[maxmad64bis]

⚠️ release/v3.8.50 is red (#9985) — based on upstream/release/v3.8.50 at c130f2aa1.

Summary

Health checks and real requests share the same code path. A health check that gets a 403 currently bans the connection for a year — same as a real user being blocked. No user was blocked, but the connection is removed from the pool until an operator re-enables it.

#10694 already fixed this for most cases. This PR makes the rule explicit: one helper, every terminal write goes through it. Health-check failures are logged but never disable the connection; real requests are unchanged.

Related Issues

Related to #11006

Changes

• src/shared/utils/terminalStatus.ts — single helper that writes terminal states: health-check origin only records the error, real-request origin disables as before; double-gated (explicit origin + check) so queued health checks are still isolated
• open-sse/handlers/chatCore.ts — banned, deactivated, and quota-exhausted sites now go through the helper (duplicated probe guards removed, log kept); temporary states and per-model locks stay outside
• tests/unit/terminal-status-origin.test.ts — health-check leaves the connection active, real request disables it

Out of scope for this PR: health-check sweep and account-unavailable paths are already outside health-check context or correctly guarded — expanding the helper there is a follow-up.

Testing

• node --import tsx/esm --test tests/unit/terminal-status-origin.test.ts tests/unit/probe-testall-isolation.test.ts — 6/6
• npm run lint / typecheck:core / check:cycles — 0 / 0 / OK

Checklist

• Focused checks rerun after rebase (n/a — fresh worktree on c130f2aa1)
• Reconciled with the current active release base; focused checks rerun afterward (base-red — will rebase when release/v3.8.50 turns green)
• No AI attribution

Reviewer Notes

• No behavior change — the sites already had the guard. The helper just removes duplication and makes it impossible to add a new terminal write without an origin.
• Temporary states and per-model quota locks are not terminal and stay outside the helper by design.
• The double check in the helper is not redundant — a health check that queued through the rate limiter is still isolated.