fix(desktop): close reconnect gaps that previously required CMD+R

[wesbillman]

Opened by Brain (agent) on behalf of @wesbillman.

Problem

Users report the desktop app doesn't reliably reconnect and can wedge in states where only CMD+R (or a full restart) restores connectivity (thread c2205e2b in #desktop-reconnecting).

Pinky's empirical light-switch matrix (real buzz-relay, SIGTERM/1012 + SIGKILL × 1s/45s/3min, at f18a9cb10) passed 4/4 — the backoff state machine recovers cleanly from ordinary relay loss. That isolates the user-stuck states to four special cases a reload resets but the auto flow never did.

Fixes

Gap	Change
G1 — recovery rode solely on the backoff timer (max 30s), throttled by WKWebView in occluded/background windows; nothing fired on network return or wake	New useRelayResumeTriggers: online, window focus, and visibility→visible call preconnect() when the session is reconnecting/stalled, rate-limited to one attempt per 5s (relayResumeTriggerPolicy.ts). Deliberately inert for the terminal disconnected state.
G2 — any AUTH OK false latched the session terminal forever, though the relay also rejects for transient causes (duplicate-AUTH "already authenticated" race, ±60s clock skew, fail-closed allowlist DB errors)	New AuthOkTracker (relayAuthPolicy.ts): "already authenticated" resolves as success; transient rejections retry with normal backoff; latch only on restricted: or after 3 consecutive rejections.
G3 — an auth-required: CLOSED (REQ racing AUTH after reconnect) permanently deleted the live subscription with no UI signal — frozen channel while state reads "connected"	Reclassified auth-required: as retryable in relayClosedPolicy.ts. Genuinely terminal classes (restricted:, invalid:, …) still delete. Can't loop: a truly unauthenticated session latches terminal at the connection level.
G4 — useRelayAutoHeal observed the 2s-debounced connection hook, so sub-2s flaps never triggered the heal even though resetConnection had already rejected every in-flight query	Auto-heal now observes the raw connection-state emitter. The existing 15s heal rate-limit still guards against flap storms.

Each fix is a colocated pure-policy module + unit tests, matching the existing relayReconnectPolicy/relayClosedPolicy pattern.

Validation

• Full desktop unit suite: 4151 pass, 0 fail (at branch tip, pnpm -C desktop test)
• pnpm -C desktop typecheck and pnpm -C desktop check clean (file-size ratchet respected — relayClientSession.ts net −2 lines despite the tracker wiring)
• Evidence trail: RESEARCH/DESKTOP_RECONNECT_CMDR_GAP_AUDIT.md (audit), RESEARCH/DESKTOP_RECONNECT_LIGHT_SWITCH_RESULTS.md (Pinky's matrix)

Not covered / follow-ups

• Native macOS sleep-wake was not automated (would kill the harness session); G1's focus trigger is the mechanism that covers wake in practice, but a manual sleep-wake verification on a real build is worthwhile.
• G3 terminal-CLOSED classes (restricted: etc.) still silently delete subs with no UI signal — surfacing that is a separate UX decision.
• Stall-watchdog latency (60s idle + 10s check) left unchanged; G1 triggers largely mask it.

[wpfleger96]

The reconnect coverage is strong, but two AUTH policy interactions can keep permanent failures retrying instead of reaching the intended terminal state.

[wpfleger96]

Both prior findings are addressed at this head: environment resume now bypasses backoff without resetting AUTH/terminal policy state, and blocked: ban responses latch terminal immediately. The interleaved resume/AUTH rejection regression is covered end to end. No remaining blocking findings.