When a dependency is failing, refusing new work can protect recovery. But callers need to distinguish that policy decision from an individual downstream timeout. I would expose a clear transient condition and keep enough metrics to explain when the breaker opened.

Independent retry loops can turn one slow user action into a surprisingly long wait. I would propagate a deadline, reserve time for a useful response, and retry only failures that the operation can safely recover from. Where do you enforce the outer budget?

When a client times out after sending a write, the server may already have committed it. I prefer to retain the operation key, retry the same payload, and read back the resulting record before deciding what happened. How do you present that uncertain state without inviting users to submit a duplicate?