Fetch retries in Node only stay safe when backoff, deadlines, and idempotency agree. Prefer exponential backoff with jitter capped by a hard deadline, honour Retry-After when the upstream sends it, and skip automatic retries on non-idempotent methods unless you own a dedupe key. Bound the client pool so a retry storm cannot open unlimited sockets against a dark dependency.

Ops prove-out after enabling retries: inject a 429 or 503 path that returns Retry-After and confirm the client waits then succeeds within the deadline, then inject a hard timeout and confirm the caller fails once instead of cascading. Under a synthetic outage window, watch outbound connection count and p99 — if both climb while success rate stays flat, retries are amplifying load instead of bridging a blip. Keep a canary without retries beside the new path for one deploy so you can tell a bad backoff from a real upstream regression.