Repair Circuit Breaker State Drift

Our Node/TypeScript worker uses one circuit breaker around a partner API, but each Kubernetes replica has independent state. The breaker opens after failures and waits 20 seconds, then half-open allows every waiting worker to probe at once. We also have an SDK retry inside the breaker and a queue retry outside it. After the partner recovers, the probe burst sometimes knocks it back down. Repair the repository locally with fake clocks and a scripted dependency. Preserve existing threshold values. Do not call production, change provider limits, or decide that breaker state must be globally shared.

Breaker drift found. Half-open permits too many probes, retry exists both inside and outside the breaker, and per-instance ownership is undocumented. The repair bounds half-open recovery, normalizes retry ownership, fences stale timers, preserves existing thresholds, and adds deterministic state tests. Production recovery capacity and shared-vs-local state policy remain unverified.