From 6810cf5d097826b6bf1f37fd5d49a24cbab18cb9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 13 Sep 2026 10:09:05 +0000
Subject: [PATCH 1/2] Keep trying an overnight sign-in instead of giving up on
 it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A refresh that came due while nobody was at the machine ended the same way
every time: the page needed the user, Frost showed a login window (or opened a
browser tab) into an empty room, AWS expired the device code ten minutes later,
and scheduleAfterFailure() then stopped refreshing altogether and raised
"Sign-in Needed". By morning that notification pointed at a code that had died
in the night, the tray said "Sign-in needed" with nothing scheduled, and
credentials had been expired for hours — with Auto-open browser set, which is
the setting that asks Frost not to leave it to the user.

Not retrying was the right fix for #83 (a login page every half second, a tab a
minute in default-browser mode) and the wrong one for this. The pile-up came
from retrying *visibly* with nobody there, so that is what changes: an
abandoned login is retried, and an attempt made while the machine is idle is
silent.

- schedule.ts: only the user ending a login themselves (`cancelledByUser`)
  still stops the retries. A login nobody finished gets its own backoff,
  5 minutes doubling to hourly, and `loginRetryAction()` decides each tick:
  the backoff says try again anyway, the user turning up says try again now.
- aws-sso.ts: every refresh Frost starts itself now carries whether anyone is
  there (`powerMonitor.getSystemIdleTime()` against AWAY_IDLE_SEC); the ones
  the user asks for are attended by definition. An unattended refresh still
  runs — that is what recovers a silent approval beaten by a slow identity
  provider — but handOverToUser() ends the attempt rather than showing a window
  or opening a tab, and notify mode and manual approval end before a device
  code is even issued. `windowOpen` becomes an `abort` error so both endings
  travel the same path out of the poll loop.
- The "Sign-in Needed" notification is now once per streak and only when
  somebody was there to miss the login, and it names the next attempt. A user
  who was away gets the retry itself instead of an unread notification.
- The tray says "Sign-in needed — retrying in 10 minutes" rather than a bare
  "Sign-in needed", which read as Frost having given up — because it had.
- AGENTS.md (schedule.ts rules, automatic approval, verification) and
  docs/docs/{credential-refresh,login,settings-behavior,troubleshooting,
  app-window}.html describe the new behaviour.

Verified with `npm run build`, `npm run lint`, and a headless harness driving
dist/aws-sso.js against stubbed electron (idle time included), a faked SSO OIDC
client and a fake clock: 46 checks over eight scenarios — away with popup and
with default browser, notify mode, automatic approval off, a transient failure
healing itself unattended, an attended login left unfinished, a window the user
closed, a network failure, and a post-token failure — plus the real dist/tray.js
rendering the retry label. One simulated night (away from 8pm, token due at 2am,
the page needing the user) against main and against this branch:

                                    main   this
  login pages shown to nobody          1      0
  browser tabs opened to nobody        1      0   (default-browser mode)
  notifications raised overnight       1      0
  signed in after sitting down      never    30s, unprompted

Not checked here: real notifications, a real tray, and idle-time reporting on a
real desktop — the harness stubs all three.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PBe4cVzZUazesEcLLaktV4
---
 AGENTS.md                         |  34 +++-
 docs/docs/app-window.html         |   1 +
 docs/docs/credential-refresh.html |   5 +-
 docs/docs/login.html              |  28 ++--
 docs/docs/settings-behavior.html  |   4 +-
 docs/docs/troubleshooting.html    |  39 ++++-
 src/aws-sso.ts                    | 269 +++++++++++++++++++++++++-----
 src/schedule.ts                   | 130 +++++++++++++--
 src/tray.ts                       |  26 ++-
 9 files changed, 441 insertions(+), 95 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 1124b4c..4ee5db6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -38,13 +38,17 @@ missing one fails at runtime only.
 - **`src/run-log.ts`** — the per-run step log behind the Activity panel. One
   run at a time; `refresh()` guards on `isWorking` because a second run would
   overwrite the current-run slot.
-- **`src/schedule.ts`** — every delay `setNextTokenRefresh()` may use. Three
-  rules: a retry delay is never derived from the stored token expiry (after a
-  failure it is in the past, which collapses to the floor and reopens the login
-  page in a loop); a login nobody completed is not retried on a timer; a
-  failure *after* the token was renewed keeps the expiry schedule rather than
-  an error retry, which would reopen the login page for an unrelated failure.
-  No electron imports.
+- **`src/schedule.ts`** — every delay `setNextTokenRefresh()` may use, plus
+  `loginRetryAction()`, the decision behind the retry of a login nobody
+  finished. Four rules: a retry delay is never derived from the stored token
+  expiry (after a failure it is in the past, which collapses to the floor and
+  reopens the login page in a loop, #83); a failure *after* the token was
+  renewed keeps the expiry schedule rather than an error retry, which would
+  reopen the login page for an unrelated failure; only the user ending a login
+  themselves (`cancelledByUser`) stops the retries; and a login nobody finished
+  is retried on its own slower backoff — what keeps that from piling up login
+  pages is the attempts being *silent* while nobody is at the machine, not
+  their absence. No electron imports.
 - **`src/page-script.ts`** — `loadPageScript()` / `injectIntoEveryFrame()`,
   used by both injected scripts. Injection follows sub-frames because
   `executeJavaScript` on a `WebContents` reaches the top frame only, and a
@@ -180,6 +184,14 @@ of them says the user is needed (issue #1). Keep these true:
   default-browser mode, `shell.openExternal`, destroying the hidden probe only
   once the browser is up. A new way for the flow to end without arriving there
   is a refresh that hangs invisibly until the device code expires.
+- **Unattended, "somewhere" is the retry, not the screen.** When nobody is at
+  the machine (`powerMonitor.getSystemIdleTime()`, see `AWAY_IDLE_SEC`), the
+  same `onUserNeeded` ends the attempt instead of showing anything, and
+  `scheduleAfterFailure()` comes back later or as soon as the user does. A login
+  page opened into an empty room is dead in ten minutes, which is what made an
+  overnight refresh a morning of expired credentials. The silent attempt itself
+  still runs unattended — that is what recovers a refresh beaten by a slow
+  identity provider, with nobody the wiser.
 - **`backgroundThrottling: false` on the window.** Chromium throttles timers in
   a window that is not visible, and the driver's scan loop is a timer.
 - **Clicking is deliberately narrow.** Only on the device-authorization hosts
@@ -546,8 +558,12 @@ Worth doing headlessly, since nothing else covers it:
   `AWS_IAM_AUTHENTICATOR_PATH` at a stub that prints an `ExecCredential` and
   kubectl walks the whole exec path with no AWS account. Cover an existing
   config carrying an entry the old loader rejected — a context with no cluster.
-- **`src/schedule.ts`**: pure and electron-free, so its delay arithmetic can be
-  exercised directly.
+- **`src/schedule.ts`**: pure and electron-free, so its delay arithmetic and
+  `loginRetryAction()` can be exercised directly. The behaviour around it —
+  which refreshes are unattended, what an unattended one is allowed to put on
+  screen, when a retry fires — needs `dist/aws-sso.js` loaded against stubbed
+  `electron` (including `powerMonitor.getSystemIdleTime`), a faked SSO OIDC
+  client and a fake clock, driving a whole night in a second.
 
 Windows behaviour — Squirrel install and update events, the tray icon, toast
 notifications, the login item — needs a real Windows machine. CI proves the
diff --git a/docs/docs/app-window.html b/docs/docs/app-window.html
index 7d83e4c..6610434 100644
--- a/docs/docs/app-window.html
+++ b/docs/docs/app-window.html
@@ -54,6 +54,7 @@ <h2 id="tray">The tray</h2>
           <thead><tr><th>Item</th><th>What it does</th></tr></thead>
           <tbody>
             <tr><td>Next refresh <em>in 7 hours</em></td><td>Not clickable — when the current token expires, and therefore when Frost will refresh. Updates every 30 seconds.</td></tr>
+            <tr><td>Sign-in needed — retrying <em>in 10 minutes</em></td><td>Not clickable — a sign-in nobody finished, and when Frost will offer it again. It also offers it as soon as you are back at the machine, whichever comes first.</td></tr>
             <tr><td>Refresh now</td><td>Starts a refresh immediately. Only shown once Frost is configured.</td></tr>
             <tr><td>Settings… / Get Started</td><td>Opens the app window. Reads <em>Get Started</em> until you have saved a start URL.</td></tr>
             <tr><td>About Frost</td><td>Opens this website in your browser.</td></tr>
diff --git a/docs/docs/credential-refresh.html b/docs/docs/credential-refresh.html
index 3f67a96..af8ea1b 100644
--- a/docs/docs/credential-refresh.html
+++ b/docs/docs/credential-refresh.html
@@ -145,7 +145,7 @@ <h2 id="notify">Auto-open or notify first</h2>
       </p>
       <ul>
         <li><strong>Auto-open browser</strong> (default) — the login page opens as soon as the token needs replacing. With federated SSO it usually completes without asking you anything.</li>
-        <li><strong>Notification + hotkey</strong> — Frost posts a system notification and waits. Click the notification or press the refresh hotkey when you are ready, and the login page opens then. If you never do, the run gives up when the device code expires, and Frost waits for you rather than notifying again.</li>
+        <li><strong>Notification + hotkey</strong> — Frost posts a system notification and waits. Click the notification or press the refresh hotkey when you are ready, and the login page opens then. The notification is only raised while you are at the machine, so one that comes due overnight arrives when you sit down — pointing at a device code issued then, rather than one that expired hours earlier. If you let it expire anyway, Frost offers it again later.</li>
       </ul>
       <p>See <a href="settings-behavior.html">behavior settings</a> for the trade-off between the two.</p>
 
@@ -155,7 +155,8 @@ <h2 id="failures">When a run fails</h2>
         kinds of failure want opposite treatment:
       </p>
       <ul>
-        <li><strong>Nobody finished the sign-in</strong> — the login window was closed, the notification was never answered, the device code expired unapproved, AWS reported the sign-in denied. Frost stops and waits for you. Trying again would only open another login page for nobody to complete, and an unattended machine would collect one every few minutes all night. The tray menu says <em>Sign-in needed</em>, a single notification tells you so unless you closed the window yourself, and the next refresh is the one <em>you</em> start.</li>
+        <li><strong>Nobody finished the sign-in</strong> — the notification went unanswered, the device code expired unapproved, the page wanted a password with nobody there to type it. Frost keeps trying: five minutes later, then ten, doubling up to hourly — and <em>the moment you are back at the machine</em>, which is the one that matters after a refresh comes due at 3am. The tray menu says <em>Sign-in needed — retrying …</em>, and if you were there for the one that went unfinished, a notification says when the next try is. Only you ending the sign-in yourself — closing the login window, refusing it at your identity provider — stops the retries, because that is you saying "not now"; the next refresh is then the one you start.</li>
+        <li><strong>Nobody was there at all</strong> — the attempts that happen while you are away are <em>silent</em>: no window, no browser tab, no notification. Frost still runs them, because a refresh beaten by a slow identity provider or a dropped network succeeds on the next try with nobody the wiser. What it will not do is open a login page into an empty room, where it dies unseen in ten minutes. So you come back to a live login page — usually within half a minute of touching the keyboard — instead of the wreck of one from the middle of the night.</li>
         <li><strong>Something else failed</strong> — no network, an AWS error before any login page opened. Nothing is on your screen to pile up, so Frost retries on its own: a minute later, then two, doubling up to half-hourly until one succeeds.</li>
         <li>If the token was renewed and a <em>later</em> step failed — profiles, EKS — the credentials are good, so Frost stays on the normal schedule and tries the whole run again when they expire.</li>
         <li>The error is stored and shown on the <strong>Credentials</strong> page, with the failing step marked on the <strong>Activity</strong> page.</li>
diff --git a/docs/docs/login.html b/docs/docs/login.html
index 50f2c1a..2a03988 100644
--- a/docs/docs/login.html
+++ b/docs/docs/login.html
@@ -143,8 +143,10 @@ <h3>Default browser</h3>
       <p>
         The trade-off is that Frost has no window to watch: it keeps polling
         until you approve or until the device code expires, so abandoning a
-        sign-in leaves the run waiting rather than failing fast. It gives up
-        once, quietly, when the code expires — it does not open a second tab.
+        sign-in leaves the run waiting rather than failing fast. The tab is
+        opened only when someone is at the machine to use it — a refresh that
+        comes due while you are away never opens one, so tabs do not collect
+        overnight.
       </p>
       <p><a href="settings-behavior.html#login-page">Behavior settings →</a></p>
 
@@ -199,20 +201,26 @@ <h2 id="timeouts">Timeouts and cancellation</h2>
             <tr><td>Close the login window</td><td>Aborts the run at once and records "Login window closed"</td></tr>
             <tr><td>Ignore it (in-app window)</td><td>Polls until AWS expires the device code, then records "Login timed out"</td></tr>
             <tr><td>Ignore it (default browser)</td><td>The same — Frost has no window to watch, so it polls the code out</td></tr>
-            <tr><td>Ignore the notification (notify mode)</td><td>Waits for the hotkey or a click until the device code expires, then gives up</td></tr>
+            <tr><td>Ignore the notification (notify mode)</td><td>Waits for the hotkey or a click until the device code expires, then records "Timed out waiting for user to trigger auth"</td></tr>
+            <tr><td>Walk away before it comes due</td><td>Runs the refresh anyway, but silently: if the page turns out to need you, the attempt ends there and is offered again when you are back</td></tr>
             <tr><td>Refuse the sign-in at your identity provider</td><td>Ends the run as soon as AWS reports it, rather than polling on</td></tr>
           </tbody>
         </table>
       </div>
       <p>
         In every case the failure is recorded on the
-        <a href="activity.html">Activity</a> page — and then Frost waits for you.
-        A sign-in nobody completed is not retried on a timer: the retry would
-        open another login page with nobody there to finish it, and by morning
-        you would have one for every few minutes you were away. The tray menu
-        says <em>Sign-in needed</em>, and a notification says so once — unless
-        you closed the window or refused the sign-in yourself, in which case you
-        already know. The next attempt is the one you start, from the tray, the
+        <a href="activity.html">Activity</a> page. What happens next depends on
+        who ended it. A sign-in <em>nobody</em> completed is tried again — after
+        five minutes, then ten, doubling up to hourly, and straight away when you
+        come back to the machine — so a refresh that came due in the night is a
+        live login page when you sit down rather than a dead one. The tray menu
+        says <em>Sign-in needed — retrying …</em>, and a notification names the
+        next try if you were there for the attempt that went unfinished.
+      </p>
+      <p>
+        Closing the login window or refusing the sign-in at your identity
+        provider is different: that is you saying "not now", so Frost stops,
+        quietly, and the next attempt is the one you start from the tray, the
         Credentials page or the hotkey.
       </p>
 
diff --git a/docs/docs/settings-behavior.html b/docs/docs/settings-behavior.html
index cbfc8f0..e98dd75 100644
--- a/docs/docs/settings-behavior.html
+++ b/docs/docs/settings-behavior.html
@@ -70,7 +70,9 @@ <h3>Notification + hotkey</h3>
       <p>
         The cost is that credentials stay expired until you act — commands fail
         with <code>ExpiredToken</code> in the meantime — and if you never act, the
-        run gives up when AWS expires the device code and tries again later.
+        run ends when AWS expires the device code and Frost offers it again
+        later. A refresh that comes due while you are away holds the notification
+        until you are back, so the code behind it is always a live one.
       </p>
       <div class="callout">
         <span class="callout-icon" aria-hidden="true">💡</span>
diff --git a/docs/docs/troubleshooting.html b/docs/docs/troubleshooting.html
index fb5e4cd..afe8513 100644
--- a/docs/docs/troubleshooting.html
+++ b/docs/docs/troubleshooting.html
@@ -54,18 +54,29 @@ <h2 id="login">Sign-in fails or never completes</h2>
       <h4>"Login window closed"</h4>
       <p>
         The login window was closed before AWS confirmed the approval. Frost
-        treats that as "not now" and aborts the run. It does not start another
-        one on its own — trigger a refresh from the tray or the Credentials page
+        treats that as "not now" and aborts the run. This is the one ending it
+        does not retry — trigger a refresh from the tray or the Credentials page
         when you are ready.
       </p>
 
       <h4>"Login timed out"</h4>
       <p>
         The device code AWS issued expired before the sign-in was approved. Frost
-        stops there and the tray menu shows <em>Sign-in needed</em>; start
-        another refresh when you are back. If this happens repeatedly in notify
-        mode, you may simply not be getting the notification —
-        <a href="#notifications">see below</a>.
+        tries again — after five minutes, then ten, doubling up to hourly, and as
+        soon as you are back at the machine — so the tray menu reads
+        <em>Sign-in needed — retrying …</em> rather than sitting there. If this
+        happens repeatedly in notify mode, you may simply not be getting the
+        notification — <a href="#notifications">see below</a>.
+      </p>
+
+      <h4>"Nobody is at the machine, and …"</h4>
+      <p>
+        A refresh came due while you were away, and the login page turned out to
+        need you: a password, a security key, an approval that automatic approval
+        could not click. Rather than open a page that would expire unseen, Frost
+        ends that attempt and offers the sign-in again when you come back —
+        usually within half a minute of your first keypress. Nothing is wrong;
+        the run is recorded so the gap in the Activity page has an explanation.
       </p>
 
       <h4>A pile of login tabs or windows waiting for me</h4>
@@ -74,8 +85,20 @@ <h4>A pile of login tabs or windows waiting for me</h4>
         twice a second from the moment the token expired, and in
         <strong>Default browser</strong> mode each attempt opened a tab, so a
         machine left alone overnight collected one every few minutes. Frost now
-        waits for you after a sign-in nobody completed, and only retries by
-        itself for failures that never put anything on your screen.
+        opens a login page only when someone is there to use it: the attempts it
+        makes while you are away are silent, so retrying costs you nothing on
+        screen.
+      </p>
+
+      <h4>An overnight refresh left expired credentials and a notification</h4>
+      <p>
+        Also fixed in the version after 0.1.0. Frost used to stop trying after a
+        sign-in nobody completed, so a refresh that came due at 3am was found in
+        the morning as a notification pointing at a device code that had died ten
+        minutes after it was issued — with <strong>Auto-open browser</strong> set,
+        which is precisely the setting that asks Frost not to leave it to you. It
+        now keeps trying, and the first thing you get when you sit down is a fresh
+        login page.
       </p>
 
       <h4>An AWS error naming the client or the endpoint</h4>
diff --git a/src/aws-sso.ts b/src/aws-sso.ts
index 5479de4..bdd8c49 100644
--- a/src/aws-sso.ts
+++ b/src/aws-sso.ts
@@ -1,4 +1,10 @@
-import { app, BrowserWindow, Notification, shell } from "electron";
+import {
+    app,
+    BrowserWindow,
+    Notification,
+    powerMonitor,
+    shell,
+} from "electron";
 import log from "electron-log/main";
 import delay from "delay";
 import moment from "moment";
@@ -36,8 +42,12 @@ import {
 import { describeError } from "./logging.js";
 import { decryptSecret, encryptSecret } from "./secrets.js";
 import {
+    AWAY_IDLE_SEC,
     LoginAbortedError,
+    loginRetryAction,
+    loginWasAbandoned,
     nextRefreshDelayMs,
+    PRESENCE_CHECK_INTERVAL_MS,
     retryDelayMsAfterError,
 } from "./schedule.js";
 
@@ -46,6 +56,17 @@ let nextRefreshAt: number | null = null;
 let consecutiveFailures = 0;
 let pendingAuthResolve: (() => void) | null = null;
 
+/**
+ * A login nobody finished, waiting to be tried again: when the backoff next
+ * allows an attempt, and whether the last one ran without showing anything
+ * because nobody was at the machine. Null when no login is outstanding.
+ */
+let loginRetry: {
+    nextAttemptAtMs: number;
+    lastAttemptWasUnattended: boolean;
+} | null = null;
+let loginRetryTimer: NodeJS.Timeout | undefined;
+
 export function hasPendingAuth(): boolean {
     return pendingAuthResolve !== null;
 }
@@ -91,14 +112,18 @@ export function setNextTokenRefresh(delayMs?: number) {
     timeoutId = setTimeout(() => {
         timeoutId = undefined;
         nextRefreshAt = null;
-        refresh();
+        // Every refresh Frost starts by itself asks first whether anyone is
+        // there: with a live federated session it needs nobody, and if it turns
+        // out to need somebody it should not open a login page into an empty
+        // room. Only a refresh the user asked for is attended by definition.
+        refresh({ attended: isUserPresent() });
     }, timeoutMs);
     log.info("[setNextTokenRefresh] New timeout set to %sms", timeoutMs);
 }
 
 /**
- * Stop refreshing until the user asks for one. The tray reads
- * getNextRefreshAt(), so "waiting for you" is visible rather than silent.
+ * Stop the ordinary expiry schedule. The tray reads getNextRefreshAt(), so the
+ * state this leaves behind is visible rather than silent.
  */
 export function cancelTokenRefresh() {
     if (timeoutId) {
@@ -114,8 +139,103 @@ export function getNextRefreshAt(): number | null {
     return nextRefreshAt;
 }
 
-export async function refresh() {
-    log.info("[refresh] Refreshing credentials");
+/**
+ * Epoch ms of the next attempt at a login nobody finished, or null when no
+ * login is outstanding. The tray says so: "Sign-in needed" on its own read as
+ * Frost having given up, which is exactly what it used to do.
+ */
+export function getLoginRetryAt(): number | null {
+    return loginRetry?.nextAttemptAtMs ?? null;
+}
+
+/**
+ * Whether somebody is at the machine, as far as the platform will say.
+ *
+ * getSystemIdleTime() is unimplemented on some Linux sessions, where it either
+ * throws or reports 0. Both read as "here", which keeps the old behaviour —
+ * Frost opens the login page and lets the user find it — rather than waiting
+ * for a signal that is never coming.
+ */
+function isUserPresent(): boolean {
+    try {
+        const idleSec = powerMonitor.getSystemIdleTime();
+        log.debug("[isUserPresent] System idle for %ss", idleSec);
+        return idleSec < AWAY_IDLE_SEC;
+    } catch (err) {
+        log.warn(
+            "[isUserPresent] Could not read the idle time: %s",
+            describeError(err)
+        );
+        return true;
+    }
+}
+
+/**
+ * Keep coming back to a login nobody finished.
+ *
+ * The tick is short and the decision is in schedule.ts: the backoff says when
+ * to try again anyway, and the user turning up says try again now. Frost used to
+ * stop dead here and wait to be asked (#83), which is why an overnight refresh
+ * was found in the morning as a notification about a device code that had
+ * expired in the night.
+ */
+function scheduleLoginRetry(
+    delayMs: number,
+    lastAttemptWasUnattended: boolean
+) {
+    cancelLoginRetry();
+    loginRetry = {
+        nextAttemptAtMs: Date.now() + delayMs,
+        lastAttemptWasUnattended,
+    };
+    loginRetryTimer = setInterval(onLoginRetryTick, PRESENCE_CHECK_INTERVAL_MS);
+    log.info(
+        "[scheduleLoginRetry] Trying the login again in %sms, or as soon as the user is back",
+        delayMs
+    );
+}
+
+function cancelLoginRetry() {
+    if (loginRetryTimer) {
+        clearInterval(loginRetryTimer);
+        loginRetryTimer = undefined;
+    }
+    loginRetry = null;
+}
+
+function onLoginRetryTick() {
+    if (!loginRetry) return;
+    // A run is already going — the manual refresh the user just asked for, say.
+    // It clears this retry itself if it gets that far.
+    if (config.get("isWorking")) return;
+
+    const action = loginRetryAction({
+        nowMs: Date.now(),
+        nextAttemptAtMs: loginRetry.nextAttemptAtMs,
+        userPresent: isUserPresent(),
+        lastAttemptWasUnattended: loginRetry.lastAttemptWasUnattended,
+    });
+    if (action === "wait") return;
+
+    log.info("[onLoginRetryTick] Retrying the login (%s)", action);
+    // Not cancelled here: refresh() does that once it commits to a run, so a
+    // run that cannot start yet leaves the retry armed.
+    refresh({ attended: action === "attended" });
+}
+
+export interface RefreshOptions {
+    /**
+     * Whether somebody is at the machine to finish a login. An unattended
+     * refresh still runs — one with a live federated session needs nobody — but
+     * it never puts a login page on screen: it gives up instead and comes back
+     * when the user does (see getNewToken and scheduleAfterFailure). Refreshes
+     * the user asked for are attended, which is the default.
+     */
+    attended?: boolean;
+}
+
+export async function refresh({ attended = true }: RefreshOptions = {}) {
+    log.info("[refresh] Refreshing credentials (attended=%s)", attended);
 
     const userConfig = config.get("userConfig") as UserConfig;
     log.debug("[refresh] userConfig=%s", userConfig);
@@ -133,6 +253,10 @@ export async function refresh() {
         return;
     }
 
+    // Committed to a run now: whatever it was that a pending login was waiting
+    // for, this run supersedes it, and it arms a new retry if it fails.
+    cancelLoginRetry();
+
     // The run id is what ties these lines to the entry the user is looking at
     // in the Activity panel when they send a log in.
     const { runId } = startRun();
@@ -145,7 +269,7 @@ export async function refresh() {
         startTokenStep();
         let newToken: CreateTokenCommandOutput;
         try {
-            newToken = await getNewToken(userConfig);
+            newToken = await getNewToken(userConfig, attended);
             log.info("[refresh] Successfully got new token");
             completeTokenStep("success");
         } catch (tokenErr) {
@@ -173,7 +297,7 @@ export async function refresh() {
         }
         config.set("lastError", described);
         completeRun("error", described);
-        scheduleAfterFailure(err);
+        scheduleAfterFailure(err, attended);
     } finally {
         config.set("isWorking", false);
         updateTrayIcon();
@@ -197,7 +321,7 @@ function hasValidToken(): boolean {
  * in MIN_REFRESH_DELAY_MS and start a whole new login every half second. These
  * three outcomes want three different answers instead.
  */
-function scheduleAfterFailure(err: unknown) {
+function scheduleAfterFailure(err: unknown, attended: boolean) {
     // The token step succeeded and something afterwards (profiles, EKS) did
     // not. The credentials are good, so stay on the ordinary expiry schedule:
     // an error retry here would re-run getNewToken() and put a login page on
@@ -210,24 +334,50 @@ function scheduleAfterFailure(err: unknown) {
 
     const retryDelayMs = retryDelayMsAfterError(err, consecutiveFailures + 1);
 
-    // Nobody completed the login. Another attempt would just open another
-    // login page for nobody to complete.
+    // The user ended the login themselves — closed the window, refused the
+    // sign-in at the identity provider. That is "not now" from someone sitting
+    // right there, so take them at their word; the next login is the one they
+    // ask for.
     if (retryDelayMs === undefined) {
         consecutiveFailures = 0;
         cancelTokenRefresh();
         log.warn(
-            "[refresh] Login was not completed, waiting for a manual refresh"
+            "[refresh] The user ended the login, waiting for a manual refresh"
+        );
+        return;
+    }
+
+    const firstFailure = consecutiveFailures === 0;
+    consecutiveFailures += 1;
+
+    // Nobody finished the login: it timed out, the device code expired, the page
+    // wanted a password with no one there to type it. Frost used to stop here
+    // and wait to be asked, which turned a refresh coming due at 3am into
+    // expired credentials at 9am. Keep trying instead — on a backoff, and
+    // silently while nobody is there — so the user meets a live login page
+    // rather than the wreck of one that died in the night.
+    if (loginWasAbandoned(err)) {
+        cancelTokenRefresh();
+        log.warn(
+            "[refresh] Login %s not completed (failure %s in a row), retrying in %sms",
+            attended ? "was" : "could not be",
+            consecutiveFailures,
+            retryDelayMs
         );
-        if (!(err instanceof LoginAbortedError) || !err.cancelledByUser) {
-            notifyLoginNeeded();
+        // Once per streak, and only when somebody was there to ignore the login:
+        // a notification per retry nags all night, and one raised at 3am is just
+        // an unread notification in the morning. The retry itself is what the
+        // user who was away gets.
+        if (firstFailure && attended) {
+            notifyLoginNeeded(retryDelayMs);
         }
+        scheduleLoginRetry(retryDelayMs, !attended);
         return;
     }
 
     // Something failed before any login page opened — no network, an AWS error
     // registering the client. Nothing is on screen to pile up, and it may well
     // fix itself, so back off and retry.
-    consecutiveFailures += 1;
     log.info(
         "[refresh] Failure %s in a row, retrying in %sms",
         consecutiveFailures,
@@ -237,29 +387,49 @@ function scheduleAfterFailure(err: unknown) {
 }
 
 /**
- * Say once that Frost has stopped trying. Not retrying an abandoned login is
- * what keeps the browser clean; without this it would also be silent, and the
- * user would come back to credentials that expired hours ago with nothing
- * working on it.
+ * Tell the user, once per streak, that a login they were there for went
+ * unfinished — and when Frost will offer it again, since it no longer waits to
+ * be asked. The click is the shortcut for not waiting that long.
  */
-function notifyLoginNeeded() {
+function notifyLoginNeeded(retryDelayMs: number) {
     const behavior =
         (config.get("behaviorConfig") as BehaviorConfig | undefined) ||
         DEFAULT_BEHAVIOR;
     const note = new Notification({
         title: "Frost — Sign-in Needed",
-        body: `The AWS login was not completed. Press ${formatHotkey(
+        body: `The AWS login was not completed. Frost will try again in ${moment
+            .duration(retryDelayMs)
+            .humanize()} — press ${formatHotkey(
             behavior.refreshHotkey
-        )} or use the tray to try again.`,
+        )} or use the tray to sign in now.`,
     });
     note.on("click", () => refresh());
     note.show();
 }
 
 async function getNewToken(
-    userConfig: UserConfig
+    userConfig: UserConfig,
+    attended: boolean
 ): Promise<CreateTokenCommandOutput> {
     config.set("lastError", null);
+
+    const behavior =
+        (config.get("behaviorConfig") as BehaviorConfig | undefined) ||
+        DEFAULT_BEHAVIOR;
+    const useBrowser = behavior.loginMethod === "default_browser";
+    const silent = behavior.autoApprove !== false;
+
+    // Nothing below can get through without the user: either they asked to be
+    // notified and press the hotkey first, or automatic approval is off and the
+    // login page opens for them to work through. Stop before asking AWS for a
+    // device code that nobody is going to redeem — the retry will ask for a
+    // fresh one when somebody is here.
+    if (!attended && (!silent || behavior.refreshMode === "notify")) {
+        throw new LoginAbortedError(
+            "Nobody is at the machine, and this login needs the user"
+        );
+    }
+
     const client = await getSsoClient(userConfig);
     const ssooidc = new SSOOIDCClient({ region: userConfig.region });
 
@@ -287,10 +457,6 @@ async function getNewToken(
     const tokenExpires = moment().add(expiresInSec, "seconds");
     let pollIntervalMs = (startAuth.interval ?? 5) * 1000;
 
-    const behavior =
-        (config.get("behaviorConfig") as BehaviorConfig | undefined) ||
-        DEFAULT_BEHAVIOR;
-
     if (behavior.refreshMode === "notify") {
         log.info("[getNewToken] Notify mode: showing notification");
         const note = new Notification({
@@ -309,12 +475,12 @@ async function getNewToken(
         throw new Error("Missing verification URL from device authorization");
     }
 
-    const useBrowser = behavior.loginMethod === "default_browser";
-    const silent = behavior.autoApprove !== false;
-
-    // In default-browser mode there is no window to watch, so windowOpen stays
-    // true and the poll loop runs until the device code expires.
-    let windowOpen = true;
+    /**
+     * Why this attempt is over, checked by the poll loop. Undefined for as long
+     * as the login is still worth waiting on — which, in default-browser mode,
+     * is until the device code expires: there is no window to watch there.
+     */
+    let abort: LoginAbortedError | undefined;
     let window: BrowserWindow | undefined;
     let closingForBrowser = false;
     let handedOver = false;
@@ -357,6 +523,21 @@ async function getNewToken(
      * saved passwords live — that browser, with the silent attempt dropped.
      */
     const handOverToUser = (reason: string) => {
+        // Nobody is here. A window shown now, or a tab opened in a browser
+        // nobody is looking at, is a login page that expires unseen — and an
+        // overnight refresh that ends as a dead page is the whole complaint.
+        // End this attempt; the retry brings a fresh page when the user is back.
+        if (!attended) {
+            log.info(
+                "[getNewToken] The login needs the user and nobody is here: %s",
+                reason
+            );
+            abort ??= new LoginAbortedError(
+                `Nobody is at the machine, and ${reason}`
+            );
+            return;
+        }
+
         if (!useBrowser) {
             showLoginWindow(reason);
             return;
@@ -448,7 +629,9 @@ async function getNewToken(
                 // user saying "not now".
                 if (closingForBrowser) return;
                 log.warn("[getNewToken] Login window closed");
-                windowOpen = false;
+                abort ??= new LoginAbortedError("Login window closed", {
+                    cancelledByUser: true,
+                });
             });
 
             window.loadURL(verificationUrl);
@@ -500,21 +683,21 @@ async function getNewToken(
                     }
                 }
 
-                // Closing the window means "I'm not logging in now". Give up here
-                // rather than waiting for a non-pending token error, which may
-                // never come — the run would then hold `isWorking` (and block every
-                // new refresh) until the device code expires.
+                // Closing the window means "I'm not logging in now", and an
+                // unattended attempt that turns out to need the user has nothing
+                // left to wait for. Give up here rather than waiting for a
+                // non-pending token error, which may never come — the run would
+                // then hold `isWorking` (and block every new refresh) until the
+                // device code expires.
                 //
                 // This has to come *after* the poll above, not before it. AWS tells
                 // the user to close the window as soon as they approve, so between
                 // the approval and the next poll the window is usually already
                 // gone — and checking first threw away a token that was waiting to
                 // be collected.
-                if (!windowOpen) {
-                    log.warn("[getNewToken] User closed login window, aborting");
-                    throw new LoginAbortedError("Login window closed", {
-                        cancelledByUser: true,
-                    });
+                if (abort) {
+                    log.warn("[getNewToken] Aborting: %s", abort.message);
+                    throw abort;
                 }
             }
             throw new LoginAbortedError("Login timed out");
diff --git a/src/schedule.ts b/src/schedule.ts
index b737c61..0adf076 100644
--- a/src/schedule.ts
+++ b/src/schedule.ts
@@ -6,6 +6,33 @@ export const ERROR_RETRY_DELAY_MS = 60 * 1000;
 /** Ceiling for that doubling, so a long outage settles at half-hourly. */
 export const MAX_ERROR_RETRY_DELAY_MS = 30 * 60 * 1000;
 
+/**
+ * The first retry of a login nobody completed. It doubles from here like the
+ * error retry, but starts slower and settles slower: an error retry is
+ * invisible, while every attempt here may end up putting a login page in front
+ * of the user.
+ */
+export const ABANDONED_LOGIN_RETRY_DELAY_MS = 5 * 60 * 1000;
+/** Ceiling for that doubling, so a login left alone all night settles hourly. */
+export const MAX_ABANDONED_LOGIN_RETRY_DELAY_MS = 60 * 60 * 1000;
+
+/**
+ * How often Frost looks for the user while a login is waiting for them. The
+ * backoff above says when to try again regardless; this is what gets a login
+ * page up within half a minute of them sitting down, rather than at the end of
+ * a backoff that has grown to an hour.
+ */
+export const PRESENCE_CHECK_INTERVAL_MS = 30 * 1000;
+
+/**
+ * How much input idleness means nobody is at the machine. Long enough that
+ * reading a page without touching anything still counts as being here; short
+ * enough that a refresh coming due after the user has gone home is treated as
+ * unattended. Getting it wrong costs little in either direction: the presence
+ * check above turns "away" into "here" within half a minute.
+ */
+export const AWAY_IDLE_SEC = 5 * 60;
+
 /**
  * A login run that ended because nobody completed it: the window was closed, the
  * device code expired, or it timed out waiting for the user.
@@ -13,8 +40,9 @@ export const MAX_ERROR_RETRY_DELAY_MS = 30 * 60 * 1000;
 export class LoginAbortedError extends Error {
     /**
      * True when the user ended it themselves — closed the window, refused the
-     * sign-in at the identity provider. They already know it did not happen, so
-     * Frost stays quiet; the passive endings are the ones worth a word.
+     * sign-in at the identity provider. That is "not now" from someone who is
+     * sitting right there, so Frost stays quiet and stops trying; the passive
+     * endings are the ones worth retrying and a word.
      */
     readonly cancelledByUser: boolean;
 
@@ -41,32 +69,102 @@ export function nextRefreshDelayMs(
     return Math.max(expiresAtMs - nowMs, MIN_REFRESH_DELAY_MS);
 }
 
+/**
+ * A login that ended because nobody finished it, rather than because the user
+ * said no. Nothing is wrong with the configuration and nothing self-heals on
+ * its own: what it needs is another attempt, at a moment when someone is there.
+ */
+export function loginWasAbandoned(err: unknown): boolean {
+    return err instanceof LoginAbortedError && !err.cancelledByUser;
+}
+
+function backoffMs(
+    firstDelayMs: number,
+    maxDelayMs: number,
+    consecutiveFailures: number
+): number {
+    const doublings = Math.max(consecutiveFailures, 1) - 1;
+    // 2 ** doublings reaches Infinity long before this matters, and Math.min
+    // brings it back to the cap.
+    return Math.min(firstDelayMs * 2 ** doublings, maxDelayMs);
+}
+
 /**
  * Delay before retrying a failed refresh, or undefined to not retry automatically.
  *
- * An aborted login means no human finished the login page, so an automatic retry
- * opens another login page nobody is there to finish. Scheduling that retry off the
- * stale `expiresAt` made the delay collapse to MIN_REFRESH_DELAY_MS, which is how one
- * unattended login became dozens of browser tabs overnight. Those wait for the user to
- * refresh (tray, dashboard, or the hotkey) instead.
+ * Never derived from the stored token expiry: a failed run leaves `expiresAt` in
+ * the past, which collapses to MIN_REFRESH_DELAY_MS, and that is how one
+ * unattended login became dozens of browser tabs overnight (#83).
+ *
+ * Only the user ending the login themselves stops the retries. A login nobody
+ * finished gets the slower backoff above — Frost stopping dead there meant an
+ * overnight refresh was found in the morning as a notification pointing at a
+ * device code that had expired minutes after it was issued. The caller keeps
+ * those attempts silent while nobody is at the machine, so what the backoff
+ * paces is login pages, not tabs piling up in an empty room.
  *
  * Everything else backs off as failures repeat. A cause that is not going to fix
- * itself — a start URL in the wrong region, an SSO instance that has been deleted —
- * otherwise asks AWS the same question every minute forever, silently.
+ * itself — a start URL in the wrong region, an SSO instance that has been
+ * deleted — otherwise asks AWS the same question every minute forever, silently.
  */
 export function retryDelayMsAfterError(
     err: unknown,
     consecutiveFailures = 1
 ): number | undefined {
     if (err instanceof LoginAbortedError) {
-        return undefined;
+        if (err.cancelledByUser) {
+            return undefined;
+        }
+        return backoffMs(
+            ABANDONED_LOGIN_RETRY_DELAY_MS,
+            MAX_ABANDONED_LOGIN_RETRY_DELAY_MS,
+            consecutiveFailures
+        );
     }
 
-    const doublings = Math.max(consecutiveFailures, 1) - 1;
-    // 2 ** doublings reaches Infinity long before this matters, and Math.min
-    // brings it back to the cap.
-    return Math.min(
-        ERROR_RETRY_DELAY_MS * 2 ** doublings,
-        MAX_ERROR_RETRY_DELAY_MS
+    return backoffMs(
+        ERROR_RETRY_DELAY_MS,
+        MAX_ERROR_RETRY_DELAY_MS,
+        consecutiveFailures
     );
 }
+
+/** What to do about a login that is waiting for the user, checked periodically. */
+export type LoginRetryAction =
+    /** Try now, and show the login page: someone is there to finish it. */
+    | "attended"
+    /** Try now without showing anything: it only succeeds if nobody is needed. */
+    | "unattended"
+    /** Not yet. */
+    | "wait";
+
+/**
+ * Decide whether a login that nobody completed should be tried again now.
+ *
+ * Two things can make it time. The user coming back to a machine that needs
+ * them is the important one: the backoff may be an hour long by then, and
+ * waiting it out would leave them looking at expired credentials with Frost
+ * apparently idle. Otherwise the backoff runs its course, and an attempt with
+ * nobody there is still worth making — a refresh whose silent approval was
+ * beaten by a slow identity provider or a dropped network goes through on the
+ * next try, with no one the wiser.
+ */
+export function loginRetryAction({
+    nowMs,
+    nextAttemptAtMs,
+    userPresent,
+    lastAttemptWasUnattended,
+}: {
+    nowMs: number;
+    nextAttemptAtMs: number;
+    userPresent: boolean;
+    lastAttemptWasUnattended: boolean;
+}): LoginRetryAction {
+    if (userPresent && lastAttemptWasUnattended) {
+        return "attended";
+    }
+    if (nowMs >= nextAttemptAtMs) {
+        return userPresent ? "attended" : "unattended";
+    }
+    return "wait";
+}
diff --git a/src/tray.ts b/src/tray.ts
index 40348de..a61c6ea 100644
--- a/src/tray.ts
+++ b/src/tray.ts
@@ -4,7 +4,7 @@ import { app, shell, Menu, Tray } from "electron";
 import log from "electron-log/main";
 import moment from "moment";
 import { config } from "./config.js";
-import { getNextRefreshAt, refresh } from "./aws-sso.js";
+import { getLoginRetryAt, getNextRefreshAt, refresh } from "./aws-sso.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -55,12 +55,26 @@ export function updateTrayIcon(onOpenDashboard?: () => void) {
     const refreshItems = [] as Electron.MenuItemConstructorOptions[];
 
     if (config.get("userConfig")) {
-        // The scheduled time, not the token expiry: after an abandoned login
-        // there is deliberately nothing scheduled (#83), and reading
-        // `expiresAt` here would claim a refresh was due hours ago instead of
-        // saying that Frost is waiting for the user.
+        // The scheduled time, not the token expiry: reading `expiresAt` after a
+        // failed login would claim a refresh was due hours ago (#83) instead of
+        // saying what Frost is actually waiting for.
         const nextRefreshAt = getNextRefreshAt();
-        if (nextRefreshAt !== null) {
+        const loginRetryAt = getLoginRetryAt();
+        if (loginRetryAt !== null && !config.get("isWorking")) {
+            // A login is outstanding: the ordinary schedule is off, and a bare
+            // "Sign-in needed" would read as Frost having given up on it. The
+            // time can be in the past for the moment between a retry coming due
+            // and the check that starts it, where "5 seconds ago" reads worse
+            // than saying nothing precise.
+            const when =
+                loginRetryAt > Date.now()
+                    ? moment(loginRetryAt).fromNow()
+                    : "shortly";
+            refreshItems.push({
+                label: `Sign-in needed — retrying ${when}`,
+                enabled: false,
+            });
+        } else if (nextRefreshAt !== null) {
             refreshItems.push({
                 label: `Next refresh ${moment(nextRefreshAt).fromNow()}`,
                 enabled: false,

From bac4eb861f81475e415e7f5d741fbb2ccdc01949 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 13 Sep 2026 10:25:49 +0000
Subject: [PATCH 2/2] Replace an unfinished login immediately, with no backoff
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up on the same overnight failure: the first pass kept Frost trying, but
paced the retries 5 minutes → hourly, and ended the attempt the moment a page
turned out to need a human. Both work against what the retry is actually for.
Continuous refreshing is the premise of the app, so a gap between a device code
dying and the next one starting is a gap in the credentials, and an attempt
ended early is one that cannot come through on its own.

So there is no Frost-side delay left. AWS's device code lives about ten minutes;
when one dies the next sign-in starts at once, all night, and the pacing is
AWS's rather than ours.

- An unattended login is no longer aborted when the page needs the user. It is
  *parked*: nothing is shown, the page keeps being driven — so a slow identity
  provider or a dropped network still completes it with nobody the wiser — and
  the live page is handed over the moment somebody is there, on the next poll.
  HANDOVER_MIN_CODE_LIFE_MS keeps a code with seconds left from being handed to
  a user who would watch it die; the replacement is immediate, so they get a
  fresh page instead.
- Presence is read wherever it matters instead of once per run: a ten-minute
  login can start with nobody there and end with the user watching it. The
  `attended` flag that threaded through refresh() is gone.
- MIN_LOGIN_CYCLE_MS (30s) is the only floor, and it is not a backoff — it never
  grows, and nothing waits for it unless a login fails the instant it starts,
  which would otherwise spin attempts as fast as AWS could refuse them.
- A parked run held `isWorking`, which would have made "Refresh now" and the
  hotkey no-ops all night and the tray read "Refreshing…" while a page sat
  waiting for a password. A refresh the user asks for now shows the login Frost
  is holding (showParkedLogin), the hotkey drops its own isWorking guard, and
  the tray says "Sign-in needed — waiting for you".
- The "Sign-in Needed" notification is gone. It existed because Frost stopped
  trying and that was invisible; the replacement login is the notice now, and a
  notification on top of it is the thing this whole change is meant to stop.
- Notification mode and manual approval cannot get through unattended at all, so
  they no longer burn a device code to find that out: Frost waits for the user
  and starts then, recording one run rather than one every half minute.
- retryDelayMsAfterError() splits into errorRetryDelayMs() (unchanged 1m→30m for
  failures with no login page involved) and nextLoginAttemptDelayMs(), with
  loginRetryAction() deciding each tick. AGENTS.md and the docs pages follow.

Verified with `npm run build`, `npm run lint`, and the headless harness
(dist/aws-sso.js against stubbed electron including powerMonitor idle time, a
faked SSO OIDC client and a fake clock): 53 checks over ten scenarios, plus the
real dist/tray.js rendering the held-login label. Eight simulated hours away
with a page that needs a human: 46-49 device codes, worst gap between attempts
10m30s (the code's life plus the poll that notices), nothing shown, nothing
notified, and the login page appears 10s after the first keypress. A slow
identity provider coming through mid-hold completes the refresh unattended.
Six hours away in default-browser mode: zero tabs, one tab when the user
returns. Notify mode, four hours away: zero device codes, one run.

Costs, deliberately accepted: a hidden login window and its 400ms approval scan
live continuously while a login is held rather than only during a refresh, and
the Activity page gains an entry per device code (~6/hour) while a machine is
away with a sign-in that needs a human.

Not checked here: real notifications, a real tray, and idle-time reporting on a
real desktop — the harness stubs all three. On a Linux session where
getSystemIdleTime() is unimplemented it reports 0, which reads as "somebody is
here", so those sessions get the visible login page rather than a held one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PBe4cVzZUazesEcLLaktV4
---
 AGENTS.md                         |  42 ++--
 docs/docs/app-window.html         |   3 +-
 docs/docs/credential-refresh.html |   4 +-
 docs/docs/login.html              |  18 +-
 docs/docs/settings-behavior.html  |   7 +-
 docs/docs/troubleshooting.html    |  40 ++--
 src/aws-sso.ts                    | 322 ++++++++++++++++++------------
 src/main.ts                       |   5 +-
 src/schedule.ts                   | 156 +++++++--------
 src/tray.ts                       |  22 +-
 10 files changed, 337 insertions(+), 282 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 4ee5db6..b23cfae 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -39,16 +39,19 @@ missing one fails at runtime only.
   run at a time; `refresh()` guards on `isWorking` because a second run would
   overwrite the current-run slot.
 - **`src/schedule.ts`** — every delay `setNextTokenRefresh()` may use, plus
-  `loginRetryAction()`, the decision behind the retry of a login nobody
-  finished. Four rules: a retry delay is never derived from the stored token
-  expiry (after a failure it is in the past, which collapses to the floor and
-  reopens the login page in a loop, #83); a failure *after* the token was
-  renewed keeps the expiry schedule rather than an error retry, which would
-  reopen the login page for an unrelated failure; only the user ending a login
-  themselves (`cancelledByUser`) stops the retries; and a login nobody finished
-  is retried on its own slower backoff — what keeps that from piling up login
-  pages is the attempts being *silent* while nobody is at the machine, not
-  their absence. No electron imports.
+  `loginRetryAction()`, the decision behind replacing a login nobody finished.
+  Four rules: a delay is never derived from the stored token expiry (after a
+  failure it is in the past, which collapses to the floor and reopens the login
+  page in a loop, #83); a failure *after* the token was renewed keeps the expiry
+  schedule rather than an error retry, which would reopen the login page for an
+  unrelated failure; only the user ending a login themselves
+  (`cancelledByUser`) stops it being replaced; and a login nobody finished is
+  replaced with **no backoff at all** — continuous refreshing is the premise, so
+  a dead device code is replaced by a live one for as long as it takes.
+  `MIN_LOGIN_CYCLE_MS` is a floor, not a backoff: it never grows, and nothing
+  waits for it unless a login fails the instant it starts. What keeps that from
+  piling up login pages is that an attempt with nobody at the machine never
+  shows anything (see automatic approval). No electron imports.
 - **`src/page-script.ts`** — `loadPageScript()` / `injectIntoEveryFrame()`,
   used by both injected scripts. Injection follows sub-frames because
   `executeJavaScript` on a `WebContents` reaches the top frame only, and a
@@ -184,14 +187,17 @@ of them says the user is needed (issue #1). Keep these true:
   default-browser mode, `shell.openExternal`, destroying the hidden probe only
   once the browser is up. A new way for the flow to end without arriving there
   is a refresh that hangs invisibly until the device code expires.
-- **Unattended, "somewhere" is the retry, not the screen.** When nobody is at
-  the machine (`powerMonitor.getSystemIdleTime()`, see `AWAY_IDLE_SEC`), the
-  same `onUserNeeded` ends the attempt instead of showing anything, and
-  `scheduleAfterFailure()` comes back later or as soon as the user does. A login
-  page opened into an empty room is dead in ten minutes, which is what made an
-  overnight refresh a morning of expired credentials. The silent attempt itself
-  still runs unattended — that is what recovers a refresh beaten by a slow
-  identity provider, with nobody the wiser.
+- **Unattended, "somewhere" is a hold, not the screen.** When nobody is at the
+  machine (`powerMonitor.getSystemIdleTime()`, see `AWAY_IDLE_SEC`), the same
+  `onUserNeeded` *parks* the attempt — nothing is shown, the page keeps being
+  driven, and the poll loop hands it over the moment somebody is there, as does
+  a refresh the user asks for (`showParkedLogin`, which is why `refresh()` no
+  longer just skips a run in progress). A login page opened into an empty room
+  is dead in ten minutes, which is what made an overnight refresh a morning of
+  expired credentials. Parking rather than aborting is deliberate twice over: a
+  slow identity provider can still come through on its own, and the user who
+  returns gets a page that is already loaded. Presence is re-read at each poll,
+  never captured once per run.
 - **`backgroundThrottling: false` on the window.** Chromium throttles timers in
   a window that is not visible, and the driver's scan loop is a timer.
 - **Clicking is deliberately narrow.** Only on the device-authorization hosts
diff --git a/docs/docs/app-window.html b/docs/docs/app-window.html
index 6610434..98d4a68 100644
--- a/docs/docs/app-window.html
+++ b/docs/docs/app-window.html
@@ -54,7 +54,8 @@ <h2 id="tray">The tray</h2>
           <thead><tr><th>Item</th><th>What it does</th></tr></thead>
           <tbody>
             <tr><td>Next refresh <em>in 7 hours</em></td><td>Not clickable — when the current token expires, and therefore when Frost will refresh. Updates every 30 seconds.</td></tr>
-            <tr><td>Sign-in needed — retrying <em>in 10 minutes</em></td><td>Not clickable — a sign-in nobody finished, and when Frost will offer it again. It also offers it as soon as you are back at the machine, whichever comes first.</td></tr>
+            <tr><td>Sign-in needed — waiting for you</td><td>Not clickable — Frost is holding a sign-in that cannot go further without you. Touch the keyboard, or pick <em>Refresh now</em>, and the login page it is holding appears.</td></tr>
+            <tr><td>Sign-in needed — trying again</td><td>Not clickable — the last sign-in went unfinished and the next one is starting. Frost replaces them continuously, so this is a glimpse rather than a resting state.</td></tr>
             <tr><td>Refresh now</td><td>Starts a refresh immediately. Only shown once Frost is configured.</td></tr>
             <tr><td>Settings… / Get Started</td><td>Opens the app window. Reads <em>Get Started</em> until you have saved a start URL.</td></tr>
             <tr><td>About Frost</td><td>Opens this website in your browser.</td></tr>
diff --git a/docs/docs/credential-refresh.html b/docs/docs/credential-refresh.html
index af8ea1b..3edbe76 100644
--- a/docs/docs/credential-refresh.html
+++ b/docs/docs/credential-refresh.html
@@ -155,8 +155,8 @@ <h2 id="failures">When a run fails</h2>
         kinds of failure want opposite treatment:
       </p>
       <ul>
-        <li><strong>Nobody finished the sign-in</strong> — the notification went unanswered, the device code expired unapproved, the page wanted a password with nobody there to type it. Frost keeps trying: five minutes later, then ten, doubling up to hourly — and <em>the moment you are back at the machine</em>, which is the one that matters after a refresh comes due at 3am. The tray menu says <em>Sign-in needed — retrying …</em>, and if you were there for the one that went unfinished, a notification says when the next try is. Only you ending the sign-in yourself — closing the login window, refusing it at your identity provider — stops the retries, because that is you saying "not now"; the next refresh is then the one you start.</li>
-        <li><strong>Nobody was there at all</strong> — the attempts that happen while you are away are <em>silent</em>: no window, no browser tab, no notification. Frost still runs them, because a refresh beaten by a slow identity provider or a dropped network succeeds on the next try with nobody the wiser. What it will not do is open a login page into an empty room, where it dies unseen in ten minutes. So you come back to a live login page — usually within half a minute of touching the keyboard — instead of the wreck of one from the middle of the night.</li>
+        <li><strong>Nobody finished the sign-in</strong> — the notification went unanswered, the device code expired unapproved, the page wanted a password with nobody there to type it. Frost replaces it, <em>immediately and with no backoff</em>: AWS keeps a device code alive for about ten minutes, and when one dies the next sign-in starts at once. That is the point of the whole app — credentials that are current whether or not anyone is at the machine — so there is deliberately no "waiting for you" gap in it. Only you ending the sign-in yourself — closing the login window, refusing it at your identity provider — stops that, because that is you saying "not now"; the next refresh is then the one you start.</li>
+        <li><strong>Nobody was there at all</strong> — then nothing is ever put on your screen. When the page turns out to need a person, Frost <em>holds</em> that sign-in instead of showing it: no window, no browser tab, no notification. The page keeps being driven in the background, so a slow identity provider or a dropped network still comes through on its own; and the moment you touch the keyboard, the login page Frost has been holding appears — already loaded, within a few seconds. You come back to a live sign-in rather than the wreck of one that expired at 3am.</li>
         <li><strong>Something else failed</strong> — no network, an AWS error before any login page opened. Nothing is on your screen to pile up, so Frost retries on its own: a minute later, then two, doubling up to half-hourly until one succeeds.</li>
         <li>If the token was renewed and a <em>later</em> step failed — profiles, EKS — the credentials are good, so Frost stays on the normal schedule and tries the whole run again when they expire.</li>
         <li>The error is stored and shown on the <strong>Credentials</strong> page, with the failing step marked on the <strong>Activity</strong> page.</li>
diff --git a/docs/docs/login.html b/docs/docs/login.html
index 2a03988..99d6900 100644
--- a/docs/docs/login.html
+++ b/docs/docs/login.html
@@ -145,8 +145,9 @@ <h3>Default browser</h3>
         until you approve or until the device code expires, so abandoning a
         sign-in leaves the run waiting rather than failing fast. The tab is
         opened only when someone is at the machine to use it — a refresh that
-        comes due while you are away never opens one, so tabs do not collect
-        overnight.
+        comes due while you are away holds the sign-in silently and opens the tab
+        when you are back, so tabs never collect overnight however many times
+        Frost tries.
       </p>
       <p><a href="settings-behavior.html#login-page">Behavior settings →</a></p>
 
@@ -202,7 +203,7 @@ <h2 id="timeouts">Timeouts and cancellation</h2>
             <tr><td>Ignore it (in-app window)</td><td>Polls until AWS expires the device code, then records "Login timed out"</td></tr>
             <tr><td>Ignore it (default browser)</td><td>The same — Frost has no window to watch, so it polls the code out</td></tr>
             <tr><td>Ignore the notification (notify mode)</td><td>Waits for the hotkey or a click until the device code expires, then records "Timed out waiting for user to trigger auth"</td></tr>
-            <tr><td>Walk away before it comes due</td><td>Runs the refresh anyway, but silently: if the page turns out to need you, the attempt ends there and is offered again when you are back</td></tr>
+            <tr><td>Walk away before it comes due</td><td>Runs the refresh anyway, but silently: if the page turns out to need you, Frost holds it — hidden, still being driven — and shows it when you are back</td></tr>
             <tr><td>Refuse the sign-in at your identity provider</td><td>Ends the run as soon as AWS reports it, rather than polling on</td></tr>
           </tbody>
         </table>
@@ -210,12 +211,11 @@ <h2 id="timeouts">Timeouts and cancellation</h2>
       <p>
         In every case the failure is recorded on the
         <a href="activity.html">Activity</a> page. What happens next depends on
-        who ended it. A sign-in <em>nobody</em> completed is tried again — after
-        five minutes, then ten, doubling up to hourly, and straight away when you
-        come back to the machine — so a refresh that came due in the night is a
-        live login page when you sit down rather than a dead one. The tray menu
-        says <em>Sign-in needed — retrying …</em>, and a notification names the
-        next try if you were there for the attempt that went unfinished.
+        who ended it. A sign-in <em>nobody</em> completed is replaced straight
+        away — no pause, no backoff — so there is always a live device code where
+        the last one died, and a refresh that came due in the night is a login
+        page waiting for you rather than a dead one. The tray menu says
+        <em>Sign-in needed — waiting for you</em> while Frost is holding one.
       </p>
       <p>
         Closing the login window or refusing the sign-in at your identity
diff --git a/docs/docs/settings-behavior.html b/docs/docs/settings-behavior.html
index e98dd75..7c7c751 100644
--- a/docs/docs/settings-behavior.html
+++ b/docs/docs/settings-behavior.html
@@ -70,9 +70,10 @@ <h3>Notification + hotkey</h3>
       <p>
         The cost is that credentials stay expired until you act — commands fail
         with <code>ExpiredToken</code> in the meantime — and if you never act, the
-        run ends when AWS expires the device code and Frost offers it again
-        later. A refresh that comes due while you are away holds the notification
-        until you are back, so the code behind it is always a live one.
+        run ends when AWS expires the device code and Frost posts a fresh
+        notification for the sign-in that replaces it. A refresh that comes due
+        while you are away waits for you rather than notifying an empty room, so
+        the code behind the notification you do get is always a live one.
       </p>
       <div class="callout">
         <span class="callout-icon" aria-hidden="true">💡</span>
diff --git a/docs/docs/troubleshooting.html b/docs/docs/troubleshooting.html
index afe8513..b9be2d9 100644
--- a/docs/docs/troubleshooting.html
+++ b/docs/docs/troubleshooting.html
@@ -61,22 +61,23 @@ <h4>"Login window closed"</h4>
 
       <h4>"Login timed out"</h4>
       <p>
-        The device code AWS issued expired before the sign-in was approved. Frost
-        tries again — after five minutes, then ten, doubling up to hourly, and as
-        soon as you are back at the machine — so the tray menu reads
-        <em>Sign-in needed — retrying …</em> rather than sitting there. If this
-        happens repeatedly in notify mode, you may simply not be getting the
-        notification — <a href="#notifications">see below</a>.
+        The device code AWS issued expired before the sign-in was approved — ten
+        minutes, typically. Frost starts another sign-in immediately, so a run
+        like this repeating every ten minutes while you were away is Frost
+        working as intended, not a fault: each entry is one device code's life.
+        If it happens repeatedly in notify mode while you <em>are</em> at the
+        machine, you may simply not be getting the notification —
+        <a href="#notifications">see below</a>.
       </p>
 
-      <h4>"Nobody is at the machine, and …"</h4>
+      <h4>"Nobody is at the machine, and this login needs the user"</h4>
       <p>
-        A refresh came due while you were away, and the login page turned out to
-        need you: a password, a security key, an approval that automatic approval
-        could not click. Rather than open a page that would expire unseen, Frost
-        ends that attempt and offers the sign-in again when you come back —
-        usually within half a minute of your first keypress. Nothing is wrong;
-        the run is recorded so the gap in the Activity page has an explanation.
+        Only in <strong>Notification + hotkey</strong> mode, or with automatic
+        approval turned off: neither can get through without you, so rather than
+        ask AWS for a device code nobody can redeem, Frost waits and starts the
+        sign-in when you are back — within half a minute of your first keypress.
+        Nothing is wrong, and there is one entry for it rather than one every
+        half minute.
       </p>
 
       <h4>A pile of login tabs or windows waiting for me</h4>
@@ -85,9 +86,9 @@ <h4>A pile of login tabs or windows waiting for me</h4>
         twice a second from the moment the token expired, and in
         <strong>Default browser</strong> mode each attempt opened a tab, so a
         machine left alone overnight collected one every few minutes. Frost now
-        opens a login page only when someone is there to use it: the attempts it
-        makes while you are away are silent, so retrying costs you nothing on
-        screen.
+        opens a login page only when somebody is at the machine to use it: the
+        sign-ins it runs while you are away are held silently, so trying again —
+        which it now does continuously — costs you nothing on screen.
       </p>
 
       <h4>An overnight refresh left expired credentials and a notification</h4>
@@ -96,9 +97,10 @@ <h4>An overnight refresh left expired credentials and a notification</h4>
         sign-in nobody completed, so a refresh that came due at 3am was found in
         the morning as a notification pointing at a device code that had died ten
         minutes after it was issued — with <strong>Auto-open browser</strong> set,
-        which is precisely the setting that asks Frost not to leave it to you. It
-        now keeps trying, and the first thing you get when you sit down is a fresh
-        login page.
+        which is precisely the setting that asks Frost not to leave it to you. A
+        dead code is now replaced immediately, for as long as it takes, so the
+        credentials come back on their own where they can and the first thing you
+        see when you sit down is a live login page where they cannot.
       </p>
 
       <h4>An AWS error naming the client or the endpoint</h4>
diff --git a/src/aws-sso.ts b/src/aws-sso.ts
index bdd8c49..20374bb 100644
--- a/src/aws-sso.ts
+++ b/src/aws-sso.ts
@@ -43,30 +43,45 @@ import { describeError } from "./logging.js";
 import { decryptSecret, encryptSecret } from "./secrets.js";
 import {
     AWAY_IDLE_SEC,
+    errorRetryDelayMs,
     LoginAbortedError,
     loginRetryAction,
     loginWasAbandoned,
+    nextLoginAttemptDelayMs,
     nextRefreshDelayMs,
     PRESENCE_CHECK_INTERVAL_MS,
-    retryDelayMsAfterError,
+    wasCancelledByUser,
 } from "./schedule.js";
 
+/**
+ * How much of the device code's life has to be left for a login held for an
+ * absent user to be worth showing them when they arrive. Below this the page
+ * would expire while they were reading it; the attempt that replaces it starts
+ * immediately and opens a fresh one.
+ */
+const HANDOVER_MIN_CODE_LIFE_MS = 60 * 1000;
+
 let timeoutId: NodeJS.Timeout | undefined;
 let nextRefreshAt: number | null = null;
 let consecutiveFailures = 0;
 let pendingAuthResolve: (() => void) | null = null;
 
 /**
- * A login nobody finished, waiting to be tried again: when the backoff next
- * allows an attempt, and whether the last one ran without showing anything
- * because nobody was at the machine. Null when no login is outstanding.
+ * The login that replaces one nobody finished, and the earliest it may start.
+ * Null when no login is outstanding.
  */
-let loginRetry: {
-    nextAttemptAtMs: number;
-    lastAttemptWasUnattended: boolean;
-} | null = null;
+let loginRetry: { nextAttemptAtMs: number } | null = null;
 let loginRetryTimer: NodeJS.Timeout | undefined;
 
+/**
+ * Shows the login page the running attempt is holding for an absent user, or
+ * null when no attempt is holding one. It is what makes a login Frost is sitting
+ * on reachable: the user who asks for a refresh — hotkey, tray, dashboard — gets
+ * that live page instead of being told a refresh is already in progress, and the
+ * tray can say what the run is really waiting for.
+ */
+let showParkedLogin: (() => void) | null = null;
+
 export function hasPendingAuth(): boolean {
     return pendingAuthResolve !== null;
 }
@@ -112,11 +127,7 @@ export function setNextTokenRefresh(delayMs?: number) {
     timeoutId = setTimeout(() => {
         timeoutId = undefined;
         nextRefreshAt = null;
-        // Every refresh Frost starts by itself asks first whether anyone is
-        // there: with a live federated session it needs nobody, and if it turns
-        // out to need somebody it should not open a login page into an empty
-        // room. Only a refresh the user asked for is attended by definition.
-        refresh({ attended: isUserPresent() });
+        refresh();
     }, timeoutMs);
     log.info("[setNextTokenRefresh] New timeout set to %sms", timeoutMs);
 }
@@ -139,20 +150,44 @@ export function getNextRefreshAt(): number | null {
     return nextRefreshAt;
 }
 
+/** What the tray should say about a login nobody has finished. */
+export type LoginRetryStatus = "none" | "replacing" | "waiting-for-user";
+
+/**
+ * Whether a login nobody finished is being replaced, and whether that
+ * replacement is one only the user can start. The tray says which: "Sign-in
+ * needed" on its own read as Frost having given up, which is what it used to do.
+ */
+export function getLoginRetryStatus(): LoginRetryStatus {
+    // A run holding a login for whoever comes back is waiting for them, not
+    // merely "Refreshing…".
+    if (showParkedLogin) return "waiting-for-user";
+    if (!loginRetry) return "none";
+    return canRefreshUnattended() || isUserPresent()
+        ? "replacing"
+        : "waiting-for-user";
+}
+
 /**
- * Epoch ms of the next attempt at a login nobody finished, or null when no
- * login is outstanding. The tray says so: "Sign-in needed" on its own read as
- * Frost having given up, which is exactly what it used to do.
+ * Whether a refresh can get all the way through with nobody at the machine.
+ * Notification mode waits for the hotkey by design, and without automatic
+ * approval the login page is the user's to work through, so in both cases an
+ * unattended attempt could only ask AWS for a device code it cannot redeem.
  */
-export function getLoginRetryAt(): number | null {
-    return loginRetry?.nextAttemptAtMs ?? null;
+function canRefreshUnattended(): boolean {
+    const behavior =
+        (config.get("behaviorConfig") as BehaviorConfig | undefined) ||
+        DEFAULT_BEHAVIOR;
+    return behavior.autoApprove !== false && behavior.refreshMode !== "notify";
 }
 
 /**
- * Whether somebody is at the machine, as far as the platform will say.
+ * Whether somebody is at the machine, as far as the platform will say. Read
+ * whenever it matters rather than once per run: a ten-minute login can start
+ * with nobody there and end with the user watching it.
  *
  * getSystemIdleTime() is unimplemented on some Linux sessions, where it either
- * throws or reports 0. Both read as "here", which keeps the old behaviour —
+ * throws or reports 0. Both read as "here", which keeps the plain behaviour —
  * Frost opens the login page and lets the user find it — rather than waiting
  * for a signal that is never coming.
  */
@@ -171,77 +206,79 @@ function isUserPresent(): boolean {
 }
 
 /**
- * Keep coming back to a login nobody finished.
+ * Replace a login nobody finished, without pausing first.
  *
- * The tick is short and the decision is in schedule.ts: the backoff says when
- * to try again anyway, and the user turning up says try again now. Frost used to
- * stop dead here and wait to be asked (#83), which is why an overnight refresh
- * was found in the morning as a notification about a device code that had
- * expired in the night.
+ * Continuous refreshing is the whole premise: a device code AWS has expired is
+ * replaced by a live one, for as long as it takes, so credentials are current
+ * whether or not anyone is at the machine. Frost used to stop dead here and wait
+ * to be asked (#83), which is why an overnight refresh was found in the morning
+ * as a notification about a code that had expired in the night.
+ *
+ * `delayMs` is therefore 0 in every case that matters — the attempt it replaces
+ * has just spent the device code's ten-minute life — and the timer doubles as
+ * the presence check for the one login Frost cannot attempt alone.
  */
-function scheduleLoginRetry(
-    delayMs: number,
-    lastAttemptWasUnattended: boolean
-) {
+function scheduleLoginRetry(delayMs: number) {
     cancelLoginRetry();
-    loginRetry = {
-        nextAttemptAtMs: Date.now() + delayMs,
-        lastAttemptWasUnattended,
-    };
-    loginRetryTimer = setInterval(onLoginRetryTick, PRESENCE_CHECK_INTERVAL_MS);
-    log.info(
-        "[scheduleLoginRetry] Trying the login again in %sms, or as soon as the user is back",
-        delayMs
-    );
+    loginRetry = { nextAttemptAtMs: Date.now() + delayMs };
+    armLoginRetryTimer(delayMs);
+    log.info("[scheduleLoginRetry] Next login attempt in %sms", delayMs);
+}
+
+function armLoginRetryTimer(delayMs: number) {
+    if (loginRetryTimer) clearTimeout(loginRetryTimer);
+    loginRetryTimer = setTimeout(onLoginRetryDue, Math.max(delayMs, 0));
 }
 
 function cancelLoginRetry() {
     if (loginRetryTimer) {
-        clearInterval(loginRetryTimer);
+        clearTimeout(loginRetryTimer);
         loginRetryTimer = undefined;
     }
     loginRetry = null;
 }
 
-function onLoginRetryTick() {
+function onLoginRetryDue() {
     if (!loginRetry) return;
+    loginRetryTimer = undefined;
+
     // A run is already going — the manual refresh the user just asked for, say.
-    // It clears this retry itself if it gets that far.
-    if (config.get("isWorking")) return;
+    // It clears this retry itself once it commits.
+    if (config.get("isWorking")) {
+        armLoginRetryTimer(PRESENCE_CHECK_INTERVAL_MS);
+        return;
+    }
 
     const action = loginRetryAction({
         nowMs: Date.now(),
         nextAttemptAtMs: loginRetry.nextAttemptAtMs,
         userPresent: isUserPresent(),
-        lastAttemptWasUnattended: loginRetry.lastAttemptWasUnattended,
+        canRefreshUnattended: canRefreshUnattended(),
     });
-    if (action === "wait") return;
+    if (action === "wait") {
+        // Nothing to do but watch for the user. Starting a run to discover that
+        // again would only record a failure every half minute.
+        armLoginRetryTimer(PRESENCE_CHECK_INTERVAL_MS);
+        return;
+    }
 
-    log.info("[onLoginRetryTick] Retrying the login (%s)", action);
+    log.info("[onLoginRetryDue] Starting the replacement login");
     // Not cancelled here: refresh() does that once it commits to a run, so a
     // run that cannot start yet leaves the retry armed.
-    refresh({ attended: action === "attended" });
+    refresh();
 }
 
-export interface RefreshOptions {
-    /**
-     * Whether somebody is at the machine to finish a login. An unattended
-     * refresh still runs — one with a live federated session needs nobody — but
-     * it never puts a login page on screen: it gives up instead and comes back
-     * when the user does (see getNewToken and scheduleAfterFailure). Refreshes
-     * the user asked for are attended, which is the default.
-     */
-    attended?: boolean;
-}
-
-export async function refresh({ attended = true }: RefreshOptions = {}) {
-    log.info("[refresh] Refreshing credentials (attended=%s)", attended);
+export async function refresh() {
+    log.info("[refresh] Refreshing credentials");
 
     const userConfig = config.get("userConfig") as UserConfig;
     log.debug("[refresh] userConfig=%s", userConfig);
 
     if (!userConfig) {
         log.warn("[refresh] Missing user config, cannot refresh credentials");
+        // Nothing can be signed in to, so stop replacing the login rather than
+        // leaving the tray claiming Frost is about to try again.
+        cancelLoginRetry();
         return;
     }
 
@@ -249,14 +286,26 @@ export async function refresh({ attended = true }: RefreshOptions = {}) {
     // stranding the first run as "in-progress" forever and writing its
     // remaining steps onto the wrong run.
     if (config.get("isWorking")) {
+        // Unless the run in progress is holding a login for an absent user: they
+        // are evidently back, and the page waiting for them is better than
+        // "already in progress" and nothing on screen.
+        if (showParkedLogin) {
+            log.info("[refresh] Showing the login this run is holding");
+            showParkedLogin();
+            return;
+        }
         log.warn("[refresh] A refresh is already in progress, skipping");
         return;
     }
 
-    // Committed to a run now: whatever it was that a pending login was waiting
-    // for, this run supersedes it, and it arms a new retry if it fails.
+    // Committed to a run now: whatever a pending login was waiting for, this run
+    // supersedes it, and it arms the next one if it fails.
     cancelLoginRetry();
 
+    // When the attempt started, not when it failed: what replaces it is due
+    // immediately, and MIN_LOGIN_CYCLE_MS is measured from here.
+    const attemptStartedAtMs = Date.now();
+
     // The run id is what ties these lines to the entry the user is looking at
     // in the Activity panel when they send a log in.
     const { runId } = startRun();
@@ -269,7 +318,7 @@ export async function refresh({ attended = true }: RefreshOptions = {}) {
         startTokenStep();
         let newToken: CreateTokenCommandOutput;
         try {
-            newToken = await getNewToken(userConfig, attended);
+            newToken = await getNewToken(userConfig);
             log.info("[refresh] Successfully got new token");
             completeTokenStep("success");
         } catch (tokenErr) {
@@ -297,7 +346,7 @@ export async function refresh({ attended = true }: RefreshOptions = {}) {
         }
         config.set("lastError", described);
         completeRun("error", described);
-        scheduleAfterFailure(err, attended);
+        scheduleAfterFailure(err, attemptStartedAtMs);
     } finally {
         config.set("isWorking", false);
         updateTrayIcon();
@@ -321,7 +370,7 @@ function hasValidToken(): boolean {
  * in MIN_REFRESH_DELAY_MS and start a whole new login every half second. These
  * three outcomes want three different answers instead.
  */
-function scheduleAfterFailure(err: unknown, attended: boolean) {
+function scheduleAfterFailure(err: unknown, attemptStartedAtMs: number) {
     // The token step succeeded and something afterwards (profiles, EKS) did
     // not. The credentials are good, so stay on the ordinary expiry schedule:
     // an error retry here would re-run getNewToken() and put a login page on
@@ -332,13 +381,11 @@ function scheduleAfterFailure(err: unknown, attended: boolean) {
         return;
     }
 
-    const retryDelayMs = retryDelayMsAfterError(err, consecutiveFailures + 1);
-
     // The user ended the login themselves — closed the window, refused the
-    // sign-in at the identity provider. That is "not now" from someone sitting
+    // sign-in at the identity provider. That is "not now" from somebody sitting
     // right there, so take them at their word; the next login is the one they
-    // ask for.
-    if (retryDelayMs === undefined) {
+    // ask for. It is the only ending that is not replaced.
+    if (wasCancelledByUser(err)) {
         consecutiveFailures = 0;
         cancelTokenRefresh();
         log.warn(
@@ -347,37 +394,32 @@ function scheduleAfterFailure(err: unknown, attended: boolean) {
         return;
     }
 
-    const firstFailure = consecutiveFailures === 0;
-    consecutiveFailures += 1;
-
     // Nobody finished the login: it timed out, the device code expired, the page
-    // wanted a password with no one there to type it. Frost used to stop here
-    // and wait to be asked, which turned a refresh coming due at 3am into
-    // expired credentials at 9am. Keep trying instead — on a backoff, and
-    // silently while nobody is there — so the user meets a live login page
-    // rather than the wreck of one that died in the night.
+    // wanted a password with nobody there to type it. Start the next one at
+    // once. The device code's own ten-minute life is what paces this — Frost
+    // adds no delay of its own, because a gap here is a gap in the credentials.
     if (loginWasAbandoned(err)) {
+        // Reaching a login page at all means the AWS calls worked, so an earlier
+        // error streak is stale.
+        consecutiveFailures = 0;
         cancelTokenRefresh();
+        const delayMs = nextLoginAttemptDelayMs({
+            attemptStartedAtMs,
+            nowMs: Date.now(),
+        });
         log.warn(
-            "[refresh] Login %s not completed (failure %s in a row), retrying in %sms",
-            attended ? "was" : "could not be",
-            consecutiveFailures,
-            retryDelayMs
+            "[refresh] Login not completed, replacing it in %sms",
+            delayMs
         );
-        // Once per streak, and only when somebody was there to ignore the login:
-        // a notification per retry nags all night, and one raised at 3am is just
-        // an unread notification in the morning. The retry itself is what the
-        // user who was away gets.
-        if (firstFailure && attended) {
-            notifyLoginNeeded(retryDelayMs);
-        }
-        scheduleLoginRetry(retryDelayMs, !attended);
+        scheduleLoginRetry(delayMs);
         return;
     }
 
     // Something failed before any login page opened — no network, an AWS error
     // registering the client. Nothing is on screen to pile up, and it may well
     // fix itself, so back off and retry.
+    consecutiveFailures += 1;
+    const retryDelayMs = errorRetryDelayMs(consecutiveFailures);
     log.info(
         "[refresh] Failure %s in a row, retrying in %sms",
         consecutiveFailures,
@@ -386,30 +428,8 @@ function scheduleAfterFailure(err: unknown, attended: boolean) {
     setNextTokenRefresh(retryDelayMs);
 }
 
-/**
- * Tell the user, once per streak, that a login they were there for went
- * unfinished — and when Frost will offer it again, since it no longer waits to
- * be asked. The click is the shortcut for not waiting that long.
- */
-function notifyLoginNeeded(retryDelayMs: number) {
-    const behavior =
-        (config.get("behaviorConfig") as BehaviorConfig | undefined) ||
-        DEFAULT_BEHAVIOR;
-    const note = new Notification({
-        title: "Frost — Sign-in Needed",
-        body: `The AWS login was not completed. Frost will try again in ${moment
-            .duration(retryDelayMs)
-            .humanize()} — press ${formatHotkey(
-            behavior.refreshHotkey
-        )} or use the tray to sign in now.`,
-    });
-    note.on("click", () => refresh());
-    note.show();
-}
-
 async function getNewToken(
-    userConfig: UserConfig,
-    attended: boolean
+    userConfig: UserConfig
 ): Promise<CreateTokenCommandOutput> {
     config.set("lastError", null);
 
@@ -421,10 +441,9 @@ async function getNewToken(
 
     // Nothing below can get through without the user: either they asked to be
     // notified and press the hotkey first, or automatic approval is off and the
-    // login page opens for them to work through. Stop before asking AWS for a
-    // device code that nobody is going to redeem — the retry will ask for a
-    // fresh one when somebody is here.
-    if (!attended && (!silent || behavior.refreshMode === "notify")) {
+    // login page is theirs to work through. Stop before asking AWS for a device
+    // code nobody can redeem; the retry watches for them and starts then.
+    if (!canRefreshUnattended() && !isUserPresent()) {
         throw new LoginAbortedError(
             "Nobody is at the machine, and this login needs the user"
         );
@@ -481,6 +500,12 @@ async function getNewToken(
      * is until the device code expires: there is no window to watch there.
      */
     let abort: LoginAbortedError | undefined;
+    /**
+     * Set when the page needs the user and nobody is at the machine: what it
+     * would have been shown for, held until somebody turns up (see the poll
+     * loop). The attempt stays alive and hidden in the meantime.
+     */
+    let parkedReason: string | undefined;
     let window: BrowserWindow | undefined;
     let closingForBrowser = false;
     let handedOver = false;
@@ -522,21 +547,9 @@ async function getNewToken(
      * the default browser, presumably because that is where their passkeys and
      * saved passwords live — that browser, with the silent attempt dropped.
      */
-    const handOverToUser = (reason: string) => {
-        // Nobody is here. A window shown now, or a tab opened in a browser
-        // nobody is looking at, is a login page that expires unseen — and an
-        // overnight refresh that ends as a dead page is the whole complaint.
-        // End this attempt; the retry brings a fresh page when the user is back.
-        if (!attended) {
-            log.info(
-                "[getNewToken] The login needs the user and nobody is here: %s",
-                reason
-            );
-            abort ??= new LoginAbortedError(
-                `Nobody is at the machine, and ${reason}`
-            );
-            return;
-        }
+    const showToUser = (reason: string) => {
+        parkedReason = undefined;
+        showParkedLogin = null;
 
         if (!useBrowser) {
             showLoginWindow(reason);
@@ -566,6 +579,34 @@ async function getNewToken(
         );
     };
 
+    /**
+     * What the window's drivers call when the page stops being something Frost
+     * can get through on its own.
+     *
+     * With nobody at the machine there is nothing to hand it to: a window shown
+     * now, or a tab opened in a browser nobody is looking at, is a login page
+     * that expires unseen — an overnight refresh found as a dead page is the
+     * whole complaint. So the attempt is held instead, hidden and still being
+     * driven, which also leaves room for a slow identity provider to come
+     * through on its own. It is shown the moment somebody is there: the poll loop
+     * below checks, and so does a refresh the user asks for.
+     */
+    const handOverToUser = (reason: string) => {
+        if (!isUserPresent()) {
+            if (parkedReason === undefined) {
+                log.info(
+                    "[getNewToken] Holding the login for whoever comes back: %s",
+                    reason
+                );
+            }
+            parkedReason = reason;
+            showParkedLogin = () => showToUser(reason);
+            return;
+        }
+
+        showToUser(reason);
+    };
+
     // Opening the login page happens inside the try: each attempt starts its
     // own device authorization, so a window left behind by a throw would sit
     // there pointing at a code nothing polls any more.
@@ -683,6 +724,21 @@ async function getNewToken(
                     }
                 }
 
+                // The page is waiting for somebody and somebody is now here.
+                // Hand them the page this attempt already loaded rather than the
+                // one after it — but not a device code with seconds left, which
+                // would die under their hands; the replacement is immediate, so
+                // the next attempt shows them a fresh page instead.
+                if (parkedReason !== undefined && isUserPresent()) {
+                    const codeLifeLeftMs = tokenExpires.diff(moment());
+                    if (codeLifeLeftMs > HANDOVER_MIN_CODE_LIFE_MS) {
+                        log.info(
+                            "[getNewToken] The user is back, handing over the login"
+                        );
+                        showToUser(parkedReason);
+                    }
+                }
+
                 // Closing the window means "I'm not logging in now", and an
                 // unattended attempt that turns out to need the user has nothing
                 // left to wait for. Give up here rather than waiting for a
@@ -702,6 +758,8 @@ async function getNewToken(
             }
             throw new LoginAbortedError("Login timed out");
     } finally {
+        // Nothing is holding a login any more, whatever happened to this one.
+        showParkedLogin = null;
         // destroy(), not close(): cleanup must not depend on the remote page
         // agreeing to unload.
         if (window && !window.isDestroyed()) {
diff --git a/src/main.ts b/src/main.ts
index a93d866..b1d313d 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -41,7 +41,10 @@ function registerHotkey(hotkey: string) {
             if (hasPendingAuth()) {
                 log.info("[hotkey] Triggering pending auth");
                 triggerPendingAuth();
-            } else if (!config.get("isWorking")) {
+            } else {
+                // No isWorking guard: refresh() skips a run that is already
+                // going, and shows the login page if that run is holding one for
+                // a user who has just come back.
                 log.info("[hotkey] Triggering refresh");
                 refresh();
             }
diff --git a/src/schedule.ts b/src/schedule.ts
index 0adf076..dc415b6 100644
--- a/src/schedule.ts
+++ b/src/schedule.ts
@@ -7,20 +7,23 @@ export const ERROR_RETRY_DELAY_MS = 60 * 1000;
 export const MAX_ERROR_RETRY_DELAY_MS = 30 * 60 * 1000;
 
 /**
- * The first retry of a login nobody completed. It doubles from here like the
- * error retry, but starts slower and settles slower: an error retry is
- * invisible, while every attempt here may end up putting a login page in front
- * of the user.
+ * The shortest a login attempt may hold the slot before its replacement starts.
+ *
+ * Not a backoff: it never grows, and in practice nothing waits for it. AWS's
+ * device code lives about ten minutes, so an attempt nobody finishes takes that
+ * long to die and the next one begins the moment it does — which is what makes
+ * refreshing continuous rather than something that gives up and waits to be
+ * asked. This is only a floor against a login that fails the instant it starts
+ * (a device authorization AWS rejects outright), which would otherwise spin new
+ * attempts as fast as AWS could refuse them.
  */
-export const ABANDONED_LOGIN_RETRY_DELAY_MS = 5 * 60 * 1000;
-/** Ceiling for that doubling, so a login left alone all night settles hourly. */
-export const MAX_ABANDONED_LOGIN_RETRY_DELAY_MS = 60 * 60 * 1000;
+export const MIN_LOGIN_CYCLE_MS = 30 * 1000;
 
 /**
- * How often Frost looks for the user while a login is waiting for them. The
- * backoff above says when to try again regardless; this is what gets a login
- * page up within half a minute of them sitting down, rather than at the end of
- * a backoff that has grown to an hour.
+ * How often Frost looks for the user while holding a sign-in that cannot go
+ * anywhere without them — notification mode, or automatic approval turned off.
+ * Those cannot be attempted unattended at all, so there is nothing to do but
+ * wait for somebody and start the moment they are there.
  */
 export const PRESENCE_CHECK_INTERVAL_MS = 30 * 1000;
 
@@ -28,8 +31,8 @@ export const PRESENCE_CHECK_INTERVAL_MS = 30 * 1000;
  * How much input idleness means nobody is at the machine. Long enough that
  * reading a page without touching anything still counts as being here; short
  * enough that a refresh coming due after the user has gone home is treated as
- * unattended. Getting it wrong costs little in either direction: the presence
- * check above turns "away" into "here" within half a minute.
+ * unattended. Getting it wrong costs little in either direction: presence is
+ * re-read as the login runs, so "away" becomes "here" within a poll.
  */
 export const AWAY_IDLE_SEC = 5 * 60;
 
@@ -40,9 +43,9 @@ export const AWAY_IDLE_SEC = 5 * 60;
 export class LoginAbortedError extends Error {
     /**
      * True when the user ended it themselves — closed the window, refused the
-     * sign-in at the identity provider. That is "not now" from someone who is
-     * sitting right there, so Frost stays quiet and stops trying; the passive
-     * endings are the ones worth retrying and a word.
+     * sign-in at the identity provider. That is "not now" from somebody sitting
+     * right there, so Frost stays quiet and stops; it is the one ending that is
+     * not replaced by another attempt.
      */
     readonly cancelledByUser: boolean;
 
@@ -69,102 +72,85 @@ export function nextRefreshDelayMs(
     return Math.max(expiresAtMs - nowMs, MIN_REFRESH_DELAY_MS);
 }
 
+/** The user ending the login themselves, which is the one ending Frost obeys. */
+export function wasCancelledByUser(err: unknown): boolean {
+    return err instanceof LoginAbortedError && err.cancelledByUser;
+}
+
 /**
  * A login that ended because nobody finished it, rather than because the user
- * said no. Nothing is wrong with the configuration and nothing self-heals on
- * its own: what it needs is another attempt, at a moment when someone is there.
+ * said no. Nothing is wrong with the configuration, so the answer is another
+ * attempt — immediately.
  */
 export function loginWasAbandoned(err: unknown): boolean {
     return err instanceof LoginAbortedError && !err.cancelledByUser;
 }
 
-function backoffMs(
-    firstDelayMs: number,
-    maxDelayMs: number,
-    consecutiveFailures: number
-): number {
-    const doublings = Math.max(consecutiveFailures, 1) - 1;
-    // 2 ** doublings reaches Infinity long before this matters, and Math.min
-    // brings it back to the cap.
-    return Math.min(firstDelayMs * 2 ** doublings, maxDelayMs);
-}
-
 /**
- * Delay before retrying a failed refresh, or undefined to not retry automatically.
- *
- * Never derived from the stored token expiry: a failed run leaves `expiresAt` in
- * the past, which collapses to MIN_REFRESH_DELAY_MS, and that is how one
- * unattended login became dozens of browser tabs overnight (#83).
- *
- * Only the user ending the login themselves stops the retries. A login nobody
- * finished gets the slower backoff above — Frost stopping dead there meant an
- * overnight refresh was found in the morning as a notification pointing at a
- * device code that had expired minutes after it was issued. The caller keeps
- * those attempts silent while nobody is at the machine, so what the backoff
- * paces is login pages, not tabs piling up in an empty room.
+ * When to start the login that replaces one nobody finished: now, unless the
+ * attempt it replaces was short enough for MIN_LOGIN_CYCLE_MS to still apply.
  *
- * Everything else backs off as failures repeat. A cause that is not going to fix
- * itself — a start URL in the wrong region, an SSO instance that has been
- * deleted — otherwise asks AWS the same question every minute forever, silently.
+ * Never derived from the stored token expiry, which a failed run leaves in the
+ * past: that collapses to MIN_REFRESH_DELAY_MS and starts a whole new login
+ * every half second (#83).
  */
-export function retryDelayMsAfterError(
-    err: unknown,
-    consecutiveFailures = 1
-): number | undefined {
-    if (err instanceof LoginAbortedError) {
-        if (err.cancelledByUser) {
-            return undefined;
-        }
-        return backoffMs(
-            ABANDONED_LOGIN_RETRY_DELAY_MS,
-            MAX_ABANDONED_LOGIN_RETRY_DELAY_MS,
-            consecutiveFailures
-        );
-    }
+export function nextLoginAttemptDelayMs({
+    attemptStartedAtMs,
+    nowMs,
+}: {
+    attemptStartedAtMs: number;
+    nowMs: number;
+}): number {
+    return Math.max(attemptStartedAtMs + MIN_LOGIN_CYCLE_MS - nowMs, 0);
+}
 
-    return backoffMs(
-        ERROR_RETRY_DELAY_MS,
-        MAX_ERROR_RETRY_DELAY_MS,
-        consecutiveFailures
+/**
+ * Delay before retrying a run that failed with no login page involved — no
+ * network, an AWS error registering the client. Nothing is on screen to pile up
+ * and it may well fix itself, so it backs off as failures repeat: a cause that
+ * is not going to fix itself (a start URL in the wrong region, an SSO instance
+ * that has been deleted) would otherwise ask AWS the same question every minute
+ * forever, silently.
+ */
+export function errorRetryDelayMs(consecutiveFailures = 1): number {
+    const doublings = Math.max(consecutiveFailures, 1) - 1;
+    // 2 ** doublings reaches Infinity long before this matters, and Math.min
+    // brings it back to the cap.
+    return Math.min(
+        ERROR_RETRY_DELAY_MS * 2 ** doublings,
+        MAX_ERROR_RETRY_DELAY_MS
     );
 }
 
-/** What to do about a login that is waiting for the user, checked periodically. */
-export type LoginRetryAction =
-    /** Try now, and show the login page: someone is there to finish it. */
-    | "attended"
-    /** Try now without showing anything: it only succeeds if nobody is needed. */
-    | "unattended"
-    /** Not yet. */
-    | "wait";
+/** Whether the login that replaces an unfinished one can start yet. */
+export type LoginRetryAction = "go" | "wait";
 
 /**
- * Decide whether a login that nobody completed should be tried again now.
+ * Decide whether to start the next login attempt.
  *
- * Two things can make it time. The user coming back to a machine that needs
- * them is the important one: the backoff may be an hour long by then, and
- * waiting it out would leave them looking at expired credentials with Frost
- * apparently idle. Otherwise the backoff runs its course, and an attempt with
- * nobody there is still worth making — a refresh whose silent approval was
- * beaten by a slow identity provider or a dropped network goes through on the
- * next try, with no one the wiser.
+ * Nothing here paces Frost for the sake of pacing: a replacement goes as soon as
+ * the last attempt is out of the way. The one thing worth waiting for is the
+ * user, and only when Frost cannot make an attempt without them — in
+ * notification mode, or with automatic approval off, an unattended attempt would
+ * ask AWS for a device code, find nobody to give it to, and record a failed run
+ * for it, every time round.
  */
 export function loginRetryAction({
     nowMs,
     nextAttemptAtMs,
     userPresent,
-    lastAttemptWasUnattended,
+    canRefreshUnattended,
 }: {
     nowMs: number;
     nextAttemptAtMs: number;
     userPresent: boolean;
-    lastAttemptWasUnattended: boolean;
+    canRefreshUnattended: boolean;
 }): LoginRetryAction {
-    if (userPresent && lastAttemptWasUnattended) {
-        return "attended";
+    if (nowMs < nextAttemptAtMs) {
+        return "wait";
     }
-    if (nowMs >= nextAttemptAtMs) {
-        return userPresent ? "attended" : "unattended";
+    if (!userPresent && !canRefreshUnattended) {
+        return "wait";
     }
-    return "wait";
+    return "go";
 }
diff --git a/src/tray.ts b/src/tray.ts
index a61c6ea..413a59d 100644
--- a/src/tray.ts
+++ b/src/tray.ts
@@ -4,7 +4,7 @@ import { app, shell, Menu, Tray } from "electron";
 import log from "electron-log/main";
 import moment from "moment";
 import { config } from "./config.js";
-import { getLoginRetryAt, getNextRefreshAt, refresh } from "./aws-sso.js";
+import { getLoginRetryStatus, getNextRefreshAt, refresh } from "./aws-sso.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -59,19 +59,17 @@ export function updateTrayIcon(onOpenDashboard?: () => void) {
         // failed login would claim a refresh was due hours ago (#83) instead of
         // saying what Frost is actually waiting for.
         const nextRefreshAt = getNextRefreshAt();
-        const loginRetryAt = getLoginRetryAt();
-        if (loginRetryAt !== null && !config.get("isWorking")) {
+        const loginRetry = getLoginRetryStatus();
+        if (loginRetry !== "none") {
             // A login is outstanding: the ordinary schedule is off, and a bare
-            // "Sign-in needed" would read as Frost having given up on it. The
-            // time can be in the past for the moment between a retry coming due
-            // and the check that starts it, where "5 seconds ago" reads worse
-            // than saying nothing precise.
-            const when =
-                loginRetryAt > Date.now()
-                    ? moment(loginRetryAt).fromNow()
-                    : "shortly";
+            // "Sign-in needed" would read as Frost having given up on it, which
+            // is what it used to do. Either another attempt is on its way, or
+            // Frost is holding one that only the user can get through.
             refreshItems.push({
-                label: `Sign-in needed — retrying ${when}`,
+                label:
+                    loginRetry === "waiting-for-user"
+                        ? "Sign-in needed — waiting for you"
+                        : "Sign-in needed — trying again",
                 enabled: false,
             });
         } else if (nextRefreshAt !== null) {