fix: preserve cookie CreatedAt and honor H1 close on reuse

[re-jevi]

Summary

• Cookie replacement now keeps the original CreatedAt so same-path Cookie order stays Chrome/RFC 6265-like instead of moving every refreshed cookie to the end of the header.
• shouldKeepAlive now honors Response.Close and Request.Close. Some HTTP parsers strip the hop-by-hop Connection header, so a closing socket could previously be returned to the idle pool.
• Pooled HTTP/1 retries already rewound bodies via GetBody on current main. That path now shares a rewindRequestBody helper, with tests for replayable and non-replayable bodies.

Test plan

• go test ./transport -run 'TestHTTP1ShouldKeepAlive|TestRewindRequestBody' passed on this machine
• go test ./session -run TestCookieJarReplacementPreservesHeaderOrder — test was updated to wait for a distinct Windows clock tick; please re-run in CI / a Go-on-PATH environment
• go test ./session ./transport

Risk

Low. Cookie order only changes when a cookie is replaced (now matches browsers). Keep-alive becomes more conservative when Close is set. Rewind helper preserves existing main retry error behavior (non-replayable body still surfaces the original connection error).

Merge

Ready for review. Do not auto-merge — please review and merge on GitHub.

Made with Cursor

[vercel]

@re-jevi is attempting to deploy a commit to the sardanioss' projects Team on Vercel.

A member of the Team first needs to authorize it.

[re-jevi]

Overview

This is a small compatibility PR from a fork (re-jevi/httpcloak). I do not have write access to sardanioss/httpcloak.

Cookie jar: Set used to stamp a new CreatedAt on every replace. Same-path cookie order is creation-time order (RFC 6265 / Chrome), so a refresh moved that cookie to the end of Cookie. Replacing now keeps the original creation time. The new test also waits for a distinct clock tick because Windows can give two immediate Set calls the same timestamp.

HTTP/1 keep-alive: shouldKeepAlive only looked at the Connection header. After parse, some stacks record close semantics on Response.Close / Request.Close and drop the hop-by-hop header. Those sockets could be pooled and then fail on reuse. Close flags now refuse reuse.

HTTP/1 body rewind: current main already rewinds via GetBody before retrying a pooled connection. This extracts that into rewindRequestBody and adds unit tests. If the body cannot be replayed, the original connection error is still returned so a corrupt retry does not go out.

Please do not auto-merge. Review and merge on GitHub if this looks right.