Provider circuit

The Lifecycle

Transitions Explained

The breaker protects the selected provider account without changing routing. Unavailable outcomes can open it; expiry permits a recovery probe and its result closes the circuit or lengthens the wait. Staff reset provides an explicit operational override.

What Cannot Happen

Recovery probing begins only after an open wait, while closed admission has no probe.

Concurrency and Timing

Persistent circuit writes compare versions, but reads can use a five-second process cache. Opening counts are process-local, so distributed failures need not reach the threshold in one process. The complete distributed probe and threshold behavior remains a proof gap.