[MotionDevLab]

Summary

Follow-up to #6. The 5xx branch in src/proxy/server.ts called
keyManager.recordRequest(key.id, { ... successful: false }) and then, on the
last attempt, fell through to the tail recorder instead of continue-ing —
counting one upstream 5xx twice (requestCount +2, errorCount +2, latency
sample folded twice).

Changes (2 files, +13/−8)

• src/proxy/server.ts — wraps the branch recorder in
  if (attempt < maxAttempts - 1), the exact pattern of f85cb2e, so
  failover attempts count in-branch and the terminal attempt counts once at
  the tail.
• src/dashboard/public/app.js — display-only: adds the throttle-403 → short cooldown + failover legend chip and retitles the other 4xx neighbor so it
  no longer claims 403s.

Behavior guarantee

The ONLY behavior change is which of two identical-valued recordRequest
calls executes. Breaker feed, markError, attemptedKeyIds, circuit-open
emit, cooldowns, affinity, quota/throttle/burst paths: byte-identical.

Verification

• npm run typecheck green; npm run build (tsc + dashboard-public copy) green.
• Hermetic drill (temp configDir, spare ports, stub 500 upstream, fake keys,
  NTFY off) 9/9 PASS: per-key request/error exactly 1/1, breaker 1/0 per the
  first-5xx-only feed design (server.ts:253-258), both keys active,
  verbatim 500 back.
• Wart-detection stash-proof: stashed (original) code shows key2.requestCount === 2 / errorCount === 2; fixed code shows 1/1.
• Legend checks: node --check passes; throttle-403 and genuine auth 403s
  each appear exactly once in built dist output.
• Live check after restart: one proxied session, serving key +4/+3/+1
  (req/ok/err, last 200) — no +2 signature, counters honest.

Plan: 2026-10-10-5xx-last-attempt-double-count (amended mid-flight: breaker
assertion corrected 1-per-key → 1/0 with server.ts:253-258 citation, plus §7
erratum entry; executed proof is the empirical settler).