Failover algorithm

This section is the authoritative description of how the webhook URL is selected. When a fallbackUrl is configured:

1. Requests are sent to the primary url.
2. If a request to the primary URL fails, that same event is re-sent immediately to the fallbackUrl. The primary URL continues to be used for subsequent requests.
3. After several consecutive failures (exact number may vary) of the primary URL, the primary URL is bypassed and requests are sent only to the fallbackUrl. This avoids incurring the timeout on every request.
4. While the primary URL is bypassed it is retried once every 60 seconds. The interval is counted from the last failure of the primary URL that triggers the bypass. Each unsuccessful retry restarts the 60-second clock. As soon as a retry succeeds the primary URL is restored and processing returns to step 1.

If no fallbackUrl is configured, a failed request is not retried and the event is not delivered.