As a Software Engineer at Chemours, you drive the technological infrastructure that supports critical chemical manufacturing, safety compliance, supply chain operations, and advanced artificial intelligence initiatives. This role bridges the gap between modern software development and complex industrial environments, creating solutions that optimize plant performance, enhance reliability, and scale digital capabilities globally. Your work directly impacts how engineering teams process data, monitor plant controls, and deploy full-stack applications across various enterprise environments. The position sits at the intersection of traditional engineering excellence and cutting-reminiscent software innovation, contributing to specialized domains such as Senior Full-Stack AI Development, process and controls automation, and operational data pipelines. You will collaborate closely with chemical, electrical, and reliability engineers to translate industrial challenges into robust, scalable software products. Whether you are building internal platforms or modernizing legacy infrastructure, your code directly influences enterprise efficiency and safety standards. Expect a collaborative yet rigorous environment where technical aptitude must be paired with a deep appreciation for safety and operational integrity.
Phone Screening
reportedInitial phone screening to evaluate candidate's background and fit for the role.
What to demonstrate
- Initial phone screening to evaluate candidate's background and fit for the role
- Depth in MOC (Management of Change)
How to prepare
- Be able to walk your CV end to end in two minutes, and say why this company specifically.
- Have your salary expectations, notice period and location constraints ready, and ask for the rest of the loop in writing.
In-Depth Interviews
reportedOne or more interviews focusing on technical assessments and behavioral evaluations.
What to demonstrate
- One or more interviews focusing on technical assessments and behavioral evaluations
- Depth in MOC (Management of Change)
How to prepare
- Answer aloud and timed: Give an example of a time when you demonstrated leadership without having formal authority.
- Answer aloud and timed: How do you handle tight deadlines and competing priorities in a fast-paced development cycle?
PracHub editorial advice for the preparation topics above.
Master the STAR Method
Because behavioral questions carry significant weight in the interview loop, structure your past project examples using the Situation, Task, Action, Result framework to ensure clarity and impact.
Research Chemours Core Values
Familiarize yourself with the company's stated values around safety, ethics, and corporate responsibility, and weave these themes naturally into your interview responses.
Communicate Your Thought Process
During technical and system design discussions, never jump straight into code in silence; talk through your assumptions, trade-offs, and alternative approaches out loud.
Prepare Questions for Your Interviewers
Use the opportunity at the end of each interview to ask thoughtful questions about team culture, technical debt, deployment pipelines, and cross-functional collaboration.
Choose a category, try a prompt, then open its approach, worked solution or follow-up when you need it.
Find overlapping job attempts and peak concurrency from lease records
A day of job_run history yields about 50,000,000 attempt records: (job_run_id, job_type, attempt, started_at, finished_at which is NULL when the worker died, lease_expires_at). Leases expire on a clock, so a job that outran its lease ran twice. Produce (a) every job_run_id whose attempts overlapped in wall-clock time and (b) the peak number of simultaneously running attempts per job_type with the minute it occurred. Target O(n log n). State how you treat a NULL finished_at and what clock skew does to your answer.
Approach
- Define the interval before sorting anything: an attempt occupies [started_at, COALESCE(finished_at, lease_expires_at)). finished_at is observed and lease_expires_at is only a promise, so every attempt without a finish contributes an estimate and the whole result is a lower bound on overlap rather than an exact count.
- For peak concurrency, sweep: emit 2n endpoints, sort by (timestamp, kind) with ends ordered before starts at equal timestamps, then walk the sequence maintaining a counter per job_type and record each type's maximum with its timestamp. O(n log n) dominated by the sort, O(n) space, or O(1) extra if the sort is external and the walk streams.
- For overlap detection, do not compare attempts pairwise. A single global sort by (job_run_id, started_at) gives both the grouping and the order; within a group, keep the maximum end seen so far and report an overlap exactly when the next start is less than that running maximum, which is one linear pass after the sort.
- Half-open intervals matter and are easy to get wrong: with closed intervals an attempt ending at the same millisecond another begins reads as concurrency two, and across 50,000,000 records that artefact swamps the real signal.
Follow-up
- A handler is not idempotent and you have found 400 overlapping jobs. Which of them actually caused damage, and what would you query to find out?
- Peak concurrency for one job_type is 4 against a configured cap of 4. Is the cap working, or is the data hiding attempts that never started?
Collapse a redelivered event batch into per-aggregate high-water marks
You drain a batch of up to 5,000,000 events, each (aggregate_id BIGINT, aggregate_version INT, event_type, payload). The log guarantees order within one aggregate only; the batch merges 64 partitions, and a relay failover has redelivered a range, so an older version for an aggregate can appear after a newer one. Given a map of last_applied_version per aggregate, produce the events worth applying, at most one per (aggregate_id, version), plus the count discarded. Target O(n) time. State the memory for 2,000,000 distinct aggregates and what you do when it does not fit.
Approach
- One pass, one hash map from aggregate_id to the highest version kept, and a discard counter. An event whose version is at or below last_applied_version for its aggregate is dropped without further work, which is the whole reason the event carries its version rather than a delta. O(n) expected time, O(d) space in distinct aggregates.
- Keep the maximum, never the last occurrence. The redelivered range means the final appearance of an aggregate in the batch can be an older version than one seen earlier in the same batch, so last-wins applies stale state over newer state and the projection regresses with no error anywhere.
- Cost the memory instead of calling it large: an 8-byte key plus a 4-byte version is 12 bytes of payload, and an open-addressed table held at a 0.7 load factor costs roughly 17 bytes per entry before per-slot metadata, so 2,000,000 aggregates is tens of megabytes in a native layout and several times that in a runtime that boxes both key and value.
- If the distinct set exceeds memory, partition on hash(aggregate_id) mod P and reduce each partition independently. Every event for one aggregate hashes to the same partition, so the per-partition result is exact and the merge is concatenation rather than a second reduction.
Follow-up
- The payload is a patch rather than a snapshot, so applying only the highest version loses the intermediate changes. What changes in your reduction?
- How do you detect that version 7 arrived while version 6 was never delivered, and what should the consumer do about the gap?
Identify the heaviest tenants in a five-minute window under memory pressure
The edge service handles about 3,000 requests per second across roughly 50,000 tenants, peaking near 9,000. Expose the 50 heaviest tenants by request count over the trailing five minutes so limits can be tightened before one tenant's backfill starves the fleet. You may not retain five minutes of raw records. Give the exact solution and its memory, then the bounded-memory approximation with its error stated as a formula, and say which you would ship and at what tenant cardinality that choice changes.
Approach
- Do the exact version first, because it is affordable at this cardinality: a ring of 300 one-second counters per tenant, advanced lazily, is 1,200 bytes of counters per tenant and roughly 60 to 90 MB for 50,000 tenants with overhead. Carry a running total and subtract the bucket you overwrite so a window read is O(1) rather than 300 adds.
- Extract the top 50 with a size-k min-heap over the tenant sums: O(d log k) for d tenants, against O(d log d) to sort them all. Maintaining the heap continuously instead of on query requires a tenant-to-heap-index map, because incrementing a count already inside the heap means sifting from a known position, and without that map you rebuild the heap on every request.
- State the approximation precisely rather than gesturing at sketches. Misra-Gries with m counters retains every item whose true count exceeds N/(m+1), and each retained count underestimates the truth by at most N/(m+1). With m = 1,000 and N = 900,000 requests in the window the error is roughly 900 requests, which is fine for spotting a tenant sending 50,000 and useless for ranking two tenants 200 apart.
- Say what breaks when the window slides: Misra-Gries and Space-Saving are insert-only and cannot be decremented as records age out. The workable construction is one summary per sub-window, say ten seconds, with 30 summaries merged at query time, and the merged error is the sum of the per-summary errors, so the bound degrades linearly in the number of sub-windows.
Follow-up
- The heaviest tenant is heavy because of one export job rather than user traffic. Should the limiter treat those as the same tenant?
- Two tenants sit tied at the boundary of the top 50. Does your answer flap, and does the flapping matter?
Find version gaps and relay lag with window functions
outbox_event holds event_id, aggregate_type, aggregate_id, aggregate_version, event_type, payload, status ('pending','published','dead'), attempts, created_at, published_at. A projection is missing rows and you must decide whether the relay skipped events or the consumer dropped them. Write three queries over the last seven days: one listing every aggregate_id whose published aggregate_version sequence has a hole, one giving per-day counts with a running total, and one returning the newest published event per aggregate. For each, say where the window function is evaluated relative to WHERE and LIMIT. PostgreSQL 16.
Approach
- Gaps: compute lead(aggregate_version) OVER (PARTITION BY aggregate_id ORDER BY aggregate_version) in a subquery, then filter next_version <> aggregate_version + 1 in the outer query. Window functions are evaluated after WHERE, GROUP BY and HAVING and before the outer ORDER BY and LIMIT, so the predicate cannot sit in the same WHERE clause and PostgreSQL 16 has no QUALIFY.
- Say what the seven-day filter does to the answer: it truncates every partition, so the first row per aggregate has no predecessor inside the window and a hole spanning the boundary is invisible. Widen the window, or join to resource.version as the authority for the true maximum.
- Running total: SELECT date_trunc('day', created_at) AS d, count() AS n, sum(count()) OVER (ORDER BY date_trunc('day', created_at) ROWS UNBOUNDED PRECEDING). An aggregate inside a window call is legal because grouping runs before windowing. The grouping key is unique per row here so ROWS and RANGE agree, but write the frame anyway — over ungrouped rows with tied timestamps the default RANGE frame pulls in every peer row and the total jumps.
- Newest per aggregate: DISTINCT ON (aggregate_id) ... ORDER BY aggregate_id, aggregate_version DESC is the cheap PostgreSQL-only form when an index matches that order; row_number() OVER (PARTITION BY aggregate_id ORDER BY aggregate_version DESC) = 1 is the portable form and needs a subquery for the same evaluation-order reason as the gap query.
Follow-up
- Relay failover redelivers events. Does a duplicate break the gap query, and how would you detect one from this table alone?
- Turn the gap check into a continuous monitor rather than a query someone runs after an incident. What does it watch?
Hold a per-tenant active cap against concurrent creates
A tenant on the standard plan may hold at most 50 resources with status='active'. The create handler runs SELECT count(*) FROM resource WHERE tenant_id = $1 AND status = 'active', compares to 50, then inserts. Two creates arrive 3 ms apart on different instances and the tenant lands at 51. Name the anomaly, say whether PostgreSQL 16 READ COMMITTED or REPEATABLE READ prevents it and why, then give an implementation that holds the cap at READ COMMITTED with the exact statements. Finally, say what changes when the cap is 'at most one running export per tenant' on job_run.
Approach
- Name it: write skew. The two transactions read an overlapping set and write disjoint rows, so there is no row-level conflict for the engine to detect and each commit is individually legal.
- Rule out the levels precisely. READ COMMITTED takes a fresh snapshot per statement and takes no lock on the counted rows, so both see 49. PostgreSQL's REPEATABLE READ is snapshot isolation: it removes non-repeatable reads and phantoms within the snapshot but still admits write skew, because the anomaly is not a re-read of a changed row, it is a read of a set that a concurrent transaction invalidates. Only SERIALIZABLE closes it, by tracking the read dependency and aborting one transaction with SQLSTATE 40001 — a guarantee that exists only if the application re-runs the whole transaction from the read.
- Convert the set predicate into a single-row conflict: keep tenant.active_resource_count and run UPDATE tenant SET active_resource_count = active_resource_count + 1 WHERE tenant_id = $1 AND active_resource_count < 50 in the same transaction as the INSERT. Zero affected rows is the cap, returned as 409. The row lock serialises the decision at any isolation level, and contention is bounded to one tenant's row — which is also the fair-scheduling unit, unlike a global counter that would convoy every tenant behind one row.
- State the cost you just took on: a counter is a second source of truth that can drift, so every path that changes status must adjust it inside the same transaction, and a periodic reconciliation has to exist, with resource_revision as the authority for what the count should have been.
Follow-up
- A resource moves from archived back to active. Which statements change, and what breaks if the counter update and the status change land in different transactions?
- The cap becomes plan-dependent and a plan can change mid-month. Where does the number 50 live, and who reads it?
How do you ensure high availability, data integrity, and security when building enterprise software solutions?
How do you ensure high availability, data integrity, and security when building enterprise software solutions?
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
What experience do you have integrating software applications with hardware, manufacturing controls, or extern
What experience do you have integrating software applications with hardware, manufacturing controls, or external data streams?
Approach
- Say who the caller is and what they do when the call fails halfway.
- Define the identity of a request so a retry cannot double-apply it.
- Separate accepted, pending, failed and confirmed; they are different facts.
- Design the error taxonomy before the success shape; callers branch on it.
Follow-up
- What happens if the caller retries after a timeout?
- How does a client discover it is on an old version of this contract?
How do you design APIs that are maintainable, well-documented, and easy for other engineering teams to consume
How do you design APIs that are maintainable, well-documented, and easy for other engineering teams to consume?
Approach
- Fix the scope first: who calls this, how often, and what they do when it fails.
- Name the read and write paths separately; they rarely have the same bottleneck.
- Choose a partition key and say what query it makes expensive.
- State the consistency you need, and where you are willing to be stale.
Follow-up
- What breaks first when traffic grows ten times?
- How does this behave when that dependency is down for an hour?
Suppose a critical production service goes down unexpectedly at midnight. Walk me through your step-by-step in
Suppose a critical production service goes down unexpectedly at midnight. Walk me through your step-by-step incident response plan.
Approach
- Clarify what is being asked and what a complete answer contains.
- State your assumptions explicitly before working the problem.
- Say what you would check first and why it is the highest-information step.
- Work from the requirement backwards to the design.
Follow-up
- What assumption would you test first?
- How would you know your answer was wrong?
If you inherit a legacy codebase with little documentation and numerous technical debts, how do you prioritize
If you inherit a legacy codebase with little documentation and numerous technical debts, how do you prioritize refactoring versus delivering new features?
Approach
- Clarify what is being asked and what a complete answer contains.
- State your assumptions explicitly before working the problem.
- Say what you would check first and why it is the highest-information step.
- Work from the requirement backwards to the design.
Follow-up
- What assumption would you test first?
- How would you know your answer was wrong?
How do you approach writing automated tests for complex systems where edge cases are difficult to reproduce?
How do you approach writing automated tests for complex systems where edge cases are difficult to reproduce?
Approach
- Clarify what is being asked and what a complete answer contains.
- State your assumptions explicitly before working the problem.
- Say what you would check first and why it is the highest-information step.
- Work from the requirement backwards to the design.
Follow-up
- What assumption would you test first?
- How would you know your answer was wrong?
Imagine a stakeholder requests a feature change late in the development cycle. How do you evaluate the trade-o
Imagine a stakeholder requests a feature change late in the development cycle. How do you evaluate the trade-offs and communicate with the business?
Approach
- Clarify what is being asked and what a complete answer contains.
- State your assumptions explicitly before working the problem.
- Say what you would check first and why it is the highest-information step.
- Work from the requirement backwards to the design.
Follow-up
- What assumption would you test first?
- How would you know your answer was wrong?
Explain how you approach debugging a complex performance bottleneck in a production environment.
Explain how you approach debugging a complex performance bottleneck in a production environment.
Approach
- Establish what changed and when, before forming any theory.
- Pick a bisection that eliminates candidates whichever way it turns out.
- Check the instrumentation before believing the symptom.
- Separate the trigger from the cause; the deploy is rarely the bug.
Follow-up
- What would you look at first, and what would it rule out?
- How would you tell a cause from a coincidence here?
How would you design a data monitoring pipeline for a remote manufacturing plant with intermittent connectivit
How would you design a data monitoring pipeline for a remote manufacturing plant with intermittent connectivity?
Approach
- Establish what changed and when, before forming any theory.
- Pick a bisection that eliminates candidates whichever way it turns out.
- Check the instrumentation before believing the symptom.
- Separate the trigger from the cause; the deploy is rarely the bug.
Follow-up
- What would you look at first, and what would it rule out?
- How would you tell a cause from a coincidence here?
Built from the rounds and topics Chemours candidates report.
Prepare, practise & reflect
One practical outcome each day. Spend longer where you need it.
0 / 7 done01Map the Chemours loop
- Write out the reported sequence: Phone Screening, In-Depth Interviews.
- For each round, write one sentence on what it is judging, from the description above, and mark the one you are least ready for.
Deliverable: A one-page map of the 2 reported rounds, with the weakest marked.
02Work MOC (Management of Change)
- Spend the session on MOC (Management of Change), which Chemours candidates report being tested on.
- Write one worked example in MOC (Management of Change) and time yourself on it.
Deliverable: One timed worked example in MOC (Management of Change).
03Work Behavioral Interviewing (STAR method)
- Spend the session on Behavioral Interviewing (STAR method), which Chemours candidates report being tested on.
- Write one worked example in Behavioral Interviewing (STAR method) and time yourself on it.
Deliverable: One timed worked example in Behavioral Interviewing (STAR method).
04Work SHE (Safety, Health & Environment) Knowledge
- Spend the session on SHE (Safety, Health & Environment) Knowledge, which Chemours candidates report being tested on.
- Write one worked example in SHE (Safety, Health & Environment) Knowledge and time yourself on it.
Deliverable: One timed worked example in SHE (Safety, Health & Environment) Knowledge.
05Answer out loud: Behavioral and Leadership
- Answer aloud, timed: Tell me about a time when you had to work with a cross-functional team to resolve a critical technical challenge.
- Answer aloud, timed: Describe a situation where you had to manage a disagreement with a stakeholder regarding project scope or technical direction.
Deliverable: Spoken answers to 2 reported Behavioral and Leadership question(s), under time.
06Answer out loud: Technical and Domain Expertise
- Answer aloud, timed: Walk me through your experience with full-stack development and how you approach designing scalable web applications.
- Answer aloud, timed: How do you ensure high availability, data integrity, and security when building enterprise software solutions?
Deliverable: Spoken answers to 2 reported Technical and Domain Expertise question(s), under time.
07Answer out loud: Problem-Solving and Situational Judgment
- Answer aloud, timed: How would you design a data monitoring pipeline for a remote manufacturing plant with intermittent connectivity?
- Answer aloud, timed: Suppose a critical production service goes down unexpectedly at midnight. Walk me through your step-by-step incident response plan.
Deliverable: Spoken answers to 2 reported Problem-Solving and Situational Judgment question(s), under time.
Expand any day for tasks and deliverables. Your progress is saved on this device.
Behavioural rounds judge the decision you made and what it cost.
Tell me about a time when you had to work with a cross-functional team to resolve a critical technical challen
Tell me about a time when you had to work with a cross-functional team to resolve a critical technical challenge.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Describe a situation where you had to manage a disagreement with a stakeholder regarding project scope or tech
Describe a situation where you had to manage a disagreement with a stakeholder regarding project scope or technical direction.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Give an example of a time when you demonstrated leadership without having formal authority.
Give an example of a time when you demonstrated leadership without having formal authority.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
How do you handle tight deadlines and competing priorities in a fast-paced development cycle?
How do you handle tight deadlines and competing priorities in a fast-paced development cycle?
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Tell me about a time when a project failed or fell short of expectations, and what you learned from the experi
Tell me about a time when a project failed or fell short of expectations, and what you learned from the experience.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
Walk me through your experience with full-stack development and how you approach designing scalable web applic
Walk me through your experience with full-stack development and how you approach designing scalable web applications.
Approach
- Pick a story where you made the decision, not one where you watched it.
- State the situation in two sentences and spend the rest on the reasoning.
- Give the blast radius: what could have broken, and what you measured.
- Name the disagreement and how you resolved it with evidence.
Follow-up
- What would you do differently if you ran that again?
- How did you know your change caused the improvement?
- 01
Tell me about a time when you had to work with a cross-functional team to resolve a critical technical challenge.
- 02
Describe a situation where you had to manage a disagreement with a stakeholder regarding project scope or technical direction.
- 03
Give an example of a time when you demonstrated leadership without having formal authority.
- 04
How do you handle tight deadlines and competing priorities in a fast-paced development cycle?
How difficult is the interview process, and how much preparation time should I plan for?
The interview process is moderately rigorous, combining structured behavioral evaluations with technical screenings and panel discussions. Candidates typically benefit from spending two to four weeks reviewing core computer science concepts, system design principles, and preparing STAR-format behavioral stories.
Chemours Software Engineer candidate reports ↗What distinguishes successful candidates from those who do not pass?
Successful candidates distinguish themselves by demonstrating strong technical depth balanced with exceptional communication and humility. Interviewers favor engineers who listen carefully, collaborate constructively, and show a genuine interest in understanding how their software impacts broader business and industrial operations.
Chemours Software Engineer candidate reports ↗What is the culture like for engineering teams at Chemours?
Engineering teams operate in a collaborative, safety-conscious, and professional environment. There is a strong emphasis on cross-functional teamwork, continuous improvement, and respecting diverse perspectives while maintaining rigorous standards for operational reliability.
Chemours Software Engineer candidate reports ↗How long does the entire interview process take from initial application to offer?
The timeline can vary significantly depending on the hiring department and location, ranging from a few weeks to a couple of months. While some stages move quickly, candidates should be prepared for a deliberate process that includes multiple coordination rounds.
Chemours Software Engineer candidate reports ↗Are remote work or hybrid options available for Software Engineers?
Work arrangements depend heavily on the specific team and project requirements. While some specialized software and AI development roles offer flexibility or remote capabilities, positions tied closely to manufacturing sites may require regular on-site collaboration.
Chemours Software Engineer candidate reports ↗What topics does Chemours test in interviews?
Chemours interviews most often cover Problem Solving, Stakeholder Management, Cross-Functional Collaboration, Data Visualization, and Requirements Gathering. The exact emphasis depends on the specific role you apply for.
Chemours Software Engineer candidate reports ↗Sources & methodology 3 sources ↗
No official company page is cited. Rounds and questions come from candidate reports and PracHub editorial material; each source shows the date it was read.
- 01Chemours Software Engineer candidate reports ↗
Company-reported rounds, questions and FAQ.
Candidate reports · Accessed 2026-09-22 - 02PracHub Software Engineer practice ↗
PracHub practice material, not company-reported.
PracHub page · Accessed 2026-09-22 - 03PracHub preparation framework ↗
PracHub preparation guidance.
PracHub page · Accessed 2026-09-22
Explore related engineering environments and compare the preparation focus.
Vercel Software Engineer Interview Guide
Debugging practice for Vercel software engineer prep built on a reproduction you trust, narrowing to the smallest failing input, and changing one variable per run so the result stays attributable.
Spotify Software Engineer Interview Guide
Timed practice for Spotify software engineer candidates who lose time to the clock: short problems taken end to end, then reviewed against a written rubric rather than a passing test run.
Scale Ai Software Engineer Interview Guide
Data structures and algorithms practice for Scale Ai candidates, where stating a bound means stating its precondition: constant-time hash lookup is an average case over keys that spread.
Ramp Software Engineer Interview Guide
Systems practice for Ramp software engineer candidates, weighted toward payments and lending work: the load that actually arrives, the failure modes that matter there, and the invariants a partial outage must not break.