A cascade router beats a retry loop on 429s, but its breaker never actually trips

Start with the counter, because it decides everything the backoff does. `consecutive_failures` is incremented on any HTTP error and reset only by a 200 ^[14], while the cooldown is written only when the status is 429 ^[17]. Two 5xx responses from a restarting server therefore leave the counter at two, and the next genuine rate-limit response parks the free endpoint for 20 seconds instead of 5 ^[21]. The author's own rule is that a 429 and a 5xx mean different things and deserve different handling ^[10]. The code shares one integer between them.

The cap arithmetic is the second problem. `min(60, 5 * 2 ** (n - 1))` ^[7] hits its ceiling on the fifth consecutive failure, where 80 is clipped to 60, after spending 5, 10, 20 and 40 seconds on the way there ^[18]. That is 75 seconds of accumulated cooldown before the endpoint is parked for a full minute ^[22]. And 60 is where it stays. The article describes the breaker as implicit, tripping once the cooldown exceeds 60 seconds ^[8], but the `min()` guarantees it never does ^[19]. There is no trip. There is a permanent one-probe-per-minute tax on the free endpoint, which on an hourly quota window works out to roughly 60 doomed requests an hour ^[20], each one paid for in latency on whichever user request happens to draw it.

What actually delivers the promised behaviour is the ordering in `complete()`: iterate the endpoint list, skip anything still cooling, return the first 200 ^[16]. Cost control comes from putting the free endpoint first, not from the breaker. That is a sound trade, and the reasoning behind the 60-second ceiling is honest about what is being bought: past a minute of waiting, the paid call is cheaper than the stall ^[9]. The number is only correct for a quota window measured in minutes, which is why the piece tells you to find yours with curl before configuring anything ^[12], and why the 60 is the wrong constant for an hourly reset ^[11].

There is a worse gap. Each call uses `urlopen` with `timeout=30`, and the only exception handled is `urllib.error.HTTPError` ^[15]. A free endpoint that accepts the connection and then says nothing produces a socket timeout, not an HTTP status, so it propagates out of `complete()` and the paid backup is never reached ^[23]. That is a 30-second stall with no fallback, which is the exact failure the article opens by condemning ^[2]. Two endpoints that both hang cost 60 seconds before anything is returned ^[25].

The pattern is still the right default for mixed-tier endpoints. But the part you must write yourself is the part the sample omits: a branch for failures that never became a status code, and a cap derived from your own measured quota window rather than the one that happened to be in the snippet.