(remote): manual refresh reconnects a host — ignore backoff, restart the watch channel

[devsuitup]

Symptom

When a remote host is in error or backoff, the only way to reconnect today is to disable and re-enable it in Settings → Remote hosts. The sidebar refresh button (#search-refresh-btn, public/app.js:713) only reindexes local sessions for search; it never touches the remote side.

What exists

• remoteIndexer.refreshHostNow(alias) (remote-index.js:237) exists since (remote): push liveness over a persistent watch channel #241 but honours the backoff: if (now() < state.nextAttemptAt) return { skipped: true }. A user-initiated refresh during backoff is silently skipped.
• remoteIndexer.refreshNow() is exposed as IPC remote-hosts-refresh (main.js:1517, preload.js:41 remoteHostsRefresh) — no renderer caller.
• The watch channel (remote-watch.js) is started by syncRemoteWatchers(); a host that ended with the SWITCHBOARD-NO-INOTIFYWAIT marker or that failed is not retried until the next sync (toggle in settings, or restart).

Fix

A manual refresh means "I know the host is back, reconnect now", so it must ignore the backoff and re-arm everything for that host:

• refreshHostNow(alias, { force: true }): reset the host's backoff state (failures, nextAttemptAt), then refresh even if nextAttemptAt is in the future. The automatic caller (onRemoteWatchEvent, main.js:486) keeps the non-forced behaviour.
• Restart the watch channel for that alias (remoteWatcher.stop(alias) then start) as part of the same action, so a channel killed by a network blip comes back without a settings round-trip.
• Renderer: the sidebar refresh button also triggers a forced refresh of every enabled remote host; a per-group refresh action on a remote project header (next to the host dot, remoteHostState(project)) triggers it for that alias only. The host dot switches to its "connecting" state immediately, not after the ssh returns.
• Feedback: on failure, the host dot's tooltip shows the fresh error and the next automatic attempt time.

Not in scope

Changing the backoff curve or the default refresh interval.

Acceptance

• Host in backoff (simulate with a failing transport): manual refresh runs the ssh inventory immediately and clears the backoff on success; the automatic path still respects it — one test each on the real remote-index.js with an injected clock, and a mutation dropping the force branch makes the manual one red.
• After a watch channel exit, manual refresh restarts it (spawn counted in the fake transport).
• No behaviour change when no remote host is enabled.

[devsuitup]

Measured on 2026-09-10 17:41, right after an app restart on v0.0.75: the first inventory refresh hit ssh: connect to host … port 22: Connection timed out (exit 255) while the watch channel opened fine 17 s earlier and five manual probes right after answered in 0.5–7.6 s. One transient timeout, and every remote session became non-attachable for 5 minutes: remote-index.js:223 and :252 do remoteSessions.set(alias, []) on failure, so annotateRemoteAttachable (main.js:537) finds no descriptor, the badge says "no live process", and a click opens the transcript instead of attaching — while the tmux sessions are alive. Manual refresh could not help because refreshHostNow honours the backoff.

Add to the fix: on a failed refresh, keep the last known descriptors and mark them stale (at unchanged, error set — the host dot already renders that), instead of wiping them. Attach stays possible; if the host is really down, the attach itself fails with the ssh error, which is the honest signal. A descriptor list is only replaced by a successful inventory.