fix(auth): lower transient error cooldown default to 10s

[warelik]

Summary

Lowers the effective default transient-error cooldown from 60 seconds to 10 seconds.

A single transient 5xx/408 blip was sidelining a genuinely-live account or model for a full minute. With several auths sharing the same upstream model, one gateway hiccup could cause a service blackout. The legacy transientErrorCooldown constant is now 10s, and the example config documents the new default. The transient-error-cooldown-seconds knob remains fully configurable for the normal transient-error path.

Note on ErrorCodeForceCooldown

transientErrorCooldown also backs the two ErrorCodeForceCooldown fallbacks in conductor_cooldown.go (model state at line ~928 and auth state at line ~2029: now.Add(transientErrorCooldown)). These enforce request-scoped stop-and-cooldown / continue-and-cooldown rules. That path uses the same constant directly and is intentionally not gated by transient-error-cooldown-seconds, so those forced cooldowns also drop from 60s to 10s. This is consistent with the blackout-avoidance rationale: a force-cooldown rule should not sideline a live account for a full minute either. A code comment has been added to conductor_refresh.go to make this explicit.

Cross-link

Mirror PR in upstream CLIProxyAPI: #5140

Related work

• Quota-429 ladder hardening is handled in fix(auth): floor quota cooldown at the escalating ladder #198 (this repo) and #5130 (upstream). Those PRs are related but not in conflict with this change.

Test plan

• sdk/cliproxy/auth/conductor_overrides_test.go pins the new default at ~10s.
• go test ./sdk/cliproxy/auth/... and go build ./... pass.

[warelik]

Review verdict: APPROVED (posted as COMMENT; GitHub rejects APPROVE on your own PR).

The PR lowers the built-in transient-error cooldown default from 60s to 10s by changing the single transientErrorCooldown constant, which feeds all three use sites: the nextTransientErrorRetryAfter default path (conductor_cooldown.go:94) and the two ErrorCodeForceCooldown fallbacks (conductor_cooldown.go:928 and :2029). The transient-error-cooldown-seconds knob semantics (0 = built-in default, -1 = disable, N = explicit seconds) are untouched. The one duration-sensitive test is updated with a ±5s window around the new 10s target; the measured value lands just under 10s, so no flake risk. I found no other code, tests, or docs pinning the old 60s value. I did not re-run the test plan; the diff is consistent with it.

Non-blocking notes:

1. See the inline comment on conductor_refresh.go: the request-scoped stop-and-cooldown / continue-and-cooldown force-cooldown path shares this constant and ignores the config knob, so those rules drop from 60s to 10s with no operator override. Worth confirming as intended.
2. config.example.yaml now says keep the legacy 10-second cooldown — 10s is the new default rather than a legacy behavior, so use the default 10-second cooldown would read better (it does at least match the SetTransientErrorCooldownSeconds doc comment terminology).

Mirror PR router-for-me/CLIProxyAPI#5140 is identical; the same review applies there.

[warelik]

Review verdict: APPROVED — re-review of head 07edc93 (posted as COMMENT; GitHub rejects APPROVE on your own PR).

The new docs commit fully addresses my previous inline feedback, in two places:

1. The code comment on transientErrorCooldown documents exactly the dual role I flagged: default for 408/500/502/503/504 transient errors (via nextTransientErrorRetryAfter) and the enforced fallback for request-scoped stop-and-cooldown / continue-and-cooldown rules, with the latter not consulting the transient-error-cooldown-seconds knob. I verified this against conductor_cooldown.go (:94, :928, :2029) — the comment is accurate. Const-block formatting stays gofmt-clean (the comment line starts a new alignment run, so the single-space = is correct).
2. The PR description now has an explicit Note on ErrorCodeForceCooldown section calling out the 60s-to-10s behavior change on that path and stating it is intentional — exactly the call-out I asked for.

Nothing else changed since my prior approval. The remaining notes from that review (the config.example.yaml legacy wording, and the force-cooldown path having no operator override) were non-blocking and stand as recorded. Ready to merge.