Your multi-agent research system processes user queries by routing them through a planner agent, a search agent, and a synthesis agent in sequence. Production monitoring reveals that the search agent occasionally takes 45+ seconds and sometimes times out entirely. How should the system implement graceful degradation for this failure mode?

C is correct because a circuit breaker with a degraded fallback mode is the standard pattern for resilient multi-agent systems. When the search agent fails, rather than collapsing the entire pipeline, the synthesis agent can provide a response using available context — clearly labeled as potentially unverified — which provides value while being transparent about its limitations. This maintains system availability at a reduced quality level rather than complete unavailability. A is wrong because waiting up to 360 seconds (120s × 3 retries) on a slow search agent creates unacceptable user-facing latency, and treating persistent timeouts as manual-intervention events is not a scalable operational model. B is wrong because for research queries, a partial response with caveats is generally more valuable than a null response — users can evaluate incomplete information and decide whether to re-query. D is wrong because the latency characteristic of the search agent is an operational problem, not an architectural reason to eliminate AI agents from the pipeline entirely.