Apply endpoint health in peer cache

agents/rap-node-agent/internal/mesh/peer_cache_test.go

@@ -100,6 +100,59 @@ func TestPeerCacheUsesBestEndpointCandidate(t *testing.T) {
 	}
 }
 
+func TestPeerCacheAppliesEndpointHealthObservations(t *testing.T) {
+	local := PeerIdentity{ClusterID: "cluster-1", NodeID: "node-a"}
+	now := time.Date(2026, 5, 16, 12, 0, 0, 0, time.UTC)
+	cache := NewPeerCache(PeerCacheConfig{
+		Local: local,
+		PeerEndpointCandidates: map[string][]PeerEndpointCandidate{
+			"node-b": {
+				{
+					EndpointID:       "node-b-quic",
+					NodeID:           "node-b",
+					Transport:        "direct_quic",
+					Address:          "quic://node-b.example.test:19443",
+					Reachability:     "public",
+					NATType:          "none",
+					ConnectivityMode: "direct",
+					Priority:         1,
+					LastVerifiedAt:   &now,
+				},
+				{
+					EndpointID:       "node-b-wss",
+					NodeID:           "node-b",
+					Transport:        "wss",
+					Address:          "https://node-b.example.test:443",
+					Reachability:     "public",
+					NATType:          "none",
+					ConnectivityMode: "direct",
+					Priority:         1,
+					LastVerifiedAt:   &now,
+				},
+			},
+		},
+		PeerEndpointObservations: map[string]EndpointCandidateHealthObservation{
+			"node-b-quic": {
+				EndpointID:        "node-b-quic",
+				FailureCount:      2,
+				LastFailureReason: "session_open_failed",
+				ReliabilityScore:  35,
+				ObservedAt:        now,
+			},
+		},
+		WarmPeerLimit: 1,
+		Now:           now,
+	})
+
+	entry, ok := peerCacheEntryByID(cache.Snapshot(), "node-b")
+	if !ok {
+		t.Fatal("node-b missing from cache")
+	}
+	if entry.BestCandidateID != "node-b-wss" || entry.Endpoint != "https://node-b.example.test:443" {
+		t.Fatalf("peer cache did not apply endpoint observations: %+v", entry)
+	}
+}
+
 func TestPeerCacheUsesPreferredCorporateEndpointAddress(t *testing.T) {
 	local := PeerIdentity{ClusterID: "cluster-1", NodeID: "node-a"}
 	cache := NewPeerCache(PeerCacheConfig{