An e-commerce checkout calls a fragile fraud API that times out under load, and the team needs automatic retries without overwhelming it plus fast fallback when failures exceed thresholds. Which controlled remediation design with safety constraints protects checkout reliability?

Exponential backoff spaces retries to relieve pressure on the fragile fraud API, while jitter randomizes delays to prevent synchronized retry storms. A circuit breaker tracks failures and opens after a threshold, routing calls to a cached fallback so checkout can remain available with bounded latency. Exponential backoff and jitter with a timeout that returns a cached fallback handles an individual slow call, but the timeout does not track aggregate failures or open a breaker; calls can continue reaching the API during a sustained outage. Fixed-interval retries with a circuit breaker and cached fallback does provide threshold-based short-circuiting, but identical retry intervals can synchronize clients into a thundering herd that overwhelms the recovering API. Exponential backoff and jitter with a circuit breaker that fails fast avoids continued calls after the breaker opens, but returning an error rather than a cached fallback sacrifices graceful degradation and can block checkout. An exam caveat: retries with backoff address transient faults, while a breaker with a fallback addresses systemic failures; a timeout alone does not replace either. As a practical check, use staging chaos tests to monitor retry attempts, breaker state transitions, and fallback hit rate, then tune the backoff base, jitter ratio, and opening threshold to engage fallback quickly without flapping.