Health, speed and rate-limit state for SearXNG instances, learned from the searches this node makes. One pool runs under the :perplexed application; tests and hosts can start more with :name.

Ranking

Each instance keeps exponentially weighted moving averages (EWMA) of its response time and failure rate, and is scored

latency_ewma_ms * (1 + failure_penalty * failure_ewma) * jitter

lowest first. An instance not measured yet scores its prior: the searx.space median when it was seed/2ed, else :prior_ms. :jitter multiplies each score by a random factor in 1 +/- jitter, so the fastest few share the load instead of one taking every search. :min_interval_ms ranks an instance used that recently after every rested one, least recently used first.

Circuit breaker

Each instance is a small state machine:

:closed --refusal--> :open --cooldown timer--> :half_open
   ^                   ^                          |
   |                   +--------trial fails-------+
   +------------------------trial answers---------+

A refusal (HTTP 429 or 503, a redirect from SearXNG's limiter, 403/418, a bot challenge, a timeout, a transport error) opens the circuit. The cooldown is the server's own Retry-After / RateLimit-Reset when it sent one, otherwise :cooldown_ms doubled per consecutive refusal, capped at :max_cooldown_ms either way. When it ends a timer moves the instance to :half_open, where it hands out a single trial lease: an answer closes the circuit, a refusal opens it again for twice as long. An open instance is never checked out. An empty or off-topic answer is a soft failure: the instance is reachable, so the circuit closes, but its failure average rises, and :soft_strikes (default 3) in a row open the circuit like a refusal: an instance that keeps answering off-topic is skipped for a while however fast it is.

Leases

checkout/3 picks and reserves instances in one step inside the server, so concurrent searches spread out instead of racing onto the same instance. The pool monitors the caller; if it dies, its leases are released. record/4 reports the outcome and returns the lease.

Rankings and stats are read straight from ETS, so inspection never waits on the process. Instances idle longer than :forget_after_ms are swept out.

Every state change emits [:perplexed, :searxng, :circuit] with metadata instance, from, to and cooldown_ms.