fix: Do not report a permanent data source failure as fatal

[kinyoklion]

A permanently shut down data source set the provider's internal status to Fatal, even though the LaunchDarkly client can keep evaluating flags from the data it already has.

• DataSourceState.Off now sets ProviderStatus.Error, matching InitializeAsync and the Java provider
• No user-visible change today: both Error and Fatal emit ProviderEventTypes.ProviderError, and the OpenFeature SDK derives provider status from events, so nothing consumed the Fatal value
• Adds an integration test asserting evaluations still succeed through the OpenFeature client after the data source goes off

@cursor review

Implementation details

Why change it if nothing consumes it

Fatal is the OpenFeature status that means "flag resolution cannot happen"; the SDK short-circuits to call-site defaults in that state. That is wrong for LaunchDarkly, since a dead stream (for example a 401 on an established connection) leaves the in-memory store fully usable. The value was only saved from causing that behavior because StatusProvider maps both Error and Fatal to a ProviderError event. Leaving the misleading value in place invites a regression the next time this status is wired to anything.

The sibling fix in the Python provider (launchdarkly/openfeature-python-server#52) does have user-visible impact, because that provider emits a fatal event directly.

Alternatives considered

Emitting Stale for Off was rejected: the failure is not recoverable without a new client, so consumers should see an error.

Testing

dotnet test test/LaunchDarkly.OpenFeature.ServerProvider.Tests -f net8.0 — 60 tests pass, including the new ItCanEvaluateFlagsAfterTheDataSourceHasBeenShutdown. Note that this test also passes on main, for the event-mapping reason above; it is a guard, not a reproduction.

No visual preview applies — this is a server-side provider change.

Link to Devin session: https://app.devin.ai/sessions/0c452d209ec54b068ba120b4c92b8f6c
Requested by: @kinyoklion

---

Note

Overview
When the LaunchDarkly data source shuts down permanently (DataSourceState.Off), the provider now reports ProviderStatus.Error instead of ProviderStatus.Fatal, because the LD client can still evaluate flags from in-memory data.

This aligns StatusChangeHandler with InitializeAsync (which already used Error for Off) and with the Java provider. StatusProvider still maps both Error and Fatal to ProviderEventTypes.ProviderError, so emitted events are unchanged today; the fix avoids mislabeling the internal status if OpenFeature later treats Fatal as “cannot resolve flags.”

A new integration test ItCanEvaluateFlagsAfterTheDataSourceHasBeenShutdown verifies boolean evaluation through the OpenFeature client after the mocked data source transitions to Off.

^{Reviewed by Cursor Bugbot for commit fbe6159. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring