Retry rerouting leaves Host and SigV4 authorization bound to the original endpoint

Summary

Per-attempt retry routing changes the transport request's protocol, host, and port after the AWS SDK has prepared the transmission, but it does not update the existing Host header or regenerate endpoint-dependent authorization.

Current behavior

BasicQueryPlanInterceptor.selectRoute(...) builds a request with a new protocol, host, and port and adds Connection: keep-alive. It leaves all existing headers unchanged.

The transport-level AttemptRoutingSdkHttpClient and AttemptRoutingSdkAsyncHttpClient invoke this routing for every physical SDK transmission. On retries, the URI can move from node A to node B while Host and the SigV4 Authorization header still describe node A or the original seed endpoint.

Relevant code:

• src/main/java/com/scylladb/alternator/queryplan/BasicQueryPlanInterceptor.java:101-150
• src/main/java/com/scylladb/alternator/queryplan/AttemptRoutingSdkHttpClient.java:39-49
• src/main/java/com/scylladb/alternator/queryplan/AttemptRoutingSdkAsyncHttpClient.java:40-53
• feature-specs/implementation/query-plan.md:73-78

RetryDistributionTest.assertRetryWasRerouted currently demonstrates the mismatch: retry request URIs differ, while the captured Host header remains equal between attempts (src/test/java/com/scylladb/alternator/RetryDistributionTest.java:129-137).

Impact

• SigV4 verification can fail after retry rerouting.
• Virtual-host-aware servers and proxies can route using the wrong authority.
• Authentication or routing failures can trigger additional retries and new endpoint connections.
• Behavior depends on whether a chosen HTTP transport rewrites an already-present Host header, which should not be relied upon.

Expected behavior

Each physical attempt should carry authority and authentication derived from its final endpoint. Endpoint selection must occur before signing, or the request must be re-signed after rerouting.

Acceptance criteria

• Retry to node B sends a Host header for node B.
• SigV4 authorization for each attempt is valid for that attempt's final request.
• Sync and async real-pipeline tests validate final wire-level authority and signing, not only SdkHttpRequest.getUri().
• Anonymous-authentication mode continues working.
• HTTP and HTTPS routing are covered.

Read BasicQueryPlanInterceptor.java:101-150 and the sync and async attempt-routing clients first, then inspect RetryDistributionTest.java:129-137 and the query-plan specification. Use the real-pipeline tests as the starting point for validating final wire-level Host and SigV4 behavior. Done means sync and async retries cover HTTP, HTTPS, and anonymous authentication, with each attempt authoritative for its final endpoint.