Aias00 opened a new issue, #7760: URL: https://github.com/apache/shenyu/issues/7760
### Current behavior After an OPEN breaker's wait window expires, `isRequestAllowed()` returns true while leaving state OPEN. `DividePlugin.filterByCircuitBreaker()` adds those upstreams to its normal allowed list and returns before reaching `tryAcquireHalfOpenProbe()`. Consequently, the recovery window admits ordinary traffic without acquiring a single probe. Even if state is explicitly HALF_OPEN, `isRequestAllowed()` still returns true and the same filter admits further requests while the first probe has no outcome. ### Locations / actual consumer - [UpstreamCircuitBreaker.java:233–251](https://github.com/apache/shenyu/blob/66d7d954ca37d651a5ad916f988a8081157a7ab4/shenyu-plugin/shenyu-plugin-base/src/main/java/org/apache/shenyu/plugin/base/circuitbreaker/UpstreamCircuitBreaker.java#L233) - [DividePlugin.java:210–225](https://github.com/apache/shenyu/blob/66d7d954ca37d651a5ad916f988a8081157a7ab4/shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-divide/src/main/java/org/apache/shenyu/plugin/divide/DividePlugin.java#L210) The class and route-filter comments explicitly describe a single half-open probe. The filter is called by normal Divide `doExecute()` before load balancing/forwarding. ### Reproduction / validation A probe compiled the current breaker, DividePlugin and its data handler. It opened the actual singleton breaker's state using its configured failure threshold, verified blocking before expiry, then backdated only its private open timestamp to simulate the elapsed wait window without sleeping ten seconds. It invoked the actual route filter twenty times before recording any outcome: ```text BEFORE_WAIT allowed=false AFTER_WAIT admissionsBeforeOutcome=20 state=OPEN EXPLICIT_PROBE_ACQUIRED=true WHILE_HALF_OPEN admissionsBeforeOutcome=20 state=HALF_OPEN ``` Independent review confirmed the early-return/eligibility interaction. This is a route-admission/state-machine reproduction, not twenty network calls or a measured outage/load benchmark. The probe reset its singleton key afterward. ### Impact / expected behavior A burst of requests can hit a recovering or still-failing upstream immediately after the wait period, defeating the intended single-probe protection. HALF_OPEN should limit forwarding until that probe succeeds/fails rather than behave like normal availability. ### Suggested fix Separate candidate eligibility from atomic forwarding permission. Acquire a half-open permit for the upstream actually selected to receive a request and suppress further admissions until its outcome. Avoid consuming permits for candidate upstreams that are never selected, and define cancellation/error release behavior. Keep normal healthy upstream traffic available. ### Related existing work #6584 introduced a built-in proxy breaker where none existed; this is incorrect recovery semantics in that implementation. #7752 concerns fixed retry bypassing failover. Live half-open/breaker searches found no matching issue. The separate speculative claim that cancellation permanently strands ordinary traffic is not included here because current admission also permits other traffic. ### Reviewed revision Apache ShenYu 2.7.2-SNAPSHOT, `master@66d7d954ca37d651a5ad916f988a8081157a7ab4`. Priority P2 / Medium, high confidence in the described source/runtime behavior. Unit-test and CI issue categories excluded. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
