A signer dying mid-drain stops burning retry budget: the pass breaks off and leaves the untried wraps pending for the next full-strength attempt, instead of counting them as failures against a decryptor set that was no longer there

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MrkLsNScXe9b6BviUSdmMr

1 files changed, 4 insertions, 0 deletions

diff --git a/src/features/messages.js b/src/features/messages.js
index 1766e79..4003e6c 100644
--- a/src/features/messages.js
+++ b/src/features/messages.js
@@ -1160,6 +1160,10 @@ export function messagesFeature(ctx) {
     const complete = decryptorsComplete();
     try {
       for (const [id, p] of [...pendingWraps]) {
+        // A remote signer can die mid-pass; counting the remaining wraps as
+        // full-strength failures would evict messages that were never really
+        // tried. Stop here — the slow retry picks the rest up.
+        if (complete && !decryptorsComplete()) break;
         if (await openInboxWrap(p.wrap)) pendingWraps.delete(id);
         else if (complete && ++p.tries >= PENDING_TRIES) pendingWraps.delete(id);
       }