fix(breaker): let the sliding window recover after a successful half-open call

[costela]

Why

After a successful half-open probe, SlidingWindowBreaker closed the circuit but kept the failures that had opened it, so the next call reopened it. A recovered upstream stayed cut off until those failures aged out of the window, regardless of the half-open delay. EWMABreaker already starts fresh after a successful probe.

While reproducing this, window rotation turned out to have two more problems:

• The rotating observation was weighed against the window from two rotations ago (the value returned by Swap), which made the reopening erratic.
• Rotation restarted the window at the first observation after it expired, so the ended window always counted in full, however long ago it ended. After an idle period, outdated failures could still reopen the circuit, contrary to the documented expiry.

Reviewing both breakers on top of this turned up three more ways a healthy circuit opens, plus one masked result:

• EWMABreaker updated its rate with a swap-then-store, so under concurrent load an observer could read another one's raw sample as the previous rate and wipe the history: a single failure opened the circuit. Its "unobserved" sentinel was also reachable by decay, after which the next failure counted as the very first sample.
• A SlidingWindowBreaker observation racing with a window rotation could read the counts and start of different windows, e.g. judge a lone failure over the near-empty new window, where it is a rate of 1. The five separate atomics could only publish a rotation piece by piece.
• The watchdog recorded an ignored context error (e.g. IgnoreContextCanceled) as a success, masking whatever the wrapped function then returned.

What

• Clear the sliding window on a successful half-open call.
• Rotate the window so the observation is weighed against the window that just ended, by its remaining overlap; drop both windows once more than two window sizes have passed.
• Update the EWMA rate with a CompareAndSwap loop and move the sentinel out of the valid range.
• Keep each sliding window together with its predecessor's counts and swap it in as a whole through one atomic pointer, so every call reads a consistent snapshot. Samples added to a window after its successor copied the counts are lost; that only affects calls racing a rotation. Not slower on one CPU, 48-69% faster on 8 and 24 (benchstat, n=10, interleaved runs, including a new benchmark with a 1ms window that rotates ~2400 times per run; command and table in the commit message).
• Have the watchdog observe failures only; otherwise the wrapped function's return decides. Side effect: an ignored cancellation no longer releases the limiter permit and the in-flight gauge mid-call.
• Skip storing an unchanged EWMA failure rate, which a healthy breaker settles on (benchstat, n=8: 81.7 → 3.3 ns/op at 8 CPUs, unchanged on one).
• Share one immutable observer per admitted state, making the uncancellable-context hot path allocation-free (benchstat, n=6: allocs/op 1 → 0 for both breakers, EWMA sec/op -10.7% at p=0.026).
• Drop a redundant selector flagged by staticcheck so golangci-lint passes.

Trade-off: like EWMA, the circuit now closes on an empty window, so the first failure after closing reopens it.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Delayed rotation can give arbitrarily old failures full weight and reopen the breaker after the window has expired.

Review effort: Balanced
Findings: 1

Open (1)

• Resetting sinceStart gives stale promoted counts full weight · New

What changed in this PR

Fixes sliding-window recovery and rotation behavior after half-open probes.

Changes:

• Clears sliding-window counters after a successful probe.
• Uses the most recently ended window during rotation.
• Simplifies failure-condition access and adds regression tests.

File	Description
breaker.go	Resets counters and updates window rotation.
breaker_test.go	Adds recovery and rotation tests.
hoglet.go	Removes redundant embedded-field selectors.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.