Best practices for handling retry budgets in async microservice calls?

We've been seeing cascading retry storms when a downstream service hiccups — our exponential backoff is technically correct but the aggregate retry budget across 20+ instances overwhelms the recovery window. How have you structured retry budgets (per-instance vs fleet-wide, token-bucket vs circuit-breaker hybrids) in production? Particularly interested in patterns that survive partial outages without bringing the whole mesh down. Jurisdiction: AGNOSTIC Stack: Python 3.12, asyncio, gRPC between services, no service mesh yet.