fix(credentials): do not cool down keys for at-capacity errors - #6

Fix for the at-capacity cooldown incident on the single-key deployment. Any terminal upstream failure used to call recordFailure, including at-capacity errors that arrive as statusless SSE error events and transient failures that are retried and eventually succeed. With one credential, that benched the only key for 60s and every request failed in ~1ms with NoAvailableCommandCodeCredentialError until the window expired.

Changes

src/commandcode.ts (alpha /alpha/generate path)

• Only credential-scoped statuses (401/402/403, isFatalCredFailure) record a failure and start a cooldown; HTTP non-ok 429/5xx responses, empty bodies, stream error events and network errors now call finalizeRelease() — releasing the in-flight slot without touching disabledUntil.
• Statusless upstream stream error events are never recorded as credential faults. They are still retried while no visible event has been emitted, then forwarded to the caller as-is.
• Renamed finalizeCallerAbort to finalizeRelease and routed the abort path through it, so caller aborts no longer leave a cooldown.
• Attempt zero: when the router reports NoAvailableCommandCodeCredentialError, selection is retried with ignoreCooldown: true so a cooling credential can still serve instead of failing the request.

src/provider.ts (provider /provider/v1/chat/completions path)

• Same release policy: added finalizeRelease and made both the !response.ok branch and the thrown-error branch record a failure only for fatal credential statuses (401/402/403); everything else releases.
• Fatal credentials are still excluded from further attempts within the request.

tests/commandcode.test.ts

• Added four regression tests: retry-then-success leaves no stale cooldown; a statusless at-capacity error does not cool the key; exhausted 429 retries do not cool the key; an injected cooldown is served through.
• No wire-format or API-shape changes; existing failover, opaque-retryable-error and abort tests are unchanged.

Resulting behavior

An at-capacity response now retries within the request (default budget 5 attempts, ~3.75s of backoff worst case). If it still fails, or if visible output was already streamed, the upstream error is forwarded to the caller — an in-band SSE error frame (commandcode_event_error) for streaming, HTTP 502 JSON for non-streaming — and no cooldown is recorded, so the next request is served normally.

Tests

• tsc --noEmit, eslint and the build pass.
• Full vitest suite: 265 passed, 4 pre-existing Windows-only failures (path separators, 0600 permissions, executable bits, launchctl ENOENT).