Retry where you know what failed

The rule I have settled on: retry at the layer that can tell a timeout from a refusal.

A client that retries a 403 is a client hammering a door that is locked. A gateway that retries a timeout is doing the one thing it is well placed to do. If a layer cannot tell the two apart, it is the wrong layer.