[P1][Review] Remove unsafe write replays and futile durable-quota retries #82

Review-only / approval gate

No implementation, PR merge, package publication or production mutation until the owner approves the full sprint plan.

Evidence

Reviewed main 36f45008f216a988a2e8fd860bad7b9073d00c21.

src/client.ts requestRaw retries transport/timeouts/5xx regardless of method; subscription/webhook POSTs use it without an idempotency key. RateLimitError is always retryable, including durable monthly/daily/trial exhaustion; Retry-After is slept directly without a bounded policy. SyntaxError from invalid successful JSON is also retried because only custom nonretryable errors are excluded. Code-confirmed paths; production duplicates not asserted.

Preferred smallest change

Constrain existing retry loop to safe methods or explicitly supported idempotent writes, typed transient failures and recoverable rate limits. Use the backend's durable counter-window headers (matching Python's current behavior); do not infer all exhausted states are permanent. Return a clear error instead of sleeping early when Retry-After exceeds an allowed wait budget.

Acceptance / negative-path tests

Commit-then-timeout POST sent once; GET502 recovers; malformed200 not replayed; durable quota429 one attempt; burst429 honors valid delay; invalid/date/huge Retry-After and caller cancellation bounded; retries=0 honored.

Risk and PR gate

High-risk request semantics/duplicate writes; Saturday.
One focused issue PR; independent adversarial review must challenge deletion safety, public compatibility, failure recovery and whether a smaller deletion suffices. Include red/green test evidence and packed/installable artifact proof for any published SDK/MCP change. Merge only in the approved priority order after reviewer objections are resolved. Do not publish a breaking change as a patch. If already fixed at execution time, record evidence and skip without a cosmetic PR.