Flaws in handling of HALF_OPEN state leading to ineffectual circuit-breaker under persistent failure conditions

[jerryjvl]

When _startTimer puts STATE into HALF_OPEN, this means that the circuit no longer registers as opened.

This means in fire when it checks if (this.opened && !this.pendingClose), it doesn't just let the single next request through, but it opens the flood-gates to all new requests passing through un-rejected.

Suggestion is to fix change this to if (!this.closed && !this.pendingClose).

When this is fixed , a new problem will surface, which is that if _startTimer fires, lets a single request through, and that request fails, it is quite likely that the failure rate has dropped below the threshold meaning that fail() will not re-issue a circuit.open() and so the timer will never trigger again meaning that all requests remain perpetually rejected.

I'd suggest that for this problem, amending the error-rate conditional in fail() from:
if (errorRate > ... || circuit.options.maxFailures >= stats.failures) {
to:
if (errorRate > ... || ... >= stats.failures || circuit.halfOpen) {
So that any failure in a half-open state causes the circuit to re-open and eventually make another attempt at closing.

[lance]

Connects to: #120

[lance]

Fix landed in: 04df6f7