Circuit Breakers
Per-channel breakers so a failing marketplace skips new work until a probe succeeds.
Why breakers exist
Without a breaker, a down Amazon app would retry until it saturated workers and delayed every other channel. eListSync opens the breaker for **that destination** so Shopify, TikTok Shop, Woo, Medusa, eBay, and Walmart keep publishing.
This is not a global “pause sync” switch. It is per-channel isolation.
States
- **Closed** — normal. Failures count toward an error budget.
- **Open** — new publish jobs for this channel are skipped (or short-circuit failed) until the cooldown ends.
- **Half-open** — a probe job is allowed. Success closes the breaker; failure opens it again.
Cooldown is on the order of tens of seconds (60s is the documented default in the rate-limit docs), not hours. If Amazon is still 500ing, the breaker re-opens.
What opens a breaker
Sustained error ratio: 401 storms, 5xx, timeouts, and repeated mapper crashes. A single 404 on one SKU should not open the breaker for the whole shop — SKU-level failures belong in channel_sync_logs.
429s usually hit **backoff** first; a breaker opens when the channel is not recovering.
What operators see
Destinations Hub banners for degraded channels. Sync logs for skipped jobs. Admin analytics for open breakers across the fleet.
Recovery
Fix the cause (re-OAuth, pay the Amazon developer bill, bring Medusa /health back), then wait for half-open or trigger a probe from Admin if your deployment exposes that action. Do not disable breakers in production to “make it publish.”