The content-exposed flag should be monotonic across all attempts for the logical request. A fallback must not reset it merely because the new provider has not emitted anything yet; the earlier prefix may already be visible.

I would keep a separate attempt ID under the request ID, with each attempt's exposure state, terminal state and unsettled usage. Then test a disconnect immediately after the gateway writes its first content frame, where delivery to the browser may be uncertain. Treating that uncertainty conservatively prevents the recovery layer from declaring a fresh retry invisible when it cannot actually establish that boundary.