Rate limits
Account rate limits and upstream capacity are different conditions. Handle both without retry storms.
429
Honor Retry-After and use bounded backoff with jitter. The gateway fails over before output when another eligible key is available.
503 and 502
Unavailable capacity or an acquisition deadline returns 503. Transport/protocol exhaustion can return 502. Public errors do not expose supplier details.
Billing
A token ceiling is not an absolute monetary cap. Partial accepted generation may be settled even when the client disconnects. Inspect your account history rather than guessing whether a retry is free.