Fired from OutNetMessage's failed-send path, so it runs only after the transport has exhausted its own retries for the probe. That distinguishes it from a single dropped packet: by then the peer has failed to answer across every transport we hold.

Uses ProfileOrganizer.demoteIfUnreachableNow(Hash) rather than the three-strike path because send-failure strikes already exist for in-use tunnels and count a congested path as much as a dead peer. A peer that cannot be connected to at all is unambiguous, and leaving it in the fast tier is what starves the pools.