fix: self-heal lazy routes on retryable split-bundle segment timeout

[huhuanming]

Problem

React.lazy permanently caches a rejected segment import on the lazy object. So when a split-bundle segment load fails with a transient/retryable error — most importantly the iOS watchdog false-firing SPLIT_BUNDLE_TIMEOUT on resume from suspension (see OneKeyHQ/app-modules#65), but also any genuine SPLIT_BUNDLE_NO_RUNTIME/SPLIT_BUNDLE_TIMEOUT on either platform — the route white-screens until the app is force-killed, even though installProdBundleLoader already marks the error retryable and the very next __loadBundleAsync would succeed in ~1ms. The only error boundary above lazy routes is the app-root Sentry boundary, which renders the full-screen error.

Fix

Wrap LazyLoad (packages/shared/src/lazyLoad/index.tsx) in a LazyRetryBoundary:

• Retries only on retryable segment errors (SPLIT_BUNDLE_TIMEOUT / SPLIT_BUNDLE_NO_RUNTIME / .retryable === true / [SplitBundle] … eval timed out message). Non-retryable errors (EVAL_ERROR/IO_ERROR/NOT_FOUND/SHA256_MISMATCH) surface immediately, exactly as today.
• Regenerates the lazy() object per retry (via a retryKey/useMemo bump) — the only way to drop React's cached rejected payload.
• Bounded (MAX_LAZY_RETRIES = 2, under the loader's own MAX_RETRYABLE_ATTEMPTS = 3).
• Foreground-gated via appVisibility: if backgrounded, the retry defers until the app returns to foreground, where the buffered native executor is about to flush — instead of burning the budget while suspended.
• Boundary semantics: getDerivedStateFromError enters a non-throwing retrying hold; render() throws only in the terminal fatal state, so a retry never escalates to the root boundary first. Retry timer cleared on unmount.

Cross-platform

The amplifier is shared JS, so this fixes both iOS (where it pairs with the native watchdog fix) and Android (where a genuine retryable timeout otherwise poisons React.lazy identically). OTA-deployable — does not need a native build.

Review & tests

Two adversarial review rounds (Claude + Codex). 16 unit tests (index.test.tsx): retryable-classification matrix, retry-then-render, non-retryable escalation, max-retry escalation, background-defer→foreground-retry. tsc:staged + lint:staged clean.

[revan-zhang]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[sidmorizon]

Reviewed the self-heal boundary against the split-bundle loader's error contract; two interaction findings noted inline.

---

Generated by Claude Code