libp2r2p 0.11.10 → 0.11.12

package/README.md

@@ -532,15 +532,42 @@ are attached. These diagnostics reach the messenger's `onError` unchanged.
 A single incomplete relay keeps the interval pending even if another relay
 returned events; received messages may already have been queued. This is a
 history completeness failure, not evidence that an outgoing message failed.
-Existing rewatch/resume and relay-list refresh paths retry pending intervals;
-there is no dedicated periodic retry timer for a failed history fetch.
+Rewatch/resume, relay-list refresh and reload-gap paths schedule bounded retries
+for pending intervals (1s doubling to 30s). Recovery tracks per-relay coverage in
+memory: a tier where some relay returned events and EOSE retries the remaining
+relays a few times (3), an empty-EOSE tier gets more attempts (6), and an
+all-failed tier gets the most (10) before coverage from EOSE relays is accepted
+and the uncovered subranges plus the pre-oldest left edge are requested from
+seeders. Offline attempts never consume the budget, mark coverage or contact
+seeders; they wait for connectivity. The per-relay tracker is process-local, so a
+restart falls back to the persisted whole interval.
+
+`prioritizeRange(channelPubkey, { since, until, type })` registers an
+application-directed priority window for the next recovery pass. `unread-page`
+requires `since` (a read anchor); `tail` derives a bounded window from the
+newest persisted range using `priorityTailSeconds` (six hours by default).
+Priority subranges are fetched before older history; relays are ordered by
+recent EOSE, consecutive failures and latency; and the first priority page may
+hedge up to `priorityHedgeRelays` (two) relays with `priorityHedgeDelayMs`
+(500 ms), aborting the loser. When relays do not cover the window, seeders with
+recent presence (`announcedAt`/`lastActiveAt` within `seederOnlineSeconds`) are
+asked only for that subrange; a successful ask counts as coverage. Priority
+probes never consume the relay tier budget, and priorities/statistics are
+process-local: they expire after `priorityTtlMs` (ten minutes) or once covered,
+and clear with channel/recovery state. Presence payloads and persisted ranges
+are unchanged.
+
 `private-channel.fetchHistory(options)` (0.11.6) is the complete-interval API
 used by messenger recovery. It accepts the signers, processor/fragment options,
 callbacks and abort signal of `fetch`, plus inclusive `since`/`until` bounds
 (defaults: 0 and the start time of the call). It returns only
 `{ oldestCreatedAt, receivedEventCount, relays }`; an empty scan has a null oldest
-time. No complete-history event array is retained. `fetch` keeps its existing
-single-query array contract and optional limit.
+time. Passing `partial: true` (used by messenger recovery) returns per-relay
+`covered`/`pending`/`events` plus `pendingByRelay`, `anyEose`, `anyEoseWithEvents`
+and `allFailed` instead of throwing on partial failure, and `resume` restricts
+each relay to the given pending subranges. No complete-history event array is
+retained. `fetch` keeps its existing single-query array contract and optional
+limit.
 
 History queries each relay independently with limit 16. A response with 16 events
 or status `satisfied` is saturated, even if it already reports EOSE or contains

package/helpers/ranges.js

@@ -0,0 +1,47 @@
+// Inclusive integer ranges [start, end]. Merge treats adjacent ranges as one.
+export function mergeRanges (ranges = []) {
+  const sorted = (ranges || [])
+    .filter(range => range && Number.isFinite(range.start) && Number.isFinite(range.end) && range.end >= range.start)
+    .map(range => ({ start: range.start, end: range.end }))
+    .sort((a, b) => a.start - b.start || a.end - b.end)
+  const out = []
+  for (const range of sorted) {
+    const last = out[out.length - 1]
+    if (!last || range.start > last.end + 1) out.push(range)
+    else last.end = Math.max(last.end, range.end)
+  }
+  return out
+}
+
+// Parts of `range` not covered by `covered`.
+export function subtractRanges (range, covered = []) {
+  if (!range || range.end < range.start) return []
+  const merged = mergeRanges(covered)
+  const out = []
+  let cursor = range.start
+  for (const entry of merged) {
+    if (entry.end < cursor) continue
+    if (entry.start > range.end) break
+    if (entry.start > cursor) out.push({ start: cursor, end: Math.min(entry.start - 1, range.end) })
+    cursor = Math.max(cursor, entry.end + 1)
+    if (cursor > range.end) break
+  }
+  if (cursor <= range.end) out.push({ start: cursor, end: range.end })
+  return out
+}
+
+export function intersectRanges (left = [], right = []) {
+  const a = mergeRanges(left)
+  const b = mergeRanges(right)
+  const out = []
+  let i = 0
+  let j = 0
+  while (i < a.length && j < b.length) {
+    const start = Math.max(a[i].start, b[j].start)
+    const end = Math.min(a[i].end, b[j].end)
+    if (start <= end) out.push({ start, end })
+    if (a[i].end < b[j].end) i++
+    else j++
+  }
+  return out
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libp2r2p",
-  "version": "0.11.10",
+  "version": "0.11.12",
   "description": "Peer-to-relay-to-peer",
   "keywords": [
     "p2r2p",

package/private-channel/helpers/history.js

@@ -1,6 +1,7 @@
 import { ValidationError } from '../../error/index.js'
 import { normalizeRelayUrl } from '../../url/index.js'
 import { createAbortableSemaphore } from '../../helpers/abortable-semaphore.js'
+import { mergeRanges } from '../../helpers/ranges.js'
 import { incompleteFetchError } from './fetch-error.js'
 
 const PAGE_SIZE = 16
@@ -23,7 +24,7 @@ function acquireRelay (relay, signal) {
 
 // Queries bounded temporal leaves, oldest first. A saturated one-second leaf
 // cannot be split using standard NIP-01; expand it only up to the safe ceiling.
-export async function readHistory ({ filter, relays, receiverPubkey, signal, getEvents, processEvent, acquirePage }) {
+export async function readHistory ({ filter, relays, receiverPubkey, signal, getEvents, processEvent, acquirePage, partial = false, resume = null }) {
   const since = filter.since ?? 0
   const until = filter.until ?? Math.floor(Date.now() / 1000)
   if (![since, until].every(value => Number.isSafeInteger(value) && value >= 0) || since > until) throw new ValidationError('INVALID_PRIVATE_CHANNEL_HISTORY_RANGE')
@@ -44,7 +45,11 @@ export async function readHistory ({ filter, relays, receiverPubkey, signal, get
     }
   }
   for (const relay of urls) {
-    const intervals = [{ since, until, limit: PAGE_SIZE }]
+    const relayStartCount = receivedEventCount
+    let relayElapsedMs = 0
+    const intervals = resumeIntervalsFor({ resume, relay, since, until })
+      .map(interval => ({ since: interval.start, until: interval.end, limit: PAGE_SIZE }))
+    const covered = []
     let outcome = { relay, status: 'eose' }
     while (intervals.length) {
       signal?.throwIfAborted()
@@ -77,14 +82,20 @@ export async function readHistory ({ filter, relays, receiverPubkey, signal, get
           signal?.throwIfAborted()
           errors.push({ relay, reason: error })
           outcome = { relay, status: 'error', error }
+          intervals.push(interval)
           break
-        } finally { elapsedMs += performance.now() - started }
+        } finally {
+          const took = performance.now() - started
+          elapsedMs += took
+          relayElapsedMs += took
+        }
         signal?.throwIfAborted()
         const status = page.relays?.find(item => item.relay === relay)
         if (page.errors?.length || !status || !['eose', 'satisfied'].includes(status.status)) {
           await process(page.result)
           errors.push(...(page.errors ?? []))
           outcome = status ?? { relay, status: 'error' }
+          intervals.push(interval)
           break
         }
         if (status.status === 'satisfied' || page.result.length >= interval.limit) {
@@ -98,10 +109,12 @@ export async function readHistory ({ filter, relays, receiverPubkey, signal, get
             const error = pageLimitError()
             errors.push({ relay, reason: error })
             outcome = { relay, status: 'error', error }
+            intervals.push(interval)
             break
           }
         } else {
           await process(page.result)
+          covered.push({ start: interval.since, end: interval.until })
         }
         signal?.throwIfAborted()
       } finally {
@@ -109,9 +122,35 @@ export async function readHistory ({ filter, relays, receiverPubkey, signal, get
         releaseRelay?.()
       }
     }
-    report.push(outcome)
+    report.push({
+      ...outcome,
+      ...(partial
+        ? {
+            covered: mergeRanges(covered),
+            pending: mergeRanges(intervals.map(interval => ({ start: interval.since, end: interval.until }))),
+            events: receivedEventCount - relayStartCount,
+            elapsedMs: Math.round(relayElapsedMs)
+          }
+        : {})
+    })
   }
   signal?.throwIfAborted()
+  if (partial) {
+    const pendingByRelay = {}
+    for (const entry of report) {
+      if (entry.pending?.length) pendingByRelay[entry.relay] = entry.pending
+    }
+    return {
+      oldestCreatedAt,
+      receivedEventCount,
+      elapsedMs: Math.round(elapsedMs),
+      relays: report,
+      pendingByRelay,
+      anyEose: report.some(entry => entry.status === 'eose'),
+      anyEoseWithEvents: report.some(entry => entry.status === 'eose' && (entry.events ?? 0) > 0),
+      allFailed: report.every(entry => entry.status !== 'eose')
+    }
+  }
   if (errors.length || report.some(item => item.status !== 'eose')) {
     const error = incompleteFetchError({ errors, report, receivedEventCount, elapsedMs: Math.round(elapsedMs), request: { relays: urls, channelPubkeys: filter.authors ?? [], receiverPubkey, since, until, limit: PAGE_SIZE, timeoutMs: TIMEOUT_MS } })
     error.operation = 'private-channel.fetchHistory'
@@ -119,3 +158,14 @@ export async function readHistory ({ filter, relays, receiverPubkey, signal, get
   }
   return { oldestCreatedAt, receivedEventCount, relays: report }
 }
+
+function resumeIntervalsFor ({ resume, relay, since, until }) {
+  const pending = resume && Object.prototype.hasOwnProperty.call(resume, relay) ? resume[relay] : null
+  const intervals = Array.isArray(pending) ? pending : [{ start: since, end: until }]
+  return mergeRanges(intervals
+    .map(interval => ({
+      start: Math.max(since, Math.floor(Number(interval?.start))),
+      end: Math.min(until, Math.floor(Number(interval?.end)))
+    }))
+    .filter(interval => Number.isSafeInteger(interval.start) && Number.isSafeInteger(interval.end) && interval.end >= interval.start))
+}

package/private-channel/index.js

@@ -972,12 +972,12 @@ export async function fetch ({ signal, receiverSigner, iykcSigner, privateChanne
 
 // Complete interval recovery with bounded pages and one fragment processor.
 // Existing fetch() retains its one-query/event-array contract.
-export async function fetchHistory ({ receiverSigner, privateChannelSigner = receiverSigner, _getEvents = getEvents, _acquirePage, ...options }) {
+export async function fetchHistory ({ receiverSigner, privateChannelSigner = receiverSigner, _getEvents = getEvents, _acquirePage, partial = false, resume = null, ...options }) {
   const authors = privateChannelPubkeyList(options)
   const filter = { kinds: [PRIVATE_BROADCAST_KIND], ...(authors.length ? { authors } : {}), since: options.since, until: options.until }
   const processOuterEvent = createProcessor({ ...options, receiverSigner, privateChannelSigner, onError: error => { options.onError?.(error); throw error } })
   try {
-    return await readHistory({ filter, relays: options.relays, receiverPubkey: options.receiverPubkey, signal: options.signal, getEvents: _getEvents, processEvent: processOuterEvent, acquirePage: _acquirePage })
+    return await readHistory({ filter, relays: options.relays, receiverPubkey: options.receiverPubkey, signal: options.signal, getEvents: _getEvents, processEvent: processOuterEvent, acquirePage: _acquirePage, partial, resume })
   } finally { processOuterEvent.close() }
 }
 

package/private-messenger/helpers/recovery-retry.js

@@ -24,3 +24,19 @@ export function recoveryRetryDelay (errors, delay) {
   errors.forEach(visit)
   return retry && !blocked ? Math.max(delay, retryAt - Date.now()) : null
 }
+
+// Permanent per-relay failures must stop that relay's retries instead of
+// consuming the range retry budget.
+export function isPermanentRecoveryError (error) {
+  const seen = new Set()
+  const visit = value => {
+    if (!value || seen.has(value)) return false
+    seen.add(value)
+    if (value.code === 'PRIVATE_CHANNEL_HISTORY_PAGE_LIMIT' || value.name === 'ValidationError' ||
+        /^(auth-required:|restricted:|blocked:|invalid:|pow:)/.test(value.message || '')) return true
+    for (const child of value.errors || []) if (visit(child)) return true
+    for (const entry of value.relays || []) if (visit(entry.error)) return true
+    return visit(value.cause)
+  }
+  return visit(error)
+}

package/private-messenger/index.js

@@ -1,4 +1,3 @@
-import { recoveryRetryDelay } from './helpers/recovery-retry.js'
 // Expected use:
 // const messenger = await createPrivateMessenger({
 //   userSigner,
@@ -44,9 +43,12 @@ import { recoveryRetryDelay } from './helpers/recovery-retry.js'
 // - For other event-list replies, use createEventReplyPacker({ messenger, question, code }).update(event).
 
 import { createAbortableSemaphore } from '../helpers/abortable-semaphore.js'
+import { mergeRanges, subtractRanges, intersectRanges } from '../helpers/ranges.js'
 import * as privateMessage from '../private-message/index.js'
 import { isOnline } from '../network/index.js'
 import { createSendRelayRouting, normalizeFallbackRelays } from './helpers/send-routing.js'
+import { incompleteFetchError } from '../private-channel/helpers/fetch-error.js'
+import { recoveryRetryDelay, isPermanentRecoveryError } from './helpers/recovery-retry.js'
 import { normalizeRelayUrl } from '../url/index.js'
 import { deliveryInfo } from '../private-channel/helpers/rumor.js'
 import { bytesToBase64 } from '../base64/index.js'
@@ -122,6 +124,17 @@ const SEED_QUEUE_INDEXES = {
 const encoder = new TextEncoder()
 const noContentKeys = async () => ({})
 
+export const RECOVERY_RELAY_RETRY_LIMITS = Object.freeze({
+  partial: 3,
+  emptyEose: 6,
+  allFailed: 10
+})
+const RECOVERY_ONLINE_CACHE_MS = 5000
+const DEFAULT_PRIORITY_TAIL_SECONDS = 6 * 3600
+const DEFAULT_PRIORITY_TTL_MS = 10 * 60 * 1000
+const DEFAULT_PRIORITY_HEDGE_DELAY_MS = 500
+const DEFAULT_PRIORITY_HEDGE_RELAYS = 2
+
 function textToBase64 (text) {
   return bytesToBase64(encoder.encode(text))
 }
@@ -204,6 +217,10 @@ export class PrivateMessenger {
     reloadGapDelayMs = DEFAULT_RELOAD_GAP_DELAY_MS,
     seederPresenceIntervalMs = DEFAULT_SEEDER_PRESENCE_INTERVAL_MS,
     seederOnlineSeconds = DEFAULT_SEEDER_ONLINE_SECONDS,
+    priorityTailSeconds = DEFAULT_PRIORITY_TAIL_SECONDS,
+    priorityTtlMs = DEFAULT_PRIORITY_TTL_MS,
+    priorityHedgeDelayMs = DEFAULT_PRIORITY_HEDGE_DELAY_MS,
+    priorityHedgeRelays = DEFAULT_PRIORITY_HEDGE_RELAYS,
     maxDynamicRecoverySeeders = DEFAULT_MAX_DYNAMIC_RECOVERY_SEEDERS,
     messageQueueMaxBytes = DEFAULT_MESSAGE_QUEUE_MAX_BYTES,
     seedQueueMaxBytes = DEFAULT_SEED_QUEUE_MAX_BYTES,
@@ -238,6 +255,19 @@ export class PrivateMessenger {
     this.reloadGapDelayMs = reloadGapDelayMs
     this.seederPresenceIntervalMs = seederPresenceIntervalMs
     this.seederOnlineSeconds = seederOnlineSeconds
+    this.priorityTailSeconds = Number.isFinite(priorityTailSeconds) && priorityTailSeconds >= 0
+      ? Math.floor(priorityTailSeconds)
+      : DEFAULT_PRIORITY_TAIL_SECONDS
+    this.priorityTtlMs = Number.isFinite(priorityTtlMs) && priorityTtlMs > 0
+      ? Math.floor(priorityTtlMs)
+      : DEFAULT_PRIORITY_TTL_MS
+    this.priorityHedgeDelayMs = Number.isFinite(priorityHedgeDelayMs) && priorityHedgeDelayMs >= 0
+      ? Math.floor(priorityHedgeDelayMs)
+      : DEFAULT_PRIORITY_HEDGE_DELAY_MS
+    const hedgeRelays = Math.floor(Number(priorityHedgeRelays))
+    this.priorityHedgeRelays = Number.isSafeInteger(hedgeRelays) && hedgeRelays >= 1
+      ? Math.min(hedgeRelays, 3)
+      : DEFAULT_PRIORITY_HEDGE_RELAYS
     this.maxDynamicRecoverySeeders = maxDynamicRecoverySeeders
     this.messageQueueMaxBytes = messageQueueMaxBytes
     this.seedQueueMaxBytes = seedQueueMaxBytes
@@ -289,6 +319,9 @@ export class PrivateMessenger {
     this.recoveries = new Map()
     this.recoveryAdmission = createAbortableSemaphore(2)
     this.recoveryControllers = new Set()
+    this.recoveryRanges = new Map()
+    this.recoveryPriority = new Map()
+    this.recoveryOnline = { at: 0, value: true }
     this.resumeWork = null
     this.capacityTimer = null
     this.capacityCheck = null
@@ -664,6 +697,7 @@ export class PrivateMessenger {
 
     if (removedPubkeys.length) {
       await this.stampChannelActivity(removedPubkeys)
+      for (const pubkey of removedPubkeys) this.dropRecoveryState(pubkey)
     }
 
     const storageSnapshot = await activatePrivateMessengerStorage({
@@ -1174,7 +1208,347 @@ export class PrivateMessenger {
     this.liveRecoveryTimers.delete(pubkey)
   }
 
+  async checkRecoveryOnline () {
+    const now = Date.now()
+    if (now - this.recoveryOnline.at < RECOVERY_ONLINE_CACHE_MS) return this.recoveryOnline.value
+    let value = true
+    try {
+      if (globalThis.navigator?.onLine === false) value = false
+      else if (this._isOnline !== isOnline || typeof globalThis.document !== 'undefined') {
+        value = (await this._isOnline()) !== false
+      }
+    } catch { value = false }
+    this.recoveryOnline = { at: Date.now(), value }
+    return value
+  }
+
+  recoveryRangeKey (channelPubkey, range) {
+    return `${channelPubkey}:${range.start}:${range.end}`
+  }
+
+  recoveryRangeRecord (channelPubkey, range) {
+    const key = this.recoveryRangeKey(channelPubkey, range)
+    let record = this.recoveryRanges.get(key)
+    if (!record) {
+      record = {
+        key,
+        channelPubkey,
+        start: range.start,
+        end: range.end,
+        covered: [],
+        claimed: [],
+        oldestCreatedAt: null,
+        relays: new Map(),
+        tier: '',
+        everEose: false,
+        everEoseWithEvents: false,
+        attempts: 0,
+        lastErrors: []
+      }
+      this.recoveryRanges.set(key, record)
+    }
+    return record
+  }
+
+  reconcileRecoveryRelays (record, relays) {
+    const current = new Set(relays)
+    for (const relay of [...record.relays.keys()]) {
+      if (!current.has(relay)) record.relays.delete(relay)
+    }
+    for (const relay of current) {
+      if (record.relays.has(relay)) continue
+      record.relays.set(relay, {
+        pending: [{ start: record.start, end: record.end }],
+        covered: [],
+        attempts: 0,
+        dead: false,
+        eose: false,
+        events: 0,
+        error: null,
+        consecutiveFailures: 0,
+        latencyMs: null,
+        lastEoseAt: 0,
+        lastErrorAt: 0
+      })
+    }
+  }
+
+  orderedRecoveryRelays (record) {
+    return [...record.relays.entries()]
+      .filter(([, state]) => !state.dead && !state.eose && state.pending?.length)
+      .sort((a, b) => {
+        const failures = (a[1].consecutiveFailures || 0) - (b[1].consecutiveFailures || 0)
+        if (failures) return failures
+        const latency = (a[1].latencyMs ?? Infinity) - (b[1].latencyMs ?? Infinity)
+        if (latency) return latency
+        return (b[1].lastEoseAt || 0) - (a[1].lastEoseAt || 0)
+      })
+  }
+
+  recoveryRelayPlan (record) {
+    const plan = {}
+    const ordered = this.orderedRecoveryRelays(record)
+    for (const [relay, state] of ordered) {
+      plan[relay] = state.pending
+    }
+    return ordered.length ? plan : null
+  }
+
+  hasActiveRecoveryRelays (channelPubkey) {
+    for (const record of this.recoveryRanges.values()) {
+      if (record.channelPubkey !== channelPubkey) continue
+      if (this.recoveryRecordActive(record)) return true
+    }
+    return false
+  }
+
+  recoveryRecordActive (record) {
+    for (const state of record.relays.values()) {
+      if (!state.dead && !state.eose && state.pending?.length) return true
+    }
+    return false
+  }
+
+  hasPendingRecovery (channelPubkey) {
+    return (this.readState().channels[channelPubkey]?.offlineRanges || []).length > 0
+  }
+
+  dropRecoveryRanges (channelPubkey) {
+    for (const [key, record] of this.recoveryRanges) {
+      if (record.channelPubkey === channelPubkey) this.recoveryRanges.delete(key)
+    }
+  }
+
+  pruneRecoveryRanges (channelPubkey, ranges) {
+    const keep = new Set((ranges || []).map(range => this.recoveryRangeKey(channelPubkey, range)))
+    for (const [key, record] of this.recoveryRanges) {
+      if (record.channelPubkey === channelPubkey && !keep.has(key)) this.recoveryRanges.delete(key)
+    }
+  }
+
+  dropRecoveryState (channelPubkey) {
+    this.dropRecoveryRanges(channelPubkey)
+    this.recoveryPriority.delete(channelPubkey)
+  }
+
+  recoveryPriorities (channelPubkey) {
+    const entries = this.recoveryPriority.get(channelPubkey) || []
+    if (!entries.length) return []
+    const now = Date.now()
+    const active = entries.filter(entry => entry.expiresAt > now)
+    if (active.length !== entries.length) {
+      if (active.length) this.recoveryPriority.set(channelPubkey, active)
+      else this.recoveryPriority.delete(channelPubkey)
+    }
+    return active
+  }
+
+  async prioritizeRange (channelPubkey, { since, until, type = 'unread-page', ttlMs } = {}) {
+    if (typeof channelPubkey !== 'string' || !/^[0-9a-f]{64}$/i.test(channelPubkey)) throw new ValidationError('INVALID_CHANNEL_PUBKEY')
+    if (type !== 'unread-page' && type !== 'tail') throw new ValidationError('INVALID_PRIORITY_TYPE')
+    if (since !== undefined && !Number.isSafeInteger(since)) throw new ValidationError('INVALID_PRIORITY_RANGE')
+    if (until !== undefined && !Number.isSafeInteger(until)) throw new ValidationError('INVALID_PRIORITY_RANGE')
+    if (type === 'unread-page' && since === undefined) throw new ValidationError('PRIORITY_SINCE_REQUIRED')
+
+    const now = nowSeconds()
+    const ranges = (this.readState().channels[channelPubkey]?.offlineRanges || []).slice()
+    if (!ranges.length) return false
+
+    let start = since
+    let end = until
+    if (type === 'unread-page') {
+      const range = ranges.filter(candidate => candidate.end >= start).sort((a, b) => a.start - b.start)[0]
+      if (!range) return false
+      start = Math.max(start, range.start)
+      if (end === undefined) end = Math.min(range.end, now)
+    } else {
+      const range = ranges.sort((a, b) => b.end - a.end)[0]
+      if (end === undefined) end = Math.min(range.end, now)
+      if (start === undefined) start = Math.max(range.start, end - this.priorityTailSeconds)
+    }
+
+    const recoverySeconds = this.offlineRecoverySecondsFor(channelPubkey)
+    if (recoverySeconds) {
+      start = Math.max(start, now - recoverySeconds)
+      end = Math.min(end, now)
+    }
+    if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || end < start) return false
+
+    const ttl = Number.isSafeInteger(ttlMs) && ttlMs > 0 ? ttlMs : this.priorityTtlMs
+    const entries = this.recoveryPriority.get(channelPubkey) || []
+    const createdAt = Date.now()
+    if (!entries.some(entry => entry.start === start && entry.end === end && entry.type === type)) {
+      entries.push({ start, end, type, createdAt, expiresAt: createdAt + ttl })
+      this.recoveryPriority.set(channelPubkey, entries)
+    }
+    return true
+  }
+
+  updateRecoveryRecord (record, history, { completeRelays = new Set((history.relays || []).map(entry => entry.relay)) } = {}) {
+    record.covered = mergeRanges([
+      ...record.covered,
+      ...(history.relays || []).flatMap(entry => entry.covered || [])
+    ])
+    if (history.oldestCreatedAt != null) {
+      record.oldestCreatedAt = record.oldestCreatedAt == null
+        ? history.oldestCreatedAt
+        : Math.min(record.oldestCreatedAt, history.oldestCreatedAt)
+    }
+    const byRelay = new Map((history.relays || []).map(entry => [entry.relay, entry]))
+    for (const [relay, state] of record.relays) {
+      const entry = byRelay.get(relay)
+      if (!entry) continue
+      const relayErrors = [...(entry.errors || [])]
+      if (entry.error) relayErrors.push(entry.error)
+      state.error = relayErrors[0] || null
+      const done = entry.status === 'eose' && !(entry.pending?.length) && completeRelays.has(relay)
+      state.covered = mergeRanges([...(state.covered || []), ...(entry.covered || [])])
+      state.eose = done
+      state.pending = done
+        ? []
+        : subtractRanges({ start: record.start, end: record.end }, mergeRanges([...state.covered, ...record.claimed]))
+      state.events += entry.events || 0
+      if (Number.isFinite(entry.elapsedMs)) {
+        state.latencyMs = state.latencyMs == null
+          ? entry.elapsedMs
+          : Math.round(state.latencyMs * 0.7 + entry.elapsedMs * 0.3)
+      }
+      if (done) {
+        state.attempts = 0
+        state.consecutiveFailures = 0
+        state.lastEoseAt = nowSeconds()
+      } else if (entry.status === 'eose') {
+        state.consecutiveFailures = 0
+        state.lastEoseAt = nowSeconds()
+      } else {
+        state.consecutiveFailures = (state.consecutiveFailures || 0) + 1
+        state.lastErrorAt = nowSeconds()
+      }
+      if (entry.status === 'eose') {
+        record.everEose = true
+        if (state.events > 0) record.everEoseWithEvents = true
+      }
+    }
+    record.tier = record.everEoseWithEvents ? 'partial' : record.everEose ? 'emptyEose' : 'allFailed'
+    record.lastErrors = (history.relays || []).flatMap(entry => [...(entry.errors || []), ...(entry.error ? [entry.error] : [])])
+  }
+
+  applyRecoveryCoverage (record, ranges) {
+    if (!ranges?.length) return
+    record.claimed = mergeRanges([...record.claimed, ...ranges])
+    record.covered = mergeRanges([...record.covered, ...ranges])
+    for (const state of record.relays.values()) {
+      if (state.eose) continue
+      state.pending = subtractRanges({ start: record.start, end: record.end }, mergeRanges([...state.covered, ...record.claimed]))
+    }
+  }
+
+  activeRecoverySeeders (channelPubkey) {
+    if (!this.offlineRecoverySecondsFor(channelPubkey)) return []
+    const channel = this.channels.get(channelPubkey)
+    if (!channel?.signer) return []
+    const activity = this.readState().channels[channelPubkey]?.seederActivity || {}
+    const cutoff = nowSeconds() - this.seederOnlineSeconds
+    const candidates = new Set([...(channel.seeders || []), ...Object.keys(activity)])
+    return [...candidates].filter(seeder => {
+      if (!seeder || seeder === this.userPubkey) return false
+      const entry = activity[seeder]
+      const recent = Math.max(entry?.announcedAt || 0, entry?.lastActiveAt || 0)
+      return recent >= cutoff
+    })
+  }
+
+  prunePriorityEntries (channelPubkey) {
+    const entries = this.recoveryPriorities(channelPubkey)
+    if (!entries.length) return
+    const records = [...this.recoveryRanges.values()].filter(record => record.channelPubkey === channelPubkey)
+    const next = entries.filter(entry => {
+      let intersects = false
+      for (const record of records) {
+        const parts = intersectRanges(
+          [{ start: entry.start, end: entry.end }],
+          [{ start: record.start, end: record.end }]
+        )
+        if (!parts.length) continue
+        intersects = true
+        if (subtractRanges(parts[0], record.covered).length) return true
+      }
+      return !intersects
+    })
+    if (next.length) this.recoveryPriority.set(channelPubkey, next)
+    else this.recoveryPriority.delete(channelPubkey)
+  }
+
+  applyRecoveryRetryBudget (record) {
+    const limit = RECOVERY_RELAY_RETRY_LIMITS[record.tier] ?? RECOVERY_RELAY_RETRY_LIMITS.allFailed
+    for (const state of record.relays.values()) {
+      if (state.eose || state.dead || !state.pending?.length) continue
+      state.attempts++
+      if (state.attempts >= limit || isPermanentRecoveryError(state.error)) state.dead = true
+    }
+    record.attempts++
+  }
+
+  recoveryIncompleteError (record, history, range) {
+    const errors = []
+    for (const entry of history.relays || []) {
+      for (const reason of entry.errors || []) errors.push({ relay: entry.relay, reason })
+      if (entry.error) errors.push({ relay: entry.relay, reason: entry.error })
+    }
+    const error = incompleteFetchError({
+      errors,
+      report: (history.relays || []).map(entry => ({
+        relay: entry.relay,
+        status: entry.status,
+        ...(entry.error ? { error: entry.error } : {})
+      })),
+      receivedEventCount: history.receivedEventCount || 0,
+      elapsedMs: history.elapsedMs || 0,
+      request: {
+        relays: [...record.relays.keys()],
+        channelPubkeys: [record.channelPubkey],
+        receiverPubkey: this.userPubkey,
+        since: range.start,
+        until: range.end,
+        limit: 16,
+        timeoutMs: 5000
+      }
+    })
+    error.operation = 'private-channel.fetchHistory'
+    return error
+  }
+
+  isPartialRecoveryHistory (history) {
+    return Boolean(history) && !Array.isArray(history) &&
+      Array.isArray(history.relays) &&
+      history.pendingByRelay !== undefined &&
+      typeof history.anyEose === 'boolean'
+  }
+
+  async finalizeRecoveryRange ({ channelPubkey, range, record }) {
+    if (!await this.checkRecoveryOnline()) return { complete: false, failures: [], offline: true }
+    const uncovered = subtractRanges({ start: range.start, end: range.end }, record.covered)
+    const oldest = record.oldestCreatedAt
+    const leftEdge = oldest == null
+      ? [{ start: range.start, end: range.end }]
+      : oldest > range.start
+        ? [{ start: range.start, end: Math.min(oldest, range.end) }]
+        : []
+    const seedRanges = mergeRanges([...uncovered, ...leftEdge])
+    const failures = []
+    for (const seedRange of seedRanges) {
+      const attempt = await this.#askSeedersForMissingRangeAttempt(channelPubkey, seedRange.start, seedRange.end)
+      failures.push(...attempt.failures.map(failure => failure.error))
+    }
+    record.lastErrors = failures
+    return { complete: failures.length === 0, failures }
+  }
+
   scheduleLiveRecovery (pubkey) {
+    return this.scheduleOfflineRecovery(pubkey)
+  }
+
+  scheduleOfflineRecovery (pubkey, { startDelayMs = 0 } = {}) {
     const current = this.liveRecoveryTimers.get(pubkey)
     if (current) { current.again = true; return }
     const work = { delay: 1000, timer: null, again: false }
@@ -1199,7 +1573,11 @@ export class PrivateMessenger {
         }
         if (!isCurrent()) return
         const pending = this.readState().channels[pubkey]?.offlineRanges?.length
-        const retry = pending ? recoveryRetryDelay(errors, Math.min(30000, work.delay * (0.8 + Math.random() * 0.4))) : null
+        let retry = null
+        if (pending) {
+          retry = recoveryRetryDelay(errors, Math.min(30000, work.delay * (0.8 + Math.random() * 0.4)))
+          if (retry === null && this.hasActiveRecoveryRelays(pubkey)) retry = Math.min(30000, work.delay)
+        }
         if (work.again || retry !== null) {
           schedule(work.again ? 0 : retry)
           work.delay = Math.min(30000, work.delay * 2)
@@ -1207,7 +1585,7 @@ export class PrivateMessenger {
       }, delay)
       work.timer?.unref?.()
     }
-    schedule(0)
+    schedule(startDelayMs)
   }
 
   recordInterruption (channels, at = nowSeconds()) {
@@ -1242,6 +1620,7 @@ export class PrivateMessenger {
     const pubkeys = channels ? uniq(Array.isArray(channels) ? channels : [channels]) : [...this.desiredChannels]
     for (const extension of this.extensions) extension.unwatch?.(pubkeys)
     for (const pubkey of pubkeys) this.desiredChannels.delete(pubkey)
+    for (const pubkey of pubkeys) this.dropRecoveryState(pubkey)
     this.recordInterruption(pubkeys)
     for (const controller of this.recoveryControllers) {
       if (pubkeys.includes(controller.channelPubkey)) controller.abort()
@@ -1278,6 +1657,9 @@ export class PrivateMessenger {
       if (this.pauseReasons.size || this.closePromise) return
       await this.reconcilePresencePublishers()
       await this.recoverOfflineRanges(channels)
+      for (const pubkey of channels) {
+        if (this.hasPendingRecovery(pubkey)) this.scheduleOfflineRecovery(pubkey, { startDelayMs: 1000 })
+      }
       for (const extension of this.extensions) await extension.resume?.()
     })()
     this.resumeWork = work
@@ -1348,6 +1730,9 @@ export class PrivateMessenger {
     }
     await this.watch(channelPubkeys, { scheduleReloadGap: false })
     await this.recoverOfflineRanges(channelPubkeys)
+    for (const pubkey of channelPubkeys) {
+      if (this.hasPendingRecovery(pubkey)) this.scheduleOfflineRecovery(pubkey, { startDelayMs: 1000 })
+    }
   }
 
   async handleAsk (channelPubkey, message) {
@@ -1928,6 +2313,9 @@ export class PrivateMessenger {
       }
       this.writeState(state)
       await this.flushStateWrites()
+      for (const channel of channels) {
+        if (!this.offlineRecoverySecondsFor(channel)) this.dropRecoveryState(channel.pubkey)
+      }
       for (const channel of channels) await this.pruneStoredSeeds(channel.pubkey)
     })
   }
@@ -1968,6 +2356,9 @@ export class PrivateMessenger {
       if ((this.watchRevisionByChannel.get(pubkey) || 0) !== revision) return
       if (start != null) this.addOfflineRange(pubkey, Math.max(0, start - this.offlineSkewSeconds), nowSeconds())
       try { await this.recoverOfflineRanges([pubkey]) } catch (err) { this.onError?.(err) }
+      if (!this.closePromise && !this.pauseReasons.size && this.desiredChannels.has(pubkey) && this.hasPendingRecovery(pubkey)) {
+        this.scheduleOfflineRecovery(pubkey, { startDelayMs: 1000 })
+      }
     }, this.reloadGapDelayMs)
     this.reloadGapTimers.set(pubkey, { timer, token, revision })
   }
@@ -1998,15 +2389,15 @@ export class PrivateMessenger {
     return asks
   }
 
-  async #askSeedersForMissingRangeAttempt (channelPubkey, since, until) {
+  async #askSeedersForMissingRangeAttempt (channelPubkey, since, until, { seeders } = {}) {
     if (!this.offlineRecoverySecondsFor(channelPubkey)) return { asks: [], failures: [] }
     if (!this.channels.get(channelPubkey)?.signer) return { asks: [], failures: [] }
-    const seeders = this.recoverySeeders(channelPubkey)
-    if (!seeders.length || until < since) return { asks: [], failures: [] }
+    const candidates = seeders ?? this.recoverySeeders(channelPubkey)
+    if (!candidates.length || until < since) return { asks: [], failures: [] }
 
     const asks = []
     const failures = []
-    for (const seeder of seeders) {
+    for (const seeder of candidates) {
       try {
         const ask = await this.ask({
           channelPubkey,
@@ -2152,24 +2543,176 @@ export class PrivateMessenger {
     return failures
   }
 
+  recoveryFetchOptions ({ channelPubkey, channel, relays, since, until, signal, partial = false, resume = null }) {
+    return {
+      _acquirePage: pageSignal => this.recoveryAdmission.acquire(pageSignal),
+      signal,
+      receivedChunkScope: this.storageLeaseId,
+      receiverSigner: this.userSigner,
+      iykcSigner: this.contentKeySigner,
+      privateChannelSigner: channel.signer,
+      privateChannelReaderSigner: channel.readerSigner,
+      privateChannelReaderPubkey: channel.readerPubkey,
+      privateChannelPubkeys: [channelPubkey],
+      receiverPubkey: this.userPubkey,
+      relays,
+      since: Math.max(0, since),
+      until,
+      partial,
+      resume,
+      mode: channel.mode,
+      modeByPubkey: { [channelPubkey]: channel.mode },
+      receivedChunkTtlMs: this.receivedChunkTtlMsFor(channel),
+      receivedChunkIndexedDB: this._indexedDB,
+      onEvent: (event, outer, meta) => this.receive(channelPubkey, () => this.enqueueRumor(eventType(event), channelPubkey, { event, outer, meta, payload: parseEventContent(event) }), { event, outer }),
+      onNymEvent: (event, outer, meta) => this.receive(channelPubkey, () => this.enqueueRumor('nym', channelPubkey, { event, outer, meta, payload: parseEventContent(event) }), { event, outer }),
+      onSeedEvent: seed => this.receive(channelPubkey, () => this.enqueueSeed(channelPubkey, seed), seed),
+      onContentKeyUsage: usage => this.handleContentKeyUsage(channelPubkey, usage),
+      onError: err => { throw err }
+    }
+  }
+
+  async hedgedPriorityFetch ({ channelPubkey, channel, candidates, since, until }) {
+    const launched = []
+    let hedgeTimer = null
+    let secondStarted = false
+    const launch = candidate => {
+      const controller = new AbortController()
+      const promise = this._privateChannel
+        .fetchHistory(this.recoveryFetchOptions({
+          channelPubkey,
+          channel,
+          relays: [candidate.relay],
+          since,
+          until,
+          signal: controller.signal,
+          partial: true,
+          resume: { [candidate.relay]: candidate.pending }
+        }))
+        .then(
+          history => ({ ok: true, relay: candidate.relay, controller, history }),
+          error => ({ ok: false, relay: candidate.relay, controller, error })
+        )
+      promise.catch(() => {})
+      launched.push({ promise, controller })
+      return promise
+    }
+    try {
+      const first = launch(candidates[0])
+      const hedge = candidates.length > 1
+        ? new Promise(resolve => {
+          hedgeTimer = this._setTimeout(() => {
+            secondStarted = true
+            resolve(launch(candidates[1]))
+          }, this.priorityHedgeDelayMs)
+        })
+        : null
+      let settled = hedge ? await Promise.race([first, hedge]) : await first
+      if (!settled.ok) {
+        if (secondStarted && launched.length > 1) settled = await launched[launched.length - 1].promise
+        else if (candidates.length > 1) settled = await launch(candidates[1])
+      }
+      if (!settled.ok) return null
+      for (const entry of launched) {
+        if (entry.controller === settled.controller) continue
+        try { entry.controller.abort() } catch { /* aborted */ }
+      }
+      return settled
+    } finally {
+      if (hedgeTimer) this._clearTimeout(hedgeTimer)
+    }
+  }
+
+  async askPrioritySeeders (channelPubkey, intervals) {
+    if (!intervals.length) return []
+    if (!await this.checkRecoveryOnline()) return []
+    const seeders = this.activeRecoverySeeders(channelPubkey)
+    if (!seeders.length) return []
+    const failures = []
+    const claimed = []
+    for (const interval of mergeRanges(intervals)) {
+      const attempt = await this.#askSeedersForMissingRangeAttempt(channelPubkey, interval.start, interval.end, { seeders })
+      failures.push(...attempt.failures.map(failure => failure.error))
+      if (!attempt.failures.length) claimed.push(interval)
+    }
+    if (claimed.length) {
+      for (const record of this.recoveryRanges.values()) {
+        if (record.channelPubkey !== channelPubkey) continue
+        const applied = intersectRanges(claimed, [{ start: record.start, end: record.end }])
+        if (applied.length) this.applyRecoveryCoverage(record, applied)
+      }
+    }
+    return failures
+  }
+
+  async runPriorityLane (channelPubkey, channel, ranges) {
+    const priorities = this.recoveryPriorities(channelPubkey)
+    if (!priorities.length) return
+    const fetchRelays = await this.resolveWatchRelays(channel)
+    for (const range of ranges) {
+      const record = this.recoveryRangeRecord(channelPubkey, range)
+      this.reconcileRecoveryRelays(record, fetchRelays)
+      const priorityIntervals = intersectRanges(
+        priorities.map(entry => ({ start: entry.start, end: entry.end })),
+        [{ start: range.start, end: range.end }]
+      )
+      if (!priorityIntervals.length) continue
+      const pending = subtractRanges({ start: range.start, end: range.end }, record.covered)
+      const wanted = intersectRanges(priorityIntervals, pending)
+      if (!wanted.length) continue
+      const candidates = this.orderedRecoveryRelays(record)
+        .map(([relay, state]) => ({ relay, pending: intersectRanges(state.pending, wanted) }))
+        .filter(candidate => candidate.pending.length)
+        .slice(0, this.priorityHedgeRelays)
+      if (candidates.length) {
+        const winner = await this.hedgedPriorityFetch({
+          channelPubkey,
+          channel,
+          candidates,
+          since: wanted[0].start,
+          until: wanted[wanted.length - 1].end
+        })
+        if (winner?.history) {
+          if (this.isPartialRecoveryHistory(winner.history)) this.updateRecoveryRecord(record, winner.history, { completeRelays: new Set() })
+          else this.applyRecoveryCoverage(record, wanted)
+        }
+      }
+      const uncovered = intersectRanges(wanted, subtractRanges({ start: range.start, end: range.end }, record.covered))
+      if (uncovered.length) await this.askPrioritySeeders(channelPubkey, uncovered)
+    }
+    this.prunePriorityEntries(channelPubkey)
+  }
+
   async recoverChannelRanges (channels) {
     const failures = []
     const state = this.readState()
     const now = nowSeconds()
+    const online = await this.checkRecoveryOnline()
 
     for (const pubkey of uniq(channels)) {
       const channel = this.channels.get(pubkey)
       const current = state.channels[pubkey]
-      if (!channel || !current?.offlineRanges?.length) continue
+      if (!channel || !current?.offlineRanges?.length) {
+        this.dropRecoveryState(pubkey)
+        continue
+      }
       const recoverySeconds = this.offlineRecoverySecondsFor(channel)
-      if (!recoverySeconds) continue
+      if (!recoverySeconds) {
+        this.dropRecoveryState(pubkey)
+        continue
+      }
       const minStart = now - recoverySeconds
       const processedRanges = new Set(current.offlineRanges.map(range => `${range.start}:${range.end}`))
 
+      if (online) {
+        try { await this.runPriorityLane(pubkey, channel, current.offlineRanges) } catch (error) { this.onError?.(error) }
+      }
+
       const remaining = []
       let recoveredThrough = current.recoveredThrough || 0
       for (const range of current.offlineRanges) {
         if (range.end < minStart) continue
+        if (!online) { remaining.push(range); continue }
         const watchRevision = this.watchRevisionByChannel.get(pubkey) || 0
         const controller = new AbortController()
         controller.channelPubkey = pubkey
@@ -2178,38 +2721,65 @@ export class PrivateMessenger {
           if (this.pauseReasons.size || this.closePromise || !this.desiredChannels.has(pubkey)) throw new Error('PRIVATE_MESSENGER_PAUSED')
           const fetchRelays = await this.resolveWatchRelays(channel)
           controller.signal.throwIfAborted()
-          const history = await this._privateChannel.fetchHistory({
-            _acquirePage: signal => this.recoveryAdmission.acquire(signal),
-            signal: controller.signal,
-            receivedChunkScope: this.storageLeaseId,
-            receiverSigner: this.userSigner,
-            iykcSigner: this.contentKeySigner,
-            privateChannelSigner: channel.signer,
-            privateChannelReaderSigner: channel.readerSigner,
-            privateChannelReaderPubkey: channel.readerPubkey,
-            privateChannelPubkeys: [pubkey],
-            receiverPubkey: this.userPubkey,
-            relays: fetchRelays,
-            since: Math.max(0, range.start),
-            until: range.end,
-            mode: channel.mode,
-            modeByPubkey: { [pubkey]: channel.mode },
-            receivedChunkTtlMs: this.receivedChunkTtlMsFor(channel),
-            receivedChunkIndexedDB: this._indexedDB,
-            onEvent: (event, outer, meta) => this.receive(pubkey, () => this.enqueueRumor(eventType(event), pubkey, { event, outer, meta, payload: parseEventContent(event) }), { event, outer }),
-            onNymEvent: (event, outer, meta) => this.receive(pubkey, () => this.enqueueRumor('nym', pubkey, { event, outer, meta, payload: parseEventContent(event) }), { event, outer }),
-            onSeedEvent: seed => this.receive(pubkey, () => this.enqueueSeed(pubkey, seed), seed),
-            onContentKeyUsage: usage => this.handleContentKeyUsage(pubkey, usage),
-            onError: err => { throw err }
-          })
-          controller.signal.throwIfAborted()
-          const attempt = await this.#askSeedersForRelayLeftEdgeAttempt(pubkey, range, history.oldestCreatedAt)
+          const record = this.recoveryRangeRecord(pubkey, range)
+          this.reconcileRecoveryRelays(record, fetchRelays)
+          const plan = this.recoveryRelayPlan(record)
+          if (plan) {
+            const history = await this._privateChannel.fetchHistory(this.recoveryFetchOptions({
+              channelPubkey: pubkey,
+              channel,
+              relays: Object.keys(plan),
+              since: range.start,
+              until: range.end,
+              signal: controller.signal,
+              partial: true,
+              resume: plan
+            }))
+            controller.signal.throwIfAborted()
+            if (this.isPartialRecoveryHistory(history)) {
+              this.updateRecoveryRecord(record, history)
+              this.applyRecoveryRetryBudget(record)
+              if ((history.relays || []).some(entry => entry.status !== 'eose' || entry.pending?.length)) {
+                const error = this.recoveryIncompleteError(record, history, range)
+                this.onError?.(error)
+                failures.push(error)
+              }
+            } else {
+              // Legacy fetch seam (tests/custom channels): resolves only when
+              // the whole range was read, so treat it as fully relay-covered.
+              record.covered = mergeRanges([...record.covered, { start: range.start, end: range.end }])
+              if (history?.oldestCreatedAt != null) {
+                record.oldestCreatedAt = record.oldestCreatedAt == null
+                  ? history.oldestCreatedAt
+                  : Math.min(record.oldestCreatedAt, history.oldestCreatedAt)
+              }
+              for (const state of record.relays.values()) {
+                state.eose = true
+                state.pending = []
+              }
+              record.tier = 'partial'
+              record.lastErrors = []
+            }
+          }
           const lifecycleChanged = controller.signal.aborted || this.closePromise || !this.channels.has(pubkey) || !this.stopByChannel.has(pubkey) ||
             (this.watchRevisionByChannel.get(pubkey) || 0) !== watchRevision
-          failures.push(...attempt.failures.map(failure => failure.error))
-          if (lifecycleChanged || attempt.failures.length) remaining.push(range)
-          else recoveredThrough = Math.max(recoveredThrough, range.end)
+          if (lifecycleChanged) {
+            remaining.push(range)
+            continue
+          }
+          if (this.recoveryRecordActive(record)) {
+            remaining.push(range)
+            continue
+          }
+          const result = await this.finalizeRecoveryRange({ channelPubkey: pubkey, range, record })
+          failures.push(...result.failures)
+          if (result.complete) recoveredThrough = Math.max(recoveredThrough, range.end)
+          else remaining.push(range)
         } catch (err) {
+          const record = this.recoveryRanges.get(this.recoveryRangeKey(pubkey, range))
+          if (record && isPermanentRecoveryError(err)) {
+            for (const state of record.relays.values()) state.dead = true
+          }
           if (!(controller.liveInterrupted && err === controller.signal.reason)) this.onError?.(err)
           failures.push(err)
           remaining.push(range)
@@ -2223,6 +2793,7 @@ export class PrivateMessenger {
         recoveredThrough: Math.max(fresh.channels[pubkey]?.recoveredThrough || 0, recoveredThrough),
         offlineRanges: mergeRanges(concurrentRanges.concat(remaining))
       }
+      this.pruneRecoveryRanges(pubkey, remaining)
       this.writeState(fresh)
       await this.flushStateWrites()
     }
@@ -2232,6 +2803,7 @@ export class PrivateMessenger {
   async clearChannel (pubkey) {
     await this.unwatch(pubkey)
     await this._privateMessage.clearChannelState?.(pubkey)
+    this.dropRecoveryState(pubkey)
     return this.runQueueOperation(async () => {
       this.channels.delete(pubkey)
       this.removeChannelState(pubkey)
@@ -2265,6 +2837,7 @@ export class PrivateMessenger {
         await this.queue?.removeBy('byChannel', pubkey)
         await (this.seedStorage ? this.seedStorage.removeLocal({ channelPubkey: pubkey }) : this.seedQueue?.removeBy('byChannel', pubkey))
       }
+      for (const pubkey of stalePubkeys) this.dropRecoveryState(pubkey)
       this.state = state
       if (stalePubkeys.length) await this.removeChannelStates(stalePubkeys)
     })
@@ -2355,22 +2928,14 @@ export class PrivateMessenger {
           temporaryStorageArea: this.temporaryStorageArea
         })
       }
+      this.recoveryRanges.clear()
+      this.recoveryPriority.clear()
       if (unwatchError) throw unwatchError
     })()
     return this.closePromise
   }
 }
 
-function mergeRanges (ranges) {
-  const out = []
-  for (const range of ranges) {
-    const last = out[out.length - 1]
-    if (!last || range.start > last.end + 1) out.push({ ...range })
-    else last.end = Math.max(last.end, range.end)
-  }
-  return out
-}
-
 function eventType (event) {
   if (event.kind === privateMessage.ASK_KIND) return 'ask'
   if (event.kind === privateMessage.REPLY_KIND) return 'reply'

package/private-messenger/session/README.md

@@ -17,9 +17,17 @@ key published after an earlier miss. Set it to `false` when the signer owns that
 `createMessengerSigner` adapts this byte signer to the transport's Base64 API.
 
 Methods: `setPeers`, `setAvailable(boolean)`, `prefetchContentKeys(peers?)`,
-`enqueue`, `retry`, `cancel`, `download`, `cancelDownload`, and `close`.
+`prioritizeRange(peer, options)`, `enqueue`, `retry`, `cancel`, `download`,
+`cancelDownload`, and `close`.
 `prefetchContentKeys` warms the content-key lookup cache for the owner and the
 given peers (default: current peers); it is best-effort and never rejects.
+`prioritizeRange` registers an in-memory priority window for a conversation:
+`type: 'unread-page'` requires `since` (the read anchor), while `type: 'tail'`
+defaults to the newest persisted range minus `priorityTailSeconds` (6 hours).
+The coordinator resolves the peer's channel and queues the request until the
+channel exists. Priorities expire after `priorityTtlMs` (10 minutes) or once
+covered, and are dropped with recovery state. They are process-local and reset
+on reload.
 Callbacks are `onOutbox`, `onMedia`,
 `onError`, and optional `onSendError(error, { id, peer })`. The caller maps its
 account permissions/connectivity/lock state to availability and owns view subscriptions. There are no DOM or UI imports.

package/private-messenger/session/index.js

@@ -21,6 +21,14 @@ const retryable = error => error?.code === 'MESSAGE_NOT_PUBLISHED' || !/DENIED|P
 
 export function createPrivateMessageSession ({ owner, signer, eventStore, messageStorage, chunkStorage, recoveryStorage, fallbackRelays = [], mode = 'seeder', seedersForPeer = peer => [peer], allowedKinds = [5, 9, 1063, 34601], useContentKeys = true, onMedia = () => {}, onOutbox = () => {}, onError = () => {}, onSendError = () => {}, Messenger = createPrivateMessenger, openOutbox = createChatOutbox, FileTransfer = createPrivateFileTransfer, _onOnline = onOnline, _getIykcProofs = getIykcProofs, openDownloads = options => createChatOutbox({ ...options, namespace: 'downloads' }) }) {
   fallbackRelays = normalizeFallbackRelays(fallbackRelays)
+  const reportedErrors = new WeakSet()
+  const reportError = error => {
+    if (error && (typeof error === 'object' || typeof error === 'function')) {
+      if (reportedErrors.has(error)) return
+      reportedErrors.add(error)
+    }
+    onError(error)
+  }
   const userSigner = messengerSigner(signer)
   messageStorage ||= createEventStoreMessageStorage({ eventStore })
   chunkStorage ||= eventStore ? createEventStoreChunkStorage({ eventStore }) : undefined
@@ -37,6 +45,8 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   let downloads
   const downloadIntents = new Map()
   const downloadEpochs = new Map()
+  const activeDownloads = new Map()
+  const pendingPriorityRanges = new Map()
   let downloadWriteTail = Promise.resolve()
   const writeDownloadIntent = operation => {
     const work = downloadWriteTail.catch(() => {}).then(operation)
@@ -72,18 +82,28 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
           const scoped = messengerSigner(signer.withSharedKey(peer, 'dm'))
           channel = { signer: scoped, pubkey: await scoped.getPublicKey(), mode, seeders: seedersForPeer(peer) }
           channels.set(peer, channel)
-        } catch (error) { if (!retryable(error)) deniedPeers.add(peer); onError(error); continue }
+        } catch (error) { if (!retryable(error)) deniedPeers.add(peer); reportError(error); continue }
       }
       if (closed || !available || version !== lifecycle) return
       values.push(channel)
     }
-    if (!messenger) messenger = await Messenger({ fallbackRelays, seedStorage: recoveryStorage?.seeds, userSigner, channels: [], useContentKeys, onMessageQueued: () => drain(), onError })
+    if (!messenger) messenger = await Messenger({ fallbackRelays, seedStorage: recoveryStorage?.seeds, userSigner, channels: [], useContentKeys, onMessageQueued: () => drain(), onError: reportError })
     if (closed || !available || version !== lifecycle) { await messenger.pause('signer'); return }
     await messenger.update({ channels: values })
+    if (pendingPriorityRanges.size && typeof messenger.prioritizeRange === 'function') {
+      for (const [peer, list] of [...pendingPriorityRanges]) {
+        const channel = channels.get(peer)
+        if (!channel) continue
+        for (const request of list) {
+          try { await messenger.prioritizeRange(channel.pubkey, request) } catch (error) { reportError(error) }
+        }
+        pendingPriorityRanges.delete(peer)
+      }
+    }
     await messenger.resume('signer')
     if (!fileTransfers) {
       fileTransfers = FileTransfer({
-        messenger, onError,
+        messenger, onError: reportError,
         resolveChannel: ({ peerPubkey, info }) => messengerSigner(signer.withSharedKey(peerPubkey, info)),
         storage: chunkStorage,
         seedStorage: recoveryStorage?.seeds,
@@ -95,20 +115,30 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
           onMedia({ ...state, peer })
           if (state.status === 'complete') {
             const id = intentId({ peer, root: state.root })
-            if (downloadIntents.delete(id)) writeDownloadIntent(() => downloads?.remove(id)).catch(onError)
+            if (downloadIntents.delete(id)) writeDownloadIntent(() => downloads?.remove(id)).catch(reportError)
           }
         }
       })
       downloads = await openDownloads({ owner, signer })
       for (const entry of await downloads.list()) downloadIntents.set(entry.id, entry)
     }
-    for (const entry of downloadIntents.values()) if (peers.has(entry.file.peer)) download(entry.file, { manual: true }).catch(onError)
+    for (const entry of downloadIntents.values()) {
+      if (!peers.has(entry.file.peer) || activeDownloads.has(entry.id)) continue
+      const work = download(entry.file, { manual: true })
+        .catch(error => {
+          // A failed intent stays queued for the next configure; report each
+          // real attempt once even if configure runs while it is in flight.
+          if (downloadIntents.has(entry.id)) reportError(error)
+        })
+        .finally(() => { if (activeDownloads.get(entry.id) === work) activeDownloads.delete(entry.id) })
+      activeDownloads.set(entry.id, work)
+    }
     drain(); pump()
   }
   function schedule () {
     const work = configuring.catch(() => {}).then(configure)
     configuring = work
-    work.catch(onError)
+    work.catch(reportError)
     return work
   }
   async function drain () {
@@ -130,7 +160,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
           const valid = event.pubkey === peer || message.provenance === 'hearsay' || message.provenance === 'signed'
           if (!valid || !isSerializableEvent(event) || !allowedKinds.includes(event.kind) || (event.sig && !isValidEvent(event)) || getEventHash(event) !== message.event.id) { await ack(); continue }
           if (event.kind === 34601) {
-            try { decodeIrfsChunk(event) } catch (error) { onError(error); await ack(); continue }
+            try { decodeIrfsChunk(event) } catch (error) { reportError(error); await ack(); continue }
           }
           if (event.kind === 5 && (message.provenance === 'hearsay' || event.pubkey !== peer)) { await ack(); continue }
           if (!available || closed) { await nack(); break }
@@ -139,7 +169,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
           await ack()
         } catch (error) {
           await nack()
-          onError(error)
+          reportError(error)
           // Retain the failed record and suspend network ingestion until recovery.
           await messenger.pause('storage')
           break
@@ -218,8 +248,8 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     } catch (error) {
       if (cancelled.has(entry.id)) { await storage.remove(entry.id); entries.delete(entry.id) } else {
         entry.status = error.retryWhenAvailable ? 'pending' : 'error'; entry.failed = true; entry.retryable = retryable(error)
-        await storage.put(entry, { existing: true }).catch(onError)
-        onError(error)
+        await storage.put(entry, { existing: true }).catch(reportError)
+        reportError(error)
         // The failed wire event may be a quote or file chunk. Report the
         // owning outbox item separately, without mutating the native error.
         if (error.retryWhenOnline) offlineSends.add(entry.id)
@@ -303,6 +333,23 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         return {}
       }
     },
+    async prioritizeRange (peer, options = {}) {
+      if (!/^[0-9a-f]{64}$/.test(peer || '')) throw new TypeError('INVALID_PRIORITY_PEER')
+      const { since, until, type = 'unread-page' } = options || {}
+      if (type !== 'unread-page' && type !== 'tail') throw new TypeError('INVALID_PRIORITY_TYPE')
+      if (since !== undefined && !Number.isSafeInteger(since)) throw new TypeError('INVALID_PRIORITY_RANGE')
+      if (until !== undefined && !Number.isSafeInteger(until)) throw new TypeError('INVALID_PRIORITY_RANGE')
+      if (type === 'unread-page' && since === undefined) throw new TypeError('PRIORITY_SINCE_REQUIRED')
+      const request = { since, until, type }
+      const channel = channels.get(peer)
+      if (channel && typeof messenger?.prioritizeRange === 'function') {
+        try { return await messenger.prioritizeRange(channel.pubkey, request) } catch (error) { reportError(error); return false }
+      }
+      const list = pendingPriorityRanges.get(peer) || []
+      list.push(request)
+      pendingPriorityRanges.set(peer, list)
+      return true
+    },
     async setPeers (values) {
       peers.clear(); for (const peer of values) if (peer !== owner) peers.add(peer)
       for (const peer of deniedPeers) if (!peers.has(peer)) deniedPeers.delete(peer)
@@ -348,14 +395,14 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     },
     async close () {
       closed = true; available = false; lifecycle++
-      stopOnlineRetry(); offlineSends.clear()
+      stopOnlineRetry(); offlineSends.clear(); activeDownloads.clear(); pendingPriorityRanges.clear()
       for (const controller of sendControllers.values()) controller.abort()
       await Promise.allSettled([configuring, initialized])
       await messenger?.pause('closed')
       if (sending || draining) await new Promise(resolve => idleWaiters.add(resolve))
       await messenger?.close()
       await storage?.close()
-      await downloadWriteTail.catch(onError)
+      await downloadWriteTail.catch(reportError)
       await downloads?.close()
     }
   }