01 / RESILIENCE
breaker
The Google SRE client-side throttling breaker over moonward's: it reads the last ten seconds of outcomes and sheds a computed fraction of calls rather than opening, and the breaker middleware answers 503 for a shed one.
WHERE IT SITS
INTERFACE
struct BreakerstructGoogle SRE's client-side throttling breaker. The algorithm is moonward's Breaker; this binds it to a Clock and a source of draws, the shape breaker has, so a call site asks with no arguments. constants are moonward's preset sre.
fn Breaker::new( clock : @clock.Clock, rand? : () -> Double, buckets~ : Int32 = 40, bucket_ms~ : Int64 = 250L) -> BreakerfnA breaker over a buckets × bucket_ms window reading time from clock. rand supplies the shed roll as a draw from [0, 1); without it the breaker draws from a system-seeded generator.
fn Breaker::drop_ratio(self : Breaker) -> DoublefnThe fraction of new calls the breaker is shedding now, zero while healthy.
fn Breaker::allow(self : Breaker) -> Promise?fnAsk to make one call. Some promise means it may proceed and the caller settles the promise when it finishes; None means the throttle shed it.
struct PromisestructThe receipt for an admitted call.
fn Promise::accept(self : Promise) -> Unitfn
fn Promise::reject(self : Promise) -> Unitfn
suberror UnavailableitemRaised by Breaker::run for a call the throttle shed.
fn[T] Breaker::run(self : Breaker, req : () -> T raise) -> T raiseitemRun req under the breaker: a shed call raises Unavailable and req never runs; a raise from req counts as a failure.
fn breaker( b : @breaker.Breaker, refusal~ : Refusal = unavailable) -> MiddlewarefnCircuit-breaker middleware: gate each HTTP request through a shared Breaker. An admitted request's outbound HttpResponseStart status is observed — a 5xx settles its promise as a failure, anything else as a success, and that is what feeds the window. A shed request is answered 503 Service Unavailable without the wrapped app running. Non-HTTP scopes pass through untouched. The promise starts out a failure and only the observed status makes it a success, on a defer — the same shape doReq uses, so a handler that raises or is cancelled before answering counts against the window instead of quietly not counting at all.