Improve handling of connection errors and dead peers

Nobody has claimed this yet.

Starting with #430 we now short-circuit attempts to reconnect to peers when we fail to open a stream.
We still try to do this for dead peers that are still perceive as connected but this logically short-circuits when the stream establishment attempt fails.

This is an improvement over what we previously had, where we could get into "respawning writer" loops.
But it does have a drawback: it is possible to have multiple connections to a peer and pick the wrong connection to open a stream, leading to an otherwise healthy peer being ignored.

We need to introduce a principled mechanism for handling reconnect attempts; quite likely a backoff and possibly a blacklist will be enough.

Start by reading issue #430 and tracing the reconnect attempts, stream-opening, and stream-establishment paths described here. Define how reconnect attempts should behave for dead peers and multiple connections, then verify that the chosen mechanism prevents respawning-writer loops without ignoring healthy peers.

Written by the indexing model from the issue text.