The problem
When a downstream slows down, callers wait and retry without end; thread pools fill up and the failure climbs the call chain until the whole site avalanches.
Three breaker states
| State | Behaviour |
|---|---|
| Closed | Normal pass, count failure rate |
| Open | Fail fast, stop hitting downstream |
| Half-open | Let a few requests probe recovery |
Above a failure threshold it opens; after a cool-down it goes half-open to test; success returns to closed, failure stays open.
What degradation is
Instead of blocking, serve a fallback: a default list for recommendations, cached data for a minor API, comments temporarily off. Keep the main flow alive and sacrifice the extras.
Two reminders
- Cap timeouts: breaking needs a sane timeout per call, or you hang in pre-open waiting forever;
- Fallbacks must be correct: degraded data should not mislead users or trigger a second error.