[rigazilla]

Closes #12. Stacked on #11 (feat/hotrod-uri) — review/merge that first.

What

fromUri already parsed all comma-separated hosts but used only the first as the seed. This makes all hosts seed servers with two failover tiers, mirroring the Java client's immutable ClusterInfo.getInitialServers() fallback.

• Startup failover — connect() tries each seed in order (reusing the pre-built bootstrap connection for seeds_[0]); if all are unreachable it throws one HotRodClientException whose message lists every seed tried.
• Runtime failover — new tryConnectSeeds() helper wired into the fall-through points of selectAnyServer and selectServerForKey (including the old return connection_ no-owners/empty path). It prefers the live bootstrap connection_ (fast path → happy path and BASIC mode do no new I/O), else walks the seeds via the existing pure orderKeyCandidates, adopting the first reachable seed as the new bootstrap connection.

Design decisions (see docs/DECISIONS.md 2026-10-19 for full rationale + Java comparison)

• Keyed seed fallback gated on proxyToNonOwner_ — a seed serving a non-owned key is a proxy, exactly what proxyToNonOwner=false forbids (preserves the D5 contract). Default true matches Java, which always proxies.
• Caller-driven exhaustion ≠ unreachability — excluding every known server still throws (no seed rescue of an excluded node, which can alias a seed under a different address, e.g. localhost vs. a topology container IP). This surfaced via a PingRetry regression and is fixed in both selection paths.
• connection_ reassigned on runtime failover (+ fast path) so isConnected() stays truthful and dead seeds aren't re-probed per op; its reads in isConnected()/disconnect() now take stateMutex_ to remove the shared_ptr assignment race.

Intentional divergences from the Java 16.3 client

• connect() throws when all seeds are down (Java tolerates and defers to the first op) — keeps our existing "establish ≥1 connection or throw" contract; the message names every seed.
• No failed-server timeout memo (Java's connectionFailedServers/serverFailureTimeout) — dead topology members are re-probed per op during an outage (dead bootstrap seed is avoided by the fast path). Latency-under-failure only. Left as future work.
• The privileged bootstrap connection_ is kept rather than folded into the pool (the Java-faithful flat model) — a larger refactor noted as future work.

Tests

• +2 startup (FromUriIntegrationTest): recover via 2nd seed; all-seeds-unreachable throws naming each.
• +2 runtime (MultiSeedIntegrationTest): BASIC client seeded with both nodes recovers after the connected node is killed; HASH client from a multi-seed URI with a dead first seed fails over at connect() then learns topology and hash-routes.
• All affected regressions re-run green (RetryView incl. D5 proxy-disabled throw, PingRetry incl. all-excluded throw, HashAwareRouting, ConcurrentMultiServer). Unit 250/250; -Werror/Release build clean.

🤖 Generated with Claude Code

---

Also in this PR: docs hygiene + PR #14's test-count convention

A follow-up docs: commit (separate from the feature commit) does current-state cleanup and adopts the convention from #14 (closed unmerged as stale; its decision + DECISIONS entry were re-applied here):

• STATUS.md trimmed to current-state-only: 1–3 Next steps, to-do-only backlog, dead Step-10 plan removed, stale dates/phrasings fixed.
• Test counts live once in STATUS.md (250 unit / 96 integration / 20 suites, via --gtest_list_tests); README drops hard counts and points to STATUS.
• DECISIONS.md: non-date heading fixed; schema-bug gotcha + docs: de-duplicate test counts; drop CI test-count badge #14's count-dedup entry preserved.