@@ -414,6 +414,44 @@ describe('coordinated token resolution while the provider fails', () => {
     ).toBeGreaterThanOrEqual(60_000)
   })
 
+  it('backs off a throttled answer after an outage from a minute, not by the outage streak', async () => {
+    const exchange = vi.fn<CoordinatedClientTokenInput['exchange']>()
+    for (const status of [502, 502]) {
+      exchange.mockImplementation(failing(status))
+      await expect(
+        resolveCoordinatedClientToken(input('outage-then-throttled', exchange))
+      ).rejects.toThrow()
+      await expireFailureRowsOf('outage-then-throttled')
+    }
+    exchange.mockImplementation(failing(429))
+    const before = Date.now()
+
+    await expect(
+      resolveCoordinatedClientToken(input('outage-then-throttled', exchange))
+    ).rejects.toMatchObject({ status: 429 })
+
+    const replayMs = (await failureRowOf('outage-then-throttled')).expiresAt.getTime() - before
+    expect(replayMs).toBeGreaterThanOrEqual(60_000)
+    expect(replayMs).toBeLessThanOrEqual(72_000 + 2_500)
+  })
+
+  it('backs off throttling that continues for every worker longer than its first minute', async () => {
+    const exchange = failing(429)
+    await expect(
+      resolveCoordinatedClientToken(input('throttled-twice', exchange))
+    ).rejects.toThrow()
+    await expireFailureRowsOf('throttled-twice')
+    const before = Date.now()
+
+    await expect(
+      resolveCoordinatedClientToken(input('throttled-twice', exchange))
+    ).rejects.toThrow()
+
+    expect(
+      (await failureRowOf('throttled-twice')).expiresAt.getTime() - before
+    ).toBeGreaterThanOrEqual(96_000)
+  })
+
   it.each([
     [
       'the still-valid token while its refresh is remembered failing',
 
@@ -11,6 +11,7 @@ import {
   requestTokenWithRetry,
   TOKEN_EXPIRY_MARGIN_MS,
   TOKEN_FAILURE_STREAK_RETENTION_MS,
+  type TokenRequestFailure,
 } from '@/lib/credentials/token-request-resilience'
 import { TokenServiceAccountValidationError } from '@/lib/credentials/token-service-accounts/errors'
 import { acquireAdvisoryXactLock } from '@/lib/db/advisory-locks'
@@ -92,13 +93,15 @@ interface StoredApplicationToken {
 /**
  * A remembered exchange failure, replayed until its row's `expiresAt`. Builds before failure
  * kinds stored `{ code, status }` only and ignore other keys, so `consecutiveFailures` is
- * written only for outages and throttling, to grow their backoff while they continue, and
- * `refusal` only for a refusal whose code those builds read as `provider_unavailable`.
+ * written only for outages and throttling, to grow their backoff while they continue, `throttled`
+ * only for throttling, so its streak is kept apart from an outage's, and `refusal` only for a
+ * refusal whose code those builds read as `provider_unavailable`.
  */
 interface StoredFailure {
   code: 'invalid_credentials' | 'grant_not_permitted' | 'site_not_found' | 'provider_unavailable'
   status: number
   consecutiveFailures?: number
+  throttled?: true
   refusal?: true
 }
 
@@ -206,6 +209,7 @@ function decodeFailure(value: string, step: string): StoredFailure {
     ...(Number.isSafeInteger(parsed.consecutiveFailures) && Number(parsed.consecutiveFailures) > 0
       ? { consecutiveFailures: Number(parsed.consecutiveFailures) }
       : {}),
+    ...(parsed.throttled === true ? { throttled: true } : {}),
     ...(parsed.refusal === true ? { refusal: true } : {}),
   }
 }
@@ -230,20 +234,24 @@ function replayedFailure(
 }
 
 /**
- * Outages and throttled answers in a row before this exchange, read from the application's last
- * failure memo for this secret once its replay has ended. Anything unreadable starts a new streak.
+ * The outage or throttling streak before this exchange, read from the application's last failure
+ * memo for this secret once its replay has ended. A refusal, or anything unreadable, starts a new
+ * streak.
  */
-async function consecutiveFailuresBefore(
+async function failureStreakBefore(
   row: StoredRow | undefined,
   step: string
-): Promise<number> {
-  if (!row || Date.now() - row.expiresAt.getTime() > TOKEN_FAILURE_STREAK_RETENTION_MS) return 0
+): Promise<Pick<TokenRequestFailure, 'kind' | 'consecutiveFailures'> | undefined> {
+  if (!row || Date.now() - row.expiresAt.getTime() > TOKEN_FAILURE_STREAK_RETENTION_MS) return
   try {
     const failure = decodeFailure((await decryptSecret(row.encryptedValue)).decrypted, step)
-    if (isRememberedRefusal(failure)) return 0
-    return failure.consecutiveFailures ?? 1
+    if (isRememberedRefusal(failure)) return
+    return {
+      kind: failure.throttled ? 'throttled' : 'transient',
+      consecutiveFailures: failure.consecutiveFailures ?? 1,
+    }
   } catch {
-    return 0
+    return
   }
 }
 
@@ -418,7 +426,7 @@ export async function resolveCoordinatedClientToken(
         if (!(error instanceof TokenServiceAccountValidationError)) throw error
         const assessed = assessTokenRequestFailure(
           error,
-          await consecutiveFailuresBefore(failureRow, step)
+          await failureStreakBefore(failureRow, step)
         )
         const replayMs = Math.max(assessed.replayMs, input.minExchangeIntervalMs ?? 0)
         const code = STORED_FAILURE_CODES.has(error.code)
@@ -428,7 +436,10 @@ export async function resolveCoordinatedClientToken(
           code,
           status: error.status,
           ...(assessed.kind !== 'permanent'
-            ? { consecutiveFailures: assessed.consecutiveFailures }
+            ? {
+                consecutiveFailures: assessed.consecutiveFailures,
+                ...(assessed.kind === 'throttled' ? { throttled: true } : {}),
+              }
             : isPermanentTokenFailureCode(code)
               ? {}
               : { refusal: true }),
 
@@ -13,7 +13,7 @@ export type TokenRequestFailureKind = 'permanent' | 'throttled' | 'transient'
 
 export interface TokenRequestFailure {
   kind: TokenRequestFailureKind
-  /** Non-permanent failures in a row, this one included; 1 for a permanent failure. */
+  /** Failures of this kind in a row, this one included; 1 for a permanent failure. */
   consecutiveFailures: number
   /** How long the failure is replayed before the provider is asked again. */
   replayMs: number
@@ -87,15 +87,17 @@ function boundedBackoff(attempt: number, bounds: { baseMs: number; maxMs: number
  * replaying (`replayForMs`) is replayed exactly as long as that layer still does. Otherwise a
  * provider's `Retry-After` is honored within 1 s to 5 min; without one, a throttled answer backs
  * off from 1 min to 5 min, an outage from 5 s to 30 s, and a refusal is replayed 30 s.
- * `previousConsecutiveFailures` counts the non-permanent failures immediately before this one (0
- * after a success or a permanent failure).
+ * `previous` is the remembered failure immediately before this one, if any: the backoff grows only
+ * while failures of the same kind continue, so a throttled answer after an outage starts its own
+ * streak at a minute instead of inheriting the outage's count.
  */
 export function assessTokenRequestFailure(
   error: unknown,
-  previousConsecutiveFailures = 0
+  previous?: Pick<TokenRequestFailure, 'kind' | 'consecutiveFailures'>
 ): TokenRequestFailure {
   const kind = classifyTokenRequestFailure(error)
-  const consecutiveFailures = kind === 'permanent' ? 1 : previousConsecutiveFailures + 1
+  const consecutiveFailures =
+    kind !== 'permanent' && previous?.kind === kind ? previous.consecutiveFailures + 1 : 1
   const replay = (replayMs: number): TokenRequestFailure => ({
     kind,
     consecutiveFailures,
 
@@ -169,7 +169,10 @@ describe('client credential token refresh after a failed mint', () => {
     )
 
   /** Resolves with fake timers running, so an in-mint retry pause elapses without real waiting. */
-  async function resolveFor(credentialId: string, providerId = RAMP_SERVICE_ACCOUNT_PROVIDER_ID) {
+  async function resolveFor(
+    credentialId: string,
+    providerId: string = RAMP_SERVICE_ACCOUNT_PROVIDER_ID
+  ) {
     queueTableRows(credential, [storedCredential])
     const outcome = resolveServiceAccountToken(credentialId, providerId).then(
       (value) => ({ value }),
@@ -356,6 +359,30 @@ describe('client credential token refresh after a failed mint', () => {
     })
   })
 
+  it('waits about a minute, not an outage streak longer, for a throttled answer after an outage', async () => {
+    const mint = minter()
+    const answers = [unavailable(), unavailable(), unavailable(429)]
+    mint.mockImplementation(async () => {
+      throw answers[0]
+    })
+
+    await resolveFor('ramp-outage-then-throttled')
+    answers.shift()
+    vi.advanceTimersByTime(30_001)
+    await resolveFor('ramp-outage-then-throttled')
+    answers.shift()
+    vi.advanceTimersByTime(30_001)
+    await expect(resolveFor('ramp-outage-then-throttled')).resolves.toEqual({
+      error: expect.objectContaining({ status: 429 }),
+    })
+    mint.mockResolvedValueOnce(token)
+
+    vi.advanceTimersByTime(73_000)
+    await expect(resolveFor('ramp-outage-then-throttled')).resolves.toEqual({
+      value: { accessToken: token.accessToken },
+    })
+  })
+
   it('waits at least 5 seconds before asking again after an outage, whatever the jitter', async () => {
     const lowestJitter = vi
       .spyOn(globalThis.crypto, 'getRandomValues')
 
@@ -652,7 +652,7 @@ interface FailedClientCredentialMint {
   /** The error the failed mint threw, re-thrown to callers while memoized. */
   error: unknown
   kind: TokenRequestFailureKind
-  /** Non-permanent failures in a row; the next one backs off longer. */
+  /** Failures of this kind in a row; the next one of the same kind backs off longer. */
   consecutiveFailures: number
   secretFingerprint: string
   /** Until when the failure is replayed instead of minting again. */
@@ -819,10 +819,7 @@ async function resolveMintedServiceAccountToken(
       return { ...minted.token }
     } catch (error) {
       if (error instanceof Error && error.name === 'AbortError') throw error
-      const failure = assessTokenRequestFailure(
-        error,
-        failed && failed.kind !== 'permanent' ? failed.consecutiveFailures : 0
-      )
+      const failure = assessTokenRequestFailure(error, failed)
       const retryAtMs = Date.now() + failure.replayMs
       clientCredentialMintFailureCache.set(cacheIdentity, {
         error: options?.privacyMode === 'selector' ? new Error('Credential mint failed') : error,
@@ -835,7 +832,7 @@ async function resolveMintedServiceAccountToken(
       const fallback = failure.kind === 'permanent' ? undefined : stillValid()
       if (fallback) {
         logger.warn('Serving a still-valid client-credential token after its refresh failed', {
-          credentialId,
+          ...(options?.privacyMode === 'selector' ? {} : { credentialId }),
           failure: failure.kind,
           retryInMs: failure.replayMs,
         })