Bounded discovery failures, containing only reason and retryable.

Configuration failures: :invalid_source, :invalid_options. Transport failures: :transport_unavailable (caller must start SSL), :resolution_failed, :address_denied, :connect_failed, :tls_failed, :deadline_exceeded, :redirect_denied, :redirect_limit. Response failures: :unexpected_status, :unexpected_media_type, :limit, :invalid_response, :invalid_key_set, :client_id_mismatch, :ambiguous_key_source, :directory_unsigned, :directory_signature_invalid. Resolution/cache failures: :unknown_key, :revoked_key, :source_unavailable, :cache_overloaded.

Connect failure, deadline expiry, source unavailability, cache overload and :unexpected_status from 5xx responses are retryable; 4xx responses are not. Retryability never authorizes replay of an application operation. No host, URL, key ID, exception, bytes, or peer text is retained.