# Circuit

> How the Gateway stops sending a failing Endpoint traffic, how it recovers, and where the protection ends.

Canonical page: https://rpc.aurpay.net/docs/failsafe/circuit

## Scope

A Circuit tracks one Endpoint and stops sending it traffic while it is failing. It is scoped per Endpoint, per Endpoint version, and per workload class: `debug_` and `trace_` family methods carry their own Circuit, so overloading them does not block ordinary traffic on the same Endpoint.

## Opening and recovery

A closed Circuit opens after consecutive hard failures — a connection failure, an interrupted response, or a timeout — or after a sustained error rate within a short rolling window, once that window holds enough samples.

While a Circuit is open the Route skips that Endpoint and moves to the next eligible candidate. The final Gateway codes and recovery actions are listed in [Errors and recovery](https://rpc.aurpay.net/docs/errors.md).

After a cooldown the Circuit half-opens and admits one probe request. Consecutive successes close it. A failure reopens it with a longer cooldown that grows exponentially up to a ceiling.

## Upstream throttling

An upstream `425` or `429` opens a shorter throttle instead. It honors the upstream `Retry-After` within bounded limits and is excluded from health scoring.

## Limits of the protection

Thresholds, window sizes, and cooldown durations are platform policy rather than Route settings, and are not fixed by this documentation.

Circuit state is shared runtime state. When that state is unavailable the Gateway admits the request rather than blocking it, so Circuit protection is best effort.