[wingleeio]

Implements the full durable-by-design plan — a send is a local write that always either delivers exactly once or visibly says why not, and recovery is event-driven, never timer luck — plus the three priority asks from the Aug 19 zombie-peer-link incident.

Phase 2 — event-driven recovery (ed8cd60)

• Online-bus subscriptions for the previously wake-only supervisors (registry/chat2 initial joins, LinkCache cooldowns, auth refresh retry) — a room stuck in its FIRST join now un-parks on any sibling dial success.
• macOS NWPathMonitor (crates/sync/src/net_path.rs) → wake::set_path_online: offline→online broadcasts the online event; while offline, backoff waits park on the event buses (30s safety recheck) instead of burning dials.
• Window-focus fast path: ProbeSync also probes {edge}/health (3s); success fires the online event so a focus lands a redial in ~1 RTT, while a failed probe leaves backoffs parked.
• Stability-gated backoff reset (a join must survive 30s — reset-on-join let connect-and-die sockets hot-loop at 250ms forever); caps 30s→16s; device-room silence lease 40s→25s with 10s pings.
• Reconnect posture is observable: retry_at_ms + sticky last_failure + numbered dial attempts in logs.

Incident asks (Aug 19, done first)

Attachments ride the durable queue (8f3bce8) — staging was a blocking pre-step in front of QueueCommand, so a send with an image died with the dead link. Now: bytes commit to the LOCAL uploads dir, the command queues immediately with pending://{uploadId}/{name} refs, and the engine pushes bytes to the host afterwards (retry-forever on the online bus; chunk/commit timeouts invalidate the link). The host drain defers a command whose refs aren't on disk — BEFORE the processed mark — and UploadCommit kicks drains; at dispatch the refs rewrite to absolute paths so the persisted transcript keeps the legacy shape. Version-gated on both the local engine and the host (>= 0.2.12); old peers keep the legacy upload, now bounded by a 300s total budget. Also fixes the incident's silent-wedge mechanics: interrupt/answer get their own task slot (assigning send_task dropped an in-flight send with no banner and a permanently stuck "Sending…"), failure banners are chat-scoped and survive navigation, chunk retries log at warn, MUTATE/QUEUE_COMMAND are deadline-bounded.

Peer-link end-to-end liveness (449a1db) — the transport lease counts the DO's auto-pong, which answers from the EDGE, so a healthy client↔edge leg masked a dead edge↔host leg for 6 minutes. The client now rides an echo frame on every keepalive and the HOST echoes it back; 20s of echo silence = zombie path → drop and redial. Feature-detected (old hosts keep transport-lease behavior; inbound RPC frames count as proof too), no edge changes (the DO relays kinds untouched). DeviceLink::connect bounded at 15s — the one unbounded await under forward().

Registry-dark dial parking (449a1db) — LinkCacheConfig.liveness: a Dark verdict fails peer calls fast with ZERO dials (was: 3-dial bursts every ~60s to a device offline for days). Dark requires positive evidence (registry room joined + past a 60s warm-up, freshest heartbeat older than 5min); registry-down and every ambiguity stay Unknown, so the rows-down/relay-up incident shape can never park the relay. Presence returning un-parks and clears the cooldown in the same beat.

Phase 1 — UI truth (b98d698)

WatchConnectivity stream (engine pushes Disabled/Offline/Reconnecting{retryAtMs,lastFailure}/Connected + per-open-chat room state, emitted only on change) → sidebar connection pill (visible only while degraded; live retry countdown; last failure stays visible through the next attempt), composer "messages will queue and send automatically" notice, amber Queued row pill + trailer instead of a fake Working spinner, and the pending overlay HOLDS while degraded instead of silently expiring at 30s with no trace. Locally-hosted chats never read as degraded — a queued command executes offline.

Phase 3 — second road + chaos suite (9055e01)

• RelayCommand: when rows can't reach the edge (10s grace) but the peer link is alive, the sender's engine forwards the queued entry itself over the device-room link. The host evaluates it against its own doc, claims the client-minted id in the processed ledger BEFORE executing — so the doc row arriving later over chat2 sync dedupes to a no-op. Exactly-once across both roads by construction, proven in relay_delivery.rs (execute via relay, then simulated row arrival + duplicate relay → still one turn). Version-gated; relay timeouts mark the link suspect.
• Deterministic flaky-network suite (chat_client/tests.rs, virtual clock): scripted drop/refuse connector asserting the durable contract — a mid-push socket death + refused dials deliver the batch exactly once AND surface Disconnected (silence is a test failure); connect-and-die sessions grow backoff until a stable session resets it; OS-offline parks dials entirely and the online event un-parks within a beat. Plus the zombie-relay echo regression (device_room.rs tests) and the queued-attachment defer/execute cycle (queued_attachments.rs).

Phase 4 — failed state + canonical timestamps (d4d4045)

Two-minute grace on unadopted sends → explicit Failed row pill and a transcript "Not delivered — click to retry" affordance wired to RetryDelivery (fresh chat2 socket, host nudge, drain pass, fresh delivery escorts with transfers re-derived from the pending refs). Timestamp canonicalization: the executor pre-writes the user message at the entry's issued_at (clamped, idempotent by id), so a send queued for minutes lands in history where the user sent it.

Notes for review

• Version gates assume this releases as 0.2.12 (QUEUED_ATTACHMENTS_MIN, RELAY_MIN_VERSION) — adjust if the release number differs.
• net_path.rs is cfg(target_os = "macos") FFI written on a Linux box — needs one mac build check.
• 685 tests green across sync/rpc/engine/ui (--features mock-server for the sync integration tier). The live half of the acceptance matrix (airplane wifi 20% loss, captive portal, flap-every-5s) still wants a real-network pass; the deterministic analogues are in the suite.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}