Fault isolation

Amex's cell boundary keeps a failing payment inside the cell that started it

Ben Cane's account of American Express's cell architecture shows that the state a second cell would need to take over a mid-flight transaction is exactly the cross-cell dependency the design bans, so isolation stands in for failover.