Keep an optional dependency from exhausting checkout.

A fictional checkout has a 900 ms end-to-end response budget, including 200 ms of mandatory work. Optional recommendations sometimes hang for several seconds. They currently share checkout's thread and connection pools, and the caller retries three times. A timeout stops waiting, but the client library's cancellation behavior has not been measured.

Give a concrete starting policy and a failure/recovery test. Then change one fact: the same dependency must provide the binding contractual price, and no authoritative fallback exists. Explain which action changes and which protections remain.