Multi-ESP fallback routing configured

A single-ESP sending architecture creates a hard dependency on one provider's availability. When SendGrid, Mailgun, or Postmark experiences an outage, all outbound email stops until the provider recovers. For SaaS products where password resets and billing receipts are blocking user actions, even a one-hour outage translates directly to churn and support volume. ISO-25010:2011 reliability.availability requires that systems maintain service continuity through component failures — a second ESP is the minimal architectural hedge against that dependency.

Implement a simple circuit-breaker router in lib/email/router.ts that switches to a fallback provider after a configurable failure threshold:

export class EmailRouter {
  private failures = 0
  private readonly threshold = 5
  constructor(
    private readonly primary: EmailProvider,
    private readonly fallback: EmailProvider
  ) {}
  async send(msg: EmailMessage) {
    if (this.failures >= this.threshold) return this.fallback.send(msg)
    try {
      const result = await this.primary.send(msg)
      this.failures = 0
      return result
    } catch (err) {
      this.failures++
      if (this.failures >= this.threshold) return this.fallback.send(msg)
      throw err
    }
  }
}

Store the fallback ESP's credentials in separate environment variables and verify both during the startup health check.