Host blast radius (per-customer impact)
When a server dies, it does not take down one customer — it takes down every customer with workload on it, all at the same instant. A single host can be carrying a dozen tenants' VMs, and a host failure hits all of them together. That shared fate is the host's "blast radius."
The post-mortem timeline tags each affected customer and the host they were on, so after a failure you can read off precisely who got hit and how badly. That visibility is what turns a vague "something broke" into an actionable list — and it is the argument for spreading workloads so no single box carries too many tenants.
Detailed explanation
On HostFailed, the engine walks vm_allocations + k8s_allocations + the running queue and emits a CustomerHostDown per affected customer, carrying the in-flight requests that failed. The renderer uses this for blast-radius visualization and the typed-event log keeps it for replay.
Three levers reduce blast radius. Spread workload across hosts (anti-affinity) so no single failure concentrates impact. Buy SREs to drop MTTR so the radius is short-lived. Sell multi-AZ to high-tier customers so a single host failure does not equal an SLA breach — their other replica absorbs it.