Handle failed logins gracefully without automatic retries

docs/docs/credential-refresh.html

@@ -145,18 +145,20 @@ <h2 id="notify">Auto-open or notify first</h2>
       </p>
       <ul>
         <li><strong>Auto-open browser</strong> (default) — the login page opens as soon as the token needs replacing. With federated SSO it usually completes without asking you anything.</li>
-        <li><strong>Notification + hotkey</strong> — Frost posts a system notification and waits. Click the notification or press the refresh hotkey when you are ready, and the login page opens then. If you never do, the run gives up when the device code expires.</li>
+        <li><strong>Notification + hotkey</strong> — Frost posts a system notification and waits. Click the notification or press the refresh hotkey when you are ready, and the login page opens then. If you never do, the run gives up when the device code expires, and Frost waits for you rather than notifying again.</li>
       </ul>
       <p>See <a href="settings-behavior.html">behavior settings</a> for the trade-off between the two.</p>
 
       <h2 id="failures">When a run fails</h2>
       <p>
-        A failed run does not retry immediately and does not leave Frost stuck:
+        What happens next depends on <em>why</em> it failed, because the two
+        kinds of failure want opposite treatment:
       </p>
       <ul>
+        <li><strong>Nobody finished the sign-in</strong> — the login window was closed, the notification was never answered, the device code expired unapproved, AWS reported the sign-in denied. Frost stops and waits for you. Trying again would only open another login page for nobody to complete, and an unattended machine would collect one every few minutes all night. The tray menu says <em>Sign-in needed</em>, a single notification tells you so unless you closed the window yourself, and the next refresh is the one <em>you</em> start.</li>
+        <li><strong>Something else failed</strong> — no network, an AWS error before any login page opened. Nothing is on your screen to pile up, so Frost retries on its own: a minute later, then two, doubling up to half-hourly until one succeeds.</li>
+        <li>If the token was renewed and a <em>later</em> step failed — profiles, EKS — the credentials are good, so Frost stays on the normal schedule and tries the whole run again when they expire.</li>
         <li>The error is stored and shown on the <strong>Credentials</strong> page, with the failing step marked on the <strong>Activity</strong> page.</li>
-        <li>The next refresh is rescheduled — if the token is already expired, that is essentially straight away, so a transient failure resolves itself.</li>
-        <li>Closing the login window is treated as "not now": the run aborts rather than holding the refresh lock until the device code expires.</li>
         <li>Errors are recorded with the AWS exception name, HTTP status and request id where AWS provides them, which is what makes them worth pasting into a bug report.</li>
       </ul>
       <p>

docs/docs/login.html

@@ -103,7 +103,8 @@ <h3>Default browser</h3>
       <p>
         The trade-off is that Frost has no window to watch: it keeps polling
         until you approve or until the device code expires, so abandoning a
-        sign-in leaves the run waiting rather than failing fast.
+        sign-in leaves the run waiting rather than failing fast. It gives up
+        once, quietly, when the code expires — it does not open a second tab.
       </p>
       <p><a href="settings-behavior.html#login-page">Behavior settings →</a></p>
 
@@ -155,16 +156,24 @@ <h2 id="timeouts">Timeouts and cancellation</h2>
           <thead><tr><th>What you do</th><th>What Frost does</th></tr></thead>
           <tbody>
             <tr><td>Approve the sign-in</td><td>Collects the token on the next poll and continues the run</td></tr>
-            <tr><td>Close the login window</td><td>Aborts the run, records "Login window closed", reschedules</td></tr>
+            <tr><td>Close the login window</td><td>Aborts the run at once and records "Login window closed"</td></tr>
             <tr><td>Ignore it (in-app window)</td><td>Polls until AWS expires the device code, then records "Login timed out"</td></tr>
+            <tr><td>Ignore it (default browser)</td><td>The same — Frost has no window to watch, so it polls the code out</td></tr>
             <tr><td>Ignore the notification (notify mode)</td><td>Waits for the hotkey or a click until the device code expires, then gives up</td></tr>
+            <tr><td>Refuse the sign-in at your identity provider</td><td>Ends the run as soon as AWS reports it, rather than polling on</td></tr>
           </tbody>
         </table>
       </div>
       <p>
         In every case the failure is recorded on the
-        <a href="activity.html">Activity</a> page and the next refresh is
-        rescheduled — a cancelled sign-in never leaves Frost wedged.
+        <a href="activity.html">Activity</a> page — and then Frost waits for you.
+        A sign-in nobody completed is not retried on a timer: the retry would
+        open another login page with nobody there to finish it, and by morning
+        you would have one for every few minutes you were away. The tray menu
+        says <em>Sign-in needed</em>, and a notification says so once — unless
+        you closed the window or refused the sign-in yourself, in which case you
+        already know. The next attempt is the one you start, from the tray, the
+        Credentials page or the hotkey.
       </p>
 
       <h2 id="client">The OAuth client registration</h2>

docs/docs/troubleshooting.html

@@ -54,18 +54,30 @@ <h2 id="login">Sign-in fails or never completes</h2>
       <h4>"Login window closed"</h4>
       <p>
         The login window was closed before AWS confirmed the approval. Frost
-        treats that as "not now", aborts the run and reschedules. Trigger a
-        refresh from the tray or the Credentials page when you are ready.
+        treats that as "not now" and aborts the run. It does not start another
+        one on its own — trigger a refresh from the tray or the Credentials page
+        when you are ready.
       </p>
 
       <h4>"Login timed out"</h4>
       <p>
-        The device code AWS issued expired before the sign-in was approved. Start
-        another refresh; if this happens repeatedly in notify mode, you may
-        simply not be getting the notification —
+        The device code AWS issued expired before the sign-in was approved. Frost
+        stops there and the tray menu shows <em>Sign-in needed</em>; start
+        another refresh when you are back. If this happens repeatedly in notify
+        mode, you may simply not be getting the notification —
         <a href="#notifications">see below</a>.
       </p>
 
+      <h4>A pile of login tabs or windows waiting for me</h4>
+      <p>
+        Fixed in the version after 0.1.0. A failed sign-in used to be retried
+        twice a second from the moment the token expired, and in
+        <strong>Default browser</strong> mode each attempt opened a tab, so a
+        machine left alone overnight collected one every few minutes. Frost now
+        waits for you after a sign-in nobody completed, and only retries by
+        itself for failures that never put anything on your screen.
+      </p>
+
       <h4>An AWS error naming the client or the endpoint</h4>
       <p>
         Almost always a region mismatch: a client registered in one region means