fix: reset stale peer to pending on 401 so ensurePeered re-handshakes

packages/server/src/utils/federationWorker.ts

@@ -261,6 +261,24 @@ async function processOutboxTick(): Promise<void> {
           })
           .where(eq(schema.federationPeers.id, peerId))
           .run();
+      } else if (response.status === 401) {
+        // 401 = HMAC verification failed on the remote side.
+        // This means the remote deleted/revoked our peer record — our local
+        // peer is stale. Reset to 'pending' so resolvePendingPeers() triggers
+        // a fresh handshake via ensurePeered() on the next tick.
+        // Outbox entries are preserved (same peer ID) and will deliver after re-peering.
+        console.warn(
+          `[federation-worker] Peer ${peerOrigin} returned 401 (HMAC rejected) — resetting to pending for re-handshake`,
+        );
+        db.update(schema.federationPeers)
+          .set({
+            status: 'pending',
+            hmacSecret: '',  // Will be regenerated by ensurePeered/performHandshake
+            consecutiveFailures: 0,
+            lastFailureAt: now,
+          })
+          .where(eq(schema.federationPeers.id, peerId))
+          .run();
       } else {
         console.warn(
           `[federation-worker] Peer ${peerOrigin} returned HTTP ${response.status}`,