@@ -1 +1 @@
-6c46e7d042ed9eb25a44506209ff540553e75562
+48944ddf3318338869da59c4a4b1e2375336babc
@@ -769,15 +769,39 @@ function tickWatchPair() {
   refreshWatchPair();
 }
 
-function openWatchPair() {
+async function openWatchPair() {
   S.channel = watcherChannel();
   // Same rule as openPair(): never open on a code that has already lapsed.
   if (pairCodeLeft() <= 0 && !S.nativeShell) newPairCode();
+  // refreshWatchPair() first, because pairLink() is what mints S.token — and
+  // the ticket in the QR has to be the same secret start() then registers as
+  // hashT, or the Viewer would present a `t` the relay has never hashed.
   refreshWatchPair();
   el.wpStatus.textContent = 'Waiting for the Viewer';
   show(el.watchPair);
   clearInterval(wpTicker);
   wpTicker = setInterval(tickWatchPair, 1000);
+
+  // ...and actually be waiting. This screen showed a QR, a spinner and the
+  // words "Waiting for the Viewer" while opening no socket at all: the relay
+  // only learns a room's ticket from a station hello, so until someone pressed
+  // "Start watching now" there was no ticket registered, and a Viewer scanning
+  // that QR was turned away at admission — as "pairing expired", about a code
+  // that had never been wrong. The screen was lying about being ready; now it
+  // is telling the truth.
+  //
+  // The camera opens here rather than on "Start watching now" because a warm
+  // room is not enough on its own: the Monitor answers a Viewer's offer with
+  // its live tracks (answerPeer attaches S.local), so a room held open with no
+  // camera would pair and then show nothing. Acquiring media inside the offer
+  // handler instead would put a permission prompt in the middle of a timed
+  // handshake. Opening it when someone picks "The Monitor" — the role whose
+  // whole job is to be the camera, on a screen that says it is waiting — is
+  // the least surprising of the three.
+  //
+  // Not in the native shell: there the shell runs its own pairing screen and
+  // connects itself, exactly as tickWatchPair() stands down for the same reason.
+  if (!S.nativeShell) await start('station', { stayPut: true });
 }
 
 $('#welcome-go').addEventListener('click', () => { note(el.setupNote, ''); show(el.setupRole); });
@@ -794,8 +818,28 @@ $('#setup-handheld').addEventListener('click', () => {
   openScanner();
 });
 
-$('#wp-start').addEventListener('click', () => start('station'));
-$('#wp-later').addEventListener('click', () => show(el.channels));
+// The session is already up — openWatchPair() started it so the QR on that
+// screen actually works — so this is only the move to the live view and the
+// pairing sheet that lives there. start() again would re-open the camera.
+// The fallback covers a start() that bailed (no camera, an insecure origin)
+// and the native shell, which never auto-starts here.
+$('#wp-start').addEventListener('click', () => {
+  clearInterval(wpTicker);
+  wpTicker = null;
+  if (S.role === 'station' && S.local) { show(el.live); openPair(); }
+  else start('station');
+});
+
+// Leaving this screen means the Monitor is not waiting for anyone after all, so
+// the camera and the room go with it. Without this, "Set up later" walked away
+// from a live camera with its light on and a room still held open at the relay.
+function leaveWatchPair() {
+  clearInterval(wpTicker);
+  wpTicker = null;
+  if (S.role === 'station' && S.local) return hangUp();
+  show(el.channels);
+}
+$('#wp-later').addEventListener('click', leaveWatchPair);
 el.wpCopy.addEventListener('click', async () => {
   try {
     await navigator.clipboard.writeText(pairLink());
@@ -806,7 +850,7 @@ el.wpCopy.addEventListener('click', async () => {
 });
 // The app bar's back affordance and the quiet "Set up later" underneath it
 // land in the same place; the bar is just the one a thumb reaches for first.
-$('#wp-back').addEventListener('click', () => show(el.channels));
+$('#wp-back').addEventListener('click', leaveWatchPair);
 
 // The empty channel list offers the same route the welcome screen does,
 // rather than describing it and leaving the user to find it.
@@ -2005,7 +2049,9 @@ function openSignal(base, tag) {
 
       // Fatal close codes: for a Handheld (one transport) the session is over;
       // for the Watcher, a bad cloud socket must NOT tear down a healthy LAN one.
-      if (ev.code === 4003 || ev.code === 4004 || ev.code === 4008) {
+      // 4010 joins the fatal set: the relay is answering and has told us the
+      // room has no Monitor in it. Retrying into that changes nothing.
+      if (ev.code === 4003 || ev.code === 4004 || ev.code === 4008 || ev.code === 4010) {
         if (S.role === 'station') {
           // ...but not immediately fatal on the cloud leg. When this phone's
           // radio blips, the socket dies without a close handshake and the
@@ -2038,12 +2084,20 @@ function openSignal(base, tag) {
         return bail(
           ev.code === 4003 ? FULL_MESSAGE
           : ev.code === 4004 ? TawnyT.t('w_bail_already_running')
+          // 4010: the relay has no ticket for this room at all, so no Monitor
+          // has ever connected. The code in this person's hand is fine and
+          // rescanning it will not help — the other end is simply not running.
+          // This used to arrive as 4008 and be read out as "expired", which
+          // sent people back to the same QR over and over.
+          : ev.code === 4010 ? TawnyT.t('w_bail_monitor_offline')
           // 4008 is the relay's own refusal — a ticket that no longer matches
           // the room. Different cause from the Monitor's pairing gate, same
           // thing to do about it, so it gets the same sentence and the same
           // screen in the native shell.
           : EXPIRED_MESSAGE,
-          ev.code === 4003 ? 'full' : ev.code === 4008 ? 'expired' : undefined
+          ev.code === 4003 ? 'full'
+            : ev.code === 4008 ? 'expired'
+            : ev.code === 4010 ? 'offline' : undefined
         );
       }
 
@@ -3598,7 +3652,16 @@ function cameraConstraints(wide = screenIsWide()) {
 // bar. Matching the capture shape to how the phone is held (idealCaptureSize)
 // is what keeps those bars small — or gone, when both ends face the same way.
 
-async function start(role) {
+/**
+ * Go live in `role`.
+ *
+ * `opts.stayPut` runs the whole of this — camera, ticket, socket, room —
+ * but leaves the caller's own screen showing instead of jumping to the live
+ * view. openWatchPair() needs exactly that: its QR is worthless unless this
+ * has run, because the relay only learns the room's ticket from a station
+ * hello, and a Viewer scanning before then is turned away at admission.
+ */
+async function start(role, opts = {}) {
   if (!S.channel) return;
   S.role = role;
   S.pending = null;
@@ -3715,15 +3778,19 @@ async function start(role) {
   const room = (S.channel.name || 'Pet camera').trim().replace(/\s*monitor$/i, '');
   el.channel.textContent = room || 'Pet camera';
 
-  show(el.live);
+  // Not while the caller is showing a screen of its own — see opts.stayPut.
+  // Everything below still runs, so the room is warm either way.
+  if (!opts.stayPut) show(el.live);
   status(TawnyT.t('w_status_connecting'), null);
   tellNative('live', { role });
   connectAll();
 
   // Settle the light question now, on the track we have just opened, so the
   // first Viewer to join is told the truth about this camera before it can
   // press anything. It is one constraint write and nothing lights up.
-  if (role === 'station') { refreshTorchSupport(); openPair(); }
+  // The pairing sheet belongs to the live screen. A caller that stayed put is
+  // already showing its own QR and would get two.
+  if (role === 'station') { refreshTorchSupport(); if (!opts.stayPut) openPair(); }
 }
 
 // ---------------------------------------------------------- capture loss
 
@@ -88,6 +88,10 @@
       w_bail_not_on_wifi: 'This phone is not on Wi-Fi yet. Connect it to Wi-Fi and try again.',
       w_bail_wifi_only_code: 'This code only works on the same Wi-Fi as the other phone. Put both phones on the same Wi-Fi and try again.',
       w_bail_already_running: 'This monitor is already running on another phone.',
+      // The relay has no ticket for this room at all: the Monitor is not running,
+      // which is a different thing from a code that stopped working. Saying
+      // "expired" here sent people back to rescan the same QR for ever.
+      w_bail_monitor_offline: 'The monitor is not online yet. Open Tawny on the monitor phone or computer and press Start, then scan again.',
       w_msg_expired: 'That pairing code has expired. Show a new code on the monitor phone and scan it again.',
     },
 
@@ -160,6 +164,7 @@
       w_bail_not_on_wifi: 'Este teléfono aún no está en Wi-Fi. Conéctalo a Wi-Fi e inténtalo de nuevo.',
       w_bail_wifi_only_code: 'Este código solo funciona en la misma red Wi-Fi que el otro teléfono. Pon los dos teléfonos en la misma Wi-Fi e inténtalo de nuevo.',
       w_bail_already_running: 'Este monitor ya se está ejecutando en otro teléfono.',
+      w_bail_monitor_offline: 'El monitor aún no está en línea. Abre Tawny en el teléfono o la computadora del monitor y pulsa Iniciar, luego vuelve a escanear.',
       w_msg_expired: 'Ese código de vinculación caducó. Muestra un código nuevo en el teléfono monitor y escanéalo otra vez.',
     },
   };
 
@@ -1500,7 +1500,14 @@ wss.on('connection', (ws, req, ctx) => {
 
     let register = null;
     if (role === 'viewer') {
-      if (REQUIRE_TICKET && (!rec || sha256hex(msg.t) !== rec.hashT)) return ws.close(4008, 'pairing expired');
+      // Two very different failures used to share one code and one sentence.
+      // `!rec` means no Monitor has ever registered this room: nothing is wrong
+      // with the code in the Viewer's hand — the Monitor simply is not running.
+      // Telling that person "your pairing code expired" sends them back to
+      // rescan the same QR, for ever, which is exactly the loop reported. 4010
+      // says the true thing, and public/app.js has its own sentence for it.
+      if (REQUIRE_TICKET && !rec) return ws.close(4010, 'monitor offline');
+      if (REQUIRE_TICKET && sha256hex(msg.t) !== rec.hashT) return ws.close(4008, 'pairing expired');
     } else { // station
       if (rec?.auth && proof && proof !== rec.auth) return ws.close(4008, 'wrong channel key');
       const mayRekey = proof !== null || !rec?.auth;
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-6c46e7d042ed9eb25a44506209ff540553e75562`
	`1`	`+48944ddf3318338869da59c4a4b1e2375336babc`