurs engineering and operational cost. If drills repeatedly fail to restore transactions within the promised recovery time, or both paths share the same unavailable identity provider, the resilience claim is not supported. The design must be revised against those observations.

Test the limits and transfer the idea

1. Conditional probability · allow 25 minutes

Four services can have one account-level point of failure

A fictional business uses four services controlled by one account. During a period, account suspension occurs with probability 0.01 and disables all four. If the account remains active, each service independently fails with probability 0.005. Compute the probability that all four are unavailable and the probability that at least one is unavailable. Explain why multiplying four unconditional marginal failure rates misrepresents the first quantity.

Get a starting hint

Partition the calculation by the account-level event before using conditional independence.

Compare your reasoning with the worked solution

All four are unavailable with probability 0.01+0.99×0.005⁴=0.01000000061875, essentially 1%. At least one is unavailable with probability 0.01+0.99×(1−0.995⁴)≈0.0296519944, or 2.9652%. Each marginal is 0.01+0.99×0.005=0.01495, but raising that to the fourth power assumes independence and hides the common account event. The calculation is a constructed risk model, not measured platform behavior. The Microsoft findings are a primary judicial record concerning a particular case, while W3C's process is a primary governance instrument. Neither provides these probabilities. Operational analysis needs actual authority boundaries, incident evidence and recovery tests, not merely a list of four product names.

Check your reasoning

• Includes the account event in both calculations.
• Uses conditional independence only when the account works.
• Distinguishes hypothetical risk inputs from case and governance documents.

2. Recovery-capacity calculation · allow 30 minutes

An export is only the first stage of an exit drill

A fictional shop accumulates 480 unprocessed orders during a six-hour platform outage. Once an alternative is ready, new orders arrive at 80/hour and the alternative processes 120/hour. Compute backlog-drain time and the elapsed time from outage start until catch-up. Then compare an alternative processing only 80/hour. Specify three acceptance observations that test the migration beyond counting exported rows.

Get a starting hint

Subtract ongoing arrivals from recovery throughput; the queue is not drained at the full processing rate.

Compare your reasoning with the worked solution

Spare capacity is 120−80=40 orders/hour, so draining 480 takes twelve hours. Catch-up occurs eighteen hours after the outage began, assuming the six-hour interval includes preparing the alternative. At capacity 80/hour, the alternative only matches new demand and the backlog never shrinks under the model. Acceptance should reconcile order identities and payment/shipment state without duplicates, execute representative customer login and purchase journeys with authorized identity migration, and measure sustained throughput plus error recovery under ongoing load. An exported list cannot recreate ranking, trust, payment authority or consent. The drill may show that a portable format exists but an essential service dependency remains. A successful result must demonstrate preserved obligations and an achievable recovery time, not only readable files.

Check your reasoning

• Uses spare capacity to find twelve-hour drain and eighteen-hour catch-up.
• Explains the non-draining case at matched capacity.
• Checks business-state integrity, authorized journeys and sustained operation.

Check your understanding

A firm exports all customer data but cannot reproduce login, payment, or discovery elsewhere. What has the export established?

• Data portability, without yet establishing effective service substitutability.
• Independent failure domains for every dependency.
• A complete tested exit path.
• No remaining platform power.

Explanation

Operational replacement includes identities, workflows, communication, and discovery beyond file possession.

Two backup services rely on the same identity provider, and that provider fails. Which resilience claim is undermined?

• That all outages last exactly one day.
• That the two service paths are independent recovery options for this failure.
• That identity can ever be shared safely.
• That either service stores any data.

Explanation

A common authority dependency can disable both paths despite separate service branding.

Sources and further reading

• United States v. Microsoft: Findings of Fact,1999: United States District Court, DOJ archive
• W3C Process Document,2025: World Wide Web Consortium