v3.0.0

Each destination can now carry a token-bucket rate limit and a circuit breaker. A delivery that finds the bucket empty or the circuit open is put back in the queue with a future due time: no attempt is spent, nothing is marked failed, and the backlog drains on its own once a half-open probe succeeds. Permanent 4xx responses do not trip the breaker, only transient failures do.

Breaker state lives in a new destination_states table (Alembic 0002) so a restarted worker resumes where it left off and the API can report it. GET /destinations shows config, circuit state and queue depth; three new Prometheus series cover deferrals, transitions and current state. 119 tests, including an up/down migration round trip.