fix: align DeepSeek canary tool rounds with gate

memind-canary-proxy.test.mjs

@@ -287,6 +287,54 @@ test('identity lookup errors fail closed to stable', async (t) => {
   assert.equal(response.headers['x-memind-runtime-route'], 'stable');
 });
 
+test('candidate health fails closed when its DeepSeek compatibility dependency is down', async (t) => {
+  const stableServer = upstream('stable');
+  const candidateServer = upstream('candidate');
+  let dependencyHealthy = true;
+  const dependencyServer = http.createServer((req, res) => {
+    res.writeHead(req.url === '/health' && dependencyHealthy ? 200 : 503);
+    res.end();
+  });
+  const stableUrl = await listen(stableServer);
+  const candidateUrl = await listen(candidateServer);
+  const dependencyUrl = await listen(dependencyServer);
+  const proxy = createMemindCanaryProxy({
+    stableTarget: stableUrl,
+    candidateTarget: candidateUrl,
+    candidateHealthDependencies: [`${dependencyUrl}/health`],
+    policy: createCanaryPolicy({ usernames: ['john'] }),
+    identityResolver: {
+      async fromSessionToken() {
+        return { id: 'user-john', username: 'john' };
+      },
+      async fromWechatOpenid() {
+        return null;
+      },
+    },
+    diagnosticSecret: 'diagnostic-secret',
+    candidateHealthTtlMs: 0,
+  });
+  const proxyUrl = await listen(proxy.server);
+  t.after(async () => {
+    await close(proxy.server);
+    await close(stableServer);
+    await close(candidateServer);
+    await close(dependencyServer);
+  });
+
+  const candidate = await request(proxyUrl, {
+    headers: { cookie: 'tkmind_user_session=john-token' },
+  });
+  assert.equal(candidate.headers['x-memind-runtime-route'], 'candidate');
+
+  dependencyHealthy = false;
+  const fallback = await request(proxyUrl, {
+    headers: { cookie: 'tkmind_user_session=john-token' },
+  });
+  assert.equal(fallback.body, 'stable:');
+  assert.equal(fallback.headers['x-memind-runtime-route'], 'stable');
+});
+
 test('candidate health requires the explicit candidate runtime role', async (t) => {
   const stableServer = upstream('stable');
   const wrongRoleServer = upstream('stable');