[maxmad64bis]

⚠️ release/v3.8.50 is red (#9985) — based on upstream/release/v3.8.50 at c130f2aa1.

Summary

When a multi-account provider fails, OmniRoute backs off one account and picks another. Right now a temporary quota on one account and a dead credential look the same — both just cool down and get retried forever. This PR teaches the rotation to tell them apart: temporary failures only cool down, repeated permanent failures retire that account from rotation until a success clears it.

No new table or setting — just an in-memory flag reset on success or on the next account sync. Single-account providers are unchanged.

Related Issues

Related to #11006

Changes

• open-sse/executors/accountRotation.ts — markCooldown now takes kind transient (quota, network) vs terminal (permanent), defaulting to transient so every existing caller stays valid; after 3 consecutive terminals the account is evicted and skipped by pickAccount unless every account is evicted (always returns an account rather than hanging); markSuccess clears the eviction
• open-sse/executors/opencode.ts — wrapper forwards the kind (no caller passes terminal yet — that mapping belongs to a follow-up, see Reviewer Notes)
• tests/unit/account-rotation-lot-c.test.ts — 5 tests: transient never evicts, terminal evicts at 3 and is skipped, all-evicted fallback still returns an account, success clears

Testing

• node --import tsx/esm --test tests/unit/account-rotation*.test.ts — 17/17
• npm run lint / typecheck:core / check:cycles — 0 / 0 / OK

Checklist

• Focused checks rerun after rebase (n/a — fresh worktree on c130f2aa1)
• Reconciled with the current active release base; focused checks rerun afterward (base-red — will rebase when release/v3.8.50 turns green)
• No AI attribution

Reviewer Notes

• The threshold 3 is just a testable bound, not a rule — adjust it in review.
• No caller passes terminal yet; wiring a real classification (e.g. account deactivated) is deliberately deferred to avoid coupling rotation to error taxonomy in this PR.
• Eviction is in-memory only, cleared on success or on the next sync from config — a restart clears it too, which is fine for a cooldown-tier state (unlike a banned connection).