fix: insert demoted source after credible alternatives, not at tail

Round 4 showed tail placement routes the third attempt to junk sources
whenever the credible alternative is gate-skipped (tight-RPM source
admitted as credible, then skipped by the limiter, falling through to
the flapping watchdog source). Demoted sources now sit between credible
and non-credible candidates.

tests/unit/test_retry.py

@@ -537,3 +537,23 @@ class TestHealthGatedDemotion:
         )
         await mw(_REQ)
         assert [n for n, _ in transport.calls] == ["a", "a", "b"]
+
+
+class TestDemotionInsertPosition:
+    """迭代 3(设计 §3.36 补): 被降权源插在可信替代之后、不可信源之前。"""
+
+    async def test_demoted_lands_before_junk_sources(self):
+        # a 失败 2 次;b 可信(0.9)但会被跳过时,第三候选应是 a 而非垃圾源 c
+        from polygateway.middleware.retry import _demote_call_failures
+
+        srcs = [_src("a"), _src("b"), _src("c")]
+        health = {"a": 0.9, "b": 0.9, "c": 0.05}.__getitem__
+        out = _demote_call_failures(srcs, {"a": 2}, health)
+        assert [s.name for s in out] == ["b", "a", "c"]
+
+    async def test_health_blind_demotion_still_tail(self):
+        from polygateway.middleware.retry import _demote_call_failures
+
+        srcs = [_src("a"), _src("b"), _src("c")]
+        out = _demote_call_failures(srcs, {"a": 2}, None)
+        assert [s.name for s in out] == ["b", "c", "a"]