A breaker only a person could reset, and a buyer who got a 500

Azores Flights scans fares from an upstream that sometimes stops answering, so the scans sit behind a circuit breaker. It tripped twice in one week: a one minute run of 403s on the 16th, and a run of 504s at 14:44 on the 24th. Both times upstream recovered within minutes. Both times the scans stayed off until someone probed by hand and reset the breaker.

A breaker that opens by itself and closes only by hand turns a two minute blip into however long it takes to notice. The probe that closes it now runs hourly on the same single thread lane as the scans, and does nothing while the breaker is closed or the scans are paused on purpose.

It waits 30 minutes before its first try, longer than the five minute cache in front of upstream, so it cannot be fooled by a cached answer. Then it ingests one route, once. A real answer with fares in it resets the breaker and sends an all clear. An empty answer does not, because empty is what throttling looks like. The cost is one request an hour, and only while tripped.

The same day went on an audit of the paid path, before a press feature sent people to it. The wiring was right: live webhook, euro prices, a one euro test twelve days earlier that worked end to end. Three things were still wrong.

The webhook and the checkout return both create the subscription, and a unique index on the account rejects whichever arrives second. The loser was the buyer’s own browser, so someone who had just paid got a 500 and no sign in code. Activation now retries once against the winning row.

Instant alerts held back during quiet hours were never sent at all. They now go out at the first hour outside quiet hours. And the alert mailer ignored the alert address set in Settings.

Six more went on a list for later. The suite ran to 1,339 examples.