fix(sender): retry_after duration can be negative

src/service/federation/mod.rs

@@ -78,7 +78,7 @@ impl Service {
 		let map = self.remote_health.read();
 		let unix_now = millis_since_unix_epoch();
 		map.get(server_name)
-			.map(|(_, next_retry)| Duration::from_millis((*next_retry).expected_sub(unix_now)))
+			.map(|(_, next_retry)| Duration::from_millis((*next_retry).saturating_sub(unix_now)))
 	}
 
 	/// Marks or updates a remote's health status as unhealthy. If the remote is