viveworker 0.8.1 → 0.8.3

package/web/remote-pairing/api-router.js

@@ -13,12 +13,13 @@
  *   2. If LAN throws a `TypeError` (network failure, DNS, connect refused —
  *      i.e. the bridge isn't reachable), fall back to the relay's
  *      `RemotePairingRpcClient.fetch()`.
- *   3. After a LAN failure, enter a STICKY_RELAY_MS window where subsequent
- *      requests skip LAN and go straight to relay. Avoids paying the LAN
- *      timeout cost on every call after we've already learned LAN is dead.
- *   4. When the window expires, the next request re-probes LAN. If LAN is
- *      back, the sticky window is left dormant and we return to the happy
- *      path. If LAN is still dead, the window resets.
+ *   3. After a LAN failure, enter a sticky relay window where subsequent
+ *      requests skip LAN and go straight to relay. If LAN was healthy very
+ *      recently, keep that window short so one transient WiFi wobble doesn't
+ *      make an in-room phone behave like it is off-LAN for minutes.
+ *   4. While sticky relay is active, periodically run a tiny LAN probe. If
+ *      LAN is back, clear sticky state and close the relay client. If LAN is
+ *      still dead, the sticky window resets and relay stays the fast path.
  *   5. AbortError (caller cancelled) is never treated as a LAN failure —
  *      we re-throw immediately rather than waste a relay attempt.
  *
@@ -76,11 +77,9 @@ import { loadPairingState } from "./pairing-state.js";
 // ---------------------------------------------------------------------------
 
 /**
- * After a LAN failure we prefer relay for this long before re-probing LAN.
- * 5 minutes is a coarse pick: long enough that a phone that fell off LAN
- * (cellular handoff, WiFi drop) doesn't pay LAN connect timeouts on every
- * outbound call, short enough that "I just walked back into wifi range"
- * recovers without the user noticing.
+ * Hard upper bound after a LAN failure. We keep this for real off-LAN use so
+ * cellular/remote sessions do not pay LAN connect timeouts on every request.
+ * Recent successful LAN sessions use a much shorter transient window below.
  */
 const STICKY_RELAY_MS = 5 * 60 * 1000;
 
@@ -98,6 +97,24 @@ const DEFAULT_RELAY_TIMEOUT_MS = 60_000;
  * LAN is the fast path, and slow/unreachable LAN should become relay.
  */
 const DEFAULT_LAN_TIMEOUT_MS = 2_500;
+const DEFAULT_STICKY_LAN_PROBE_TIMEOUT_MS = 350;
+// Recover quickly from accidentally sticky relay while still avoiding LAN
+// timeout spam during real off-LAN sessions.
+const AUTO_STICKY_LAN_PROBE_INTERVAL_MS = 8_000;
+const AUTO_STICKY_LAN_PROBE_TIMEOUT_MS = 900;
+const LAN_REACHABILITY_PROBE_TIMEOUT_MS = 700;
+const LAN_REACHABILITY_PROBE_PATH = "/health";
+const RECENT_LAN_OK_GRACE_MS = 60_000;
+const TRANSIENT_LAN_FAILURE_STICKY_MS = 8_000;
+const TRANSIENT_LAN_FAILURE_THRESHOLD = 2;
+// If LAN was healthy moments ago, a single timed-out local request is more
+// likely a busy bridge/Safari wobble than a true off-LAN transition. Delay
+// relay fallback for the first few consecutive failures to avoid burning
+// Cloudflare Durable Object quota while the phone is still on trusted LAN.
+const RECENT_LAN_RELAY_SUPPRESSION_FAILURES = 2;
+const RELAY_FAILURE_WINDOW_MS = 60_000;
+const RELAY_FAILURE_THRESHOLD = 6;
+const RELAY_CIRCUIT_BREAKER_MS = 60_000;
 const PAIRING_STATE_STORAGE_KEY = "viveworker.remote-pairing.state";
 const PAIRING_STATE_SCHEMA_VERSION = 2;
 const PAIRING_STATE_LEGACY_SCHEMA_VERSION = 1;
@@ -128,12 +145,29 @@ let _lastPairingStateStatus = null;
 /** Last transport route that completed successfully. */
 let _lastSuccessfulRoute = null;
 
+/** Last time a LAN request completed successfully. */
+let _lastLanOkAtMs = 0;
+
+/** Last time we tried a LAN probe while sticky relay was active. */
+let _lastStickyLanProbeAtMs = 0;
+
+/** Consecutive LAN transport failures since the last LAN success. */
+let _consecutiveLanFailures = 0;
+
+/** Recent relay-level failures used to avoid burning relay/DO quota in loops. */
+let _relayFailureAtMs = [];
+
+/** If > now, relay attempts are intentionally skipped. */
+let _relayCircuitOpenUntilMs = 0;
+
 function newTelemetry() {
   return {
     lanOk: 0,
     lanFail: 0,
+    lanReachableAfterFailure: 0,
     relayOk: 0,
     relayFail: 0,
+    relaySuppressed: 0,
     lastLanFailAt: 0,
     lastRelayFailAt: 0,
     clientResets: 0,
@@ -404,6 +438,74 @@ function resetRelayClientForRetry() {
   _wakeUnbind = null;
 }
 
+function closeRelayClient(_reason = "closed") {
+  if (_client) {
+    _telemetry.clientResets++;
+    try { _client.close(); } catch { /* ignore */ }
+  }
+  _client = null;
+  _clientPairingKey = null;
+  if (_wakeUnbind) {
+    try { _wakeUnbind(); } catch { /* ignore */ }
+  }
+  _wakeUnbind = null;
+}
+
+function relayCircuitDelayMs(opts = {}) {
+  return Math.max(0, _relayCircuitOpenUntilMs - nowMs(opts));
+}
+
+function relayCircuitError(opts = {}) {
+  const delayMs = relayCircuitDelayMs(opts);
+  const err = new Error(`remote relay temporarily cooled down (${Math.ceil(delayMs / 1000)}s)`);
+  err.name = "RemoteRelayCircuitOpenError";
+  err.code = "remote-relay-circuit-open";
+  err.retryAfterMs = delayMs;
+  return err;
+}
+
+function shouldAutoProbeLanWhileSticky(now, opts = {}) {
+  if (opts.autoProbeLanWhileSticky === false) {
+    return false;
+  }
+  if (relayCircuitDelayMs(opts) > 0) {
+    return false;
+  }
+  return now - _lastStickyLanProbeAtMs >= AUTO_STICKY_LAN_PROBE_INTERVAL_MS;
+}
+
+function stickyLanProbeOpts(opts, autoProbe) {
+  if (!autoProbe) {
+    return opts;
+  }
+  if (opts.stickyLanProbeTimeoutMs != null) {
+    return opts;
+  }
+  return {
+    ...opts,
+    stickyLanProbeTimeoutMs: AUTO_STICKY_LAN_PROBE_TIMEOUT_MS,
+  };
+}
+
+function recordRelayFailure(err, opts = {}) {
+  const now = nowMs(opts);
+  _relayFailureAtMs = _relayFailureAtMs.filter((at) => now - at <= RELAY_FAILURE_WINDOW_MS);
+  _relayFailureAtMs.push(now);
+  if (_relayFailureAtMs.length < RELAY_FAILURE_THRESHOLD) return;
+  _relayCircuitOpenUntilMs = Math.max(_relayCircuitOpenUntilMs, now + RELAY_CIRCUIT_BREAKER_MS);
+  _relayFailureAtMs = [];
+  closeRelayClient("relay circuit open");
+  emitRoutingStatus("remote-cooled-down", opts, {
+    reason: err?.message || String(err || "relay failure"),
+    retryAfterMs: RELAY_CIRCUIT_BREAKER_MS,
+  });
+}
+
+function resetRelayFailureCircuit() {
+  _relayFailureAtMs = [];
+  _relayCircuitOpenUntilMs = 0;
+}
+
 // ---------------------------------------------------------------------------
 // Response adapter — RpcResponse → minimal Fetch-Response shape
 // ---------------------------------------------------------------------------
@@ -499,7 +601,13 @@ async function attemptLanFetch(url, init, opts) {
       ? await Promise.race([fetchPromise, timeoutPromise])
       : await fetchPromise;
     _telemetry.lanOk++;
+    _lastLanOkAtMs = nowMs(opts);
+    _consecutiveLanFailures = 0;
     _lastSuccessfulRoute = "lan";
+    _stickyRelayUntilMs = 0;
+    _lastStickyLanProbeAtMs = 0;
+    resetRelayFailureCircuit();
+    closeRelayClient("lan connected");
     emitRoutingStatus("lan-connected", opts, { url: String(url || "") });
     return { ok: true, response };
   } catch (err) {
@@ -508,12 +616,17 @@ async function attemptLanFetch(url, init, opts) {
       throw err;
     }
     const lanErr = didTimeout ? new TypeError("LAN fetch timed out") : err;
+    const failedAt = nowMs(opts);
     _telemetry.lanFail++;
-    _telemetry.lastLanFailAt = nowMs(opts);
-    _stickyRelayUntilMs = _telemetry.lastLanFailAt + STICKY_RELAY_MS;
+    _consecutiveLanFailures++;
+    _telemetry.lastLanFailAt = failedAt;
+    _lastStickyLanProbeAtMs = failedAt;
+    _stickyRelayUntilMs = failedAt + stickyRelayWindowAfterLanFailure(failedAt);
     emitRoutingStatus("lan-failed", opts, {
       url: String(url || ""),
       reason: lanErr?.message || String(lanErr),
+      consecutiveLanFailures: _consecutiveLanFailures,
+      stickyRelayMs: Math.max(0, _stickyRelayUntilMs - failedAt),
     });
     return { ok: false, err: lanErr };
   } finally {
@@ -524,6 +637,81 @@ async function attemptLanFetch(url, init, opts) {
   }
 }
 
+function stickyRelayWindowAfterLanFailure(now) {
+  const recentLanOk = _lastLanOkAtMs > 0 && now - _lastLanOkAtMs <= RECENT_LAN_OK_GRACE_MS;
+  if (recentLanOk && _consecutiveLanFailures <= TRANSIENT_LAN_FAILURE_THRESHOLD) {
+    return TRANSIENT_LAN_FAILURE_STICKY_MS;
+  }
+  return STICKY_RELAY_MS;
+}
+
+function shouldDelayRelayAfterRecentLanFailure(now, opts = {}) {
+  if (opts.delayRelayAfterRecentLanFailure === false) {
+    return false;
+  }
+  if (_lastLanOkAtMs <= 0 || now - _lastLanOkAtMs > RECENT_LAN_OK_GRACE_MS) {
+    return false;
+  }
+  return _consecutiveLanFailures > 0 &&
+    _consecutiveLanFailures <= RECENT_LAN_RELAY_SUPPRESSION_FAILURES;
+}
+
+function suppressRelayAfterRecentLanFailure(url, err, opts = {}) {
+  _telemetry.relaySuppressed++;
+  emitRoutingStatus("remote-delayed", opts, {
+    url: String(url || ""),
+    reason: err?.message || String(err || "LAN failure"),
+    consecutiveLanFailures: _consecutiveLanFailures,
+    recentLanOkAtMs: _lastLanOkAtMs,
+  });
+}
+
+function shouldConfirmLanReachability(now, opts = {}) {
+  if (opts.confirmLanReachabilityBeforeRelay === false) {
+    return false;
+  }
+  return _lastLanOkAtMs > 0 && now - _lastLanOkAtMs <= RECENT_LAN_OK_GRACE_MS;
+}
+
+async function confirmLanUnavailableBeforeRelay(url, err, opts = {}) {
+  if (!shouldConfirmLanReachability(nowMs(opts), opts)) {
+    return false;
+  }
+  const path = urlToRelayPath(url);
+  if (path === LAN_REACHABILITY_PROBE_PATH) {
+    return false;
+  }
+
+  const probe = await attemptLanFetch(LAN_REACHABILITY_PROBE_PATH, {
+    cache: "no-store",
+    credentials: "same-origin",
+    headers: { Accept: "application/json" },
+  }, {
+    ...opts,
+    lanTimeoutMs: opts.lanReachabilityProbeTimeoutMs ?? LAN_REACHABILITY_PROBE_TIMEOUT_MS,
+  });
+  if (!probe.ok) {
+    return false;
+  }
+
+  _telemetry.lanReachableAfterFailure++;
+  suppressRelayAfterRecentLanFailure(url, err, opts);
+  return true;
+}
+
+async function attemptStickyLanProbe(url, init, opts) {
+  const probeTimeoutMs = opts.stickyLanProbeTimeoutMs ?? DEFAULT_STICKY_LAN_PROBE_TIMEOUT_MS;
+  _lastStickyLanProbeAtMs = nowMs(opts);
+  const lan = await attemptLanFetch(url, init, {
+    ...opts,
+    lanTimeoutMs: probeTimeoutMs,
+  });
+  if (lan.ok) {
+    _stickyRelayUntilMs = 0;
+  }
+  return lan;
+}
+
 function abortError(signal) {
   if (signal?.reason instanceof Error) {
     const err = signal.reason;
@@ -680,6 +868,9 @@ async function encodeFormDataForRelay(formData, signal) {
 
 async function attemptRelayFetch(url, init, opts) {
   emitRoutingStatus("remote-connecting", opts, { url: String(url || "") });
+  if (relayCircuitDelayMs(opts) > 0) {
+    return { ok: false, err: relayCircuitError(opts) };
+  }
   const client = await getOrInitClient(opts);
   if (!client) {
     return { ok: false, err: relayClientUnavailableError(_lastPairingStateStatus) };
@@ -724,6 +915,7 @@ async function attemptRelayFetch(url, init, opts) {
     });
     _telemetry.relayOk++;
     _lastSuccessfulRoute = "relay";
+    resetRelayFailureCircuit();
     emitRoutingStatus("remote-connected", opts, { url: String(url || "") });
     return { ok: true, response: adaptRpcResponse(rpcRes) };
   } catch (err) {
@@ -734,6 +926,7 @@ async function attemptRelayFetch(url, init, opts) {
     }
     _telemetry.relayFail++;
     _telemetry.lastRelayFailAt = nowMs(opts);
+    recordRelayFailure(err, opts);
     emitRoutingStatus("remote-failed", opts, {
       url: String(url || ""),
       reason: err?.message || String(err),
@@ -783,6 +976,12 @@ function nowMs(opts) {
  *   onRouteStatus?: (event: { phase: string, atMs: number, url?: string, sticky?: boolean, reason?: string, state?: string, previousState?: string, code?: number, resumed?: boolean }) => void,
  *   suppressRoutingStatus?: boolean,
  *   preferRelayError?: boolean,
+ *   probeLanWhileSticky?: boolean,
+ *   autoProbeLanWhileSticky?: boolean,
+ *   delayRelayAfterRecentLanFailure?: boolean,
+ *   confirmLanReachabilityBeforeRelay?: boolean,
+ *   stickyLanProbeTimeoutMs?: number,
+ *   lanReachabilityProbeTimeoutMs?: number,
  * }} [opts]
  * @returns {Promise<{
  *   ok: boolean,
@@ -798,6 +997,25 @@ export async function routedFetch(url, init = {}, opts = {}) {
 
   // Sticky-relay path: LAN just failed, prefer relay for a while.
   if (_stickyRelayUntilMs > t) {
+    if (shouldDelayRelayAfterRecentLanFailure(t, opts)) {
+      const lan = await attemptLanFetch(url, init, opts);
+      if (lan.ok) return lan.response;
+      if (shouldDelayRelayAfterRecentLanFailure(nowMs(opts), opts)) {
+        suppressRelayAfterRecentLanFailure(url, lan.err, opts);
+        throw lan.err;
+      }
+      if (await confirmLanUnavailableBeforeRelay(url, lan.err, opts)) {
+        throw lan.err;
+      }
+    }
+    const autoProbe = shouldAutoProbeLanWhileSticky(t, opts);
+    if (opts.probeLanWhileSticky === true || autoProbe) {
+      const lan = await attemptStickyLanProbe(url, init, stickyLanProbeOpts(opts, autoProbe));
+      if (lan.ok) return lan.response;
+      if (await confirmLanUnavailableBeforeRelay(url, lan.err, opts)) {
+        throw lan.err;
+      }
+    }
     emitRoutingStatus("remote-switching", opts, { url: String(url || ""), sticky: true });
     const r = await attemptRelayFetch(url, init, opts);
     if (r.ok) return r.response;
@@ -816,6 +1034,13 @@ export async function routedFetch(url, init = {}, opts = {}) {
   // Happy path: LAN first.
   const lan = await attemptLanFetch(url, init, opts);
   if (lan.ok) return lan.response;
+  if (shouldDelayRelayAfterRecentLanFailure(nowMs(opts), opts)) {
+    suppressRelayAfterRecentLanFailure(url, lan.err, opts);
+    throw lan.err;
+  }
+  if (await confirmLanUnavailableBeforeRelay(url, lan.err, opts)) {
+    throw lan.err;
+  }
 
   // Try relay once before giving up.
   emitRoutingStatus("remote-switching", opts, { url: String(url || ""), sticky: false });
@@ -837,8 +1062,12 @@ export function __getTelemetry() {
     ..._telemetry,
     stickyRelayUntilMs: _stickyRelayUntilMs,
     lastRoute: _lastSuccessfulRoute,
+    lastLanOkAtMs: _lastLanOkAtMs,
+    lastStickyLanProbeAtMs: _lastStickyLanProbeAtMs,
+    consecutiveLanFailures: _consecutiveLanFailures,
     hasClient: Boolean(_client),
     clientPairingKey: _clientPairingKey,
+    relayCircuitOpenUntilMs: _relayCircuitOpenUntilMs,
   };
 }
 
@@ -864,10 +1093,18 @@ export function __resetForTest() {
   _telemetry = newTelemetry();
   _lastPairingStateStatus = null;
   _lastSuccessfulRoute = null;
+  _lastLanOkAtMs = 0;
+  _lastStickyLanProbeAtMs = 0;
+  _consecutiveLanFailures = 0;
+  _relayFailureAtMs = [];
+  _relayCircuitOpenUntilMs = 0;
 }
 
 // Test-visible constants for tests that want to assert behavior at the
 // sticky-window boundary without hard-coding 5 minutes in two places.
 export const __STICKY_RELAY_MS = STICKY_RELAY_MS;
+export const __AUTO_STICKY_LAN_PROBE_INTERVAL_MS = AUTO_STICKY_LAN_PROBE_INTERVAL_MS;
+export const __TRANSIENT_LAN_FAILURE_STICKY_MS = TRANSIENT_LAN_FAILURE_STICKY_MS;
 export const __DEFAULT_RELAY_TIMEOUT_MS = DEFAULT_RELAY_TIMEOUT_MS;
 export const __DEFAULT_LAN_TIMEOUT_MS = DEFAULT_LAN_TIMEOUT_MS;
+export const __RECENT_LAN_RELAY_SUPPRESSION_FAILURES = RECENT_LAN_RELAY_SUPPRESSION_FAILURES;

package/web/remote-pairing/transport.js

@@ -84,6 +84,10 @@ const DEFAULT_BACKOFF_MS = [1_000, 2_000, 4_000, 8_000, 16_000, 30_000];
 const DEFAULT_HANDSHAKE_TIMEOUT_MS = 30_000;
 const MAX_PRE_CONNECT_BACKOFF_MS = 4_000;
 const RELAY_RESET_RECONNECT_MS = 250;
+const DEFAULT_FAILURE_WINDOW_MS = 60_000;
+const DEFAULT_FAILURE_THRESHOLD = 4;
+const DEFAULT_CIRCUIT_BREAKER_MS = 60_000;
+const DEFAULT_MAX_CIRCUIT_BREAKER_MS = 10 * 60_000;
 const DEFAULT_PROLOGUE = new TextEncoder().encode("viveworker/remote-pairing/v1");
 
 // CloseEvent codes we emit. 1000 is normal; 4xxx is application-defined.
@@ -113,6 +117,10 @@ const CLOSE_RELAY_RESET_SESSION = 4004;
  * @property {number} [pingIntervalMs]
  * @property {number[]} [backoffMs]
  * @property {number} [handshakeTimeoutMs]
+ * @property {number} [failureWindowMs]
+ * @property {number} [failureThreshold]
+ * @property {number} [circuitBreakerMs]
+ * @property {number} [maxCircuitBreakerMs]
  * @property {typeof WebSocket} [WebSocketImpl]     injectable for Node-side tests
  * @property {{debug?: Function, warn?: Function}} [logger]
  */
@@ -154,6 +162,10 @@ export class RemotePairingTransport {
     this._backoffMs = (opts.backoffMs ?? DEFAULT_BACKOFF_MS).slice();
     if (this._backoffMs.length === 0) this._backoffMs = [1_000];
     this._handshakeTimeoutMs = opts.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS;
+    this._failureWindowMs = opts.failureWindowMs ?? DEFAULT_FAILURE_WINDOW_MS;
+    this._failureThreshold = opts.failureThreshold ?? DEFAULT_FAILURE_THRESHOLD;
+    this._circuitBreakerMs = opts.circuitBreakerMs ?? DEFAULT_CIRCUIT_BREAKER_MS;
+    this._maxCircuitBreakerMs = opts.maxCircuitBreakerMs ?? DEFAULT_MAX_CIRCUIT_BREAKER_MS;
 
     this._WebSocketImpl = opts.WebSocketImpl ?? globalThis.WebSocket;
     if (typeof this._WebSocketImpl !== "function") {
@@ -188,6 +200,12 @@ export class RemotePairingTransport {
     this._pingTimer = null;
     /** @type {ReturnType<typeof setTimeout> | null} */
     this._handshakeTimer = null;
+    /** @type {number[]} recent reconnect-triggering failures. */
+    this._recentFailureAtMs = [];
+    /** If > Date.now(), reconnect attempts are intentionally delayed. */
+    this._circuitOpenUntilMs = 0;
+    /** Consecutive circuit openings, used to lengthen persistent outages. */
+    this._circuitOpenCount = 0;
 
     // ---- crypto state (persists across reconnects until RESUME_FAIL) ----
     /** @type {import("../remote-pairing.bundle.js").NoiseSession | null} */
@@ -320,6 +338,12 @@ export class RemotePairingTransport {
 
   _open() {
     this._cancelReconnectTimer();
+    const circuitDelay = this._circuitDelayMs();
+    if (circuitDelay > 0) {
+      this._log.warn?.(`relay reconnect circuit open for ${circuitDelay}ms`);
+      this._scheduleReconnect();
+      return;
+    }
     this._setState(STATE.OPENING);
 
     const url =
@@ -484,6 +508,12 @@ export class RemotePairingTransport {
 
     this._log.debug?.(`ws closed code=${evt?.code} reason=${evt?.reason}`);
     this._setState(STATE.DISCONNECTED, { code: evt?.code, reason: evt?.reason });
+    if (Number(evt?.code) !== CLOSE_NORMAL) {
+      this._recordReconnectFailure({
+        code: Number(evt?.code) || 0,
+        reason: String(evt?.reason || ""),
+      });
+    }
     if (isRelayReset) {
       this._scheduleRelayResetReconnect();
     } else {
@@ -619,9 +649,10 @@ export class RemotePairingTransport {
     const idx = Math.min(this._reconnectAttempt, this._backoffMs.length - 1);
     const waitingForFirstConnect = this._connectPromise != null && this._session == null;
     const rawDelay = this._backoffMs[idx];
-    const delay = waitingForFirstConnect
+    const backoffDelay = waitingForFirstConnect
       ? Math.min(rawDelay, MAX_PRE_CONNECT_BACKOFF_MS)
       : rawDelay;
+    const delay = Math.max(backoffDelay, this._circuitDelayMs());
     this._reconnectAttempt += 1;
     this._log.debug?.(`reconnect in ${delay}ms (attempt ${this._reconnectAttempt})`);
     this._reconnectTimer = setTimeout(() => {
@@ -636,7 +667,7 @@ export class RemotePairingTransport {
     // rendezvous again. Treat it as a protocol reset, not a network failure,
     // so app boot does not sit behind the exponential backoff ladder.
     this._reconnectAttempt = 0;
-    const delay = RELAY_RESET_RECONNECT_MS;
+    const delay = Math.max(RELAY_RESET_RECONNECT_MS, this._circuitDelayMs());
     this._log.debug?.(`reconnect in ${delay}ms (relay reset)`);
     this._reconnectTimer = setTimeout(() => {
       this._reconnectTimer = null;
@@ -713,6 +744,9 @@ export class RemotePairingTransport {
     this._state = newState;
     if (newState === STATE.CONNECTED) {
       this._reconnectAttempt = 0;
+      this._recentFailureAtMs = [];
+      this._circuitOpenUntilMs = 0;
+      this._circuitOpenCount = 0;
     }
     try {
       this._onStateChange(newState, prev, info);
@@ -729,6 +763,10 @@ export class RemotePairingTransport {
   }
 
   _fail(err) {
+    this._recordReconnectFailure({
+      code: CLOSE_FATAL,
+      reason: err?.message || "fatal-error",
+    });
     this._setState(STATE.FAILED, { error: err });
     this._stopPing();
     this._stopHandshakeTimer();
@@ -748,6 +786,33 @@ export class RemotePairingTransport {
     this._session = null;
     this._handshake = null;
   }
+
+  _recordReconnectFailure(info = {}) {
+    const now = Date.now();
+    const windowMs = Math.max(1_000, Number(this._failureWindowMs) || DEFAULT_FAILURE_WINDOW_MS);
+    this._recentFailureAtMs = this._recentFailureAtMs.filter((at) => now - at <= windowMs);
+    this._recentFailureAtMs.push(now);
+    const threshold = Math.max(2, Math.floor(Number(this._failureThreshold) || DEFAULT_FAILURE_THRESHOLD));
+    if (this._recentFailureAtMs.length < threshold) return;
+
+    const baseCooldownMs = Math.max(1_000, Number(this._circuitBreakerMs) || DEFAULT_CIRCUIT_BREAKER_MS);
+    const maxCooldownMs = Math.max(baseCooldownMs, Number(this._maxCircuitBreakerMs) || DEFAULT_MAX_CIRCUIT_BREAKER_MS);
+    const multiplier = Math.min(16, 2 ** this._circuitOpenCount);
+    const cooldownMs = Math.min(maxCooldownMs, baseCooldownMs * multiplier);
+    this._circuitOpenCount += 1;
+    this._circuitOpenUntilMs = Math.max(this._circuitOpenUntilMs, now + cooldownMs);
+    this._recentFailureAtMs = [];
+    this._dropNoiseState();
+    this._log.warn?.(
+      `relay reconnect circuit opened for ${cooldownMs}ms` +
+      `${info?.code ? ` after close=${info.code}` : ""}` +
+      `${info?.reason ? ` (${String(info.reason).slice(0, 64)})` : ""}`,
+    );
+  }
+
+  _circuitDelayMs() {
+    return Math.max(0, this._circuitOpenUntilMs - Date.now());
+  }
 }
 
 // ---------------------------------------------------------------------------

package/web/sw.js

@@ -1,6 +1,7 @@
 const APP_BUILD_ID = "__VIVEWORKER_APP_BUILD_ID__";
 const CACHE_NAME = `viveworker-${APP_BUILD_ID}`;
 const APP_SCRIPT_URL = `/app.js?v=${APP_BUILD_ID}`;
+const APP_STYLE_URL = `/app.css?v=${APP_BUILD_ID}`;
 const API_ROUTER_URL = `/remote-pairing/api-router.js?v=${APP_BUILD_ID}`;
 const NOTIFICATION_INTENT_CACHE = "viveworker-notification-intent-v1";
 const NOTIFICATION_INTENT_PATH = "/__viveworker_notification_intent__";
@@ -14,7 +15,7 @@ const NOTIFICATION_INTENT_PATH = "/__viveworker_notification_intent__";
 const APP_ASSETS = [
   "/app",
   APP_SCRIPT_URL,
-  "/app.css",
+  APP_STYLE_URL,
   "/app.js",
   "/i18n.js",
   "/icons/viveworker-v-pulse.svg",
@@ -31,10 +32,12 @@ const APP_ROUTES = new Set(["/", "/app", "/app/"]);
 const CACHED_PATHS = new Set(APP_ASSETS.map((asset) => new URL(asset, self.location.origin).pathname));
 const VERSIONED_CACHE_PATHS = new Set([
   "/app.js",
+  "/app.css",
   "/remote-pairing/api-router.js",
 ]);
 const NETWORK_FIRST_PATHS = new Set([
   "/app.js",
+  "/app.css",
   "/remote-pairing/api-router.js",
 ]);
 const APP_NAVIGATION_NETWORK_TIMEOUT_MS = 1800;
@@ -49,7 +52,7 @@ const APP_SHELL_FALLBACK_HTML = `<!doctype html>
     <link rel="manifest" href="/manifest.webmanifest">
     <link rel="apple-touch-icon" href="/icons/apple-touch-icon.png">
     <link rel="icon" type="image/png" sizes="192x192" href="/icons/viveworker-icon-192.png">
-    <link rel="stylesheet" href="/app.css">
+    <link rel="stylesheet" href="${APP_STYLE_URL}">
     <style>
       html, body { min-height: 100%; margin: 0; background: #081015; color: #f5fbff; }
       .boot-splash { position: fixed; inset: 0; display: grid; place-items: center; font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", sans-serif; background: radial-gradient(circle at 50% 18%, rgba(47, 143, 103, 0.22), transparent 30%), linear-gradient(180deg, #081015 0%, #091015 100%); }
@@ -150,14 +153,14 @@ self.addEventListener("push", (event) => {
   } catch {
     payload = {
       title: "viveworker",
-      body: event.data ? event.data.text() : "A new Codex item is available.",
+      body: event.data ? event.data.text() : fallbackNotificationBody(),
       data: { url: "/app" },
     };
   }
 
   const title = payload.title || "viveworker";
   const options = {
-    body: payload.body || "A new Codex item is available.",
+    body: payload.body || fallbackNotificationBody(),
     tag: payload.tag || "",
     data: payload.data || { url: "/app" },
   };
@@ -175,6 +178,13 @@ self.addEventListener("push", (event) => {
   })());
 });
 
+function fallbackNotificationBody() {
+  const language = String(self.navigator?.language || "").toLowerCase();
+  return language.startsWith("ja")
+    ? "viveworker を開いて確認してください。"
+    : "Open viveworker for details.";
+}
+
 self.addEventListener("notificationclick", (event) => {
   event.preventDefault?.();
   event.notification.close();