[loganj]

🤖

Summary

• Some failures of the app's live relay connection stopped it until the app was restarted. Nothing on screen showed this. An agent running in the app stopped hearing mentions, with no sign anything was wrong.
• These failures now retry on their own, slowly, while the error stays visible:
  • A relay that rejected sign-in, or a sign-in signature that failed (for example, while the signer was locked). Before: final. Now: reconnects after 60 s, doubling to 10 minutes.
  • A channel subscription the relay closed with a reason that needs action (for example blocked: or auth-required:). Before: final. Now: retried on the existing one-minute recovery timer with the same backoff. The "not a channel member" denial flow is unchanged.
  • One event the app could not decode. Before: it failed its whole channel batch (up to 10 channels) for good. Now: only that event is dropped and logged.
  • The dev broker's event stream (browser build) used to stop for good on HTTP 400/401/403/413. It now retries on the same slow timer. Its reconnect backoff also never reset, so after a few drops every reconnect waited 30 s. It now resets once a stream has stayed up for a minute. The first frame does not count, because every new stream sends one at once.
• While a slow retry runs, the "Live updates limited" notice keeps its reason and its Retry live updates button, so it does not vanish or lose the button on each attempt (Design feedback). Pressing Retry also leaves the notice in place. When the attempt succeeds and the notice goes away with keyboard focus on its button, focus moves on to the composer, as it already did for the session recovery notice.
• If the recovery callback throws, the one-minute recovery timer used to stop for good. It now logs the error and keeps running.

Details

• One backoff, liveSlowRetryDelay (src/features/relay/live.ts), serves the auth, route and broker cases. It starts at 60 s, the existing recovery tick, so a refusal is never retried faster than today's timer. It is capped at 10 minutes, so a relay that keeps refusing sees at most 6 attempts an hour per route.
• Session recovery still treats these states as settled, so it does not retry them every few seconds. Only the slow timer retries them. A signer that does not match the signed-in account stays terminal: retrying cannot fix it.
• docs/relay-queries.md is updated where it described these states as terminal.

Not in this PR

• A broker that restarts loses its community registrations. A /stream retry alone does not register again, so that case still needs something to call registration again.
• A manual Retry, or session recovery triggered by another failure, still sends refused routes again at once, as it does today.
• feat(identity): add native federated sessions and agent tokens #1424 (a draft) adds a final state for a relay policy close (WebSocket code 1008). Whichever lands second decides whether that close also gets the slow retry.
• Related work: fix(relay): replace a live socket that stops answering #1629 replaces a socket that stops answering, and fix(agents): catch up an agent's mentions, in their own pass #1634 catches agents up on mentions the live connection missed.

🤖 Generated with Claude Code

[kalvinnchau]

🤖 Approved. No actionable findings at 647c1fc. The duplicate status predicate is resolved, and Retry focus, passive notices, and channel-local recovery remain covered. Merge remains contingent on required CI passing.