Debrid-Link stability: stop double-blocking, shorter transport cooldown, max-wins

User reported Debrid-Link "often jumps into provider-cooldown" and feels
unstable. Root cause was four cooperating bugs that turned isolated key-level
failures into provider-wide multi-minute outages.

Fix 1: Skip provider-wide circuit breaker for ALL Debrid-Link errors
  (download-manager.ts ~8689)
  Previously only the explicit `debrid_link_cooldown:` sentinel was bypassed;
  every other Debrid-Link error (terminal failures, timeouts, parse errors)
  still went through recordProviderFailure() + applyProviderBusyBackoff(),
  applying a provider-wide cooldown ON TOP of the per-key cooldown debrid.ts
  already managed. Now any error message containing "debrid-link" or where
  the failure key is "debridlink" skips the provider-level circuit breaker
  entirely. Per-key cooldowns alone are the right granularity.

Fix 2: Transport errors get a short 15s cooldown, not 2 min
  (debrid.ts ~2684)
  A single network timeout / ECONNRESET was parking the key for 2 full
  minutes. With 9 keys all of which might experience the same transient
  issue at different moments, this could cascade into all keys cooling
  down for 2 min each. Now isolated transport hiccups get 15s while real
  API/server problems still get the full 2 min.

Fix 3: HTTP 200 with success:false (no error code) is now temporary, not fatal
  (debrid.ts ~2691)
  Previously these went through to the fallthrough "fatal: true" which
  permanently failed the item. Now they get a 30s temporary cooldown and
  the item retries on the next key.

Fix 4: setDebridLinkKeyCooldownState is max-wins under concurrent calls
  (debrid.ts ~135)
  When 8 parallel items all hit the same key with floodDetected, each
  computes its own cooldown duration and calls setDebrid LinkKeyCooldown
  State. Without max-wins, the LAST setter could shorten the cooldown
  (e.g. one item read a 1h Retry-After header, another defaulted to 2 min;
  the 2 min would then overwrite the 1h). Now the longer cooldown wins,
  with rate_limit/quota/invalid categories also winning over plain
  temporary regardless of duration.

Tests: 201/201 (debrid + download-manager) green.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/main/debrid.ts

@@ -142,7 +142,30 @@ function setDebridLinkKeyCooldownState(
     clearDebridLinkKeyCooldownState(keyId);
     return;
   }
-  debridLinkKeyCooldowns.set(keyId, Date.now() + Math.max(1000, Math.floor(cooldownMs)));
+  // Cooldown set: max-wins. When 8 parallel items hit floodDetected on the
+  // same key, each computes its own retry-after and calls setDebridLinkKey
+  // CooldownState. Without max-wins, the LAST setter could shorten the
+  // cooldown (e.g. one item got a 1h Retry-After header, another got the
+  // default 2 min — without max-wins the 2 min would overwrite the 1h).
+  // Quota and rate_limit categories take priority over generic temporary
+  // cooldowns regardless of duration to preserve the more-specific signal.
+  const newUntil = Date.now() + Math.max(1000, Math.floor(cooldownMs));
+  const existingUntil = Number(debridLinkKeyCooldowns.get(keyId) || 0);
+  const existingDetail = debridLinkKeyCooldownDetails.get(keyId);
+  const newIsStrongCategory = category === "rate_limit" || category === "quota" || category === "invalid";
+  const existingIsStrongCategory = existingDetail
+    ? (existingDetail.category === "rate_limit" || existingDetail.category === "quota" || existingDetail.category === "invalid")
+    : false;
+  // Keep existing if it's still active and either lasts longer or has a stronger category
+  if (existingUntil > Date.now()) {
+    if (existingUntil >= newUntil && (!newIsStrongCategory || existingIsStrongCategory)) {
+      return;
+    }
+    if (existingIsStrongCategory && !newIsStrongCategory) {
+      return;
+    }
+  }
+  debridLinkKeyCooldowns.set(keyId, newUntil);
   debridLinkKeyCooldownDetails.set(keyId, { message, category });
   setDebridLinkKeyRuntimeStatus(keyId, mapDebridLinkCooldownCategoryToRuntimeState(category), message);
 }
@@ -2682,13 +2705,32 @@ class DebridLinkClient {
     }
 
     if (isRetryableErrorText(errorText) || /debrid-link.*(json|html)/i.test(errorText)) {
+      // Distinguish a single transient transport error (timeout, network blip,
+      // ECONNRESET) from a real API/server problem. Single timeouts shouldn't
+      // park a key for 2 full minutes — that just delays parallel work for
+      // no reason. Use a short 15s cooldown for transport, full 2min only
+      // for things that look like server-side faults (5xx HTML pages, etc).
+      const isTransport = /timeout|network|fetch failed|aborted|econnreset|enotfound|etimedout|socket/i.test(errorText)
+        && !(error instanceof DebridLinkApiError);
       return {
         fatal: false,
-        cooldownMs: DEBRID_LINK_KEY_COOLDOWN_MS,
+        cooldownMs: isTransport ? 15_000 : DEBRID_LINK_KEY_COOLDOWN_MS,
         message: errorText || "temporärer Transportfehler"
       };
     }
 
+    // HTTP 200 with success:false but no recognizable error code: don't kill
+    // the item permanently. Treat as a temporary blip — same key can be tried
+    // again after a short cooldown, or another key picked up.
+    if (errorText && /success.*false|kein.*json|empty.*response/i.test(errorText)) {
+      return {
+        fatal: false,
+        cooldownMs: 30_000,
+        message: errorText,
+        category: "temporary"
+      };
+    }
+
     return {
       fatal: true,
       cooldownMs: 0,