docs(ops): refresh reboot readback route retry [skip ci]

scripts/reboot-recovery/post-start-quick-check.sh

@@ -7,6 +7,8 @@ set -uo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 SSH_CONNECT_TIMEOUT="${SSH_CONNECT_TIMEOUT:-6}"
+ROUTE_RETRY_ATTEMPTS="${ROUTE_RETRY_ATTEMPTS:-3}"
+ROUTE_RETRY_DELAY_SECONDS="${ROUTE_RETRY_DELAY_SECONDS:-2}"
 RUN_COLD_START=1
 RUN_MOMO=1
 RUN_STOCK=1
@@ -71,6 +73,10 @@ Options:
   --no-color          Disable ANSI color.
   -h, --help          Show this help.
 
+Environment:
+  ROUTE_RETRY_ATTEMPTS        Public route attempts before blocking. Default: 3.
+  ROUTE_RETRY_DELAY_SECONDS  Delay between failed public route attempts. Default: 2.
+
 Exit codes:
   0 = no service blockers. Boundary / evidence warnings may still be present.
   1 = service warnings only.
@@ -348,13 +354,30 @@ fi
 if [[ "$RUN_ROUTES" -eq 1 ]]; then
   section "Public routes"
   for url in "${ROUTES[@]}"; do
-    code="$(curl -k -sS -o /dev/null -w '%{http_code}' --max-time 12 "$url" 2>/dev/null || true)"
+    code=""
+    attempt=1
+    while [[ "$attempt" -le "$ROUTE_RETRY_ATTEMPTS" ]]; do
+      code="$(curl -k -sS -o /dev/null -w '%{http_code}' --max-time 12 "$url" 2>/dev/null || true)"
+      case "$code" in
+        2*|3*)
+          break
+          ;;
+      esac
+      if [[ "$attempt" -lt "$ROUTE_RETRY_ATTEMPTS" ]]; then
+        sleep "$ROUTE_RETRY_DELAY_SECONDS"
+      fi
+      attempt=$((attempt + 1))
+    done
     case "$code" in
       2*|3*)
-        ok "$code $url"
+        if [[ "$attempt" -gt 1 ]]; then
+          evidence_warn "$code $url recovered_after_attempt=$attempt"
+        else
+          ok "$code $url"
+        fi
         ;;
       *)
-        blocked "${code:-curl_failed} $url"
+        blocked "${code:-curl_failed} $url attempts=$ROUTE_RETRY_ATTEMPTS"
         ;;
     esac
   done