Preserve delegation work through any upstream outage, not just budget

An exhausted budget was a special case of something more general: the
work is not at fault. A network blip, a timeout, a 5xx from the proxy,
or a rate limit that did not clear all leave a delegation branch that
may be perfectly good, and discarding it would throw away work for a
reason that has nothing to do with the work.

UpstreamUnavailable now names that family, with BudgetExhausted a
member of it — distinguishable where the difference matters, since a
budget will not clear within the hour while a network blip will. A
delegation stopped by any of them is "interrupted": branch kept,
intent left pending, and A3's resume rule picks it up.

The benefit of the doubt stops at the server's own door. A 4xx that is
not a rate limit means the request itself was wrong, and preserving
branches on the strength of one would hide a real bug — so those still
fail and clean up.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nisse-dev/tests/test_llm.py

@@ -15,10 +15,12 @@ from nisse_dev.llm import (
     DEFAULT_MAX_OUTPUT_TOKENS,
     RATE_LIMIT_RETRY_S,
     AnthropicPassthroughClient,
+    BudgetExhausted,
     LiteLLMClient,
     LLMError,
     RoleMap,
     TruncatedResponse,
+    UpstreamUnavailable,
     has_native_adapter,
     max_output_tokens,
     select_client,
@@ -343,3 +345,38 @@ def test_truncation_is_an_llm_error_so_callers_already_handle_it() -> None:
     # The planner retries, the executor and delegation gate. None of them
     # need to learn a new exception type.
     assert issubclass(TruncatedResponse, LLMError)
+
+
+def test_a_5xx_is_upstream_trouble() -> None:
+    client = make_client(lambda request: httpx.Response(503, text="bad gateway"))
+    with pytest.raises(UpstreamUnavailable, match="503"):
+        client.complete(EVENTS, tools=None, model="local-fast")
+
+
+def test_a_connection_failure_is_upstream_trouble() -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        raise httpx.ConnectError("refused")
+
+    with pytest.raises(UpstreamUnavailable, match="request failed"):
+        make_client(handler).complete(EVENTS, tools=None, model="local-fast")
+
+
+def test_a_persistent_rate_limit_is_upstream_trouble() -> None:
+    # It cleared for neither attempt, so the caller should keep its work
+    # rather than discard it.
+    client = make_client(lambda request: httpx.Response(429, text="slow down"))
+    with pytest.raises(UpstreamUnavailable):
+        client.complete(EVENTS, tools=None, model="local-fast")
+
+
+def test_a_bad_request_is_not_upstream_trouble() -> None:
+    client = make_client(lambda request: httpx.Response(400, text="bad schema"))
+    with pytest.raises(LLMError) as excinfo:
+        client.complete(EVENTS, tools=None, model="local-fast")
+    assert not isinstance(excinfo.value, UpstreamUnavailable)
+
+
+def test_budget_refusal_is_a_kind_of_upstream_trouble() -> None:
+    # So one catch covers the family, but it can still be told apart where
+    # the difference matters — it will not clear within the hour.
+    assert issubclass(BudgetExhausted, UpstreamUnavailable)