Hold DNS cutover until play_state_sync succeeds on handback

Retries up to PLAY_SYNC_HANDBACK_RETRIES times (default 5, 60s apart)
before giving up — one successful run catches all state regardless of
outage length, so users land on current watch state after DNS flips.

Deployment/master.conf.template

@@ -686,6 +686,12 @@
     FALLBACK_PARTNERSHIP_SUSPEND_AFTER=120      # minutes without active partnership before suspending
                                                 # 0 = suspend immediately when partnership goes inactive
 
+# ━━━ Play State Sync — Handback ━━━
+# play_state_sync runs before DNS cutover so users land on current watch state.
+# Retried until success — DNS is held until sync completes or retries are exhausted.
+    PLAY_SYNC_HANDBACK_RETRIES=5        # attempts before giving up and proceeding to DNS cutover
+    PLAY_SYNC_HANDBACK_RETRY_DELAY=60   # seconds between retry attempts
+
 # ━━━ Failover Test ━━━
 # Controlled simulation of a failover event — run manually via fallback_test.sh.
     FALLBACK_TEST_BLOCK_WAIT=150    # seconds to wait after blocking connectivity

Fallback/fallback.sh

@@ -793,17 +793,30 @@ run_handback() {
         [[ "$is_ddns" == false ]] && remote_start "$container"
     done
 
-    # ── Step 7: Play State Sync — before DNS cutover so users land on current state ──────────
+    # ── Step 7: Play State Sync — DNS held until sync succeeds or retries exhausted ──────────
+    # Retried so users land on current watch state — after a 3hr outage one successful
+    # run catches everything regardless of how many cron cycles were missed.
     echo ""
     echo "━━━ $ICON_SYNC Play State Sync ━━━"
+    local _sync_ok=false
+    local _retry_max="${PLAY_SYNC_HANDBACK_RETRIES:-5}"
+    local _retry_delay="${PLAY_SYNC_HANDBACK_RETRY_DELAY:-60}"
     if [[ "$DRY_RUN" == false ]]; then
-        if bash "$SCRIPT_DIR/../Media/play_state_sync.sh" --wait; then
-            log "Play state synced — $REMOTE_SERVER_NAME watch state reconciled ✅"
-        else
-            warn "play_state_sync failed — users may see stale watch state until next sync cycle"
-        fi
+        for _attempt in $(seq 1 "$_retry_max"); do
+            if bash "$SCRIPT_DIR/../Media/play_state_sync.sh" --wait; then
+                _sync_ok=true
+                log "Play state synced ✅ (attempt ${_attempt}/${_retry_max})"
+                break
+            fi
+            if [[ "$_attempt" -lt "$_retry_max" ]]; then
+                warn "Play state sync failed (attempt ${_attempt}/${_retry_max}) — retrying in ${_retry_delay}s"
+                sleep "$_retry_delay"
+            fi
+        done
+        [[ "$_sync_ok" == false ]] && \
+            warn "Play state sync failed after ${_retry_max} attempts — proceeding to DNS cutover"
     else
-        warn "DRY RUN — would run play_state_sync --wait"
+        warn "DRY RUN — would retry play_state_sync --wait up to ${_retry_max} times before DNS cutover"
     fi
 
     # ── Step 8: DNS Cutover — final step ────────────────────────────────────────────────────