A bugged or prompt-injected agent can fire mutations at machine speed — thousands of duplicate POs, hundreds of SWIFT messages — before a human reacts. This deterministic breaker is the hard limiter the runtime calls before every action: trip on a velocity breach or a consecutive-error streak, freeze (preserve state, don't kill), deny during cooldown, then allow one half-open trial. Policy here: 10/window, 3 errors, 60s cooldown.
Honest scope. A pure FSM — it holds no state itself; the runtime persists {status, opened_at, window_count, recent[]} and calls the breaker before each side-effecting action. freeze means freeze, not kill — the execution container is preserved for debugging and a high-priority alert is routed. It composes with the live O(1) per-key rate limiter (agent_rate_hit) and the watchdog (per-run budget); the breaker is the cross-call failure-rate trip with cooldown. Source: flowdesk-breaker-kernel.js.