A retry budget bounds total load, not per-caller load

Three retries per caller sounds modest and means four times the load on a struggling dependency, which is the opposite of what a retry is for.

per-caller limit    3 attempts each
                    → 1000 clients = 4000 requests

retry budget        retries may be at most 10% of the
                    successful request rate, measured
                    over a rolling minute
                    → the budget is EXHAUSTED during an
                      outage, so retries stop entirely

the difference: the second one degrades to zero retries
exactly when the dependency cannot take them.

A budget is a shared counter rather than a per-request rule, which makes it more work to implement and is the only version that bounds the aggregate. The property that matters is that it self-disables: when almost everything is failing, there are almost no successes to fund retries, so the retry load falls to nothing. A per-caller limit does the reverse and multiplies the load precisely when the dependency is least able to absorb it.