Retrying a Transient Downstream Failure

A send_notification tool calls an internal email-delivery API. During one incident, that API returns HTTP 503 for about 90 seconds while it restarts. There's no ambiguity about what to do next — retrying shortly will either succeed or it won't — and the model has no conversational context that would change that decision.

Where should the retry logic for this specific failure live?