Four hundred and twelve times

The mistake

A watchdog restarts the shop whenever response times cross a slowness threshold, on the assumption that slow always means stuck. Load-induced latency looks identical to a hang from the outside, so the busiest traffic of the year trips the check, and every restart drops in-flight requests and dumps warm caches, which makes the next round of responses even slower. The result is a self-sustaining restart loop that only fires when real customers show up.