Separate urgent customer work from deferrable accessibility work
Alt text matters, but a batch of 3,600 media jobs does not need to start in the same minute that checkout and search peak. Put media generation in its own queue and label it background. Customer-facing assistant requests need a separate concurrency and token reservation so the queue cannot consume every available slot.
Inventory every path sharing the provider account: checkout help, search, staff tools, image analysis, and retries. If they cannot be distinguished in logs, add a source or context field before launch. A single account-level graph cannot enforce a business priority.
Turn the four-hour goal into a paced budget
The base batch is 3,600 images × 1,200 tokens, or 4.32 million tokens before retries. Over four hours that is 900 images and 1.08 million tokens per hour. Apply an observed retry multiplier and provider limits, then reduce the background pace by the capacity reserved for customers.
Do not confuse the deadline with a requirement for constant maximum throughput. Use short dispatch intervals and recalculate from remaining jobs, queue age, current customer load, and recent failures. A pause should delay the batch without losing job identity or creating duplicates.
| Board field | Launch value | Pause or reduce when | Owner |
|---|---|---|---|
| Customer capacity reserve | enter requests/tokens per minute | reserve is consumed | commerce lead |
| Background dispatch | 225 images per 15 min before adjustment | checkout p95 breaches target | queue operator |
| Queue age | under 4-hour objective | age rises despite full dispatch | incident lead |
| Retry ratio | measured baseline | exceeds agreed band | integration owner |
| Temporary rule expiry | launch end plus review | never automatic renewal | approver |
Use checkout health as the throttle input
Every five minutes, review checkout p95 latency, customer AI completion, payment failures, provider headroom, queue age, and retry rate. Reduce or pause background dispatch when customer indicators breach their thresholds; do not wait for the monthly budget wall.
Avoid using page views alone as demand. A live campaign can have high browsing with few AI-assisted checkouts, while a lower-volume period can produce expensive long answers. Reserve the actual constrained unit—requests, tokens, concurrency, or a combination supported by the integration.
Make retries safe before increasing workers
Give each image a stable job ID and record content hash, attempt count, provider request ID, outcome, and committed alt text. On timeout, reconcile the prior attempt before resubmitting. More workers applied to an idempotency defect simply multiply cost faster.
Send permanently failing images to a review queue after a bounded number of attempts. One corrupt file must not occupy the launch queue indefinitely. Store the reason and allow a human to retry after correction without resetting the whole batch.
Expire launch mode even when work remains
At the published expiry, return background limits to the normal schedule even if some jobs remain. Report completed, deferred, failed, retried, and duplicate-prevented counts, along with actual tokens and customer performance. Extend the window only with a new approval based on remaining exposure.
Judge launch success across customers, jobs, and controls
The launch passes when checkout stayed within its service target, every image has one durable job state, the queue can resume without duplication, and the temporary rule expired. Use the Pro page to assess supported controls only after the capacity board identifies the limit the site genuinely needs.
Use the customer-capacity reservation board from “Launch-day alt text generation without turning the media library into a queue storm” on a real first installation. Download AI Cost Circuit Breaker for free, begin in Monitoring, and move to enforcement only after the expected signals and rollback are verified.