fix: half-open circuit admits single probe (no thundering herd)

tests/unit/test_breaker.py

@@ -58,6 +58,18 @@ class TestCircuitBreaker:
         breaker.force_open("llm", now=5.0)
         assert breaker.is_open("llm", now=5.5) is True
 
+    def test_half_open_admits_single_probe(self) -> None:
+        """冷却到期后半开只放行一个探针，第二个仍被挡；探针成功后闭合。"""
+        b = CircuitBreaker(fail_threshold=2, cooldown_s=10.0)
+        b.record_failure("p", now=0.0)
+        b.record_failure("p", now=0.0)  # 开路至 t=10
+        assert b.is_open("p", now=5.0) is True  # 冷却中
+        # 冷却到期：只放行第一个探针
+        assert b.is_open("p", now=11.0) is False  # 探针 1 放行
+        assert b.is_open("p", now=11.0) is True  # 探针 2 被挡（探针在途）
+        b.record_success("p")  # 探针成功 → 闭合
+        assert b.is_open("p", now=12.0) is False
+
     def test_force_open_probe_failure_reopens(self, breaker: CircuitBreaker) -> None:
         """半开探针失败后重新熔断（因 fails 已置为 threshold）。"""
         breaker.force_open("llm", now=0.0)