amend! STF-322: Add bounded transport-failure retry to WebServiceClient

When the JDK HttpClient pool reuses an idle connection that an intermediary
(load balancer, proxy, NAT) has silently closed, the next send() fails with
"Connection reset", "Broken pipe", or related transport errors. A single
retry recovers transparently without exposing this race to callers. The
default JDK keep-alive timeout exceeds many intermediaries' idle timeout,
making this mismatch the common case.

The retry predicate is permissive by exclusion: any IOException from
httpClient.send() is retried EXCEPT HttpTimeoutException (covering both
request-phase and connect-phase timeouts, since HttpConnectTimeoutException
is a subclass) and InterruptedIOException. Both timeouts are customer-set
budgets that retrying would silently extend; InterruptedIOException is a
user-cancellation signal. HTTP 4xx and 5xx responses are surfaced as
HttpException (and subclasses) from a separate code path -- they come back
as HttpResponse objects rather than IOExceptions, so the predicate is
structurally unable to retry them.

Customers can opt out via .maxRetries(0). Default is 1 (one retry, two total
attempts). The interrupt flag is restored before rewrapping
InterruptedException, and a pre-set interrupt short-circuits the predicate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: oschwald

src/main/java/com/maxmind/minfraud/WebServiceClient.java

@@ -16,23 +16,20 @@
 import com.maxmind.minfraud.response.ScoreResponse;
 import java.io.IOException;
 import java.io.InputStream;
-import java.net.ConnectException;
+import java.io.InterruptedIOException;
 import java.net.ProxySelector;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.http.HttpClient;
-import java.net.http.HttpConnectTimeoutException;
 import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
 import java.net.http.HttpTimeoutException;
-import java.nio.channels.ClosedChannelException;
 import java.nio.charset.StandardCharsets;
 import java.time.Duration;
 import java.util.Base64;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
-import java.util.Locale;
 import java.util.Map;
 
 /**
@@ -405,40 +402,23 @@ private static boolean isRetriableTransportFailure(IOException e) {
         if (Thread.currentThread().isInterrupted()) {
             return false;
         }
-        // Walk the cause chain: the JDK HttpClient wraps the underlying transport
-        // failure in different ways depending on the protocol path. Over HTTP/1.1
-        // a "Connection reset" surfaces as a SocketException; over HTTP/2 a
-        // SETTINGS-frame write failure may surface as a plain IOException with
-        // the same message; an HTTP/2 upgrade against an already-closed socket
-        // surfaces as a (message-less) IOException caused by a
-        // ClosedChannelException. Match by class for the framing types and by
-        // message (case-insensitive) for the resets, while keeping the explicit
-        // checks for connect-phase timeouts and request-phase timeouts (which
-        // must NEVER be retried).
-        Throwable t = e;
-        while (t != null) {
-            if (t instanceof HttpConnectTimeoutException) {
-                return true; // subclass of HttpTimeoutException - must be checked first
-            }
-            if (t instanceof HttpTimeoutException) {
-                return false; // request-phase timeout: NOT retriable
-            }
-            if (t instanceof ConnectException) {
-                return true;
-            }
-            if (t instanceof ClosedChannelException) {
-                return true;
-            }
-            String msg = t.getMessage();
-            if (msg != null) {
-                String lower = msg.toLowerCase(Locale.ROOT);
-                if (lower.contains("connection reset") || lower.contains("broken pipe")) {
-                    return true;
-                }
-            }
-            t = t.getCause();
+        // Both connect-phase and request-phase timeouts are customer-set
+        // budgets that retrying would silently extend.
+        // HttpConnectTimeoutException extends HttpTimeoutException, so this
+        // single check covers both.
+        if (e instanceof HttpTimeoutException) {
+            return false;
+        }
+        // The thread was interrupted during I/O; honor the cancellation.
+        if (e instanceof InterruptedIOException) {
+            return false;
         }
-        return false;
+        // Everything else from httpClient.send() is a transport failure
+        // (connection reset, broken pipe, EOF, closed channel, connect refused,
+        // DNS, TLS, protocol). HTTP 4xx and 5xx responses cannot reach this
+        // predicate -- they come back as HttpResponse objects rather than
+        // IOExceptions.
+        return true;
     }
 
     private HttpRequest requestFor(AbstractModel transaction, URI uri)