Adaptive traffic shaping under overload

A payments API is approaching overload during a flash sale: incoming traffic exceeds capacity and naive behavior (accept everything) is driving latency up and triggering client retries that make it worse (a retry storm / metastable failure). Design adaptive traffic shaping and load shedding that keeps the system in a healthy regime. Cover how you decide what to shed vs admit, how you prioritize (a checkout vs a balance-poll), how you prevent retries from amplifying overload, and how the system recovers once it's tipped over.