agent-comms 5.0.6 → 5.2.0

package/dist/core/peer-lifecycle.js

@@ -2,9 +2,18 @@
  * PeerLifecycle — the TransportEvents callbacks around a peer's own comings and goings on the mesh: peer-list/peer-joined bookkeeping, the coordinator's own new-peer introduction handshake, post-connection state-sync, inbound data-message routing (state_sync/state_update), taking over as coordinator, and peer disconnection. Split out of mesh-store.ts to reduce it under the repo's max-lines cap.
  */
 import { normaliseWireState } from "./wire-protocol.js";
+import { isAddrInUse, isConnectionRefused } from "./bind-retry.js";
 import { COORDINATOR_HOST } from "./mesh-store-shared.js";
+/** The message an unknown thrown value is reported as, so a takeover or rejoin failure reads the same whether the transport rejected with an Error or something else. */
+function describe(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** How many times a peer that has lost its coordinator alternates between binding the vacated port and joining whoever bound it first. More than one round is genuinely needed: a graceful handover names its successor before the outgoing coordinator's own listener closes, so a bind attempted in that window fails on a port that is about to be free, and the join it falls back to finds nothing listening a moment later. */
+const COORDINATOR_TAKEOVER_ROUNDS = 5;
 export class PeerLifecycle {
     deps;
+    /** Guards against a second contest running while the first is still binding or rejoining -- a coordinator whose process dies can close more than one session to this side, and each close arrives as its own disconnect. */
+    contestingCoordinatorRole = false;
     constructor(deps) {
         this.deps = deps;
     }
@@ -70,8 +79,12 @@ export class PeerLifecycle {
         await this.deps
             .requireTransport()
             .becomeCoordinator(COORDINATOR_HOST, this.deps.coordinatorPort);
-        this.deps.peerInfo.clear();
         const peerId = this.deps.getPeerId();
+        // peerList never names the successor itself (neither the graceful handover nor the crash race includes it), so this side's own entry is carried across the reset rather than dropped: handleIntroduction answers every later joiner with exactly these entries, and a joiner that is never told the coordinator's own data port never dials it.
+        const self = this.deps.peerInfo.get(peerId);
+        this.deps.peerInfo.clear();
+        if (self !== undefined)
+            this.deps.peerInfo.set(peerId, self);
         for (const peer of peerList) {
             this.deps.peerInfo.set(peer.id, peer);
             void this.deps.requireTransport().connectToPeer(peer, peerId);
@@ -81,7 +94,76 @@ export class PeerLifecycle {
         await this.deps.onCoordinatorRoleChanged?.();
     }
     handlePeerDisconnected(handle) {
-        this.deps.peerInfo.delete(handle.id);
+        void this.handlePeerDeparture(handle.id);
+    }
+    /** The awaitable form of handlePeerDisconnected, which TransportEvents forces to be synchronous. A departing peer leaves the peer list; when it was this side's own coordinator, its vacated role is contested before anything else, so whoever wins is already coordinator by the time the departed peer's agent record is retired. */
+    async handlePeerDeparture(peerId) {
+        this.deps.peerInfo.delete(peerId);
+        if (peerId === this.deps.getCoordinatorPeerId()) {
+            await this.contestCoordinatorRole(peerId);
+        }
+        await this.retireDepartedAgent(peerId);
+    }
+    /** Races every other surviving peer to rebind the coordinator port, which is what makes a coordinator CRASH recoverable at all: unlike the graceful handover, a killed coordinator names no successor, so each survivor contests independently and the operating system's own exclusive bind decides the single winner. The winner runs the ordinary takeover path (handleBecomeCoordinator) over the peers it still holds connections to; a loser -- the one case where the bind fails specifically because the port is already taken -- re-introduces itself to the winner so it is a full member of the new mesh again, with its own data port known to whoever joins next. Direct peer-to-peer data connections are untouched throughout, so traffic between survivors never depends on the outcome of this race. */
+    async contestCoordinatorRole(lostCoordinatorId) {
+        const transport = this.deps.requireTransport();
+        if (transport.isCoordinator || this.contestingCoordinatorRole)
+            return;
+        this.contestingCoordinatorRole = true;
+        try {
+            const selfId = this.deps.getPeerId();
+            const survivors = [...this.deps.peerInfo.values()].filter((peer) => peer.id !== selfId && peer.id !== lostCoordinatorId);
+            for (let round = 0; round < COORDINATOR_TAKEOVER_ROUNDS; round++) {
+                try {
+                    await this.handleBecomeCoordinator(survivors);
+                    return;
+                }
+                catch (error) {
+                    if (!isAddrInUse(error)) {
+                        this.deps.onError?.(new Error(`PeerLifecycle: could not take over the vacated coordinator role: ${describe(error)}`));
+                        return;
+                    }
+                }
+                // A graceful handover racing this crash race can have made this side the coordinator while the bind above was in flight: the bind then fails against this side's own freshly bound listener, and dialling it would be this peer introducing itself to itself. Re-read through requireTransport() rather than the narrowed local, which TypeScript still believes is false from the guard at the top of this method.
+                if (this.deps.requireTransport().isCoordinator)
+                    return;
+                if ((await this.rejoinUnderNewCoordinator(selfId)) !== "nothing-listening")
+                    return;
+            }
+            this.deps.onError?.(new Error("PeerLifecycle: the vacated coordinator port kept changing hands and this peer neither took it nor found anyone holding it"));
+        }
+        finally {
+            this.contestingCoordinatorRole = false;
+        }
+    }
+    /** Re-introduces this side to whichever survivor won the bind race, over a fresh coordinator connection to the same well-known port. Without it this peer would keep its existing data connections but be unknown to the new coordinator, so it would never appear in the peer list handed to the next joiner. A refused dial is reported as "nothing-listening" rather than as an error: it means the winner released the port again (or never finished taking it), which the caller answers by re-entering the bind race. Any other failure is reported here, since it says the coordinator is there and this peer still cannot reach it. */
+    async rejoinUnderNewCoordinator(selfId) {
+        const transport = this.deps.requireTransport();
+        try {
+            await transport.connectToCoordinator(COORDINATOR_HOST, this.deps.coordinatorPort, selfId, transport.dataPort);
+            return "joined";
+        }
+        catch (error) {
+            if (isConnectionRefused(error))
+                return "nothing-listening";
+            this.deps.onError?.(new Error(`PeerLifecycle: lost the coordinator bind race and could not rejoin under the new coordinator: ${describe(error)}`));
+            return "failed";
+        }
+    }
+    /** Marks a departed peer's own agent offline and announces it, but only from the coordinator -- the same single-authority rule StaleAgentChecker's PID probe already follows, so a departure produces one announcement rather than one per surviving peer. An agent's id is its peer's id (AgentRegistry.registerAgent), so the departed peer names its own record directly; the PID probe remains the backstop for an agent whose process dies without its session closing. */
+    async retireDepartedAgent(peerId) {
+        if (!this.deps.requireTransport().isCoordinator)
+            return;
+        const agent = this.deps.agents.get(peerId);
+        if (agent === undefined || agent.status === "offline")
+            return;
+        agent.status = "offline";
+        this.deps.agents.set(peerId, agent);
+        await this.deps.deliveryEngine.notifyRoomsOfStatus(peerId, "offline");
+        await this.deps.deliveryEngine.broadcastPatch({
+            type: "agent_offline",
+            agentId: peerId,
+        });
     }
     /** Graceful coordinator handover (agent-comms#170): called by MeshStore.shutdown() while the transport is still up. A no-op unless this side currently holds the coordinator role and at least one other peer remains connected -- neither condition is this class's own business to log or report on, since a solo coordinator shutting down or a non-coordinator peer shutting down are both entirely ordinary. When both hold, picks the longest-running remaining peer (the one with the earliest recorded PeerInfo.startedAt, matching the README's documented policy) as the successor and sends it become_coordinator carrying every other remaining peer -- exactly the peerList shape handleBecomeCoordinator already expects (it dials each entry itself; the successor doesn't need to be told about itself). The crash-race path (each surviving peer independently racing to rebind the coordinator port) is a separate mechanism and untouched by this method. */
     async sendCoordinatorHandover() {

package/dist/core/peer-lifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"peer-lifecycle.js","sourceRoot":"","sources":["../../src/core/peer-lifecycle.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAMxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAyB1D,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;IAAG,CAAC;IAExD,cAAc,CAAC,KAA0B;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACtC,kMAAkM;YAClM,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM;gBAAE,SAAS;YACjC,KAAK,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,IAAwB;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM;YAAE,OAAO;QAC/B,KAAK,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,MAAkC,EAClC,GAAmD;QAEnD,MAAM,OAAO,GAAa;YACxB,EAAE,EAAE,GAAG,CAAC,MAAM;YACd,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE5C,sCAAsC;QACtC,MAAM,QAAQ,GAAgB;YAC5B,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;SACxC,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE1D,0CAA0C;QAC1C,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACrE,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAErD,wCAAwC;QACxC,KAAK,IAAI,CAAC,IAAI;aACX,gBAAgB,EAAE;aAClB,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,MAAkC,EAClC,KAAyB;QAEzB,yDAAyD;QACzD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAoB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC9C,MAAM,EAAE,YAAY;gBACpB,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,MAAkC,EAClC,GAAgB;QAEhB,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,QAA6B;QACzD,iEAAiE;QACjE,MAAM,IAAI,CAAC,IAAI;aACZ,gBAAgB,EAAE;aAClB,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACtC,KAAK,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,EAAE,CAAC;QACzD,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB,CAAC,MAAkC;QACvD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,g7BAAg7B;IACh7B,KAAK,CAAC,uBAAuB;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,aAAa;YAAE,OAAO;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC5D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAC7B,CAAC;QACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAExC,iFAAiF;QACjF,cAAc,CAAC,IAAI,CACjB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAC5D,CAAC;QACF,MAAM,CAAC,SAAS,EAAE,GAAG,WAAW,CAAC,GAAG,cAAc,CAAC;QACnD,iKAAiK;QACjK,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO;QAEpC,MAAM,SAAS,CAAC,IAAI,CAClB,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,EACpB,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,WAAW,EAAE,CACxD,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"peer-lifecycle.js","sourceRoot":"","sources":["../../src/core/peer-lifecycle.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAMxD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAgC1D,yKAAyK;AACzK,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,qaAAqa;AACra,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAKtC,MAAM,OAAO,aAAa;IAIK;IAH7B,4NAA4N;IACpN,yBAAyB,GAAG,KAAK,CAAC;IAE1C,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;IAAG,CAAC;IAExD,cAAc,CAAC,KAA0B;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACtC,kMAAkM;YAClM,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM;gBAAE,SAAS;YACjC,KAAK,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,IAAwB;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM;YAAE,OAAO;QAC/B,KAAK,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,MAAkC,EAClC,GAAmD;QAEnD,MAAM,OAAO,GAAa;YACxB,EAAE,EAAE,GAAG,CAAC,MAAM;YACd,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE5C,sCAAsC;QACtC,MAAM,QAAQ,GAAgB;YAC5B,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;SACxC,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE1D,0CAA0C;QAC1C,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACrE,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAErD,wCAAwC;QACxC,KAAK,IAAI,CAAC,IAAI;aACX,gBAAgB,EAAE;aAClB,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,MAAkC,EAClC,KAAyB;QAEzB,yDAAyD;QACzD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAoB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC9C,MAAM,EAAE,YAAY;gBACpB,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,MAAkC,EAClC,GAAgB;QAEhB,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,QAA6B;QACzD,iEAAiE;QACjE,MAAM,IAAI,CAAC,IAAI;aACZ,gBAAgB,EAAE;aAClB,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,gVAAgV;QAChV,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7D,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACtC,KAAK,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,EAAE,CAAC;QACzD,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;IAC/C,CAAC;IAED,sBAAsB,CAAC,MAAkC;QACvD,KAAK,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,wUAAwU;IACxU,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,yxBAAyxB;IACjxB,KAAK,CAAC,sBAAsB,CAClC,iBAAyB;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,aAAa,IAAI,IAAI,CAAC,yBAAyB;YAAE,OAAO;QACtE,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CACvD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,KAAK,iBAAiB,CAC9D,CAAC;YACF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,2BAA2B,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjE,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;wBACxB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CACjB,IAAI,KAAK,CACP,oEAAoE,QAAQ,CAAC,KAAK,CAAC,EAAE,CACtF,CACF,CAAC;wBACF,OAAO;oBACT,CAAC;gBACH,CAAC;gBACD,oZAAoZ;gBACpZ,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,aAAa;oBAAE,OAAO;gBACvD,IACE,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,KAAK,mBAAmB;oBAEtE,OAAO;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CACjB,IAAI,KAAK,CACP,2HAA2H,CAC5H,CACF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,yBAAyB,GAAG,KAAK,CAAC;QACzC,CAAC;IACH,CAAC;IAED,+mBAA+mB;IACvmB,KAAK,CAAC,yBAAyB,CACrC,MAAc;QAEd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,oBAAoB,CAClC,gBAAgB,EAChB,IAAI,CAAC,IAAI,CAAC,eAAe,EACzB,MAAM,EACN,SAAS,CAAC,QAAQ,CACnB,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,OAAO,mBAAmB,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CACjB,IAAI,KAAK,CACP,iGAAiG,QAAQ,CAAC,KAAK,CAAC,EAAE,CACnH,CACF,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,gdAAgd;IACxc,KAAK,CAAC,mBAAmB,CAAC,MAAc;QAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,aAAa;YAAE,OAAO;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO;QAC9D,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;YAC5C,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;IACL,CAAC;IAED,g7BAAg7B;IACh7B,KAAK,CAAC,uBAAuB;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,aAAa;YAAE,OAAO;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC5D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAC7B,CAAC;QACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAExC,iFAAiF;QACjF,cAAc,CAAC,IAAI,CACjB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAC5D,CAAC;QACF,MAAM,CAAC,SAAS,EAAE,GAAG,WAAW,CAAC,GAAG,cAAc,CAAC;QACnD,iKAAiK;QACjK,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO;QAEpC,MAAM,SAAS,CAAC,IAAI,CAClB,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,EACpB,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,WAAW,EAAE,CACxD,CAAC;IACJ,CAAC;CACF"}

package/dist/core/room-messaging.d.ts

@@ -4,7 +4,7 @@
 import type { MeshStoreIdentity } from "./mesh-store-shared.js";
 import type { RoomProtocol } from "./room-protocol.js";
 import type { AgentIdentity, DmMessage, Room, RoomMessage, StreamingBehavior } from "./types.js";
-import type { SendRoomMessageOptions } from "./comms-store.js";
+import type { SentDm, SentRoomMessage, SendRoomMessageOptions } from "./comms-store.js";
 /** The state and collaborators RoomMessaging needs from MeshStore. rooms/messages/dms are direct references into MeshStore's own fields; roomProtocol is the already-constructed instance (construction order: ... -\> roomProtocol -\> roomMessaging -\> ...), narrowed to what sending a message or DM ever needs; resolveAgent is AgentRegistry's own getAgent (deferred the same lazy-closure way DeliveryEngine's sendRoomRequestToMember closure is, since AgentRegistry doesn't exist yet at RoomMessaging's own construction point) rather than a bare `agents.get` lookup, so sendDm's own existence check also resolves a gossip-discovered agent (a remote, hub-learned one included, agent-comms#155) that will never appear in the agents map directly. */
 export interface RoomMessagingDeps {
     rooms: Map<string, Room>;
@@ -29,13 +29,17 @@ export declare class RoomMessaging {
      * Sends a room message via a real, wire-authenticated room.send fan-out (P3.5): one directed request per member, each carrying this sender's own persisted room:member token, rather than the legacy broadcastPatch's full-state replication. A member unreachable right now is queued for retry (see sendRoomRequestToMember/flushPendingRoomRequests) instead of blocking or failing the whole send -- delivery to any one recipient is independent of every other.
      *
      * durable, when true, additionally records this same message as a room-notice in the sender's own oplog via recordRoomSendNotice (P5, agent-comms#50) -- deliberately opt-in per call, not automatic: matching this codebase's own design principle that delivery and durable catch-up are the same artifact only when a caller actually opts a message into it. A caller that wants an offline member to be able to catch up on this specific message later passes true; every other send stays exactly as before.
+     *
+     * Returns the message alongside one delivery state per remote member, so the caller can tell who actually received it from who it is merely queued for. A member that refuses the message outright raises: a refusal is the member's settled answer, not a state to report as pending, and a fan-out whose members cannot all be reported honestly is not a successful send.
      */
-    sendRoomMessage(roomIdOrName: string, from: string, content: string, options?: RoomMessagingSendOptions): Promise<RoomMessage>;
+    sendRoomMessage(roomIdOrName: string, from: string, content: string, options?: RoomMessagingSendOptions): Promise<SentRoomMessage>;
     readRoomMessages(roomIdOrName: string, since?: string): Promise<RoomMessage[]>;
     /**
-     * Sends a DM via the same wire-authenticated room.send fan-out sendRoomMessage uses (P3.5): a DM is just a dm-shaped room path with exactly one other member, so it rides the identical mechanism rather than a separate one. Self-DM is the one exception -- a purely local scratchpad note that never leaves the process, so it needs no token and no wire round trip at all.
+     * Sends a DM via the same wire-authenticated room.send fan-out sendRoomMessage uses (P3.5): a DM is just a dm-shaped room path with exactly one other member, so it rides the identical mechanism rather than a separate one. Self-DM is the one exception -- a purely local scratchpad note that never leaves the process, so it needs no token and no wire round trip at all, and is delivered the moment it is recorded.
+     *
+     * Returns the message alongside what actually became of it, so a caller can never mistake a message merely held for retry for one the recipient received. A recipient that refuses the message raises SEND_REFUSED naming its own reason: a DM has exactly one recipient, so its refusal is the whole send failing, and no retry will change it.
      */
-    sendDm(from: string, to: string, content: string, streamingBehavior?: StreamingBehavior): Promise<DmMessage>;
+    sendDm(from: string, to: string, content: string, streamingBehavior?: StreamingBehavior): Promise<SentDm>;
     /** The room:member token this device holds for its DM path with `to`, requesting DM access from `to` first when none is persisted yet. Throws NOT_MEMBER if the request resolves without a token having been persisted, since no send can be authenticated without one. */
     private dmRoomMemberToken;
 }

package/dist/core/room-messaging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"room-messaging.d.ts","sourceRoot":"","sources":["../../src/core/room-messaging.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EACV,aAAa,EACb,SAAS,EACT,IAAI,EACJ,WAAW,EACX,iBAAiB,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE/D,wuBAAwuB;AACxuB,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACrC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9B,eAAe,EAAE,MAAM,iBAAiB,CAAC;IACzC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;IAC5D,6PAA6P;IAC7P,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,+SAA+S;IAC/S,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAChD,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;CAClE;AAED,sMAAsM;AACtM,MAAM,WAAW,wBAAyB,SAAQ,sBAAsB;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,iBAAiB;IAEpD;;;;OAIG;IACG,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,WAAW,CAAC;IAuEjB,gBAAgB,CACpB,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,EAAE,CAAC;IAQzB;;OAEG;IACG,MAAM,CACV,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,SAAS,CAAC;IAqDrB,2QAA2Q;YAC7P,iBAAiB;CAgBhC"}
+{"version":3,"file":"room-messaging.d.ts","sourceRoot":"","sources":["../../src/core/room-messaging.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EACV,aAAa,EACb,SAAS,EAET,IAAI,EACJ,WAAW,EACX,iBAAiB,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,MAAM,EACN,eAAe,EACf,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAW1B,wuBAAwuB;AACxuB,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACrC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9B,eAAe,EAAE,MAAM,iBAAiB,CAAC;IACzC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;IAC5D,6PAA6P;IAC7P,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,+SAA+S;IAC/S,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAChD,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;CAClE;AAED,sMAAsM;AACtM,MAAM,WAAW,wBAAyB,SAAQ,sBAAsB;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,iBAAiB;IAEpD;;;;;;OAMG;IACG,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,eAAe,CAAC;IA+ErB,gBAAgB,CACpB,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,EAAE,CAAC;IAQzB;;;;OAIG;IACG,MAAM,CACV,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,OAAO,CAAC,MAAM,CAAC;IA6DlB,2QAA2Q;YAC7P,iBAAiB;CAgBhC"}

package/dist/core/room-messaging.js

@@ -7,6 +7,13 @@ import { loadRoomTokens } from "./identity-store.js";
 import { randomId } from "./random-id.js";
 import { recordRoomSendNotice } from "./room-notice-log.js";
 import { CommsError } from "./store.js";
+import { describeRefusal } from "./send-outcome.js";
+/** Turns one member's send outcome into the delivery state its sender is told about. A refusal is not represented here at all: a refused send raises rather than resolving, so this only ever maps the two states a resolved send can be in. */
+function deliveryFromOutcome(outcome) {
+    return outcome.kind === "delivered"
+        ? { status: "delivered" }
+        : { status: "queued", reason: outcome.reason };
+}
 export class RoomMessaging {
     deps;
     constructor(deps) {
@@ -16,6 +23,8 @@ export class RoomMessaging {
      * Sends a room message via a real, wire-authenticated room.send fan-out (P3.5): one directed request per member, each carrying this sender's own persisted room:member token, rather than the legacy broadcastPatch's full-state replication. A member unreachable right now is queued for retry (see sendRoomRequestToMember/flushPendingRoomRequests) instead of blocking or failing the whole send -- delivery to any one recipient is independent of every other.
      *
      * durable, when true, additionally records this same message as a room-notice in the sender's own oplog via recordRoomSendNotice (P5, agent-comms#50) -- deliberately opt-in per call, not automatic: matching this codebase's own design principle that delivery and durable catch-up are the same artifact only when a caller actually opts a message into it. A caller that wants an offline member to be able to catch up on this specific message later passes true; every other send stays exactly as before.
+     *
+     * Returns the message alongside one delivery state per remote member, so the caller can tell who actually received it from who it is merely queued for. A member that refuses the message outright raises: a refusal is the member's settled answer, not a state to report as pending, and a fan-out whose members cannot all be reported honestly is not a successful send.
      */
     async sendRoomMessage(roomIdOrName, from, content, options) {
         const { replyTo, streamingBehavior, durable } = options ?? {};
@@ -65,12 +74,20 @@ export class RoomMessaging {
                 "streaming-behavior": streamingBehavior,
             }),
         };
+        const deliveries = [];
         for (const memberId of room.members) {
-            if (memberId !== from) {
-                await this.deps.roomProtocol.sendRoomRequestToMember(memberId, roomId, token, params);
-            }
+            if (memberId === from)
+                continue;
+            const outcome = await this.deps.roomProtocol.sendRoomRequestToMember(memberId, roomId, token, params);
+            // A refusal is reported as this member's own delivery state rather than raised, unlike sendDm's single recipient: delivery to any one member is independent of every other, so one member's refusal must neither stop the message reaching the rest nor discard what became of them.
+            deliveries.push({
+                member: memberId,
+                delivery: outcome.kind === "refused"
+                    ? { status: "refused", code: describeRefusal(outcome) }
+                    : deliveryFromOutcome(outcome),
+            });
         }
-        return message;
+        return { message, deliveries };
     }
     async readRoomMessages(roomIdOrName, since) {
         await Promise.resolve();
@@ -81,7 +98,9 @@ export class RoomMessaging {
         return arr.filter((m) => m.timestamp > since);
     }
     /**
-     * Sends a DM via the same wire-authenticated room.send fan-out sendRoomMessage uses (P3.5): a DM is just a dm-shaped room path with exactly one other member, so it rides the identical mechanism rather than a separate one. Self-DM is the one exception -- a purely local scratchpad note that never leaves the process, so it needs no token and no wire round trip at all.
+     * Sends a DM via the same wire-authenticated room.send fan-out sendRoomMessage uses (P3.5): a DM is just a dm-shaped room path with exactly one other member, so it rides the identical mechanism rather than a separate one. Self-DM is the one exception -- a purely local scratchpad note that never leaves the process, so it needs no token and no wire round trip at all, and is delivered the moment it is recorded.
+     *
+     * Returns the message alongside what actually became of it, so a caller can never mistake a message merely held for retry for one the recipient received. A recipient that refuses the message raises SEND_REFUSED naming its own reason: a DM has exactly one recipient, so its refusal is the whole send failing, and no retry will change it.
      */
     async sendDm(from, to, content, streamingBehavior) {
         if (to !== from) {
@@ -109,20 +128,24 @@ export class RoomMessaging {
         const arr = this.deps.dms.get(key) ?? [];
         arr.push(message);
         this.deps.dms.set(key, arr);
-        if (token !== undefined) {
-            const { clock } = this.deps.requireIdentity();
-            const params = {
-                verb: "room.send",
-                "message-id": messageId,
-                "sent-at": clock.now(),
-                text: content,
-                ...(streamingBehavior !== undefined && {
-                    "streaming-behavior": streamingBehavior,
-                }),
-            };
-            await this.deps.roomProtocol.sendRoomRequestToMember(to, key, token, params);
+        // A self-DM never leaves the process, so it is already exactly as delivered as it will ever be by the time it is recorded above.
+        if (token === undefined)
+            return { message, delivery: { status: "delivered" } };
+        const { clock } = this.deps.requireIdentity();
+        const params = {
+            verb: "room.send",
+            "message-id": messageId,
+            "sent-at": clock.now(),
+            text: content,
+            ...(streamingBehavior !== undefined && {
+                "streaming-behavior": streamingBehavior,
+            }),
+        };
+        const outcome = await this.deps.roomProtocol.sendRoomRequestToMember(to, key, token, params);
+        if (outcome.kind === "refused") {
+            throw new CommsError(`DM to ${to} refused (${describeRefusal(outcome)})`, "SEND_REFUSED");
         }
-        return message;
+        return { message, delivery: deliveryFromOutcome(outcome) };
     }
     /** The room:member token this device holds for its DM path with `to`, requesting DM access from `to` first when none is persisted yet. Throws NOT_MEMBER if the request resolves without a token having been persisted, since no send can be authenticated without one. */
     async dmRoomMemberToken(from, to) {

package/dist/core/room-messaging.js.map

@@ -1 +1 @@
-{"version":3,"file":"room-messaging.js","sourceRoot":"","sources":["../../src/core/room-messaging.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAgCxC,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;IAAG,CAAC;IAExD;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,YAAoB,EACpB,IAAY,EACZ,OAAe,EACf,OAAkC;QAElC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,UAAU,CAAC,QAAQ,MAAM,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC9B,MAAM,IAAI,UAAU,CAAC,mBAAmB,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC;QAElE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,UAAU,CAAC,4BAA4B,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,oBAAoB,CACxB,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EACzC;gBACE,IAAI,EAAE,MAAM;gBACZ,KAAK;gBACL,WAAW,EAAE,YAAY;gBACzB,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;aAC3C,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAgB;YAC3B,EAAE;YACF,IAAI;YACJ,IAAI,EAAE,MAAM;YACZ,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;YACzC,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAC9D,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAEpC,MAAM,MAAM,GAA4B;YACtC,IAAI,EAAE,WAAW;YACjB,YAAY,EAAE,SAAS;YACvB,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;YACtB,IAAI,EAAE,OAAO;YACb,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI;gBAC3B,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;aACzD,CAAC;YACF,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI;gBACrC,oBAAoB,EAAE,iBAAiB;aACxC,CAAC;SACH,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAClD,QAAQ,EACR,MAAM,EACN,KAAK,EACL,MAAM,CACP,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,KAAc;QAEd,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAY,EACZ,EAAU,EACV,OAAe,EACf,iBAAqC;QAErC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;YACnE,IAAI,SAAS,CAAC,UAAU,KAAK,OAAO;gBAClC,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrE,CAAC;QAED,qRAAqR;QACrR,MAAM,KAAK,GACT,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAc;YACzB,EAAE;YACF,IAAI;YACJ,EAAE;YACF,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAC9D,CAAC;QAEF,sOAAsO;QACtO,MAAM,GAAG,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAE5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,MAAM,MAAM,GAA4B;gBACtC,IAAI,EAAE,WAAW;gBACjB,YAAY,EAAE,SAAS;gBACvB,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;gBACtB,IAAI,EAAE,OAAO;gBACb,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI;oBACrC,oBAAoB,EAAE,iBAAiB;iBACxC,CAAC;aACH,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAClD,EAAE,EACF,GAAG,EACH,KAAK,EACL,MAAM,CACP,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,2QAA2Q;IACnQ,KAAK,CAAC,iBAAiB,CAC7B,IAAY,EACZ,EAAU;QAEV,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAE5C,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAAC,4BAA4B,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
+{"version":3,"file":"room-messaging.js","sourceRoot":"","sources":["../../src/core/room-messaging.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAoBpD,gPAAgP;AAChP,SAAS,mBAAmB,CAC1B,OAAmE;IAEnE,OAAO,OAAO,CAAC,IAAI,KAAK,WAAW;QACjC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE;QACzB,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACnD,CAAC;AAqBD,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;IAAG,CAAC;IAExD;;;;;;OAMG;IACH,KAAK,CAAC,eAAe,CACnB,YAAoB,EACpB,IAAY,EACZ,OAAe,EACf,OAAkC;QAElC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,UAAU,CAAC,QAAQ,MAAM,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC9B,MAAM,IAAI,UAAU,CAAC,mBAAmB,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC;QAElE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,UAAU,CAAC,4BAA4B,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,oBAAoB,CACxB,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EACzC;gBACE,IAAI,EAAE,MAAM;gBACZ,KAAK;gBACL,WAAW,EAAE,YAAY;gBACzB,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;aAC3C,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAgB;YAC3B,EAAE;YACF,IAAI;YACJ,IAAI,EAAE,MAAM;YACZ,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;YACzC,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAC9D,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAEpC,MAAM,MAAM,GAA4B;YACtC,IAAI,EAAE,WAAW;YACjB,YAAY,EAAE,SAAS;YACvB,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;YACtB,IAAI,EAAE,OAAO;YACb,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI;gBAC3B,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;aACzD,CAAC;YACF,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI;gBACrC,oBAAoB,EAAE,iBAAiB;aACxC,CAAC;SACH,CAAC;QAEF,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,QAAQ,KAAK,IAAI;gBAAE,SAAS;YAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAClE,QAAQ,EACR,MAAM,EACN,KAAK,EACL,MAAM,CACP,CAAC;YACF,qRAAqR;YACrR,UAAU,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EACN,OAAO,CAAC,IAAI,KAAK,SAAS;oBACxB,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE;oBACvD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,KAAc;QAEd,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CACV,IAAY,EACZ,EAAU,EACV,OAAe,EACf,iBAAqC;QAErC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;YACnE,IAAI,SAAS,CAAC,UAAU,KAAK,OAAO;gBAClC,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrE,CAAC;QAED,qRAAqR;QACrR,MAAM,KAAK,GACT,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAc;YACzB,EAAE;YACF,IAAI;YACJ,EAAE;YACF,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAC9D,CAAC;QAEF,sOAAsO;QACtO,MAAM,GAAG,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAE5B,iIAAiI;QACjI,IAAI,KAAK,KAAK,SAAS;YACrB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC;QAExD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,MAAM,MAAM,GAA4B;YACtC,IAAI,EAAE,WAAW;YACjB,YAAY,EAAE,SAAS;YACvB,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;YACtB,IAAI,EAAE,OAAO;YACb,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI;gBACrC,oBAAoB,EAAE,iBAAiB;aACxC,CAAC;SACH,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAClE,EAAE,EACF,GAAG,EACH,KAAK,EACL,MAAM,CACP,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,UAAU,CAClB,SAAS,EAAE,aAAa,eAAe,CAAC,OAAO,CAAC,GAAG,EACnD,cAAc,CACf,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,2QAA2Q;IACnQ,KAAK,CAAC,iBAAiB,CAC7B,IAAY,EACZ,EAAU;QAEV,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAE5C,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAAC,4BAA4B,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/core/room-protocol.d.ts

@@ -2,6 +2,7 @@
  * RoomProtocol — the receiving/responding half of the room wire protocol: the room-verb handlers a WireMeshTransport dispatches into (room.send, room.read, room.members, room.join, room.invite, room.leave), the directed room-domain request fan-out primitives (sendRoomMessageDirected, sendRoomRequestToMember, its retry queue and flush), and the human accept/reject decision points for a pending room.join. Split out of mesh-store.ts to reduce it under the repo's max-lines cap. Owns pendingRoomRequests and pendingRoomJoins exclusively -- nothing outside this class ever reads or writes them.
  */
 import type { CapabilityToken } from "wire-mesh-core/generated/protocol";
+import { type RoomRequestOutcome } from "./send-outcome.js";
 import type { MeshStoreIdentity } from "./mesh-store-shared.js";
 import type { DeliveryEngine } from "./delivery-engine.js";
 import type { RoomVerbHandler } from "./room-router.js";
@@ -25,7 +26,7 @@ export interface RoomProtocolDeps {
 }
 export declare class RoomProtocol {
     private readonly deps;
-    /** Directed room-domain requests (room.send, room.read) that failed because their target member wasn't reachable at send time, held for retry when that member's own connection is (re)established -- the wire-authenticated fan-out's substitute for the legacy full-state-sync's own automatic eventual consistency, since a direct request to a disconnected peer fails immediately with no protocol-level retry of its own. Keyed by member device-id hex, bounded oldest-first per member with the same cap ordinary delivery queues use. */
+    /** Directed room-domain requests (room.send, room.read) that failed because their target member wasn't reachable at send time, held for retry when that member becomes reachable by any route -- the wire-authenticated fan-out's substitute for the legacy full-state-sync's own automatic eventual consistency, since a direct request to a disconnected peer fails immediately with no protocol-level retry of its own. Keyed by member device-id hex, bounded oldest-first per member and by each entry's own age; every entry that leaves the queue without being delivered is reported to its sender as a terminal delivery status. */
     private readonly pendingRoomRequests;
     /** Pending room.join requests awaiting owner approval, keyed by `${roomPath}::${requesterId}` -- the held-open manage-request's own resolve() function is stored here so acceptRoomJoin/rejectRoomJoin can settle it in place. */
     private readonly pendingRoomJoins;
@@ -56,13 +57,23 @@ export declare class RoomProtocol {
      * Sends one directed room.send to a single member's own session, attaching this store's own persisted room:member token for the given room path -- the primitive P3.5's own directed fan-out (deliverToRoom) will loop over per member once it replaces the legacy broadcastPatch path this store still uses for message delivery today. Throws if this store holds no token for the room: never a member, or a token that expired or was revoked with nothing fresh persisted in its place.
      */
     sendRoomMessageDirected(roomPath: string, memberId: string, text: string): Promise<void>;
-    /** Records a room-domain request that couldn't reach memberId right now, for a later flushPendingRoomRequests to retry once that member reconnects. Bounded oldest-first with the same cap ordinary delivery queues use, so an indefinitely-offline member cannot grow this without limit. */
-    private queuePendingRoomRequest;
+    /** Tells this device's own agent what became of a message it sent, over the same delivery_status event read receipts already ride, so a queued, dropped, expired or refused message reaches the sender through the one path that already reports delivery. Does nothing for a request carrying no message of this sender's own (a room.read receipt, a room.notify), which has no message-id to report against. */
+    private reportDelivery;
+    /** Holds a request for retry, evicting the oldest entries beyond the per-member bound and telling each evicted entry's sender the message was dropped, so a message given up on is never left looking merely pending. */
+    private enqueuePendingRoomRequest;
     /**
-     * Sends one directed room-domain request (room.send, room.read, or any future room:member-gated verb) to a single member, queuing it for retry instead of throwing when the member isn't currently reachable -- the fan-out's own per-recipient primitive, distinct from sendRoomMessageDirected's deliberate throw-on-failure contract for a caller sending to one specific, known recipient. Silently drops a request this store no longer holds a token for (no longer a member of the room) rather than queuing something that will only fail again on retry.
+     * Gives up on every queued request older than the age bound, across every member, telling each one's sender it expired. Deliberately a sweep run from sendRoomRequestToMember and flushPendingRoomRequests rather than a timer: the queue only ever grows on a send and only ever drains on a flush, so those are exactly the moments an expired entry starts to matter, and nothing has to keep a timer alive for a member that may never come back.
+     */
+    private expirePendingRoomRequests;
+    /** One attempt at a directed room-domain request, with no queueing of its own: the raw wire outcome classified into delivered, undelivered (nobody answered, so a retry may still work) or refused (the member answered with a failure it will repeat). A rejection from the transport is the connection dropping mid-request, per wire-mesh-core's own rejectPendingManageRequests, which is the same "never answered" fact as a timeout. */
+    private attemptRoomRequest;
+    /**
+     * Sends one directed room-domain request (room.send, room.read, or any future room:member-gated verb) to a single member and reports honestly what became of it -- the fan-out's own per-recipient primitive, distinct from sendRoomMessageDirected's deliberate throw-on-failure contract for a caller sending to one specific, known recipient. An undelivered request is held for retry and says so; a refused one is not queued at all, since the member has already answered with a failure it will give again, and its sender needs to know now rather than waiting on a retry that cannot help.
+     */
+    sendRoomRequestToMember(memberId: string, roomPath: string, token: CapabilityToken, params: Record<string, unknown>): Promise<RoomRequestOutcome>;
+    /**
+     * Retries every request queued for memberId since it was last reachable, and tells each one's sender what came of the retry: delivered, refused, or still undelivered and held for another attempt. An entry whose room this store no longer holds a token for can never be sent at all, so it is reported as dropped rather than retried forever. Called whenever memberId becomes reachable by any route -- a direct peer connection, or the hub admitting its device into this side's directory -- since a queued request cares only that some path to the member now exists, not which one.
      */
-    sendRoomRequestToMember(memberId: string, roomPath: string, token: CapabilityToken, params: Record<string, unknown>): Promise<void>;
-    /** Retries every room.send queued for memberId since it was last reachable, dropping (not re-queuing) any whose room this store no longer holds a token for. Called once a connection to memberId is (re)established -- handlePeerConnected fires for both a fresh introduction and a reconnection after downtime, exactly the two cases a queued send needs to be retried on. */
     flushPendingRoomRequests(memberId: string): Promise<void>;
     /**
      * Owner-side admission for an incoming room.join request, against either a named room this store owns or a DM path this store is a participant of. Named-room admission always needs a human decision; DM admission needs one only for the party being contacted first -- the reply half of the two-round consent flow (section 6) auto-approves, since a reply on a path this node itself opened is not unsolicited contact, and so does a request presenting a valid dm:send capability this node's own user principal already issued the requester (agent-comms#162's own durable admission list, checked before ever falling through to a fresh human decision).

package/dist/core/room-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"room-protocol.d.ts","sourceRoot":"","sources":["../../src/core/room-protocol.ts"],"names":[],"mappings":"AAAA;;GAEG;AAcH,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,mCAAmC,CAAC;AAoB3C,OAAO,KAAK,EACV,iBAAiB,EAElB,MAAM,wBAAwB,CAAC;AAMhC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAoB,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGtE,OAAO,KAAK,EACV,aAAa,EAEb,SAAS,EACT,IAAI,EACJ,WAAW,EACZ,MAAM,YAAY,CAAC;AAKpB,yjBAAyjB;AACzjB,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACrC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACnC,uBAAuB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,iBAAiB,CAAC;IACzC,gBAAgB,EAAE,MAAM,aAAa,CAAC;IACtC,cAAc,EAAE,IAAI,CAClB,cAAc,EACZ,eAAe,GACf,mBAAmB,GACnB,MAAM,GACN,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,CAClB,CAAC;IACF,4HAA4H;IAC5H,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,qBAAa,YAAY;IAiBX,OAAO,CAAC,QAAQ,CAAC,IAAI;IAhBjC,khBAAkhB;IAClhB,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAGhC;IAEJ,kOAAkO;IAClO,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAO7B;gBAEyB,IAAI,EAAE,gBAAgB;IAEnD,iJAAiJ;IACjJ,IAAI,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAgB/D;IAED,sSAAsS;IACtS,OAAO,CAAC,MAAM,CAAC,eAAe;IAO9B,uaAAua;IACva,OAAO,CAAC,MAAM,CAAC,2BAA2B;IAS1C;;OAEG;YACW,cAAc;IAyE5B;;OAEG;YACW,gBAAgB;IAyC9B;;OAEG;YACW,cAAc;IAuD5B;;OAEG;YACW,iBAAiB;IAyC/B;;OAEG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC;IA+BhB,8RAA8R;IAC9R,OAAO,CAAC,uBAAuB;IAa/B;;OAEG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC;IAqBhB,kXAAkX;IAC5W,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB/D;;OAEG;YACW,cAAc;IA4C5B,4NAA4N;IAC5N,OAAO,CAAC,uBAAuB;IAW/B,iNAAiN;YACnM,aAAa;IAkF3B;;OAEG;YACW,gBAAgB;IA+C9B;;OAEG;YACW,eAAe;IAqF7B,oGAAoG;IACpG,oBAAoB,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE;IAMnE,mHAAmH;IACnH,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAY3D,gJAAgJ;IAChJ,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;CAc7E"}
+{"version":3,"file":"room-protocol.d.ts","sourceRoot":"","sources":["../../src/core/room-protocol.ts"],"names":[],"mappings":"AAAA;;GAEG;AAcH,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,mCAAmC,CAAC;AAqB3C,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,iBAAiB,EAElB,MAAM,wBAAwB,CAAC;AAMhC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAoB,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGtE,OAAO,KAAK,EACV,aAAa,EAEb,SAAS,EAET,IAAI,EACJ,WAAW,EAEZ,MAAM,YAAY,CAAC;AAuBpB,yjBAAyjB;AACzjB,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACrC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACnC,uBAAuB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,iBAAiB,CAAC;IACzC,gBAAgB,EAAE,MAAM,aAAa,CAAC;IACtC,cAAc,EAAE,IAAI,CAClB,cAAc,EACZ,eAAe,GACf,mBAAmB,GACnB,MAAM,GACN,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,CAClB,CAAC;IACF,4HAA4H;IAC5H,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,qBAAa,YAAY;IAiBX,OAAO,CAAC,QAAQ,CAAC,IAAI;IAhBjC,6mBAA6mB;IAC7mB,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAGhC;IAEJ,kOAAkO;IAClO,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAO7B;gBAEyB,IAAI,EAAE,gBAAgB;IAEnD,iJAAiJ;IACjJ,IAAI,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAgB/D;IAED,sSAAsS;IACtS,OAAO,CAAC,MAAM,CAAC,eAAe;IAO9B,uaAAua;IACva,OAAO,CAAC,MAAM,CAAC,2BAA2B;IAS1C;;OAEG;YACW,cAAc;IAyE5B;;OAEG;YACW,gBAAgB;IAyC9B;;OAEG;YACW,cAAc;IAuD5B;;OAEG;YACW,iBAAiB;IAyC/B;;OAEG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC;IA+BhB,mZAAmZ;IACnZ,OAAO,CAAC,cAAc;IAmBtB,yNAAyN;IACzN,OAAO,CAAC,yBAAyB;IAejC;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAkBjC,8aAA8a;YACha,kBAAkB;IAsBhC;;OAEG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,kBAAkB,CAAC;IAoB9B;;OAEG;IACG,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmC/D;;OAEG;YACW,cAAc;IA4C5B,4NAA4N;IAC5N,OAAO,CAAC,uBAAuB;IAW/B,iNAAiN;YACnM,aAAa;IAkF3B;;OAEG;YACW,gBAAgB;IA+C9B;;OAEG;YACW,eAAe;IAqF7B,oGAAoG;IACpG,oBAAoB,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE;IAMnE,mHAAmH;IACnH,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAY3D,gJAAgJ;IAChJ,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;CAc7E"}

package/dist/core/room-protocol.js

@@ -11,15 +11,23 @@ import { verifyDmSendToken } from "./dm-token-verification.js";
 import { loadRoomTokens, saveIssuedRoomGrant, saveRoomToken, } from "./identity-store.js";
 import { randomId } from "./random-id.js";
 import { CommsError } from "./store.js";
-import { MAX_QUEUED_DELIVERIES_PER_AGENT, ROOM_TOKEN_LIFETIME_MS, } from "./mesh-store-shared.js";
+import { MAX_PENDING_ROOM_REQUESTS_PER_MEMBER, PENDING_ROOM_REQUEST_TTL_MS, ROOM_TOKEN_LIFETIME_MS, } from "./mesh-store-shared.js";
+import { classifyManageOutcome, } from "./send-outcome.js";
 import { parseInviterAgentExtension, parseRoomStateExtension, roomStateExtension, } from "./room-wire-extensions.js";
 import { z } from "zod";
 import { DeliveryEventSchema, StreamingBehavior } from "./types.js";
+/** The hex message-id a directed room-domain request carries, when it is a room.send carrying one. Read from the already-built params rather than re-derived, so a queued entry can report a delivery status against the very message the sender was told about. */
+function messageIdFromParams(params) {
+    if (params.verb !== "room.send")
+        return undefined;
+    const raw = params["message-id"];
+    return raw instanceof Uint8Array ? bytesToHex(raw) : undefined;
+}
 /** room.notify's own params shape: the already-validated DeliveryEvent to deliver, and nothing else -- room.notify carries no content of its own beyond the event, unlike room.send's own message/dm fields. Not a wire-mesh-generated schema (room.notify is agent-comms' own verb, riding manage-command-params' open socket the same way the legacy opaque frame carriage always did, never a real wire-mesh CDDL type other clients need to interoperate with). */
 const RoomNotifyParamsSchema = z.object({ event: DeliveryEventSchema });
 export class RoomProtocol {
     deps;
-    /** Directed room-domain requests (room.send, room.read) that failed because their target member wasn't reachable at send time, held for retry when that member's own connection is (re)established -- the wire-authenticated fan-out's substitute for the legacy full-state-sync's own automatic eventual consistency, since a direct request to a disconnected peer fails immediately with no protocol-level retry of its own. Keyed by member device-id hex, bounded oldest-first per member with the same cap ordinary delivery queues use. */
+    /** Directed room-domain requests (room.send, room.read) that failed because their target member wasn't reachable at send time, held for retry when that member becomes reachable by any route -- the wire-authenticated fan-out's substitute for the legacy full-state-sync's own automatic eventual consistency, since a direct request to a disconnected peer fails immediately with no protocol-level retry of its own. Keyed by member device-id hex, bounded oldest-first per member and by each entry's own age; every entry that leaves the queue without being delivered is reported to its sender as a terminal delivery status. */
     pendingRoomRequests = new Map();
     /** Pending room.join requests awaiting owner approval, keyed by `${roomPath}::${requesterId}` -- the held-open manage-request's own resolve() function is stored here so acceptRoomJoin/rejectRoomJoin can settle it in place. */
     pendingRoomJoins = new Map();
@@ -199,7 +207,7 @@ export class RoomProtocol {
                 type: "delivery_status",
                 messageId,
                 agent: handle.id,
-                status: "read",
+                delivery: { status: "read" },
                 ...(isDm ? {} : { room: roomPath }),
             };
             this.deps.deliveryEngine.queueDelivery(peerId, event);
@@ -266,20 +274,59 @@ export class RoomProtocol {
             throw new CommsError(`room.send to ${memberId} for ${roomPath} failed (${outcome.code})`, "SEND_FAILED");
         }
     }
-    /** Records a room-domain request that couldn't reach memberId right now, for a later flushPendingRoomRequests to retry once that member reconnects. Bounded oldest-first with the same cap ordinary delivery queues use, so an indefinitely-offline member cannot grow this without limit. */
-    queuePendingRoomRequest(memberId, roomPath, params) {
+    /** Tells this device's own agent what became of a message it sent, over the same delivery_status event read receipts already ride, so a queued, dropped, expired or refused message reaches the sender through the one path that already reports delivery. Does nothing for a request carrying no message of this sender's own (a room.read receipt, a room.notify), which has no message-id to report against. */
+    reportDelivery(memberId, entry, delivery) {
+        if (entry.messageId === undefined)
+            return;
+        const peerId = this.deps.getPeerId();
+        const isDm = parseRoomPath(entry.roomPath).kind === "dm";
+        const event = {
+            type: "delivery_status",
+            messageId: entry.messageId,
+            agent: memberId,
+            delivery,
+            ...(isDm ? {} : { room: entry.roomPath }),
+        };
+        this.deps.deliveryEngine.queueDelivery(peerId, event);
+        this.deps.deliveryEngine.fireLocalDelivery(peerId, event);
+    }
+    /** Holds a request for retry, evicting the oldest entries beyond the per-member bound and telling each evicted entry's sender the message was dropped, so a message given up on is never left looking merely pending. */
+    enqueuePendingRoomRequest(memberId, entry) {
         const queue = this.pendingRoomRequests.get(memberId) ?? [];
-        queue.push({ roomPath, params });
-        if (queue.length > MAX_QUEUED_DELIVERIES_PER_AGENT) {
-            queue.splice(0, queue.length - MAX_QUEUED_DELIVERIES_PER_AGENT);
+        queue.push(entry);
+        while (queue.length > MAX_PENDING_ROOM_REQUESTS_PER_MEMBER) {
+            const evicted = queue.shift();
+            if (evicted !== undefined) {
+                this.reportDelivery(memberId, evicted, { status: "dropped" });
+            }
         }
         this.pendingRoomRequests.set(memberId, queue);
     }
     /**
-     * Sends one directed room-domain request (room.send, room.read, or any future room:member-gated verb) to a single member, queuing it for retry instead of throwing when the member isn't currently reachable -- the fan-out's own per-recipient primitive, distinct from sendRoomMessageDirected's deliberate throw-on-failure contract for a caller sending to one specific, known recipient. Silently drops a request this store no longer holds a token for (no longer a member of the room) rather than queuing something that will only fail again on retry.
+     * Gives up on every queued request older than the age bound, across every member, telling each one's sender it expired. Deliberately a sweep run from sendRoomRequestToMember and flushPendingRoomRequests rather than a timer: the queue only ever grows on a send and only ever drains on a flush, so those are exactly the moments an expired entry starts to matter, and nothing has to keep a timer alive for a member that may never come back.
      */
-    async sendRoomRequestToMember(memberId, roomPath, token, params) {
-        // sendRoomRequest can reject outright (e.g. the connection drops mid-request, per wire-mesh-core's own rejectPendingManageRequests), not just resolve with an error outcome -- both are exactly the same "memberId isn't reachable right now" fact from this method's own point of view, so both queue for retry rather than one of them propagating as an uncaught rejection out of what every caller treats as a fire-and-forget send.
+    expirePendingRoomRequests() {
+        // Nothing queued means nothing to sweep, and nothing to ask this store's identity for: a bridge with no identity yet still sees peers connect, and a sweep must not turn that into a rejected promise inside a fire-and-forget event handler.
+        if (this.pendingRoomRequests.size === 0)
+            return;
+        const cutoff = this.deps.requireIdentity().clock.now() - PENDING_ROOM_REQUEST_TTL_MS;
+        for (const [memberId, queue] of this.pendingRoomRequests) {
+            const live = queue.filter((entry) => entry.queuedAt > cutoff);
+            if (live.length === queue.length)
+                continue;
+            for (const entry of queue) {
+                if (entry.queuedAt <= cutoff) {
+                    this.reportDelivery(memberId, entry, { status: "expired" });
+                }
+            }
+            if (live.length === 0)
+                this.pendingRoomRequests.delete(memberId);
+            else
+                this.pendingRoomRequests.set(memberId, live);
+        }
+    }
+    /** One attempt at a directed room-domain request, with no queueing of its own: the raw wire outcome classified into delivered, undelivered (nobody answered, so a retry may still work) or refused (the member answered with a failure it will repeat). A rejection from the transport is the connection dropping mid-request, per wire-mesh-core's own rejectPendingManageRequests, which is the same "never answered" fact as a timeout. */
+    async attemptRoomRequest(memberId, roomPath, token, params) {
         let outcome;
         try {
             outcome = await this.deps
@@ -287,15 +334,32 @@ export class RoomProtocol {
                 .sendRoomRequest(memberId, { verb: ROOM_MEMBER_CAPABILITY, params }, { kind: "room", path: roomPath }, token);
         }
         catch {
-            this.queuePendingRoomRequest(memberId, roomPath, params);
-            return;
+            return { kind: "undelivered", reason: "connection_lost" };
         }
-        if (outcome.result !== "ok") {
-            this.queuePendingRoomRequest(memberId, roomPath, params);
+        return classifyManageOutcome(outcome);
+    }
+    /**
+     * Sends one directed room-domain request (room.send, room.read, or any future room:member-gated verb) to a single member and reports honestly what became of it -- the fan-out's own per-recipient primitive, distinct from sendRoomMessageDirected's deliberate throw-on-failure contract for a caller sending to one specific, known recipient. An undelivered request is held for retry and says so; a refused one is not queued at all, since the member has already answered with a failure it will give again, and its sender needs to know now rather than waiting on a retry that cannot help.
+     */
+    async sendRoomRequestToMember(memberId, roomPath, token, params) {
+        this.expirePendingRoomRequests();
+        const outcome = await this.attemptRoomRequest(memberId, roomPath, token, params);
+        if (outcome.kind === "undelivered") {
+            this.enqueuePendingRoomRequest(memberId, {
+                roomPath,
+                params,
+                queuedAt: this.deps.requireIdentity().clock.now(),
+                reason: outcome.reason,
+                messageId: messageIdFromParams(params),
+            });
         }
+        return outcome;
     }
-    /** Retries every room.send queued for memberId since it was last reachable, dropping (not re-queuing) any whose room this store no longer holds a token for. Called once a connection to memberId is (re)established -- handlePeerConnected fires for both a fresh introduction and a reconnection after downtime, exactly the two cases a queued send needs to be retried on. */
+    /**
+     * Retries every request queued for memberId since it was last reachable, and tells each one's sender what came of the retry: delivered, refused, or still undelivered and held for another attempt. An entry whose room this store no longer holds a token for can never be sent at all, so it is reported as dropped rather than retried forever. Called whenever memberId becomes reachable by any route -- a direct peer connection, or the hub admitting its device into this side's directory -- since a queued request cares only that some path to the member now exists, not which one.
+     */
     async flushPendingRoomRequests(memberId) {
+        this.expirePendingRoomRequests();
         const queue = this.pendingRoomRequests.get(memberId);
         if (queue === undefined || queue.length === 0)
             return;
@@ -303,9 +367,27 @@ export class RoomProtocol {
         const { slot } = this.deps.requireIdentity();
         for (const pending of queue) {
             const token = loadRoomTokens(slot)[pending.roomPath];
-            if (token === undefined)
+            if (token === undefined) {
+                this.reportDelivery(memberId, pending, { status: "dropped" });
                 continue;
-            await this.sendRoomRequestToMember(memberId, pending.roomPath, token, pending.params);
+            }
+            const outcome = await this.attemptRoomRequest(memberId, pending.roomPath, token, pending.params);
+            if (outcome.kind === "delivered") {
+                this.reportDelivery(memberId, pending, { status: "delivered" });
+            }
+            else if (outcome.kind === "refused") {
+                this.reportDelivery(memberId, pending, {
+                    status: "refused",
+                    code: outcome.code,
+                });
+            }
+            else {
+                // Re-queued with its original queuedAt, never a fresh one: a member that keeps briefly reappearing and failing must not be able to keep a message pending past the age bound.
+                this.enqueuePendingRoomRequest(memberId, {
+                    ...pending,
+                    reason: outcome.reason,
+                });
+            }
         }
     }
     /**