Circuit breaker on repeated ESP failures

Exponential backoff slows down retry frequency, but it does not stop new jobs from being accepted and attempted against a broken ESP. A circuit breaker adds the missing control: after N consecutive failures, it stops attempting sends entirely and waits for a cooldown before probing again. Without it, a prolonged ESP outage fills the queue with failed jobs that burn retry budget. CWE-400 applies because new jobs continue to consume processing resources against an endpoint that is confirmed unavailable. The circuit breaker is the difference between "we paused sends during the outage" and "we burned through all retry attempts before the outage resolved."

Wrap the ESP send call with a circuit breaker using a library like opossum in your send adapter (e.g., src/lib/email/providers/sendgrid.ts):

import CircuitBreaker from 'opossum'

const breaker = new CircuitBreaker(esp.send.bind(esp), {
  timeout: 5000,
  errorThresholdPercentage: 50,
  resetTimeout: 60_000 // 1 minute cooldown
})

breaker.on('open', () => {
  alertOps('ESP circuit breaker opened — sends paused for 60s', 'critical')
})

export const sendEmail = (msg: EmailMessage) => breaker.fire(msg)

This check may be skipped when ab-001981 (ESP failover) is already passing, as immediate failover to a secondary fills the circuit breaker role.