ENGINEERING NOTE 18 / 50 · SMS
Use circuit breakers without multiplying SMS purchases
A circuit breaker should stop new risky calls while preserving the ability to reconcile existing orders. It must not turn every timeout into a fresh purchase elsewhere.
Published by OPEN RAMBO. The engineering patterns and pseudocode illustrate designs, not a documented product API. Numerical examples are illustrative.
Count relevant failures
Separate network timeouts and upstream unavailability from user input errors. A stream of invalid service selections should not mark a healthy upstream as down. Track failures per operation because catalogue reads and financial writes have different consequences.
Preserve uncertain outcomes
An allocation timeout may mean the upstream created an order but the response was lost. Put that attempt into reconciliation. Opening the circuit should prevent more purchases, not release a reservation before checking whether a number was already allocated.
Probe with low-impact reads
Use a documented read-only health or catalogue operation for a recovery probe when available. Do not buy numbers merely to test whether a circuit can close. Reopen gradually and monitor actual mature-order outcomes after recovery.
Illustrative implementation
if circuit.open:
reject_new_allocations()
allow_existing_order_reconciliation()
# Unknown outcomes are never retried as new purchases.Acceptance check
Test timeout after upstream creation. The next action must query that attempt, not allocate a replacement automatically.