Claude apps gateway: billing errors should be failover-eligible, or configurable

The gateway's failover set is 5xx, 429, 401, 403, 404, 501, and timeouts. 402 billing_error is not included, so a billing failure on the primary upstream is returned to the client rather than retried against a healthy secondary upstream — even when that secondary serves the requested model and has budget.

This looks inconsistent with the set's own principle. 401 and 403 are included, and those are account-state failures rather than request-shaped ones — the same family 402 belongs to. Credit exhaustion is arguably the canonical case for multi-upstream failover: the request is fine, one upstream's account cannot serve it, and another can.

We hit this on 2026-07-31 with an Anthropic-primary / Bedrock-failover configuration. The Anthropic balance hit zero, every model failed, and Bedrock was never contacted once — including for claude-opus-5, which Bedrock serves and which we had force-tested successfully hours earlier.

Requesting either that billing errors be added to the failover set, or a per-upstream failover_on / retryable_status_codes option so operators can decide. We understand the counter-argument that failing over on billing silently converts a billing outage into spend on another provider — which is why configurable seems preferable to a fixed default either way.

Additional note

In our incident the credit-exhaustion error actually arrived as 400 invalid_request_error, not 402, despite the error reference documenting 402 - billing_error for exactly this case. That is a separate issue we are reporting through Console support. Flagging it here because fixing only the classification would not help: 402 is not in the failover set either, so both would need to change for failover to engage.