fix: key rotation infinite suspension loop, round-robin broken, strike decay, WA double-reject

Bug A (Critical) — multi-provider-key-rotator.cjs
recordFailure() used a plain assignment for blacklistedUntil:
ks.blacklistedUntil = Date.now() + cooldown;
When a perm-suspended key is used as last-resort and receives another 429,
recordFailure() is called again (strikes stay at MAX_STRIKES, cooldown = PERM).
The assignment RESETS the timer to a fresh 16h window even if only 1h had passed.
In a 429-storm with all keys exhausted, this causes an infinite rolling 16h
suspension — keys never recover.

Fix: Math.max() so existing longer suspensions are never shortened.
ks.blacklistedUntil = Math.max(ks.blacklistedUntil || 0, Date.now() + cooldown);

Bug B (Critical) — multi-provider-key-rotator.cjs
The last-resort path in nextKey() (all keys suspended) returned a key without
updating p.idx. Normal and saturated paths both advance p.idx after picking, so
the next call starts from a different position. The last-resort path did not,
causing the same key (index 0, or whichever had the earliest expiry) to be
picked on every call — round-robin completely broken when all keys are suspended.

Also: the scan started at 0, ignoring p.idx, so even if expiries differed the
selection was not round-robin-fair.

Fix: scan from p.idx (same as normal path) so ties in expiry are broken by
position, and advance p.idx after pick.

Bug C (Medium) — multi-provider-key-rotator.cjs
isActive() cleared blacklistedUntil on expiry but left strikes unchanged.
A key with 2 strikes that served its full 240s cooldown came back with
strikes=2. The very next 429 immediately pushed it to strike 3 = 16h
perm-suspend, regardless of how long ago the previous failures were.

Practical scenario: 3 rate-limits spread over several hours on a free-tier
Gemini key → permanent 16h suspension. Intended for truly exhausted keys,
not intermittent rate-limits.

Fix: decrement strikes by 1 in isActive() when a blacklist expires naturally
(served full cooldown). The key still needs a successful response to fully
reset, but one cooldown served = one strike forgiven.

Bug D (Minor) — wa-guardian.js
createConnection() timeout callback called ws.close() without setting
resolved=true first. ws.close() can synchronously emit an 'error' event
on some WebSocket states (readyState CONNECTING/CLOSING), which triggered
the ws.on('error') listener → if (!resolved) reject(e) — a second reject on
an already-rejected Promise. Silently swallowed by JS but emitted a spurious
error log line that could mask real errors.

Fix: set resolved=true in the timeout callback before calling ws.close().

multi-provider-key-rotator.cjs

@@ -177,6 +177,12 @@ if (fallbackCount > 0)
 /**
  * Is this key currently sitting out?
  * Also auto-clears expired blacklists so the key re-enters the pool silently.
+ * Strike decay: each time a blacklist period expires naturally (served its
+ * full cooldown without a success), we reduce strikes by 1.  This prevents a
+ * key from being permanently suspended just because it was rate-limited 3 times
+ * over a long period (e.g. 3 × 429s spread across hours on a free-tier quota).
+ * A key that truly has quota exhausted will simply accumulate strikes again on
+ * the next requests and settle back into long suspension.
  */
 function isActive(p, key) {
   const ks = p.keyState.get(key);
@@ -184,7 +190,11 @@ function isActive(p, key) {
   if (ks.blacklistedUntil === 0) return true;    // not blacklisted
   if (Date.now() >= ks.blacklistedUntil) {
     ks.blacklistedUntil = 0;                     // expired → back in pool
-    debug(`[key-rotator] ${p.name}: ...${key.slice(-6)} back in pool`);
+    // Decay strikes by 1 on natural expiry so a key that served its full
+    // cooldown gets a partial fresh start.  It still needs a success to fully
+    // reset, but this prevents instant perm-suspension on the very next 429.
+    if (ks.strikes > 0) ks.strikes -= 1;
+    debug(`[key-rotator] ${p.name}: ...${key.slice(-6)} back in pool (strikes now ${ks.strikes})`);
     return true;
   }
   return false;
@@ -221,7 +231,11 @@ function recordFailure(p, key) {
     debug(`[key-rotator] ${p.name}: ...${key.slice(-6)} strike ${ks.strikes}/${MAX_STRIKES} — backoff ${secs}s`);
   }
 
-  ks.blacklistedUntil = Date.now() + cooldown;
+  // Use Math.max so a longer existing suspension is never shortened.
+  // This matters when a last-resort key (already perm-suspended) gets another
+  // 429 — without Math.max the timer would reset to a fresh 16 h window,
+  // potentially looping forever and keeping all keys in perpetual suspension.
+  ks.blacklistedUntil = Math.max(ks.blacklistedUntil || 0, Date.now() + cooldown);
 }
 
 /**
@@ -338,12 +352,17 @@ function nextKey(p) {
   }
 
   warn(`[key-rotator] ${p.name}: all ${total} key(s) suspended — using soonest-recovering key`);
-  let best = p.keys[0], bestExpiry = Infinity;
-  for (const k of p.keys) {
-    const exp = p.keyState.get(k)?.blacklistedUntil ?? 0;
-    if (exp < bestExpiry) { best = k; bestExpiry = exp; }
+  // FIX: scan from p.idx (same round-robin start as normal path) so ties in
+  // expiry are broken by position — every key gets equal turns even when all
+  // are suspended with the same blacklistedUntil timestamp.
+  let bestIdx = -1, bestExpiry = Infinity;
+  for (let offset = 0; offset < total; offset++) {
+    const i = (p.idx + offset) % total;
+    const exp = p.keyState.get(p.keys[i])?.blacklistedUntil ?? 0;
+    if (exp < bestExpiry) { bestIdx = i; bestExpiry = exp; }
   }
-  return best;
+  p.idx = (bestIdx + 1) % total; // advance for next call
+  return p.keys[bestIdx];
 }
 
 // ─── Auth header injection ────────────────────────────────────────────────────

wa-guardian.js

@@ -123,7 +123,9 @@ async function createConnection() {
     });
 
     ws.on("error", (e) => { if (!resolved) reject(e); });
-    setTimeout(() => { if (!resolved) { ws.close(); reject(new Error("Timeout")); } }, 10000);
+    // FIX: set resolved=true before ws.close() so the error listener above does not
+    // fire a second reject when close() triggers a WebSocket error event (double-reject).
+    setTimeout(() => { if (!resolved) { resolved = true; ws.close(); reject(new Error("Timeout")); } }, 10000);
   });
 }