[glennawatson]

Summary

Add opt-in HTTP-aware retries for Refit clients and ordinary HttpClient callers without an external resilience dependency.

• Add HttpRetryHandler and HttpRetryOptions for configurable response rules, transport retries, bounded exponential backoff and full jitter.
• Read standard Retry-After and Azure, AWS, GitHub and Jira timing hints. Custom headers can specify their encoding.
• Replay fresh requests with copied metadata and bounded request bodies. Cancellation covers buffering, sending and waiting.
• Add RetryReply and StubHttp.CreateRetryHandler for deterministic retry tests with TimeProvider.
• Document retry configuration, ownership and resilience composition in the README and local guides. Check that resolved redirect targets preserve encoded queries with existing [Url] support.
• Record the additive public API in the modern target baselines.

Why

Transient HTTP failures and provider rate limits need retry timing that respects server instructions. A handler can apply those rules consistently without changing generated clients or requiring each application to implement request replay.

Breaking changes

None. Retries are opt-in, existing behavior stays unchanged, and no dependency or target framework changes are introduced.

How this was verified

Tests cover classification, provider parsing, replay, disposal, cancellation, fake-time waits and generated-client use; coverage includes every executable line and branch added by the retry implementation.
Built both shipped libraries, exercised the runtime and testing suites, and rendered the website with strict link validation.

Notes for the reviewer

Start with HttpRetryHandler for request ownership and replay rules, then RetryDelayProviders for provider-specific units and eligibility. The public API baseline additions are mechanical.

Only safe methods retry by default. Unsafe methods require explicit opt-in. Server hints are not shortened by jitter, and hints above MaxDelay return the response instead of retrying early.

Timeouts, concurrency limits, circuit breakers, hedging and typed fallback are evaluated in the guide but are not added as strategies. Query aliases and redirect targets retain the existing [AliasAs] and [Url] APIs, with no generator changes.

The website guide is prepared in the separate website repository and is not included in this PR. Its build reported package audit and downgrade warnings, plus unresolved Android resource references.

Checklist

• I have read the Contribute guide
• The PR title follows Conventional Commits
• Tests cover this change, or the summary says why they do not
• New or changed public API has XML documentation

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (8e03c5e) to head (845e853).

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #2364      +/-   ##
===========================================
+ Coverage   99.97%   100.00%   +0.02%     
===========================================
  Files         219       242      +23     
  Lines       11903     13018    +1115     
  Branches     2302      2416     +114     
===========================================
+ Hits        11900     13018    +1118     
+ Misses          3         0       -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
99.8% Coverage on New Code
0.3% Duplication on New Code

See analysis details on SonarQube Cloud