I don't understand why load shedding wasn't considered here. My experience has been that it's so effective at making a system recover properly that everything else feels like it's handling an edge case.
> Then Mary and Ben discussed whether load shedding on the server would help, but in the end, they decided that a thick client in this case was acceptable.
Just guessing, but it seems that they share the client code between many teams and microservices, so possibly it was just easier to embed the logic in the shared client code. But it seems clear that they consider load shedding to be another way to handle this problem.
You can also configure your client to stop retrying if it sees a load shedding error. That won't protect you against traffic that overwhelms the load shedder, but it's pretty effective against an innocently misbehaving client.