back off the matrix daemon's restarts so a homeserver outage can't flood the store with logins

nix/agent-modules/matrix.nix

@@ -396,6 +396,13 @@ in
         # non-zero exit, which `on-failure` already restarts.
         Restart = "on-failure";
         RestartSec = 5;
+        # Each start logs in to the store before its first homeserver call, so
+        # a down homeserver must not restart it every `RestartSec`. systemd
+        # grows the delay exponentially from `RestartSec` to `RestartMaxDelaySec`
+        # over `RestartSteps` restarts and resets it after a successful run
+        # (systemd.service(5)).
+        RestartSteps = 6;
+        RestartMaxDelaySec = 300;
         # The daemon exits 75 (`ACCOUNTS_CHANGED_EXIT` in
         # hive-matrix-mcp/src/main.rs) when the store's linked accounts change:
         # a clean exit that must still restart it onto the new set.

nix/module-eval/agent-matrix.nix

@@ -168,6 +168,16 @@ let
       ok =
         agentMatrixBao.systemd.timers.hive-matrix-daemon.timerConfig.OnUnitInactiveSec or null == "5min";
     }
+    {
+      # A homeserver outage fails every start, and each start logs in to the
+      # store: the restart delay must grow rather than stay at `RestartSec`.
+      name = "the matrix daemon backs off between restarts";
+      ok =
+        let
+          c = (daemon agentMatrixBao).serviceConfig;
+        in
+        c.RestartSteps or 0 > 0 && c.RestartMaxDelaySec or 0 > c.RestartSec;
+    }
     {
       # The absence arm for the four above: with no store, no identity, no
       # timer, and the file is the whole mechanism.