libp2r2p 0.11.25 → 0.11.27

package/README.md

@@ -10,7 +10,8 @@ power-ups used by that messenger.
 
 For remote-work scheduling, see [`libp2r2p/network`](network/README.md):
 `isOnline` probes connectivity and `onOnline` shares recovery monitoring,
-including retries when the browser omits its native `online` event.
+including retries when the browser omits its native `online` event and optional
+30-second expedited windows for foreground remote sends.
 
 ## Relay reads and lifecycle
 
@@ -1251,3 +1252,8 @@ uploads budget each chunk independently. Monotonic clocks never enter storage or
 Nostr events. Omitted timestamps keep the publication-local delay.
 `RelayPool.sendEvent` accepts a consumer `signal` without closing shared sockets.
 See [fallback and cancellation](private-messenger/session/README.md#relay-fallback).
+
+The 0.11.27 session publishes independently of local event-store persistence after
+its initial durable intent and exact-envelope checkpoint. `deliveryConfirmed`
+and the copied `localPersistence` summary distinguish relay acceptance from
+local storage. See `private-messenger/session/README.md` for retry and cleanup.

package/network/README.md

@@ -30,3 +30,34 @@ Successful probes do not guarantee a particular relay or HTTP server is reachabl
 Handle request failures, cancellations, and timeouts separately. Browsers can
 suspend background tabs, so recovery notification has no wall-clock guarantee.
 Consumers should keep their own work queues but should not duplicate probe loops.
+
+
+## Expedited connectivity detection
+
+`onOnline(handler, { strict = false, expediteForMs = 0, onDebug })` can request
+an optional urgent window (clamped to 30,000 ms; finite, nonnegative durations).
+The same realm/mode monitor coalesces subscriptions: urgent requests can advance
+the next check, at least two seconds after the previous start. Failed checks
+repeat at five seconds between starts, without overlapping slow checks. Native
+online/focus/visibility wakeups remain available. Removing a subscription removes
+its demand without stopping other listeners.
+
+The urgent loop does not spend/reset the ordinary jittered backoff. At expiry it
+returns to the ordinary deadline, or a fresh interval of the preserved retry step
+if that deadline passed; it never catches up missed checks. For example, a normal
+60-second wait remains a 60-second step after an unsuccessful urgent window.
+Connectivity returning after the window must await normal recovery or a new user
+send/retry; automatic retries never extend urgency. `expediteForMs` is scheduling
+advice, not evidence of Internet connectivity or a relay/ACK delivery deadline.
+
+Private-message sessions remember a runtime-only 30-second deadline for new
+remote intents and manual retry. Only work actually waiting for network subscribes
+with the remaining time, sharing one subscription per session. Self-chat, restored
+outbox entries, chunks and automatic retries never renew that deadline. Lock and
+close discard urgency. A confirmed monitor result resumes the existing automatic
+pause owner without another immediate probe; explicit pauses remain caller-owned.
+
+Optional `onDebug` reports only probe reason, state, remaining window and duration.
+Consumers wire it only in development; it is disabled by default. The monitor
+retains no diagnostic history. Session diagnostics additionally correlate the
+network wait and pause-release duration with the event ID.

package/network/index.js

@@ -133,6 +133,8 @@ export function createConnectivityMonitor ({
   _setTimeout = globalThis.setTimeout,
   _clearTimeout = globalThis.clearTimeout,
   _random = Math.random,
+  _now = () => performance.now(),
+  onDebug,
   reportError = error => console.error('Online listener failed', error)
 } = {}) {
   if (check !== undefined && typeof check !== 'function') throw new ValidationError('INVALID_CONNECTIVITY_CHECK')
@@ -148,21 +150,49 @@ export function createConnectivityMonitor ({
     try { Promise.resolve(entry.handler()).catch(reportError) } catch (error) { reportError(error) }
   }
 
-  function schedule (current) {
-    if (session !== current || !listeners.size) return
-    const delay = current.online ? 60000 : RETRY_DELAYS[Math.min(current.retry++, RETRY_DELAYS.length - 1)]
+  const urgencyEnd = () => Math.max(0, ...[...listeners].map(entry => entry.expediteUntil))
+  function arm (current) {
+    if (session !== current || current.pending || !listeners.size) return
+    if (current.timer != null) clearTimer(current.timer)
+    const now = _now()
+    const until = urgencyEnd()
+    const urgent = until > now && (!current.online || current.urgentDue != null)
+    // Urgent checks do not consume or reset the ordinary retry sequence.
+    if (!urgent && current.normalDue <= now) current.normalDue = now + current.normalDelay
+    let due = current.normalDue
+    if (urgent) due = Math.min(until, current.urgentDue ?? current.lastStartedAt + 5000)
     current.timer = setTimer(() => {
       current.timer = null
-      return probe(current)
-    }, Math.round(delay * (0.8 + _random() * 0.4)))
+      if (urgent && _now() >= urgencyEnd()) { arm(current); return }
+      return probe(current, urgent ? 'expedited' : 'backoff')
+    }, Math.max(0, due - now))
     current.timer?.unref?.()
   }
 
-  async function probe (current) {
+  function schedule (current, expedited) {
+    if (session !== current || !listeners.size) return
+    if (!expedited || current.online) {
+      const delay = current.online ? 60000 : RETRY_DELAYS[Math.min(current.retry++, RETRY_DELAYS.length - 1)]
+      current.normalDelay = Math.round(delay * (0.8 + _random() * 0.4))
+      current.normalDue = _now() + current.normalDelay
+    }
+    current.urgentDue = null
+    arm(current)
+  }
+
+  async function probe (current, reason = 'wake') {
     if (session !== current || current.pending) return
     if (current.timer != null) clearTimer(current.timer)
     current.timer = null
     current.pending = true
+    current.lastStartedAt = _now()
+    const expedited = reason === 'expedited'
+    const startedAt = _now()
+    const report = values => {
+      const entry = { stage: 'connectivity-probe', reason, expediteRemainingMs: Math.max(0, urgencyEnd() - _now()), ...values }
+      for (const callback of [onDebug, ...[...listeners].map(listener => listener.onDebug)]) { try { callback?.(entry) } catch {} }
+    }
+    report({ state: 'started' })
     try {
       const online = await runCheck({ signal: current.controller.signal })
       if (session !== current) return
@@ -179,12 +209,13 @@ export function createConnectivityMonitor ({
       for (const entry of listeners) entry.delivered = false
     } finally {
       current.pending = false
-      schedule(current)
+      report({ state: current.online ? 'online' : 'offline', elapsedMs: _now() - startedAt })
+      schedule(current, expedited)
     }
   }
 
   function start () {
-    const current = { online: false, retry: 0, timer: null, pending: false, controller: new AbortController() }
+    const current = { online: false, retry: 0, timer: null, pending: false, lastStartedAt: -Infinity, normalDue: Infinity, normalDelay: 5000, urgentDue: null, controller: new AbortController() }
     session = current
     current.wake = () => { probe(current) }
     current.connectionChanged = () => {
@@ -213,18 +244,29 @@ export function createConnectivityMonitor ({
   }
 
   // Notify once on confirmed initial connectivity, then after each detected reconnection.
-  function onOnline (handler) {
+  function onOnline (handler, { expediteForMs = 0, onDebug } = {}) {
     if (typeof handler !== 'function') throw new ValidationError('INVALID_ONLINE_HANDLER')
-    const entry = { handler, delivered: false }
+    if (!Number.isFinite(expediteForMs) || expediteForMs < 0) throw new ValidationError('INVALID_EXPEDITE_FOR_MS')
+    if (onDebug !== undefined && typeof onDebug !== 'function') throw new ValidationError('INVALID_CONNECTIVITY_DEBUG')
+    const entry = { handler, onDebug, delivered: false, expediteUntil: _now() + Math.min(expediteForMs, 30000) }
     listeners.add(entry)
     if (!session) start()
     else {
       const current = session
-      queueMicrotask(() => { probe(current) })
+      if (expediteForMs > 0 || urgencyEnd() > _now()) {
+        current.urgentDue = Math.max(_now(), current.lastStartedAt + 2000)
+        arm(current)
+      } else {
+        queueMicrotask(() => {
+          if (urgencyEnd() > _now()) arm(current)
+          else probe(current)
+        })
+      }
     }
     return () => {
       if (!listeners.delete(entry)) return
       if (!listeners.size) stop()
+      else arm(session)
     }
   }
 
@@ -234,12 +276,12 @@ export function createConnectivityMonitor ({
 const defaultMonitors = new Map()
 
 // Share probes, capped backoff and wake-up listeners per mode in this realm.
-export function onOnline (handler, { strict = false } = {}) {
+export function onOnline (handler, { strict = false, expediteForMs = 0, onDebug } = {}) {
   const key = strict ? 'strict' : 'lenient'
   let monitor = defaultMonitors.get(key)
   if (!monitor) {
     monitor = createConnectivityMonitor({ strict })
     defaultMonitors.set(key, monitor)
   }
-  return monitor.onOnline(handler)
+  return monitor.onOnline(handler, { expediteForMs, onDebug })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libp2r2p",
-  "version": "0.11.25",
+  "version": "0.11.27",
   "description": "Peer-to-relay-to-peer",
   "keywords": [
     "p2r2p",

package/private-messenger/helpers/pause-recovery.js

@@ -33,11 +33,14 @@ export function createPauseRecovery ({ attempt, online, onOnline, retryable, onE
     const run = () => {
       if (!active() || job.work) return job.work
       const work = (async () => {
-        if (online && !await online({ signal: job.controller.signal })) {
+        const confirmedOnline = job.confirmedOnline
+        job.confirmedOnline = false
+        if (online && !confirmedOnline && !await online({ signal: job.controller.signal })) {
           if (!active()) return
           job.stopOnline = onOnline(() => {
             if (!active()) return
             job.stopOnline?.(); job.stopOnline = null
+            job.confirmedOnline = true
             schedule(0)
           })
           return

package/private-messenger/session/README.md

@@ -77,7 +77,8 @@ Callbacks are optional `onDebug`, `onOutbox`, `onMedia`,
 account permissions/connectivity/lock state to availability and owns view subscriptions. There are no DOM or UI imports.
 
 `onSendError` identifies the main outbox message even when its quote, metadata,
-file chunks, or local persistence failed. The original error is also reported to
+file chunks, or self-chat persistence failed. Remote local-persistence failures
+use onError and the copied localPersistence summary, never a send failure. The original error is also reported to
 `onError` unchanged. It fires once per failed send attempt (including retries),
 not when persisted failures are read, nor for inbox/download/deletion operations
 or cancelled/closed sends. Apps own route visibility and user-intent filtering;
@@ -233,10 +234,10 @@ creates a fresh publication lifetime, without treating the pause as a user abort
 ## Independent local persistence and publication
 
 One encrypted outbox feeds two independent serial processors. Local persistence
-never waits for peer preparation or an in-flight publication. Remote entries
-become publishable only after their local progress checkpoint commits; failed
-checkpoints are retried even if the copies have already committed. Text may
-continue passing uploads between chunks after its local stage is ready.
+never waits for peer preparation or an in-flight publication. After the initial encrypted intent commits, remote preparation and publication
+never wait for event-store persistence. Only the exact prepared-envelope
+checkpoint gates transmission. Text continues passing uploads between chunks;
+its local stage need not have completed. Both stages use the admitted inner ID.
 
 Self entries emit `status: 'saved'` as soon as local persistence succeeds. They
 do not write a redundant localSaved checkpoint before removal. Remote entries
@@ -275,7 +276,7 @@ First acceptance of every required envelope emits saved independently of archive
 or cleanup. ACK progress checkpoints serialize with other entry writes. A crash
 between ACK and its checkpoint may replay the same envelope; acknowledged durable
 progress only archives. Archive failure never becomes `onSendError` or changes
-saved status. Removal waits for archival and outstanding entry writes.
+saved status. Removal waits for local persistence, archival and outstanding entry writes.
 
 At most one unit awaits archival per entry; a stalled upload yields its remote
 slot to other texts rather than accumulating the entire file. Cancel stops wire
@@ -283,3 +284,35 @@ work but retains potentially transmitted seeds until archival finishes. Close
 drains active local operations and leaves durable backoff work for restart.
 Diagnostics add publication/seed IDs, checkpoint time, archive wait/execution and
 first-ACK timing, without message or ciphertext contents.
+
+## Independent delivery status (0.11.27)
+
+`deliveryConfirmed` is an optional boolean in encrypted outbox JSON. It records
+relay confirmation separately from `localSaved`. Old entries normalize from
+saved delivery status, never from local progress; their event/file indices and
+prepared envelopes remain unchanged. No database migration is needed.
+
+`onOutbox` adds `localPersistence: { state, retryable }`, where state is pending,
+saved or failed. It is a presentation summary with no native error objects.
+A saved remote entry may still have pending/failed local work. Keep it visible
+through reload until the local store catches up. `retry(id)` on a confirmed
+entry repeats local/archival cleanup only and never renews network urgency.
+Recoverable local failures retain bounded backoff without clearing terminal
+remote errors or releasing network pauses. Self-chat still confirms on commit.
+
+Entry updates serialize through existing-only checkpoints; not-yet-started
+writes coalesce and capture the latest monotonic progress at transaction start.
+Prepared-publication callers wait for the resulting durable snapshot. An ACK
+checkpoint may merge local progress but never requires it. Shutdown/lock waits
+for admitted local writes; cancellation cannot recreate a removed intent.
+
+The local failure summary remains failed while a retry is queued or running;
+unrelated snapshots cannot hide its warning before commit. Retry admission is
+runtime-only and temporarily makes that summary non-retryable. A failed retry
+restores retryability after its operation ends; a successful commit clears the
+failure. This does not change the already confirmed remote status.
+
+Legacy single-stage failure flags with incomplete local progress normalize into
+local failure state, preserving manual-only retry refusals. The new delivery
+marker distinguishes those records from a modern remote failure racing local
+persistence. Both formats enter the same processors after normalization.

package/private-messenger/session/helpers/publication-journal.js

@@ -4,13 +4,19 @@ import { isRecoverableStorageFailure } from '../../helpers/pause-recovery.js'
 
 export function createPublicationJournal ({ entries, store, archive, changed, onError, debug, setTimer = setTimeout, clearTimer = clearTimeout, random = Math.random }) {
   const writes = new Map()
+  const waitingWrites = new Map()
   const failed = new Set()
   const durable = new WeakSet()
   const queued = new WeakMap()
   let working; let stopped = false; let enabled = false; let timer; let delay = 1000
   function write (entry) {
+    if (waitingWrites.has(entry.id)) return waitingWrites.get(entry.id)
     const previous = writes.get(entry.id) || Promise.resolve()
-    const work = previous.catch(() => {}).then(() => store().put(structuredClone(entry), { existing: true }))
+    const work = previous.catch(() => {}).then(() => {
+      waitingWrites.delete(entry.id)
+      return store().put(structuredClone(entry), { existing: true })
+    })
+    waitingWrites.set(entry.id, work)
     writes.set(entry.id, work)
     work.finally(() => { if (writes.get(entry.id) === work) writes.delete(entry.id) }).catch(() => {})
     return work

package/private-messenger/session/index.js

@@ -45,7 +45,7 @@ function messengerStatusSnapshot (value) {
   return { closed: value.closed, paused: value.paused, pauseReasons: [...value.pauseReasons] }
 }
 
-export function createPrivateMessageSession ({ owner, signer, eventStore, messageStorage, chunkStorage, recoveryStorage, fallbackRelays = [], fallbackDelayMs = null, mode = 'seeder', seedersForPeer = peer => [peer], allowedKinds = [5, 9, 1063, 34601], useContentKeys = true, pendingDecryptionReady = true, onMedia = () => {}, onOutbox = () => {}, onError = () => {}, onSendError = () => {}, onDebug, Messenger = createPrivateMessenger, openOutbox = createChatOutbox, FileTransfer = createPrivateFileTransfer, _onOnline = onOnline, _isOnline = isOnline, _getIykcProofs = getIykcProofs, _setTimeout = setTimeout, _clearTimeout = clearTimeout, _random = Math.random, openDownloads = options => createChatOutbox({ ...options, namespace: 'downloads' }) }) {
+export function createPrivateMessageSession ({ owner, signer, eventStore, messageStorage, chunkStorage, recoveryStorage, fallbackRelays = [], fallbackDelayMs = null, mode = 'seeder', seedersForPeer = peer => [peer], allowedKinds = [5, 9, 1063, 34601], useContentKeys = true, pendingDecryptionReady = true, onMedia = () => {}, onOutbox = () => {}, onError = () => {}, onSendError = () => {}, onDebug, Messenger = createPrivateMessenger, openOutbox = createChatOutbox, FileTransfer = createPrivateFileTransfer, _onOnline = onOnline, _isOnline = isOnline, _getIykcProofs = getIykcProofs, _setTimeout = setTimeout, _clearTimeout = clearTimeout, _random = Math.random, _now = () => performance.now(), openDownloads = options => createChatOutbox({ ...options, namespace: 'downloads' }) }) {
   fallbackRelays = normalizeFallbackRelays(fallbackRelays)
   fallbackDelayMs = normalizeFallbackDelay(fallbackDelayMs)
   if (typeof pendingDecryptionReady !== 'boolean') throw new ValidationError('INVALID_PENDING_DECRYPTION_READY')
@@ -67,9 +67,11 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   const entries = new Map()
   const cancelled = new Set()
   const attemptStarts = new Map()
+  const networkUrgency = new Map()
   const sendControllers = new Map()
-  const localReady = new Set()
   const localIdleWaiters = new Set()
+  // Last local failure survives retry admission until an actual commit.
+  const localRetries = new Set()
   const cleanups = new Map()
   const queuedAt = new WeakMap()
   const debug = (entry, stage, startedAt, coordinates = {}) => {
@@ -79,6 +81,8 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   const offlineSends = new Set()
   const pausedSends = new Set()
   let messengerStatus
+  let networkPauseStartedAt
+  let networkConfirmed = false
   let messengerBinding
   let storageBlocked = false
   const inboxRecovery = createPauseRecovery({
@@ -89,22 +93,32 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   let inboxError
   const stateChanged = state => {
     if (closed) return
+    const wasNetworkPaused = messengerStatus?.pauseReasons.includes('network')
     messengerStatus = messengerStatusSnapshot(state)
+    if (!wasNetworkPaused && state.pauseReasons.includes('network')) { networkPauseStartedAt = _now(); networkConfirmed = false }
+    if (wasNetworkPaused && !state.pauseReasons.includes('network')) {
+      for (const entry of entries.values()) if (entry.peer !== owner && entry.status !== 'saved') debug(entry, 'network-pause-released', undefined, { elapsedMs: _now() - networkPauseStartedAt })
+      networkPauseStartedAt = undefined; networkConfirmed = false
+    }
     if (!available || state.closed) return
     if (state.paused) {
       for (const entry of entries.values()) {
         if (entry.peer !== owner && entry.failed && entry.status === 'pending') pausedSends.add(entry.id)
       }
-      if (![...entries.values()].some(entry => pendingRetryable(entry) && !pausedSends.has(entry.id))) clearSendRetry()
+      if (![...entries.values()].some(entry => (entry.localFailed && entry.localRetryable) || (pendingRetryable(entry) && !pausedSends.has(entry.id)))) clearSendRetry()
+      watchOfflineSends()
       return
     }
     clearSendRetry()
     for (const id of pausedSends) { const entry = entries.get(id); if (entry) { entry.failed = false; attemptStarts.set(entry.id, performance.now()) } }
     pausedSends.clear()
+    if ([...entries.values()].some(entry => entry.localFailed && entry.localRetryable)) scheduleSendRetry()
+    watchOfflineSends()
     // The callback can run inside construction/resume, before configure settles.
     queueMicrotask(() => pump())
   }
   let stopOnline
+  let requestedUrgency = 0
   let sendRetryTimer
   let sendRetryDelay = SEND_RETRY_MIN_MS
   let messenger
@@ -141,7 +155,12 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   let redrain = false
   const idleWaiters = new Set()
   const settled = () => { if (!sending && !localSaving && !enqueuing && !draining && !cleanups.size) { for (const resolve of idleWaiters) resolve(); idleWaiters.clear() } }
-  const emit = () => onOutbox([...entries.values()].filter(entry => !entry.deletion && !entry.cancelled))
+  const localComplete = entry => entry.localSaved.every(Boolean)
+  const completed = entry => localComplete(entry) && (entry.peer === owner || entry.deliveryConfirmed)
+  const emit = () => onOutbox([...entries.values()].filter(entry => !entry.deletion && !entry.cancelled).map(entry => ({
+    ...entry,
+    localPersistence: { state: localComplete(entry) ? 'saved' : entry.localFailed ? 'failed' : 'pending', retryable: Boolean(entry.localFailed && entry.localRetryable && !localRetries.has(entry.id)) }
+  })))
   const journal = createPublicationJournal({
     entries, store: () => storage, onError: reportError, debug, setTimer: _setTimeout, clearTimer: _clearTimeout, random: _random,
     archive: async (entry, rows) => {
@@ -152,7 +171,8 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
       }
     },
     changed: entry => {
-      if (!entry.prepared && (entry.status === 'saved' || entry.cancelled)) cleanupEntry(entry)
+      watchOfflineSends()
+      if (!entry.prepared && (completed(entry) || entry.cancelled)) cleanupEntry(entry)
       else if (!closed && available) pumpRemote()
     }
   })
@@ -161,11 +181,17 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     storage = await openOutbox({ owner, signer, onDebug })
     for (const entry of await storage.list()) {
       // Old encrypted entries retain progress and enter this same pipeline.
+      const legacyLocalFailure = entry.deliveryConfirmed === undefined && entry.failed && !entry.localSaved.every(Boolean)
+      if (legacyLocalFailure) {
+        entry.localFailed = true; entry.localRetryable = Boolean(entry.retryable || entry.status === 'pending')
+        if (entry.peer !== owner) { entry.failed = false; entry.status = 'pending' }
+      }
+      entry.deliveryConfirmed ??= entry.peer !== owner && entry.status === 'saved'
+      if (entry.deliveryConfirmed) entry.status = 'saved'
       if (entry.cancelled) cancelled.add(entry.id)
       entries.set(entry.id, entry)
       journal.adopt(entry)
       attemptStarts.set(entry.id, performance.now())
-      if (entry.localSaved.every(Boolean)) localReady.add(entry.id)
       queuedAt.set(entry, Date.now())
     }
     emit()
@@ -419,10 +445,12 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   }
   async function cleanupEntry (entry) {
     if (entry.prepared) { journal.wake(); return }
+    if (!entry.cancelled && !completed(entry)) return
+    if (entry.failed && entry.status === 'saved') return
     if (cleanups.has(entry.id)) return cleanups.get(entry.id)
     const startedAt = Date.now()
     const work = Promise.resolve().then(async () => { await journal.flush(entry); await storage.remove(entry.id) }).then(() => {
-      entries.delete(entry.id); localReady.delete(entry.id); attemptStarts.delete(entry.id)
+      entries.delete(entry.id); localRetries.delete(entry.id); attemptStarts.delete(entry.id)
       debug(entry, 'outbox-cleanup', startedAt)
       emit()
     }).catch(error => {
@@ -434,7 +462,49 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     cleanups.set(entry.id, work)
     return work
   }
-  async function sendEntry (entry, localOnly = false) {
+  async function saveEntry (entry) {
+    if (entry.peer === owner) { entry.status = 'pending'; emit() }
+    const releaseForeground = foreground.enter()
+    const active = async () => {
+      if (storage.has && !await storage.has(entry.id)) { cancelled.add(entry.id); sendControllers.get(entry.id)?.abort() }
+      if (closed || !available || cancelled.has(entry.id) || (entry.peer !== owner && !peers.has(entry.peer))) throw new Error('CHAT_UNAVAILABLE')
+    }
+    const startedAt = Date.now()
+    try {
+      debug(entry, 'local-start', queuedAt.get(entry))
+      for (let index = 0; index < entry.events.length; index++) {
+        await active()
+        if (entry.localSaved[index]) continue
+        const event = entry.events[index]
+        const hearsay = !event.sig && event.pubkey !== owner
+        const result = await messageStorage.save(event, { peerPubkey: entry.peer, hearsay })
+        if (result?.result?.code === 'blocked') { cancelled.add(entry.id); entry.cancelled = true; sendControllers.get(entry.id)?.abort(); await active() }
+        if (!result?.result?.ok) throw Object.assign(new Error('MESSAGE_STORAGE_FAILED'), { code: result?.result?.code?.toUpperCase() })
+        entry.localSaved[index] = true
+      }
+      entry.localFailed = false
+      debug(entry, 'local-stored', startedAt)
+      if (entry.peer === owner) entry.status = 'saved'
+      emit()
+      if (completed(entry)) cleanupEntry(entry)
+      else await journal.write(entry)
+    } catch (error) {
+      if (cancelled.has(entry.id)) { sendControllers.get(entry.id)?.abort(); entry.cancelled = true; cleanupEntry(entry) } else if (!closed && available) {
+        entry.localFailed = true; entry.localRetryable = retryable(error)
+        if (entry.peer === owner) { entry.status = 'error'; entry.retryable = entry.localRetryable }
+        await journal.write(entry).catch(reportError)
+        reportError(error)
+        if (entry.localRetryable) scheduleSendRetry()
+        if (entry.peer === owner && !entry.deletion) onSendError(error, { id: entry.id, peer: entry.peer })
+        emit()
+      }
+    } finally {
+      const retried = localRetries.delete(entry.id)
+      releaseForeground()
+      if (retried && entry.localFailed) emit()
+    }
+  }
+  async function sendEntry (entry) {
     if (entry.status === 'saved') return
     const releaseForeground = foreground.enter()
     entry.status = 'pending'; emit()
@@ -442,36 +512,9 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     sendControllers.set(entry.id, controller)
     try {
       const active = async () => {
-        if (storage.has && !await storage.has(entry.id)) cancelled.add(entry.id)
+        if (storage.has && !await storage.has(entry.id)) { cancelled.add(entry.id); sendControllers.get(entry.id)?.abort() }
         if (closed || !available || cancelled.has(entry.id) || (entry.peer !== owner && !peers.has(entry.peer))) throw new Error('CHAT_UNAVAILABLE')
       }
-      if (localOnly) {
-        debug(entry, 'local-start', queuedAt.get(entry))
-        const startedAt = Date.now()
-        for (let index = 0; index < entry.events.length; index++) {
-          await active()
-          if (entry.localSaved[index]) continue
-          const event = entry.events[index]
-          const hearsay = !event.sig && event.pubkey !== owner
-          const result = await messageStorage.save(event, { peerPubkey: entry.peer, hearsay })
-          if (result?.result?.code === 'blocked') { cancelled.add(entry.id); await active() }
-          if (!result?.result?.ok) throw Object.assign(new Error('MESSAGE_STORAGE_FAILED'), { code: result?.result?.code?.toUpperCase() })
-          entry.localSaved[index] = true
-        }
-        debug(entry, 'local-stored', startedAt)
-        await active()
-        if (entry.peer === owner) {
-          entry.status = 'saved'; emit()
-          cleanupEntry(entry)
-        } else {
-          // Retry this checkpoint even when a preceding attempt saved all copies
-          // but failed to persist progress. Only then admit remote publication.
-          await journal.write(entry)
-          await active()
-          localReady.add(entry.id)
-        }
-        return
-      }
       if (entry.peer !== owner && !preparation.get(entry.peer)) {
         if (preparation.error(entry.peer)) throw preparation.error(entry.peer)
         preparation.request(entry.peer).catch(() => {})
@@ -505,14 +548,10 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
           await active()
           if (entry.prepared) { journal.accept(entry); return }
           await journal.write(entry)
-          if ([...entries.values()].some(pending => !pending.files.length && pending.peer !== owner && !pending.failed && !localReady.has(pending.id))) {
-            await pumpLocal()
-            if (localSaving) await new Promise(resolve => localIdleWaiters.add(resolve))
-          }
           let admitted = 0
           for (const pending of entries.values()) {
             if (closed || !available || admitted >= 8) break
-            if (!localReady.has(pending.id) || pending.peer === owner || pending.status === 'saved' || pending.files.length || pending.failed || cancelled.has(pending.id) || pending.prepared?.accepted || !peers.has(pending.peer)) continue
+            if (pending.peer === owner || pending.status === 'saved' || pending.files.length || pending.failed || cancelled.has(pending.id) || pending.prepared?.accepted || !peers.has(pending.peer)) continue
             admitted++
             await sendEntry(pending)
           }
@@ -526,21 +565,23 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         debug(entry, 'publication-accepted', startedAt)
         await active()
         entry.index++
-        if (entry.index === entry.events.length) { entry.status = 'saved'; emit() }
+        if (entry.index === entry.events.length) { entry.deliveryConfirmed = true; entry.status = 'saved'; emit() }
         if (entry.prepared) { journal.accept(entry); return }
         if (entry.index < entry.events.length) await journal.write(entry)
       }
-      entry.status = 'saved'; emit()
+      entry.deliveryConfirmed = true; entry.status = 'saved'; emit()
+      await journal.write(entry)
       cleanupEntry(entry)
     } catch (cause) {
       // Pauses can surface at any stage (text publication, file authorization
       // or chunk delivery). Normalize all of them into the retryable path.
-      const error = cause?.retryWhenAvailable ? cause : (isUnavailableSend(cause) ? unavailableError(cause, controller.signal) : cause)
+      const error = !available || closed ? unavailableError(cause) : cause?.retryWhenAvailable ? cause : (isUnavailableSend(cause) ? unavailableError(cause, controller.signal) : cause)
       if (cancelled.has(entry.id)) {
         entry.cancelled = true
         if (entry.prepared) { await journal.write(entry); journal.wake() } else { await storage.remove(entry.id); entries.delete(entry.id) }
       } else {
-        entry.status = error.retryWhenAvailable ? 'pending' : 'error'; entry.failed = true; entry.retryable = retryable(error)
+        if (!entry.deliveryConfirmed) entry.status = error.retryWhenAvailable ? 'pending' : 'error'
+        entry.failed = true; entry.retryable = retryable(error)
         await journal.write(entry).catch(reportError)
         if (entry.peer !== owner && error.retryWhenAvailable && messenger?.readStatus().paused) pausedSends.add(entry.id)
         else if (isUnavailableSend(cause) && cause.pauseReasons?.length && available && !closed) {
@@ -553,13 +594,13 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         // The failed wire event may be a quote or file chunk. Report the
         // owning outbox item separately, without mutating the native error.
         if (error.retryWhenOnline) offlineSends.add(entry.id)
-        if (entry.failed && error.retryWhenAvailable && !pausedSends.has(entry.id)) scheduleSendRetry()
-        if (!closed && !entry.deletion && !cancelled.has(entry.id) && !error.retryWhenAvailable) onSendError(error, { id: entry.id, peer: entry.peer })
+        if (entry.failed && (error.retryWhenAvailable || (entry.deliveryConfirmed && entry.retryable)) && !pausedSends.has(entry.id)) scheduleSendRetry()
+        if (!closed && !entry.deletion && !cancelled.has(entry.id) && !entry.deliveryConfirmed && !error.retryWhenAvailable) onSendError(error, { id: entry.id, peer: entry.peer })
       }
       emit()
     } finally { sendControllers.delete(entry.id); releaseForeground() }
   }
-  function stopOnlineRetry () { stopOnline?.(); stopOnline = undefined }
+  function stopOnlineRetry () { stopOnline?.(); stopOnline = undefined; requestedUrgency = 0 }
   // Transient availability failures without an active messenger pause retain
   // bounded retries. Observed pauses wait exclusively for their release.
   function clearSendRetry () {
@@ -570,7 +611,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     clearSendRetry()
     sendRetryDelay = SEND_RETRY_MIN_MS
   }
-  const pendingRetryable = entry => Boolean(entry.failed && !cancelled.has(entry.id) && (entry.retryable || entry.status === 'pending'))
+  const pendingRetryable = entry => Boolean(!cancelled.has(entry.id) && ((entry.localFailed && entry.localRetryable) || (entry.failed && (entry.retryable || entry.status === 'pending'))))
   function scheduleSendRetry () {
     if (closed || !available || sendRetryTimer) return
     const delay = Math.min(SEND_RETRY_MAX_MS, sendRetryDelay * (0.8 + _random() * 0.4))
@@ -580,32 +621,60 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
       if (closed || !available) return
       let retried = false
       for (const entry of entries.values()) {
-        if (!pendingRetryable(entry) || pausedSends.has(entry.id)) continue
+        if (!pendingRetryable(entry)) continue
+        if (entry.localFailed && entry.localRetryable) { localRetries.add(entry.id); retried = true }
+        if (pausedSends.has(entry.id) || !entry.failed || !(entry.retryable || entry.status === 'pending')) continue
         entry.failed = false
         attemptStarts.set(entry.id, performance.now())
         if (entry.status === 'saved') { cleanupEntry(entry); continue }
         retried = true
       }
-      if (retried) pump()
+      if (retried) { emit(); pump() }
     }, delay)
     sendRetryTimer.unref?.()
   }
   function watchOfflineSends () {
-    if (closed || !available || !offlineSends.size) { stopOnlineRetry(); return }
-    if (stopOnline) return
-    // A fresh listener receives confirmed connectivity even when a brief outage
-    // occurred between the app's long-lived monitor checks.
+    const waiting = [...entries.values()].filter(entry => entry.peer !== owner && peers.has(entry.peer) && entry.status !== 'saved' && !entry.cancelled && !cancelled.has(entry.id) && !entry.prepared?.accepted && (!entry.failed || pendingRetryable(entry)) &&
+      (offlineSends.has(entry.id) || (!networkConfirmed && messengerStatus?.pauseReasons.includes('network'))))
+    for (const id of networkUrgency.keys()) {
+      const entry = entries.get(id)
+      if (!entry || entry.status === 'saved' || entry.cancelled || cancelled.has(id)) networkUrgency.delete(id)
+    }
+    if (closed || !available || !waiting.length) { stopOnlineRetry(); return }
+    const deadline = Math.max(0, ...waiting.map(entry => networkUrgency.get(entry.id) ?? 0))
+    if (stopOnline && deadline === requestedUrgency) return
+    const previous = stopOnline
+    requestedUrgency = deadline
+    const startedAt = _now()
+    // Replacing a subscription retains the shared loop and its backoff. This is
+    // only done when a new user action extends the window, never per chunk/retry.
     stopOnline = _onOnline(() => {
       stopOnlineRetry()
       if (closed || !available) return
+      networkConfirmed = true
+      for (const entry of waiting) debug(entry, 'network-confirmed', undefined, { elapsedMs: _now() - startedAt })
       for (const id of offlineSends) {
         const entry = entries.get(id)
         if (entry?.retryable) { entry.failed = false; attemptStarts.set(entry.id, performance.now()) }
       }
       offlineSends.clear()
+      // The messenger's automatic recovery owns its network pause; the same
+      // monitor also notifies that recovery job. Never resume explicit pauses.
       return schedule()
+    }, {
+      expediteForMs: Math.max(0, deadline - _now()),
+      ...(onDebug
+        ? {
+            onDebug: measure => {
+              const entry = waiting[0]
+              debug(entry, measure.stage, undefined, measure)
+            }
+          }
+        : {})
     })
+    previous?.()
   }
+
   async function pumpLocal () {
     if (!available || closed || !storage) return
     if (localSaving) { relocal = true; return }
@@ -615,14 +684,16 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         relocal = false
         for (const entry of entries.values()) {
           if (closed || !available) break
-          if (entry.failed || cancelled.has(entry.id) || (entry.peer !== owner && !peers.has(entry.peer))) continue
-          if (entry.status === 'saved') { cleanupEntry(entry); continue }
-          if (localReady.has(entry.id) && entry.peer !== owner) continue
-          await sendEntry(entry, true)
+          if ((entry.localFailed && !localRetries.has(entry.id)) || cancelled.has(entry.id) || (entry.peer !== owner && !peers.has(entry.peer))) continue
+          if (localComplete(entry) && !entry.localFailed) { if (entry.status === 'saved') cleanupEntry(entry); continue }
+          await saveEntry(entry)
           pumpRemote()
         }
       } while (relocal)
-    } finally { localSaving = false; for (const resolve of localIdleWaiters) resolve(); localIdleWaiters.clear(); settled() }
+    } finally {
+      if ([...entries.values()].some(entry => (entry.localFailed && entry.localRetryable) || (entry.status === 'saved' && entry.failed && entry.retryable))) scheduleSendRetry()
+      localSaving = false; for (const resolve of localIdleWaiters) resolve(); localIdleWaiters.clear(); settled()
+    }
   }
   async function pumpRemote () {
     if (!available || closed || !storage || !messenger) return
@@ -634,7 +705,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         for (const entry of entries.values()) {
           if (closed || !available) break
           if (entry.prepared?.accepted) { journal.wake(); continue }
-          if (entry.peer === owner || entry.status === 'saved' || !localReady.has(entry.id) || !peers.has(entry.peer) || entry.failed || cancelled.has(entry.id)) continue
+          if (entry.peer === owner || entry.status === 'saved' || !peers.has(entry.peer) || entry.failed || cancelled.has(entry.id)) continue
           if (!preparation.get(entry.peer) && !preparation.error(entry.peer)) {
             preparation.request(entry.peer).catch(() => {})
             continue
@@ -738,6 +809,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
       const next = new Set([...values].filter(peer => peer !== owner))
       if (next.size === peers.size && [...next].every(peer => peers.has(peer))) return configuring
       peers.clear(); for (const peer of next) peers.add(peer)
+      watchOfflineSends()
       preparation.reconcile(peers)
       if (pendingDecryptionPeer && !peers.has(pendingDecryptionPeer)) {
         pendingDecryptionPeer = null
@@ -757,20 +829,27 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
       const changed = available !== (value === true)
       available = value === true
       if (!changed && !available) return
-      stopOnlineRetry(); offlineSends.clear()
+      if (changed || !available) { stopOnlineRetry(); offlineSends.clear() }
+      if (!available) { networkUrgency.clear(); networkConfirmed = false }
       if (available) resetSendRetry()
       else clearSendRetry()
       if (changed) lifecycle++
       if (!available) {
+        for (const controller of sendControllers.values()) controller.abort()
         journal.setAvailable(false)
         preparation.setAvailable(false)
         for (const peer of channels.keys()) if (!preparation.get(peer)) channels.delete(peer)
-        inboxRecovery.stop(); await messenger?.pause('signer'); return
+        inboxRecovery.stop(); await messenger?.pause('signer')
+        if (localSaving) await new Promise(resolve => localIdleWaiters.add(resolve))
+        return
       }
       await ready()
       journal.setAvailable(true)
       pumpLocal()
-      for (const entry of entries.values()) if (pendingRetryable(entry)) { entry.failed = false; attemptStarts.set(entry.id, performance.now()) }
+      for (const entry of entries.values()) {
+        if (entry.localRetryable) localRetries.add(entry.id)
+        if (entry.failed && (entry.retryable || entry.status === 'pending')) { entry.failed = false; attemptStarts.set(entry.id, performance.now()) }
+      }
       if (storageBlocked) inboxRecovery.start({ immediate: true })
       if (!changed && messenger && !configurationFailed) { preparation.setAvailable(true); pump(); return configuring }
       return schedule()
@@ -778,6 +857,8 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     async enqueue ({ peer, event, context = [], requiredFiles = [], deletion = false, attemptStartedAt }) {
       if (closed || !available || (peer !== owner && !peers.has(peer))) throw new Error('CHAT_UNAVAILABLE')
       if (attemptStartedAt !== undefined && (!Number.isFinite(attemptStartedAt) || attemptStartedAt < 0)) throw new ValidationError('INVALID_ATTEMPT_STARTED_AT')
+      const urgencyUntil = _now() + 30000
+      const urgencyLifecycle = lifecycle
       const releaseForeground = foreground.enter()
       enqueuing++
       try {
@@ -786,7 +867,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         const id = getEventHash(main)
         const events = [...context.map(value => wireEvent(value, owner)), main]
         const files = events.filter(value => value.kind === 1063).map(value => ({ ...decodeFileMetadata(value), optional: !requiredFiles.includes(getEventHash(value)) })).filter(file => file.service === 'irfs').flatMap(file => [file, ...(file.thumbnail?.root ? [{ ...file.thumbnail, optional: file.optional }] : [])])
-        const entry = { id, peer, event: { ...main, id }, events, files, index: 0, fileIndex: 0, chunkIndex: 0, localSaved: context.map(() => true).concat(false), status: 'pending', deletion }
+        const entry = { id, peer, event: { ...main, id }, events, files, index: 0, fileIndex: 0, chunkIndex: 0, localSaved: context.map(() => true).concat(false), status: 'pending', deliveryConfirmed: false, deletion }
         const startedAt = Date.now()
         debug(entry, 'outbox-start')
         await storage.put(entry)
@@ -797,31 +878,51 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         // An accepted durable intent survives shutdown/locking for replay. Only
         // explicit cancellation removes it; no late callback or work is admitted.
         if (closed) return id
-        entries.set(id, entry); emit(); pump()
+        entries.set(id, entry)
+        if (peer !== owner && available && lifecycle === urgencyLifecycle) networkUrgency.set(id, urgencyUntil)
+        watchOfflineSends(); emit(); pump()
         if (available && peer !== owner) preparePeer(peer).catch(() => {})
         return id
       } finally { releaseForeground(); enqueuing--; settled() }
     },
     async retry (id) {
-      offlineSends.delete(id); pausedSends.delete(id); watchOfflineSends()
       if (storageBlocked) inboxRecovery.start({ immediate: true })
       await ready()
       const entry = entries.get(id)
-      if (entry) { attemptStarts.set(id, performance.now()); journal.retry(); entry.failed = false; resetSendRetry(); if (entry.peer !== owner) preparePeer(entry.peer).catch(() => {}); return pump() }
+      if (!entry) return
+      journal.retry()
+      if (entry.deliveryConfirmed) {
+        // This action belongs to local recovery, never a fresh network attempt.
+        if (entry.localFailed && !entry.localRetryable) return
+        if (entry.localFailed) localRetries.add(id)
+        entry.failed = false
+        resetSendRetry(); emit()
+        return pumpLocal()
+      }
+      if (entry.localFailed) localRetries.add(id)
+      if (entry.peer !== owner && entry.status !== 'saved' && available) networkUrgency.set(id, _now() + 30000)
+      // Renew while the old wait is still subscribed, preserving the monitor's
+      // generation/backoff even if this session is its only consumer.
+      watchOfflineSends()
+      offlineSends.delete(id); pausedSends.delete(id)
+      attemptStarts.set(id, performance.now()); journal.retry(); entry.failed = false; resetSendRetry()
+      if (entry.peer !== owner) preparePeer(entry.peer).catch(() => {})
+      return pump()
     },
     async cancel (id) {
       cancelled.add(id)
+      localRetries.delete(id)
       sendControllers.get(id)?.abort()
       offlineSends.delete(id); pausedSends.delete(id); watchOfflineSends()
       await ready()
       const entry = entries.get(id)
-      if (entry?.prepared) { entry.cancelled = true; await journal.write(entry); journal.wake() } else { entries.delete(id); localReady.delete(id); await storage.remove(id) }
+      if (entry?.prepared) { entry.cancelled = true; await journal.write(entry); journal.wake() } else { entries.delete(id); await storage.remove(id) }
       emit()
     },
     close () {
       return (closeWork ??= (async () => {
-        closed = true; available = false; lifecycle++
-        stopOnlineRetry(); offlineSends.clear(); activeDownloads.clear(); pendingPriorityRanges.clear()
+        closed = true; available = false; lifecycle++; localRetries.clear()
+        stopOnlineRetry(); offlineSends.clear(); networkUrgency.clear(); activeDownloads.clear(); pendingPriorityRanges.clear()
         clearSendRetry(); inboxRecovery.stop(); preparation.close(); foreground.close(); pausedSends.clear()
         for (const controller of sendControllers.values()) controller.abort()
         await Promise.allSettled([configuring, initialized, messengerWork, fileSetupWork])