When should a distributed system stop retrying?
Answer from the constraint
Bound retries by an end-to-end deadline, use backoff and jitter, retry only safe or idempotent work, and shed load before retries amplify an outage.
A useful response structure
- Name the user-visible requirement or invariant.
- Choose the simplest decision that protects it.
- State the cost and the likely failure mode.
- Give one observable trigger for changing the design.