**When an upstream goes down, your users shouldn’t have to know.**
—
Multiple upstream routes for the same model If one fails, the request moves to the next.
—
Circuit breaking is scoped It targets the route with the problem, not the entire model.
—
Failures are logged and reviewable They aren’t silently swallowed.
At 3 a.m., an upstream begins returning 5xx. No one is on call, and you have no retry logic in place. The request completes through another route; you only learn what happened from the logs the next day.