fix(auxiliary): retry transient blips harder + isolate client cache per model (#56889)

Two related hardening fixes for auxiliary calls (which include MoA reference
advisors — a pinned-model path where provider fallback is not a meaningful
recovery):

1. Transient-transport retries: the same-provider retry on a connection reset /
   timeout / 5xx / 408 was a single attempt, then fallback. For a pinned aux
   call a second blip silently loses the call (root of the run2 double-advisor
   'Connection error' collapse — a genuine upstream blip). Now retries N times
   with exponential backoff, N = auxiliary.transient_retries (default 2 -> 3
   total attempts, clamped [0,6]). Compression-on-timeout fast-fail carve-out
   preserved.

2. Per-model client-cache isolation: _client_cache_key excluded the model, so
   two concurrent auxiliary calls to the same provider/base_url/key but
   different models (e.g. an opus + gpt-5.5 MoA fan-out) shared one cache entry
   and could race each other's client lifecycle. Model now participates in the
   key -> distinct clients, no cross-call races. Same-model reuse unchanged.

- agent/auxiliary_client.py: _transient_retry_count() + backoff loop; model in
  _client_cache_key and both call sites.
- hermes_cli/config.py: auxiliary.transient_retries default (2).
- tests: new retry/isolation tests; updated 2 stale-expectation tests to the
  corrected behavior (per-model resolve; N-retry escalation).

Backoff base is overridable (_TRANSIENT_RETRY_BACKOFF_BASE) so tests don't sleep.

tests/agent/test_auxiliary_client.py

@@ -1523,7 +1523,13 @@ class TestAuxiliaryPoolAwareness:
 
         assert client is fake_client
         assert model == "openai/gpt-5.4-mini"
-        assert mock_resolve.call_count == 1
+        # A DIFFERENT model resolves its own client (model participates in the
+        # cache key). This isolation is what stops two concurrent advisors on
+        # the same provider/base_url/key (e.g. a MoA fan-out) from sharing — and
+        # racing the lifecycle of — one cached client. Same-model reuse is still
+        # a single resolve (verified elsewhere); distinct models => distinct
+        # resolves.
+        assert mock_resolve.call_count == 2
 
 
 # ── Payment / credit exhaustion fallback ─────────────────────────────────
@@ -2581,6 +2587,8 @@ class TestTransientTransportRetry:
         p1, p2, p3 = self._patches(primary)
         with (
             p1, p2, p3,
+            patch("agent.auxiliary_client._transient_retry_count", return_value=1),
+            patch("agent.auxiliary_client._TRANSIENT_RETRY_BACKOFF_BASE", 0.0),
             patch(
                 "agent.auxiliary_client._try_configured_fallback_chain",
                 return_value=(None, None, ""),
@@ -2592,7 +2600,7 @@ class TestTransientTransportRetry:
         ):
             result = call_llm(task="compression", messages=[{"role": "user", "content": "hi"}])
         assert result == {"fallback": True}
-        # Primary tried twice (initial + same-target retry), then fallback.
+        # Primary tried twice (initial + one same-target retry), then fallback.
         assert primary.chat.completions.create.call_count == 2
         assert fb_client.chat.completions.create.call_count == 1
 

tests/agent/test_auxiliary_transient_retry.py

@@ -0,0 +1,82 @@
+"""Transient-transport retry count + per-model client-cache isolation.
+
+Two related hardening behaviors for auxiliary calls (which include MoA
+reference advisors, a pinned-model path where provider fallback is not a
+meaningful recovery):
+
+1. A transient transport blip (connection reset / timeout / 5xx) is retried
+   on the SAME provider several times with backoff before giving up — a single
+   upstream blip should not silently lose a pinned auxiliary call (root of the
+   run2 double-advisor "Connection error" collapse).
+2. Two auxiliary calls to the same provider/base_url/key but DIFFERENT models
+   get DISTINCT client-cache keys, so a concurrent fan-out (e.g. opus + gpt-5.5
+   advisors) never shares one client entry.
+"""
+
+from __future__ import annotations
+
+import os
+import types
+from unittest.mock import patch
+
+import pytest
+
+
+class _ConnErr(Exception):
+    """Stand-in that the transient detector recognizes as a connection blip."""
+
+
+def test_transient_retry_count_default(monkeypatch):
+    from agent import auxiliary_client as ac
+
+    # No config value -> default.
+    monkeypatch.setattr(ac, "load_config", lambda: {}, raising=False)
+    with patch("hermes_cli.config.load_config", return_value={}), \
+         patch("hermes_cli.config.cfg_get", return_value=None):
+        assert ac._transient_retry_count() == ac._DEFAULT_TRANSIENT_RETRIES
+
+
+def test_transient_retry_count_configurable_and_clamped():
+    from agent import auxiliary_client as ac
+
+    with patch("hermes_cli.config.cfg_get", return_value=4):
+        assert ac._transient_retry_count() == 4
+    with patch("hermes_cli.config.cfg_get", return_value=100):
+        assert ac._transient_retry_count() == 6  # clamped high
+    with patch("hermes_cli.config.cfg_get", return_value=-3):
+        assert ac._transient_retry_count() == 0  # clamped low
+    with patch("hermes_cli.config.cfg_get", side_effect=RuntimeError):
+        assert ac._transient_retry_count() == ac._DEFAULT_TRANSIENT_RETRIES
+
+
+def test_model_participates_in_client_cache_key():
+    """Same provider/base_url/key, different model -> different cache key.
+
+    This is what stops two concurrent advisors from sharing (and racing on)
+    one cached client entry."""
+    from agent.auxiliary_client import _client_cache_key
+
+    k_opus = _client_cache_key(
+        "openrouter", async_mode=False, base_url="https://openrouter.ai/api/v1",
+        api_key="K", model="anthropic/claude-opus-4.8",
+    )
+    k_gpt = _client_cache_key(
+        "openrouter", async_mode=False, base_url="https://openrouter.ai/api/v1",
+        api_key="K", model="openai/gpt-5.5",
+    )
+    assert k_opus != k_gpt
+    # Same model still collides (cache still works for reuse).
+    k_opus2 = _client_cache_key(
+        "openrouter", async_mode=False, base_url="https://openrouter.ai/api/v1",
+        api_key="K", model="anthropic/claude-opus-4.8",
+    )
+    assert k_opus == k_opus2
+
+
+def test_missing_model_key_is_stable():
+    """Omitting model (legacy callers) is still a valid, stable key."""
+    from agent.auxiliary_client import _client_cache_key
+
+    a = _client_cache_key("openrouter", async_mode=False, base_url="u", api_key="k")
+    b = _client_cache_key("openrouter", async_mode=False, base_url="u", api_key="k")
+    assert a == b