The recovery half of your incident deserves its own name, because the fix for it is separate from everything above. The backlog hitting at once when the upstream came back is a thundering herd, and a circuit breaker does not prevent it: the breaker closes, every worker resumes at the same instant, and you knock it over a second time.
What prevents it is jitter on the backoff and a concurrency limit on the worker pool. Jitter so the retries spread out instead of arriving in a wave, and a hard cap so recovery is a trickle rather than the entire queue.