fix(http): stop replaying POST on a gateway 5xx

HotdataClient passed its own `retries=` into Configuration, which replaces
the generated SDK's retry policy wholesale. That policy listed POST in
`allowed_methods` alongside a (502, 503, 504) forcelist, so an intermediary
timing out a long request produced a silent, identical re-POST while the
server was still working on the first one.

For a non-idempotent call — a data load — the duplicate collides with the
write lock the original holds and is refused, and the caller sees contention
rather than the timeout that actually happened.

The override is removed so the SDK's own default applies. It is the policy
this wrapper was reaching for: hotdata._retry retries a pre-response
connection reset on any method (the stale pooled socket case, where the
server did no work) while leaving read timeouts and status retries
idempotent-only.

hotdata_framework/http.py existed only to build that policy and had no other
callers, so it goes with it.

Author: anoop-narang

CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- A `POST` is no longer replayed because of a response status. `HotdataClient`
+  passed its own `retries=` into `Configuration`, which replaced the generated
+  SDK's policy wholesale with one listing `POST` in `allowed_methods` alongside
+  a `(502, 503, 504)` forcelist — so an intermediary timing out a long request
+  produced a silent, identical re-`POST` while the server was still working on
+  the first one. For a load that is not idempotent: the duplicate collides with
+  the write lock the original holds and is refused.
+
+  The override is removed and the SDK's own default now applies. It is the
+  policy this wrapper was reaching for — `hotdata._retry` retries a
+  *pre-response* connection reset (the stale pooled socket case, where the
+  server did no work) on any method, while leaving read timeouts and status
+  retries idempotent-only.
+
+### Removed
+
+- `hotdata_framework.http` and `default_http_retries()`. The module existed only
+  to build the retry policy above and had no other callers. It predates
+  `hotdata._retry`, which supersedes it.
+
 
 ## [0.11.0] - 2026-08-11
 

hotdata_framework/client.py

@@ -52,7 +52,6 @@
     normalize_host,
     pick_workspace,
 )
-from hotdata_framework.http import default_http_retries
 from hotdata_framework.result import QueryResult
 
 # Load modes the managed-table endpoint accepts: replace overwrites, append adds
@@ -154,11 +153,16 @@ def __init__(
         self._host = normalize_host(host) if host else default_host()
         self._api_key = api_key
         self._workspace_id = workspace_id
+        # No `retries=`: the generated SDK's own default is the correct policy
+        # and passing one here replaces it wholesale. `hotdata._retry` retries a
+        # pre-response connection reset on any method — the stale pooled socket
+        # case this wrapper was reaching for — while leaving read timeouts and
+        # status retries idempotent-only, so a POST that may have reached the
+        # server is never replayed.
         self._config = Configuration(
             host=self._host,
             api_key=api_key,
             workspace_id=workspace_id,
-            retries=default_http_retries(),
         )
         self._api = ApiClient(self._config)
         if request_timeout is not None:

hotdata_framework/http.py

@@ -0,0 +1,56 @@
+"""A POST must never be replayed because of a response status.
+
+A load is not idempotent: re-sending one that the server is still working on
+collides with the write lock the first attempt holds, and the duplicate is
+refused. The generated SDK already draws this line — ``hotdata._retry`` retries
+a *pre-response* connection reset on any method (the stale pooled socket case,
+where the server did no work) while leaving read timeouts and status retries
+idempotent-only. This wrapper used to pass its own ``retries=`` into
+``Configuration``, which replaced that policy wholesale with one that listed
+POST alongside a 502/503/504 forcelist — so a gateway timing out a long request
+produced a silent duplicate of it.
+
+These tests pin the resulting policy rather than the absence of an argument,
+so re-introducing an override that is unsafe for POST fails here.
+"""
+
+from __future__ import annotations
+
+from hotdata_framework.client import HotdataClient
+
+WS = "work_test0000000000000000000000"
+
+
+def _retry_policy():
+    client = HotdataClient(api_key="hd_test", workspace_id=WS, host="https://example.invalid")
+    return client._config.retries
+
+
+def test_no_status_forcelist() -> None:
+    """A status code means the request reached the server, so retrying one is a
+    decision about idempotency that the transport layer cannot make."""
+    retry = _retry_policy()
+    assert not retry.status_forcelist, retry.status_forcelist
+    assert retry.status == 0
+
+
+def test_post_is_not_read_or_status_retried() -> None:
+    """``allowed_methods`` gates both read and status retries. POST outside it is
+    what stops a request the server may already be processing from being sent
+    twice."""
+    retry = _retry_policy()
+    assert "POST" not in retry.allowed_methods
+    assert "GET" in retry.allowed_methods
+
+
+def test_pre_response_connection_reset_still_retries_any_method() -> None:
+    """The case the wrapper's own override was reaching for, kept: a reset before
+    any response means the request never landed, so a POST retry is safe."""
+    from urllib3.exceptions import ProtocolError
+
+    retry = _retry_policy()
+    cause = ConnectionResetError(54, "Connection reset by peer")
+    reset = ProtocolError("Connection aborted.", cause)
+    assert retry._is_connection_error(reset)
+    # A read timeout is NOT reclassified — the server may have done the work.
+    assert not retry._is_connection_error(ProtocolError("Connection aborted.", None))