fix(kanban): dispatch fallback skips rungs whose credential is cooling

[Kyzcreig]

Card t_6445986b.

Incident 2026-09-25: lane pool claude-bpr was budget-capped, so the dispatch fallback picked openai-codex while its credential was in cooldown. Every worker died at auth (worker_route_pin_refused rate_limited=true, exit 75), and each death stamped a rate_limited backoff, up to 45 min. The same thing was still happening live on the board on 09-26 (runs 11412-11419).

• (1) A rate-limited worker_route_pin_refused event marks the provider as cooling for kanban.credential_cooldown_seconds (default 1800, 0 disables). A cooling rung is skipped the same way an open rate-limit circuit is. A card whose own route is cooling is held with reason credential_cooldown.
• (2) If every rung is capped or cooling, the card is deferred: no spawn, no run, so no backoff stamp.
• (3) Ordering is priority DESC, created_at ASC. That was already the case; a test now pins it for the freed pool slot.
• (4) The deferred payload (fallback_skipped), the dispatch_provider_fallback event (skipped) and the route source string (dispatch-fallback(capped X; skipped openai-codex:credential_cooldown)) now name each skipped rung and the reason.

Tests: tests/hermes_cli/test_kanban_fallback_credential_cooldown.py. 8 pass on this branch; 4 fail on base.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[ang-fleet-lander]

🤖 merged-by: apollo · lane: discord · gate: BYPASS: FR paused by Ace 2026-09-22; Argus off card review (Ace 09-24 13:08); gate = CI green + Apollo read · why: kanban dispatcher: dispatch-fallback skips a rung whose credential recorded a rate-limited pin refusal / rate-limit circuit within the cooldown; holds the card instead of spawning into a dead rung (cost t_c7a20f1b 4 spawns + 2h backoff). Tests 37/0 (t_6445986b)

[ang-prism]

FleetReview

Review: post-merge · head 838bd59948d0 · duration 11m 05s
Profile: full recipe · policy: below-size-and-path-gates
Roster: B-assert-ctx → gpt-6-sol (openai), B-state → gpt-6-sol (openai), C-assert-xhigh → claude-code-opus-5-5 (anthropic), F → gpt-6-sol (openai), G → grok-4.6 (xai), L6 → gpt-6-sol (openai)

Post-merge review (fleetreview:post-merge override): this reviewed the merge commit against its first parent — the bytes that already shipped. It is not a pre-merge gate pass.

Confidence: 3/5

Findings

• P1 hermes_cli/kanban_db.py:14659 — One runtime 429 on a pinned pool provider holds every card on that provider for 30 min · agreed: B-assert-ctx,C-assert-xhigh,F (openai, anthropic)

---

FleetReview provenance · models: D=grok-4.6 · cost: $0.00 · duration: 15m 59s · rounds: 1 · files examined: 4