If the external GIS geocoder is down, the address-lookup feature should fail fast after repeated errors and serve a degraded enter-manually path instead of hanging every request. Which pattern is this?
Select an answer to reveal the explanation.
Short Explanation
After enough sparks, flip the breaker so you stop shoving current into a dead geocoder. Fail fast, offer the manual address path, then peek with a half-open trial later. That circuit-breaker pattern keeps the rest of the portal healthy.
Full Explanation
If the external GIS geocoder is down, failing fast after repeated errors and serving a degraded enter-manually path is the circuit-breaker pattern: open after a failure threshold, short-circuit calls, then try half-open probes before closing again. Citizens still complete forms with manual address entry while the city stops paying latency and thread taxes to a dead dependency. When probes succeed, the breaker closes and automated geocoding resumes.
Unlimited retries with no timeout hang request workers and worsen user experience. Removing error handling so exceptions crash the whole API process turns a dependency outage into a total portal outage. Caching nothing and always waiting the maximum socket timeout on every citizen request maximizes pain without learning from consecutive failures.
Exam caveat: circuit breakers complement timeouts and bounded retries; they are not a substitute for monitoring the dependency. Half-open state must be limited so recovery probes do not become another stampede.
Operational check: track geocoder error rates; open the breaker after threshold failures; return a clear degraded UX for manual address entry; periodically probe; and page on prolonged open state so GIS vendor issues get operational attention.