feat(reconnect): retry forever — quiet escalation, dormant tail, outage cues

[TX-RX]

Summary

Reworks the Mumble reconnect UX so an unexpected drop no longer reads as an immediate "error," an off-grid device stops beeping and draining battery — and the radio never gives up trying.

This PR supersedes its own earlier auto-pause design. The landed policy (2026-07-14): a real LMR radio never stops reaching for the repeater, and XV must not either. Silence because we quit is operationally worse than silence because we can't get through — an operator who keys up expecting the radio to have been trying, and finds it dormant, has been lied to by the device.

The insight that reconciles this with the original off-grid complaint: slowing down and giving up are separable, and only the first was ever wanted. The dormant tail fixes the battery drain; auto-pause was never load-bearing for it.

What changed

Ladder — never stops

• Removed PAUSE_AFTER_ATTEMPTS / shouldPause() and the wrapper branch that suspended the ladder after ~10 consecutive failures (~19 min).
• Kept the 2m/5m dormant tail. DEFAULT_SCHEDULE is 1, 2, 4, 8, 15, 30, 60s → 2m → 5m, with 5m repeating forever.
• The only things that stop retries: an operator disconnect, a Fatal outcome (auth wall — retrying walks into the same wall), or the auto-reconnect toggle.

Audio — ReconnectNotificationTracker now owns all three decisions

Cue	When	Sound
WARNING_VOICE_LOST	once, at 3 failed attempts	unchanged triple-tap, 80% amp
RECONNECT_RETRY (new)	per attempt, first 10 min	one 150 ms / 700 Hz pulse, ~1/3 amp
RECONNECT_RECOVERED (new)	on a reconnect that resolves a real outage	two ascending 800→1200 Hz beeps

• The retry chirp is a single pulse — every other cue in the system is 2+ pulses, so one mid-frequency blip can't be confused with any of them. Deliberately quiet: it repeats over minutes, so it sits under the conversation; WARNING_VOICE_LOST is the cue allowed to demand attention, and it still fires once.
• Alert and chirp never stack on one attempt — they mean different things ("act on this" vs "stand by").
• Chirping stops at 10 min (AUDIBLE_UNTIL); retries do not. Only the sound stops.
• A first-time connect does not chime — onReconnected() returns false when nothing was broken.
• RECONNECT_RETRY opts out of the shared 5 s status cooldown, which would otherwise mute exactly the early attempts (1s/2s/4s gaps) an operator most wants to hear.

Visual — the signal that outlives the audio

• New ReconnectStatusNotifier: silent, ongoing shade notification for the duration of an outage. Once the cues go quiet at 10 min this is the only thing distinguishing "still trying" from "gave up," which is what makes the never-give-up policy legible to the operator.
• setWhen + setUsesChronometer render a live "last attempt" counter with no timer of our own — one cheap re-post per failed attempt (once per 5 min on the tail).
• Cleared on recovery, deliberate disconnect, plugin teardown, and when auto-reconnect is switched off (its text promises XV keeps trying; with the ladder suspended that would be a lie).
• New LOW-importance, no-badge xv_reconnect_status channel. No server hostname in the text — the shade is a screenshot surface.

Retained from the earlier revision

Quiet escalation, the PREF_AUTO_RECONNECT toggle (still the operator's manual off-switch for the trunk case), PTT re-arm via retryNow(), and the talk-permit-tone suppression on a dead transport.

Test plan

• ./gradlew ktlintCheck — green
• ./gradlew assembleCivDebug — green
• ./gradlew testCivDebugUnitTest — green (842 tests) — see caveat below
• On-device smoke — the part that can't be exercised in CI:
  • Brief blip → no sound at all, amber indicator only.
  • Sustained outage → exactly one triple-tap, then a quiet chirp per attempt.
  • Leave it down >10 min → chirps stop, notification stays, ladder keeps retrying (watch logcat XvMumbleReconnect: scheduled reconnect attempt N).
  • Restore the server → single recovery chime, notification clears.
  • PTT during the dormant tail → collapses the backoff and reconnects.
  • Toggle auto-reconnect off mid-outage → notification clears, ladder stops.
  • Verify the recovery chime is distinguishable from the channel-join chirp in real use (both are two ascending beeps; this one is a fifth higher). If they're confusable, the fix is a three-beep run, not a pitch tweak — pattern is what operators discriminate.

⚠️ Caveat on the unit-test gate

testCivDebugUnitTest cannot compile on main today, independent of this PR: XvPlacementDecisionTest (landed in #72) references XvVoiceService.PlaceDecision, an enum nested in a companion object, and fails with Unresolved reference. CI runs Detekt/Ktlint/Semgrep but has no unit-test job, so it merged silently. I verified this reproduces on main with this branch's changes stashed.

To get the green run above I temporarily moved that one file aside, then restored it — it is untouched by this PR. Tracked separately (fix + add a CI unit-test job); that is the real bug here.

Reviewer notes

• ReconnectNotificationTracker.onAttemptFailed() now returns a Decision(playAlert, playChirp) instead of a Boolean. Single call, atomic under the existing @Synchronized, and the caller can't get the ordering wrong or stack both cues.
• Clock is injected (nowMs) so the audible-window logic is testable; the window is measured from outage start, not last attempt, so a sparse dormant-tail cadence can't refresh it.
• ReconnectPolicyTest pins the never-give-up contract at 10,000 consecutive failures — a deliberately absurd count, so reintroducing any "give up after N" gate fails with a name that explains why.
• Also fixes a pre-existing failing test on this branch (retryNow collapses a pending backoff): it built its inner mock with isConnected=true, so retryNow() correctly no-opped on a "live" link and the assertions failed for an unrelated reason. Sibling tests already pinned the flag false.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR reworks the Mumble reconnect behavior and operator UX to reduce noisy/expensive retry behavior during sustained outages, while still allowing an explicit operator action (PTT) to force reconnection.

Changes:

• Adds quiet escalation for the audible “voice lost” alert (thresholded + once-per-outage) via a new ReconnectNotificationTracker, wired into XvMapComponent disconnect/failure handling.
• Extends reconnect backoff with a dormant tail and adds an auto-pause threshold in ReconnectPolicy, with corresponding behavior in ReconnectingMumbleTransport plus new unit tests.
• Introduces an “Auto-reconnect on drop” settings toggle (persisted in XvSettings, surfaced in xv_settings.xml, wired through XvDropDownReceiver and XvMapComponent), and adds retryNow() to re-arm/collapse backoff (used from PTT-down).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
app/src/test/java/com/atakmap/android/xv/transport/ReconnectPolicyTest.kt	Updates tests for dormant-tail schedule and adds coverage for auto-pause predicate.
app/src/test/java/com/atakmap/android/xv/transport/ReconnectNotificationTrackerTest.kt	Adds unit tests pinning the quiet-escalation/once-per-outage contract.
app/src/test/java/com/atakmap/android/xv/transport/ReconnectingMumbleTransportTest.kt	Adds tests for toggle-off suspension, retryNow(), and auto-pause stopping scheduling.
app/src/main/res/layout/xv_settings.xml	Adds the “Auto-reconnect on drop” switch and explanatory text in Settings → Server.
app/src/main/java/com/atakmap/android/xv/ui/XvDropDownReceiver.kt	Extends controller interface and wires the new settings switch to controller persistence.
app/src/main/java/com/atakmap/android/xv/transport/ReconnectPolicy.kt	Adds dormant-tail schedule and PAUSE_AFTER_ATTEMPTS + shouldPause().
app/src/main/java/com/atakmap/android/xv/transport/ReconnectNotificationTracker.kt	New tracker gating when the audible alert is allowed to fire.
app/src/main/java/com/atakmap/android/xv/transport/ReconnectingMumbleTransport.kt	Adds reconnect enable gate, reconnect suspension state, retryNow(), and auto-pause behavior.
app/src/main/java/com/atakmap/android/xv/plugin/XvSettings.kt	Persists the auto-reconnect preference.
app/src/main/java/com/atakmap/android/xv/plugin/XvMapComponent.kt	Wires the toggle and PTT re-arm into the live transport; gates audible alert firing via tracker.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.