Three bugs caused ME writers to not be properly removed when ME
connections flapped:
1. Reader task's unconditional ws.retain() removed writers from the
pool Vec without going through remove_writer_only(), skipping
registry cleanup, quarantine, and refill side effects. Fixed by
moving retain inside the cleanup_done CAS block as shutdown-only
fallback.
2. Draining writers bypassed quarantine entirely because trigger_refill
gated both quarantine and refill. Separated: quarantine now runs for
all removals (flapping endpoint is unstable regardless of drain
state), refill remains non-draining only.
3. connectable_endpoints() returned quarantined endpoints immediately
when all DC endpoints were quarantined, nullifying the circuit
breaker for single-endpoint DCs. Now waits for quarantine expiry
with proper Mutex guard drop before sleep.
Also normalized the CAS ordering in ping task cleanup to match the
reader task (CAS-first, then pool.upgrade check).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Maksim Sirotenko