Add a circuit breaker around the payments upstream so retries pause when the error rate spikes.
Surface breaker state in @acme/observability.

• edge-casedefendedf_1
  Breaker open state needs a fallback path
  When the breaker is open, callers will see immediate failures. Confirm the upstream queue absorbs this or define a fallback.
  Discussed with the payments team — open state is acceptable; the queue is sized to absorb 5 minutes of failures.

  decided —
• complianceaddressedf_2
  No PII in breaker telemetry
  Breaker state and error rates only — no request bodies. Compliant with PII rule.