Retry budget and adaptive throttling.

When a backend is overloaded, its clients make it worse: every rejected request is retried, and every retry is more load on the thing that is already failing (Week 2 preview, Concept 3). Backoff and jitter spread retries out (the retry-backoff-jitter lab); this lab caps how many there are and stops sending what the backend will only reject. Both mechanisms come from the "Handling Overload" chapter of Google's Site Reliability Engineering book:

• A per-client retry budget: a request is retried only while retries are under 10% of the requests the client sent recently.
• Client-side adaptive throttling: each client counts, over the last two minutes, requests (attempts made by the application, including ones it rejected itself) and accepts (attempts the backend accepted), and rejects new attempts locally with probability

p = max(0, (requests − K × accepts) / (requests + 1))

With K = 2 the client sends freely while the backend accepts at least half of what it sends; beyond that it drops the excess itself, so the backend spends nothing on requests it would have refused.

Implement OverloadClient(clock, rng, k=2.0, window=120, retry_ratio=0.1, max_attempts=3) with call(send), where send() makes one attempt and returns "ok" or "overloaded". Each attempt (attempt 0 is the first, 1 and 2 are retries) does this, using the counts in the window:

1. A retry is allowed only if retries < retry_ratio × requests. Otherwise return "budget".
2. p = max(0, (requests − k × accepts) / (requests + 1)).
3. Count the attempt as a request (and as a retry, if it is one).
4. Draw exactly one u = rng.random() per attempt, even when p is 0. If u < p, return "throttled": don't call send, don't retry.
5. Call send(). "ok": count an accept and return "ok". "overloaded": go to the next attempt.

After max_attempts attempts that were all overloaded, return "failed".

The window. Count in one bucket per whole second, floor(clock.now()). The counts are the sums over the buckets s with s > floor(now) − window: with window = 120, the current second and the 119 before it. Drop older buckets, so memory stays bounded however long the client runs. Also expose requests(), accepts(), retries() and reject_probability() (the p of step 2, right now).

In JavaScript and TypeScript: new OverloadClient(clock, rng, { k = 2, window = 120, retryRatio = 0.1, maxAttempts = 3 } = {}) with call(send), requests(), accepts(), retries() and rejectProbability().