A retry policy is written per hop and paid for by the whole chain.

Three hops at three attempts each is 27 leaf requests for one client call, not 9 — the attempts multiply along the chain rather than adding, and every team wrote a factor it can defend while nobody owns the product. A hop’s worst case is attempts × timeout + sum(backoff), so a 3 × 10s policy with 1s of backoff doubling is 33s — already more than a 30s client deadline on its own, and 1.65m three hops deep.

The engine is free and needs no account, and it makes no request to anything: every figure is arithmetic on the policy you paste. The deadline is spent in chain order, so the outermost hop spends first and the innermost is the one that runs out — and unless the deadline propagates, each hop starts a fresh timeout and can still be working after the caller has gone. In an ordinary three-hop chain that is 7 of the 9 attempts that cannot be paid for — they end after the client has already given up, each costing the dependency a full timeout with a zero probability of helping. Without jitter the whole client population retries at the same instant — 10,000 clients on an 8s backoff is 10,000 requests in one moment, at an offset the backoff makes exactly predictable. And a retry of something that is not idempotent is a duplicate, not a retry: a timeout does not say whether the work happened. Every lane ships a worked example that costs nothing. Writing the report needs credits.