fix(codeartifact): verify GOAWAY recovery and retain diagnostics

.github/workflows/ci.yml

@@ -22,6 +22,17 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Activate Hermit
         run: ./bin/hermit env --raw >> "$GITHUB_ENV"
+      - name: Install pinned uv for recovery tests
+        run: |
+          archive="$RUNNER_TEMP/cachew-test-uv.tar.gz"
+          curl --fail --location --retry 3 \
+            https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz \
+            --output "$archive"
+          printf '%s  %s\n' \
+            2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f "$archive" \
+            | sha256sum --check --strict
+          tar --extract --gzip --file "$archive" --directory "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/uv-x86_64-unknown-linux-gnu" >> "$GITHUB_PATH"
       - name: Run tests
         run: just test
   lint:

README.md

@@ -288,6 +288,13 @@ Failures before response headers use bounded statuses in those same metrics:
 `transport_connection`, or `transport_error` for other failures. Logs include
 only that status, never the origin URL or signed redirect URL.
 
+Incomplete streamed origin bodies abort the downstream transfer rather than
+completing a partial response. Recognized HTTP/2 GOAWAY body errors use the bounded
+`http2_goaway` classification, subject to existing error and cancellation precedence.
+Stream-failure logs may also include `http2_error_code` and `http2_last_stream_id`;
+these fields are not metric labels, and these logs omit peer-provided debug text.
+Unknown or malformed GOAWAY metadata retains the generic transport classification.
+
 Authorization tokens are reused in-process. The default 12-hour token enters
 proactive refresh one hour before expiration; one request performs each refresh
 attempt under a detached, bounded context while concurrent requests continue

internal/strategy/codeartifact.go

@@ -22,7 +22,10 @@ import (
 	"github.com/block/cachew/internal/packagepolicy"
 )
 
-const codeArtifactUsername = "aws"
+const (
+	codeArtifactUsername             = "aws"
+	codeArtifactStatusClientCanceled = "client_canceled"
+)
 
 const (
 	defaultCodeArtifactOriginHeaderTimeout   = 30 * time.Second