fix(proxies): set aside egress after repeated transport failures with cross-egress success

[maxmad64bis]

⚠️ base-red inherited: #14547

Summary

A pool member that is dead behind a healthy local probe was never set aside: tagged transport failures carry no upstream status, so the outcome path ignores them and the refusal memory never learns. Final tagged failures are now recorded per egress and destination host at the single end-of-request site, with successes through a different egress as counter-proof, and a member is set aside under a new transport refusal kind only when at least 3 tagged failures coincide with a completed response through a different egress inside a 5-minute window. Opt-in via the existing flag; retried-then-recovered attempts, isolated failures, globally unreachable destinations, direct egress and single-member pools never write.

Related Issues

• No linked issue — no existing report covers transport-tagged failures condemned only with cross-egress evidence (upstream searches transport set-aside / tagProxyUnreachable returned 0 covering issues).
• Related to fix(proxyHealth): promote connection failures with cross-proxy evidence #14776 (open, disjoint files): same cross-proof idea on sweep verdicts rather than the transport path; no collision, no action required.

Validation

• Change type: routing
• Focused tests and category gates from the golden path
• npm run lint (0 errors on touched files)
• Reconciled with the current active release base (release/v3.8.51); focused checks rerun afterward
• Production-code changes include a new automated test in this PR

Tests Added Or Updated

• New tests/unit/proxy-transport-setaside-cross-evidence.test.ts (10 cases): condemnation on 3 failures plus cross-egress success; no set-aside without cross-evidence; isolated failures (1-2) ignored; success through the same egress is not evidence; expired window ignored; flag-off writes nothing; null key ignored; single-member pool ignored with documented fallback when size is unknown; cooldown curve 60s then 120s through the real writer; store bounds. Failing before the change (helpers absent), 10/10 green after.
• Traffic simulation through the real fetch path (4/4).

Coverage Notes

• The change (open-sse/utils/proxyRefusalMemory.ts, open-sse/utils/proxyFetch.ts, src/sse/handlers/proxyOutcomeMemory.ts) is covered by the 2 new files above; neighbors kept green (single-file runs): refusal-memory, quota-tuning, outcome-memory, health-refusal-memory, and health-recovery suites 48/48; outcome-memory pair 18/18; undici-retry 10/10; pool-skips-refused 12/12; opencode refusal-memory 7/7; health-refusal 4/4. Lint clean on all touched files; core typecheck clean; cycle check OK.

Reviewer Notes

• Pointers: failure decision at open-sse/utils/proxyFetch.ts:1239 (tag read off the sanitized error) calling the helper at proxyRefusalMemory.ts:357, success hook at :1203 calling the helper at proxyRefusalMemory.ts:374; evidence stores and threshold predicate in open-sse/utils/proxyRefusalMemory.ts (:267-269 constants, :290/:302/:319 helpers, policy entry at :69, null-key cases at proxyEgressKey :133-153); single gated writer in src/sse/handlers/proxyOutcomeMemory.ts:56-66. Counter-proof is any completed dispatcher response, not strictly 2xx — deliberately broader than the 5-minute/2xx sketch in the design; template-style destinations remain the residual (conservative under-count, see Coverage Notes).
• The poolSize guard is advisory in production (size not yet threaded); condemning still requires another key's success.
• Docs Gates red is inherited (🔴 Release branch not green: release/v3.8.51 #14547); file-size rebaselined 1334→1341 (own key).

[diegosouzapw]

Thanks — the cross-egress evidence rule is careful and the traffic-simulation test is a great addition. Three things: (1) open-sse now lazily imports @/sse/handlers/proxyOutcomeMemory, which inverts the layering — could the callback be injected instead? (2) success evidence is recorded on every proxied request even with the flag off; gating it would avoid the hot-path cost. (3) poolSize is never passed, so the single-member guard described in the PR body isn't actually active. Please also confirm the new tests fail on the base version.