Function degradation_failure 

pub fn degradation_failure(
    fail_on_degraded: bool,
    vec_degraded: bool,
    reason_code: Option<&str>,
) -> Option<AppError>

Decides whether a degraded read must become a non-zero exit.

Returns None — the read stands, exit 0, envelope untouched — when any of:

• fail_on_degraded is off, which is the default and the historical behaviour byte for byte;
• nothing degraded;
• the degradation was REQUESTED with --fallback-fts-only.

That third case is the whole point of the discriminator. --fallback-fts-only is an operator saying “skip the provider, BM25 is what I want”; turning their own instruction into a failure would make the two flags mutually unusable.

Error classification

The class is derived from reason_code, never from the message prose, so a reworded string cannot silently reclassify a failure:

• timeout, slot_exhausted, oauth_quota, cancelled — the provider was unreachable or too slow. crate::errors::AppError::Timeout is retryable, so error_class is transient and retryable is true: retrying is exactly the right advice.
• anything else (dim_zero, backend_mismatch, embedding_failed) — the configuration or the response shape is wrong, and retrying an unchanged invocation reproduces it. crate::errors::AppError::Embedding carries exit 11.