@wix/himalaya-cli 0.1391.0 → 0.1393.0

package/templates/branded-lite/tier5-src/himi-branded-lite-cart/index.ts

@@ -24,25 +24,33 @@ async function resolveMsid(): Promise<string> {
   }
 }
 import { copyParam, copyTemplate, stashCopy } from "../_shared/himi-copy.js";
-import { getAll, upsert, remove as dbRemove, enqueue, type DbEntity } from "@himalaya/local-db";
-import { isBridgeUnavailable } from "../_shared/owner-load-error.js";
+import { getAll, upsert, remove as dbRemove, type DbEntity } from "@himalaya/local-db";
+import { isOfflineFailure, writeMayHaveLanded } from "../_shared/owner-load-error.js";
 
 // Offline-first (data-offline): the cart is READ-THROUGH — paint the last-synced line
 // items from the on-device `cart` entity first (instant, works offline), then
-// revalidate from Wix and refresh the cache. `remove` is WRITE-BEHIND — the line is
-// dropped from the cache OPTIMISTICALLY, then the Wix write is attempted; if it can't
-// reach the bridge/network the removal is ENQUEUED for replay on reconnect. The
-// checkout redirect path is unchanged. Every local-db call is wrapped so a build
+// revalidate from Wix and refresh the cache.
+// `remove` drops the line from the cache only AFTER Wix confirms it; a failed removal
+// keeps the line on screen and says nothing was removed (no host replays a
+// queued write, so the old "removed offline" promise was a removal that never happened).
+// The checkout redirect path is unchanged. Every local-db call is wrapped so a build
 // without the `local_database` grant behaves exactly as before (online-only).
 const ENTITY = "cart";
 async function readCachedItems(): Promise<Row[]> {
   try { return (await getAll(ENTITY)) as unknown as Row[]; } catch { return []; }
 }
+/** Mirror the cart Wix returned: upsert its lines and drop any cached line it no longer has
+ *  (one removed elsewhere, or a removal whose answer was lost), so the offline paint never
+ *  shows a line that is gone. */
 async function writeCachedItems(rows: Row[]): Promise<void> {
-  try { for (const r of rows) await upsert(ENTITY, r as unknown as DbEntity); } catch { /* capability not granted → online-only */ }
+  try {
+    const keep = new Set(rows.map((r) => r.id));
+    for (const old of (await getAll(ENTITY)) as unknown as Row[]) if (!keep.has(old.id)) await dbRemove(ENTITY, old.id);
+    for (const r of rows) await upsert(ENTITY, r as unknown as DbEntity);
+  } catch { /* capability not granted → online-only */ }
 }
+
 async function cacheDrop(id: string): Promise<void> { try { await dbRemove(ENTITY, id); } catch { /* capability not granted */ } }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> { try { await enqueue(actionId, params); } catch { /* capability not granted */ } }
 
 interface Row {
   catalogReference?: { appId: string; catalogItemId: string; options?: Record<string, unknown> };
@@ -164,6 +172,39 @@ function derive(state: State): State {
   };
 }
 
+/** Remove one line (the trash button, and "−" at quantity 1). The cache drops it only once
+ *  Wix confirms; a failure keeps it on screen and says why. */
+/** Remove one line (the trash button, and "−" at quantity 1). The cache drops it only once
+ *  Wix confirms; a failure keeps it on screen and says why. */
+async function removeLine(state: State, id: string): Promise<State> {
+  try {
+    await removeLineItemsFromCurrentCart([id]);
+  } catch (e) {
+    // The line stays visible (and cached) until a read says otherwise.
+    if (isOfflineFailure(e)) {
+      return derive({ ...state, checkoutHint: copyParam("cart.removeOfflineFailedMessage", "You’re offline — nothing was removed. Try again when you reconnect.") });
+    }
+    // It may have landed (mid-request drop, after-send envelope, gateway 5xx): say so,
+    // rather than "could not remove".
+    if (writeMayHaveLanded(e)) {
+      return derive({ ...state, checkoutHint: copyParam("cart.removeUnconfirmedMessage", "The connection dropped, so this item may already be removed. Refresh to check.") });
+    }
+    return derive({ ...state, checkoutHint: copyParam("cart.removeFailedMessage", "Could not remove this item.") });
+  }
+  // Wix confirmed it: only now does the line leave the cache, and it stays gone even
+  // if the re-fetch below fails.
+  await cacheDrop(id);
+  const removed = copyParam("cart.itemRemovedMessage", "Item removed.");
+  try {
+    return await refresh(state, removed);
+  } catch {
+    // The totals Wix last sent still count the removed line, and the new ones did not
+    // arrive: show none rather than a wrong one.
+    const items = state.items.filter((it) => it.id !== id);
+    return derive({ ...state, status: "ready", items, subtotal: "", commerceSubtotal: "", emptyText: items.length ? "" : copyParam("cart.emptyText", "Your cart is empty."), checkoutHint: removed });
+  }
+}
+
 async function refresh(state: State, checkoutHint = ""): Promise<State> {
   const cart = await getCurrentCart();
   const items = (cart.lineItems ?? []).map(row);
@@ -240,21 +281,7 @@ const svc = defineService<State, {
     remove: async (state, arg) => {
       const id = itemId(arg);
       if (!id) return state;
-      // Optimistic local delete — the cart drops the row immediately (offline or not).
-      await cacheDrop(id);
-      try {
-        await removeLineItemsFromCurrentCart([id]);
-        return await refresh(state, copyParam("cart.itemRemovedMessage", "Item removed."));
-      } catch (e) {
-        if (isBridgeUnavailable(e)) {
-          // Offline / no bridge: the optimistic cache drop already shows; queue the
-          // removal to replay (WriteQueue, idempotent) when connectivity returns.
-          await queueWrite("tier5.himiStoreCart.remove", { id });
-          const items = state.items.filter((it) => it.id !== id);
-          return derive({ ...state, status: "ready", items, emptyText: items.length ? "" : copyParam("cart.emptyText", "Your cart is empty."), checkoutHint: copyParam("cart.removedOfflineMessage", "Removed offline — will sync when you reconnect.") });
-        }
-        return derive({ ...state, checkoutHint: copyParam("cart.removeFailedMessage", "Could not remove this item.") });
-      }
+      return removeLine(state, id);
     },
     increment: async (state, arg) => {
       const id = itemId(arg);
@@ -272,12 +299,9 @@ const svc = defineService<State, {
       const id = itemId(arg);
       const line = state.items.find((candidate) => candidate.id === id);
       if (!line) return state;
+      // Qty 1 − ⇒ remove the line (the control never dead-ends), with remove's handling.
+      if (line.quantity <= 1) return removeLine(state, id);
       try {
-        if (line.quantity <= 1) {
-          // Qty 1 − ⇒ remove the line (the control never dead-ends).
-          await removeLineItemsFromCurrentCart([id]);
-          return await refresh(state, copyParam("cart.itemRemovedMessage", "Item removed."));
-        }
         const cartId = (await getCurrentCart()).id || "";
         await updateLineItemQuantity(cartId, id, line.quantity - 1);
         return await refresh(state);

package/templates/branded-lite/tier5-src/himi-branded-lite-group/index.ts

@@ -4,8 +4,8 @@ import { getMember } from "@himalaya/wix-members";
 import { signedInEmail } from "../_shared/himi-account";
 import { initials } from "../_shared/himi-text.js";
 import { copyParam, stashCopy } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, enqueue as dbEnqueue, type DbEntity } from "@himalaya/local-db";
-import { isBridgeUnavailable } from "../_shared/owner-load-error";
+import { get as dbGet, upsert as dbUpsert, type DbEntity } from "@himalaya/local-db";
+import { isOfflineFailure, writeMayHaveLanded } from "../_shared/owner-load-error";
 
 interface MemberAvatar {
   initials: string;
@@ -13,11 +13,12 @@ interface MemberAvatar {
 }
 
 // Offline-first (data-offline): the group detail READS through the shared `groups`
-// cache (get by id) so a previously-synced group still renders offline, and join/leave
-// are WRITE-BEHIND — the membership is written OPTIMISTICALLY to the local store, then
-// the Wix mutation is attempted; if the bridge/network is unreachable the mutation is
-// ENQUEUED for replay on reconnect. Every local-db call is wrapped (try/catch) so a
-// build without the `local_database` grant behaves exactly as before (online-only).
+// cache (get by id) so a previously-synced group still renders offline. Join/leave
+// are SERVER-CONFIRMED: the cached membership changes only after Wix accepts it; a
+// failed one leaves it alone and tells the member why. No host replays a queued
+// write, so nothing is queued.
+// Every local-db call is wrapped so a build without the `local_database` grant
+// behaves exactly as before (online-only).
 const ENTITY = "groups";
 async function readCachedGroup(id: string): Promise<DbEntity | null> {
   try { return await dbGet(ENTITY, id); } catch { return null; }
@@ -41,9 +42,6 @@ async function cachePutMembership(state: State, joined: boolean): Promise<void>
     await dbUpsert(ENTITY, { ...existing, id: state.id, joined: joined ? "true" : "false" });
   } catch { /* capability not granted */ }
 }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> {
-  try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ }
-}
 
 interface State {
   status: "loading" | "ready" | "error";
@@ -242,17 +240,19 @@ const svc = defineService<State, {
       if (state.privacy !== "Public" && state.privacy !== "Unknown") {
         return membershipState({ ...state, message: copyParam("group.privateInviteMessage", "Private groups are available by invitation.") }, false, true);
       }
-      // Optimistic local write — persist the joined membership so it survives offline.
-      await cachePutMembership(state, true);
       try {
         await joinGroup(state.id);
+        // Wix confirmed it: persist the joined membership so it survives offline.
+        await cachePutMembership(state, true);
         return membershipState({ ...state, message: copyParam("group.joinedMessage", "You joined the group.") }, true, true);
       } catch (e) {
-        if (isBridgeUnavailable(e)) {
-          // Offline / no bridge: the optimistic cache already reflects the join; queue
-          // the write to replay (WriteQueue, idempotent) when connectivity returns.
-          await queueWrite("tier5.himiBrandedGroup.join", { id: state.id });
-          return membershipState({ ...state, message: copyParam("group.joinedOfflineMessage", "You joined the group — it will sync when you reconnect.") }, true, true);
+        if (isOfflineFailure(e)) {
+          return membershipState({ ...state, message: copyParam("group.offlineFailedMessage", "You’re offline — nothing was saved. Try again when you reconnect.") }, false, true);
+        }
+        // It may have landed: neither "joined" nor "could not". (No "refresh to check": a load
+        // does not read the membership back.)
+        if (writeMayHaveLanded(e)) {
+          return membershipState({ ...state, message: copyParam("group.joinUnconfirmedMessage", "Wix didn’t confirm this, so you may already have joined the group.") }, false, true);
         }
         return membershipState({ ...state, message: copyParam("group.joinFailedMessage", "The group could not be joined. Try again.") }, false, true);
       }
@@ -260,17 +260,17 @@ const svc = defineService<State, {
     leave: async (state) => {
       const signedIn = Boolean(await signedInEmail());
       if (!signedIn) return membershipState({ ...state, message: copyParam("group.manageSignInMessage", "Sign in from Profile to manage groups.") }, state.isJoined, false);
-      // Optimistic local write — persist the left membership so it survives offline.
-      await cachePutMembership(state, false);
       try {
         await leaveGroup(state.id);
+        // Wix confirmed it: persist the left membership so it survives offline.
+        await cachePutMembership(state, false);
         return membershipState({ ...state, message: copyParam("group.leftMessage", "You left the group.") }, false, true);
       } catch (e) {
-        if (isBridgeUnavailable(e)) {
-          // Offline / no bridge: the optimistic cache already reflects the leave; queue
-          // the write to replay (WriteQueue, idempotent) when connectivity returns.
-          await queueWrite("tier5.himiBrandedGroup.leave", { id: state.id });
-          return membershipState({ ...state, message: copyParam("group.leftOfflineMessage", "You left the group — it will sync when you reconnect.") }, false, true);
+        if (isOfflineFailure(e)) {
+          return membershipState({ ...state, message: copyParam("group.offlineFailedMessage", "You’re offline — nothing was saved. Try again when you reconnect.") }, true, true);
+        }
+        if (writeMayHaveLanded(e)) {
+          return membershipState({ ...state, message: copyParam("group.leaveUnconfirmedMessage", "Wix didn’t confirm this, so you may already have left the group.") }, true, true);
         }
         return membershipState({ ...state, message: copyParam("group.leaveFailedMessage", "The group could not be left. Try again.") }, true, true);
       }

package/templates/community-club/tier5-src/_shared/owner-load-error.ts

@@ -20,10 +20,9 @@ export function isOwnerPreviewLive(): boolean {
  *
  * `isBridgeUnavailable` cannot answer this: it reads "not live" as "preview",
  * and on NATIVE there is no input at all, so `undefined` satisfies it. That is
- * harmless for the callers that use it to pick a demo fallback or to queue a
- * write, and it is deliberately left alone for them — native write-behind
- * depends on it. It is NOT harmless for choosing COPY: native workers format
- * their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
+ * left alone for the other apps that use it to pick a demo fallback or to queue
+ * a write. Owner-lite reads ask `ownerDemoFallback` instead. It is NOT
+ * harmless for choosing COPY: native workers format their failures the same way (`"HTTP \(code): \(body)"`, JSWorker.swift;
  * `"HTTP ${e.code}: ..."`, WebViewJSWorker.kt), so a transient `HTTP 503` on a
  * phone would otherwise be answered with "open this app on a device" — on the
  * device. Callers that pick a SENTENCE ask this instead.
@@ -43,11 +42,89 @@ export function isBridgeUnavailable(e: unknown): boolean {
   return /HTTP (405|501|502|503)\b/.test(String((e as Error)?.message ?? e));
 }
 
-/** Preserve native write-behind when the bridge is unavailable. This is a
- * queue decision, never permission to replace a failed live read with samples. */
-export function shouldQueueOwnerWrite(e: unknown): boolean {
-  if (ownerPreviewMode() === "live" || isOwnerPreviewDemo()) return false;
-  return /HTTP (405|501|502|503)\b/.test(String((e as Error)?.message ?? e));
+/**
+ * Whether a failed owner-lite READ may answer with the built-in demo records.
+ *
+ * Only where a demo was asked for: a web preview host that is not live. On a phone no
+ * mode is injected, so `isBridgeUnavailable` alone is `true` for a transient Wix
+ * `HTTP 503` — and the owner was shown sample appointments, orders and sites as if
+ * they were their business. Native falls through to the screen's error state.
+ * `isBridgeUnavailable` keeps its semantics: other apps' callers depend on it.
+ */
+export function ownerDemoFallback(e: unknown): boolean {
+  return isOwnerPreviewHost() && !isOwnerPreviewLive() && isBridgeUnavailable(e);
+}
+
+/**
+ * The sentence for an owner WRITE that failed because the device could not reach Wix at
+ * all (a transport failure). Nothing replays a queued write on any platform — every host's
+ * `drain` passes an empty closure — so the honest answer is that nothing was saved.
+ * Copy-as-configuration under `ownerCommon.`, which every owner screen forwards.
+ */
+export function ownerOfflineNotSaved(): string {
+  return copyParam(
+    "ownerCommon.offlineNotSaved",
+    "You’re offline — nothing was saved. Try again when you reconnect.",
+  );
+}
+
+/** The sentence for an owner WRITE that Wix answered with an unavailable status: the
+ *  device is online, so it is not "offline" — but nothing was saved all the same. */
+/**
+ * Whether a failed WRITE may have landed on Wix anyway, so the user must not be told it
+ * was not saved: a transport failure mid-request (timeout, reset, fetch rejection), the web
+ * host's after-send envelope (`HTTP 502 {…"sent":true}`), the serve bridge's mid-request
+ * `webwix_bridge_upstream_failed`, or a gateway status (502/503/504) that can arrive after
+ * the backend already ran. Only connect-time failures (`isOfflineFailure`) and the designed
+ * 405/501 bridge refusals prove nothing happened.
+ */
+export function writeMayHaveLanded(e: unknown): boolean {
+  if (isOfflineFailure(e)) return false;
+  if (isTransportFailure(e)) return true;
+  const msg = String((e as Error)?.message ?? e ?? "");
+  if (/"sent"\s*:\s*true/.test(msg)) return true;
+  // The web host's own envelope WITHOUT `sent: true` failed before the request left it, and
+  // a disabled owner rung / bridge refuses by design without sending anything.
+  if (/\bwebwix_(?:direct_failed|owner_disabled|bridge_disabled)\b/.test(msg)) return false;
+  // `webwix_bridge_upstream_failed` stays ambiguous: the same code covers a lookup that failed
+  // before sending and a serve-bridge failure mid-request, and nothing in it says which.
+  return /\bwebwix_bridge_upstream_failed\b/.test(msg) || /HTTP (502|503|504)\b/.test(msg);
+}
+
+/** Wix answered that the record does not exist (`HTTP 404`). A detail must not fall back to
+ *  its cached row then: that row is what a delete whose reply was lost leaves behind. */
+export function isNotFound(e: unknown): boolean {
+  if (/HTTP 404\b/.test(String((e as Error)?.message ?? e ?? ""))) return true;
+  // An SDK that answers a 404 with its own "not found" error keeps the HTTP one as `cause`
+  // (the blog SDK's getPost, after its query fallback also finds nothing).
+  const cause = (e as { cause?: unknown } | null | undefined)?.cause;
+  return cause !== undefined && cause !== e && /HTTP 404\b/.test(String((cause as Error)?.message ?? cause));
+}
+
+export function ownerUnavailableNotSaved(): string {
+  return copyParam(
+    "ownerCommon.unavailableNotSaved",
+    "Wix isn’t available right now — nothing was saved. Try again in a moment.",
+  );
+}
+
+/** The sentence for an owner WRITE that may have landed (`writeMayHaveLanded`): it can't
+ *  be called saved or not saved. */
+export function ownerWriteUnconfirmed(): string {
+  return copyParam(
+    "ownerCommon.writeUnconfirmed",
+    "Wix didn’t confirm this, so it may or may not have been saved. Check before trying again.",
+  );
+}
+
+/** Display copy for a failed owner write: `ownerOfflineNotSaved` when the request never
+ *  left the device, `ownerWriteUnconfirmed` when it may have landed, `ownerUnavailableNotSaved`
+ *  for the designed 405/501 bridge refusals outside a live preview, else `ownerLoadError`. */
+export function ownerWriteError(e: unknown): string {
+  if (isOfflineFailure(e)) return ownerOfflineNotSaved();
+  if (writeMayHaveLanded(e)) return ownerWriteUnconfirmed();
+  if (!isOwnerPreviewLive() && /HTTP (405|501)\b/.test(String((e as Error)?.message ?? e))) return ownerUnavailableNotSaved();
+  return ownerLoadError(e);
 }
 
 /** `HTTP 403: …` → "403", when the message carries a status at all. */
@@ -99,6 +176,10 @@ const TRANSPORT = [
   /^Failed to connect to \S/,
   /^Unable to resolve host\b/,
   /\b(?:Connection refused|Network is unreachable|Software caused connection abort)\b/,
+  // OkHttp / HttpURLConnection messages a dropped connection produces mid-request, which
+  // Android's bridge forwards without the exception class.
+  /\b(?:Connection reset|ECONNRESET|ETIMEDOUT|EPIPE|Broken pipe|stream was reset)\b/,
+  /^unexpected end of stream\b/i,
   /^(?:timeout|Read timed out|connect timed out)$/i,
   /\bFailed to fetch\b/,
   /\bNetworkError when attempting to fetch\b/,
@@ -113,6 +194,27 @@ export function isTransportFailure(e: unknown): boolean {
   return TRANSPORT.some((re) => re.test(msg));
 }
 
+/** Transport failures that happen while CONNECTING — no connection, no route, no such host,
+ *  connection refused — so the request provably never left the device. Every other
+ *  transport failure (a timeout, a reset, a bad or truncated response, a browser's fetch
+ *  rejection, which says nothing about when it failed) may come after Wix took the write. */
+const NEVER_SENT = [
+  /\bNSURLErrorDomain Code=-10(?:09|04|03|06|20|18)\b/,  // not connected / cannot connect / no host / DNS / data not allowed / roaming off
+  /\b(?:UnknownHost|Connect|NoRouteToHost)Exception\b/,
+  /^Failed to connect to \S/,
+  /^Unable to resolve host\b/,
+  /\b(?:Connection refused|Network is unreachable)\b/,
+  /\bnet::ERR_(?:INTERNET_DISCONNECTED|NAME_NOT_RESOLVED|CONNECTION_REFUSED|ADDRESS_UNREACHABLE|NETWORK_ACCESS_DENIED)\b/,
+];
+
+/** No HTTP answer, and the request provably never left the device: the user is offline, and
+ *  a write certainly did not happen. Anything else may have landed (see `NEVER_SENT`). */
+export function isOfflineFailure(e: unknown): boolean {
+  if (!isTransportFailure(e)) return false;
+  const msg = String((e as Error)?.message ?? e ?? "");
+  return NEVER_SENT.some((re) => re.test(msg));
+}
+
 /** The one sentence for a transport failure. Copy-as-configuration: the key is
  *  under `ownerCommon.`, which every owner screen (Aria included) forwards. */
 export function ownerTransportFailureText(): string {
@@ -194,8 +296,8 @@ export function ownerPreviewUnavailable(): string {
  * error says: this names the web preview when there IS one. `isBridgeUnavailable`
  * reads "not live" as "preview", and native injects no mode at all, so the
  * default would answer a device-side `HTTP 503` with "open this app on a device"
- * — on the device. That predicate is deliberately left alone: native
- * write-behind (`shouldQueueOwnerWrite`) depends on exactly it.
+ * — on the device. That predicate is deliberately left alone: other apps'
+ * demo and write-queue decisions depend on exactly it.
  *
  * The reductions this used to add are now in `humanWireError`, so every owner
  * screen gets them rather than the two that happened to call this.
@@ -232,6 +334,7 @@ export function ownerDisplayError(e: unknown): string {
  */
 export function ownerLoadError(e: unknown): string {
   const msg = String((e as Error)?.message ?? e);
-  if (isBridgeUnavailable(e)) return ownerPreviewUnavailable();
+  // Same host guard as `ownerDisplayError`: on a phone, "open this app on a device" is false.
+  if (isOwnerPreviewHost() && isBridgeUnavailable(e)) return ownerPreviewUnavailable();
   return humanWireError(msg);
 }

package/templates/community-club/tier5-src/himi-branded-lite-group/index.ts

@@ -4,8 +4,8 @@ import { getMember } from "@himalaya/wix-members";
 import { signedInEmail } from "../_shared/himi-account";
 import { initials } from "../_shared/himi-text.js";
 import { copyParam, stashCopy } from "../_shared/himi-copy.js";
-import { get as dbGet, upsert as dbUpsert, enqueue as dbEnqueue, type DbEntity } from "@himalaya/local-db";
-import { isBridgeUnavailable } from "../_shared/owner-load-error";
+import { get as dbGet, upsert as dbUpsert, type DbEntity } from "@himalaya/local-db";
+import { isOfflineFailure, writeMayHaveLanded } from "../_shared/owner-load-error";
 
 interface MemberAvatar {
   initials: string;
@@ -13,11 +13,12 @@ interface MemberAvatar {
 }
 
 // Offline-first (data-offline): the group detail READS through the shared `groups`
-// cache (get by id) so a previously-synced group still renders offline, and join/leave
-// are WRITE-BEHIND — the membership is written OPTIMISTICALLY to the local store, then
-// the Wix mutation is attempted; if the bridge/network is unreachable the mutation is
-// ENQUEUED for replay on reconnect. Every local-db call is wrapped (try/catch) so a
-// build without the `local_database` grant behaves exactly as before (online-only).
+// cache (get by id) so a previously-synced group still renders offline. Join/leave
+// are SERVER-CONFIRMED: the cached membership changes only after Wix accepts it; a
+// failed one leaves it alone and tells the member why. No host replays a queued
+// write, so nothing is queued.
+// Every local-db call is wrapped so a build without the `local_database` grant
+// behaves exactly as before (online-only).
 const ENTITY = "groups";
 async function readCachedGroup(id: string): Promise<DbEntity | null> {
   try { return await dbGet(ENTITY, id); } catch { return null; }
@@ -41,9 +42,6 @@ async function cachePutMembership(state: State, joined: boolean): Promise<void>
     await dbUpsert(ENTITY, { ...existing, id: state.id, joined: joined ? "true" : "false" });
   } catch { /* capability not granted */ }
 }
-async function queueWrite(actionId: string, params: Record<string, string>): Promise<void> {
-  try { await dbEnqueue(actionId, params); } catch { /* capability not granted */ }
-}
 
 interface State {
   status: "loading" | "ready" | "error";
@@ -242,17 +240,19 @@ const svc = defineService<State, {
       if (state.privacy !== "Public" && state.privacy !== "Unknown") {
         return membershipState({ ...state, message: copyParam("group.privateInviteMessage", "Private groups are available by invitation.") }, false, true);
       }
-      // Optimistic local write — persist the joined membership so it survives offline.
-      await cachePutMembership(state, true);
       try {
         await joinGroup(state.id);
+        // Wix confirmed it: persist the joined membership so it survives offline.
+        await cachePutMembership(state, true);
         return membershipState({ ...state, message: copyParam("group.joinedMessage", "You joined the group.") }, true, true);
       } catch (e) {
-        if (isBridgeUnavailable(e)) {
-          // Offline / no bridge: the optimistic cache already reflects the join; queue
-          // the write to replay (WriteQueue, idempotent) when connectivity returns.
-          await queueWrite("tier5.himiBrandedGroup.join", { id: state.id });
-          return membershipState({ ...state, message: copyParam("group.joinedOfflineMessage", "You joined the group — it will sync when you reconnect.") }, true, true);
+        if (isOfflineFailure(e)) {
+          return membershipState({ ...state, message: copyParam("group.offlineFailedMessage", "You’re offline — nothing was saved. Try again when you reconnect.") }, false, true);
+        }
+        // It may have landed: neither "joined" nor "could not". (No "refresh to check": a load
+        // does not read the membership back.)
+        if (writeMayHaveLanded(e)) {
+          return membershipState({ ...state, message: copyParam("group.joinUnconfirmedMessage", "Wix didn’t confirm this, so you may already have joined the group.") }, false, true);
         }
         return membershipState({ ...state, message: copyParam("group.joinFailedMessage", "The group could not be joined. Try again.") }, false, true);
       }
@@ -260,17 +260,17 @@ const svc = defineService<State, {
     leave: async (state) => {
       const signedIn = Boolean(await signedInEmail());
       if (!signedIn) return membershipState({ ...state, message: copyParam("group.manageSignInMessage", "Sign in from Profile to manage groups.") }, state.isJoined, false);
-      // Optimistic local write — persist the left membership so it survives offline.
-      await cachePutMembership(state, false);
       try {
         await leaveGroup(state.id);
+        // Wix confirmed it: persist the left membership so it survives offline.
+        await cachePutMembership(state, false);
         return membershipState({ ...state, message: copyParam("group.leftMessage", "You left the group.") }, false, true);
       } catch (e) {
-        if (isBridgeUnavailable(e)) {
-          // Offline / no bridge: the optimistic cache already reflects the leave; queue
-          // the write to replay (WriteQueue, idempotent) when connectivity returns.
-          await queueWrite("tier5.himiBrandedGroup.leave", { id: state.id });
-          return membershipState({ ...state, message: copyParam("group.leftOfflineMessage", "You left the group — it will sync when you reconnect.") }, false, true);
+        if (isOfflineFailure(e)) {
+          return membershipState({ ...state, message: copyParam("group.offlineFailedMessage", "You’re offline — nothing was saved. Try again when you reconnect.") }, true, true);
+        }
+        if (writeMayHaveLanded(e)) {
+          return membershipState({ ...state, message: copyParam("group.leaveUnconfirmedMessage", "Wix didn’t confirm this, so you may already have left the group.") }, true, true);
         }
         return membershipState({ ...state, message: copyParam("group.leaveFailedMessage", "The group could not be left. Try again.") }, true, true);
       }