libp2r2p 0.11.26 → 0.11.27

package/README.md

@@ -1252,3 +1252,8 @@ uploads budget each chunk independently. Monotonic clocks never enter storage or
 Nostr events. Omitted timestamps keep the publication-local delay.
 `RelayPool.sendEvent` accepts a consumer `signal` without closing shared sockets.
 See [fallback and cancellation](private-messenger/session/README.md#relay-fallback).
+
+The 0.11.27 session publishes independently of local event-store persistence after
+its initial durable intent and exact-envelope checkpoint. `deliveryConfirmed`
+and the copied `localPersistence` summary distinguish relay acceptance from
+local storage. See `private-messenger/session/README.md` for retry and cleanup.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libp2r2p",
-  "version": "0.11.26",
+  "version": "0.11.27",
   "description": "Peer-to-relay-to-peer",
   "keywords": [
     "p2r2p",

package/private-messenger/session/README.md

@@ -77,7 +77,8 @@ Callbacks are optional `onDebug`, `onOutbox`, `onMedia`,
 account permissions/connectivity/lock state to availability and owns view subscriptions. There are no DOM or UI imports.
 
 `onSendError` identifies the main outbox message even when its quote, metadata,
-file chunks, or local persistence failed. The original error is also reported to
+file chunks, or self-chat persistence failed. Remote local-persistence failures
+use onError and the copied localPersistence summary, never a send failure. The original error is also reported to
 `onError` unchanged. It fires once per failed send attempt (including retries),
 not when persisted failures are read, nor for inbox/download/deletion operations
 or cancelled/closed sends. Apps own route visibility and user-intent filtering;
@@ -233,10 +234,10 @@ creates a fresh publication lifetime, without treating the pause as a user abort
 ## Independent local persistence and publication
 
 One encrypted outbox feeds two independent serial processors. Local persistence
-never waits for peer preparation or an in-flight publication. Remote entries
-become publishable only after their local progress checkpoint commits; failed
-checkpoints are retried even if the copies have already committed. Text may
-continue passing uploads between chunks after its local stage is ready.
+never waits for peer preparation or an in-flight publication. After the initial encrypted intent commits, remote preparation and publication
+never wait for event-store persistence. Only the exact prepared-envelope
+checkpoint gates transmission. Text continues passing uploads between chunks;
+its local stage need not have completed. Both stages use the admitted inner ID.
 
 Self entries emit `status: 'saved'` as soon as local persistence succeeds. They
 do not write a redundant localSaved checkpoint before removal. Remote entries
@@ -275,7 +276,7 @@ First acceptance of every required envelope emits saved independently of archive
 or cleanup. ACK progress checkpoints serialize with other entry writes. A crash
 between ACK and its checkpoint may replay the same envelope; acknowledged durable
 progress only archives. Archive failure never becomes `onSendError` or changes
-saved status. Removal waits for archival and outstanding entry writes.
+saved status. Removal waits for local persistence, archival and outstanding entry writes.
 
 At most one unit awaits archival per entry; a stalled upload yields its remote
 slot to other texts rather than accumulating the entire file. Cancel stops wire
@@ -283,3 +284,35 @@ work but retains potentially transmitted seeds until archival finishes. Close
 drains active local operations and leaves durable backoff work for restart.
 Diagnostics add publication/seed IDs, checkpoint time, archive wait/execution and
 first-ACK timing, without message or ciphertext contents.
+
+## Independent delivery status (0.11.27)
+
+`deliveryConfirmed` is an optional boolean in encrypted outbox JSON. It records
+relay confirmation separately from `localSaved`. Old entries normalize from
+saved delivery status, never from local progress; their event/file indices and
+prepared envelopes remain unchanged. No database migration is needed.
+
+`onOutbox` adds `localPersistence: { state, retryable }`, where state is pending,
+saved or failed. It is a presentation summary with no native error objects.
+A saved remote entry may still have pending/failed local work. Keep it visible
+through reload until the local store catches up. `retry(id)` on a confirmed
+entry repeats local/archival cleanup only and never renews network urgency.
+Recoverable local failures retain bounded backoff without clearing terminal
+remote errors or releasing network pauses. Self-chat still confirms on commit.
+
+Entry updates serialize through existing-only checkpoints; not-yet-started
+writes coalesce and capture the latest monotonic progress at transaction start.
+Prepared-publication callers wait for the resulting durable snapshot. An ACK
+checkpoint may merge local progress but never requires it. Shutdown/lock waits
+for admitted local writes; cancellation cannot recreate a removed intent.
+
+The local failure summary remains failed while a retry is queued or running;
+unrelated snapshots cannot hide its warning before commit. Retry admission is
+runtime-only and temporarily makes that summary non-retryable. A failed retry
+restores retryability after its operation ends; a successful commit clears the
+failure. This does not change the already confirmed remote status.
+
+Legacy single-stage failure flags with incomplete local progress normalize into
+local failure state, preserving manual-only retry refusals. The new delivery
+marker distinguishes those records from a modern remote failure racing local
+persistence. Both formats enter the same processors after normalization.

package/private-messenger/session/helpers/publication-journal.js

@@ -4,13 +4,19 @@ import { isRecoverableStorageFailure } from '../../helpers/pause-recovery.js'
 
 export function createPublicationJournal ({ entries, store, archive, changed, onError, debug, setTimer = setTimeout, clearTimer = clearTimeout, random = Math.random }) {
   const writes = new Map()
+  const waitingWrites = new Map()
   const failed = new Set()
   const durable = new WeakSet()
   const queued = new WeakMap()
   let working; let stopped = false; let enabled = false; let timer; let delay = 1000
   function write (entry) {
+    if (waitingWrites.has(entry.id)) return waitingWrites.get(entry.id)
     const previous = writes.get(entry.id) || Promise.resolve()
-    const work = previous.catch(() => {}).then(() => store().put(structuredClone(entry), { existing: true }))
+    const work = previous.catch(() => {}).then(() => {
+      waitingWrites.delete(entry.id)
+      return store().put(structuredClone(entry), { existing: true })
+    })
+    waitingWrites.set(entry.id, work)
     writes.set(entry.id, work)
     work.finally(() => { if (writes.get(entry.id) === work) writes.delete(entry.id) }).catch(() => {})
     return work

package/private-messenger/session/index.js

@@ -69,8 +69,9 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   const attemptStarts = new Map()
   const networkUrgency = new Map()
   const sendControllers = new Map()
-  const localReady = new Set()
   const localIdleWaiters = new Set()
+  // Last local failure survives retry admission until an actual commit.
+  const localRetries = new Set()
   const cleanups = new Map()
   const queuedAt = new WeakMap()
   const debug = (entry, stage, startedAt, coordinates = {}) => {
@@ -104,13 +105,14 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
       for (const entry of entries.values()) {
         if (entry.peer !== owner && entry.failed && entry.status === 'pending') pausedSends.add(entry.id)
       }
-      if (![...entries.values()].some(entry => pendingRetryable(entry) && !pausedSends.has(entry.id))) clearSendRetry()
+      if (![...entries.values()].some(entry => (entry.localFailed && entry.localRetryable) || (pendingRetryable(entry) && !pausedSends.has(entry.id)))) clearSendRetry()
       watchOfflineSends()
       return
     }
     clearSendRetry()
     for (const id of pausedSends) { const entry = entries.get(id); if (entry) { entry.failed = false; attemptStarts.set(entry.id, performance.now()) } }
     pausedSends.clear()
+    if ([...entries.values()].some(entry => entry.localFailed && entry.localRetryable)) scheduleSendRetry()
     watchOfflineSends()
     // The callback can run inside construction/resume, before configure settles.
     queueMicrotask(() => pump())
@@ -153,7 +155,12 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   let redrain = false
   const idleWaiters = new Set()
   const settled = () => { if (!sending && !localSaving && !enqueuing && !draining && !cleanups.size) { for (const resolve of idleWaiters) resolve(); idleWaiters.clear() } }
-  const emit = () => onOutbox([...entries.values()].filter(entry => !entry.deletion && !entry.cancelled))
+  const localComplete = entry => entry.localSaved.every(Boolean)
+  const completed = entry => localComplete(entry) && (entry.peer === owner || entry.deliveryConfirmed)
+  const emit = () => onOutbox([...entries.values()].filter(entry => !entry.deletion && !entry.cancelled).map(entry => ({
+    ...entry,
+    localPersistence: { state: localComplete(entry) ? 'saved' : entry.localFailed ? 'failed' : 'pending', retryable: Boolean(entry.localFailed && entry.localRetryable && !localRetries.has(entry.id)) }
+  })))
   const journal = createPublicationJournal({
     entries, store: () => storage, onError: reportError, debug, setTimer: _setTimeout, clearTimer: _clearTimeout, random: _random,
     archive: async (entry, rows) => {
@@ -165,7 +172,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     },
     changed: entry => {
       watchOfflineSends()
-      if (!entry.prepared && (entry.status === 'saved' || entry.cancelled)) cleanupEntry(entry)
+      if (!entry.prepared && (completed(entry) || entry.cancelled)) cleanupEntry(entry)
       else if (!closed && available) pumpRemote()
     }
   })
@@ -174,11 +181,17 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     storage = await openOutbox({ owner, signer, onDebug })
     for (const entry of await storage.list()) {
       // Old encrypted entries retain progress and enter this same pipeline.
+      const legacyLocalFailure = entry.deliveryConfirmed === undefined && entry.failed && !entry.localSaved.every(Boolean)
+      if (legacyLocalFailure) {
+        entry.localFailed = true; entry.localRetryable = Boolean(entry.retryable || entry.status === 'pending')
+        if (entry.peer !== owner) { entry.failed = false; entry.status = 'pending' }
+      }
+      entry.deliveryConfirmed ??= entry.peer !== owner && entry.status === 'saved'
+      if (entry.deliveryConfirmed) entry.status = 'saved'
       if (entry.cancelled) cancelled.add(entry.id)
       entries.set(entry.id, entry)
       journal.adopt(entry)
       attemptStarts.set(entry.id, performance.now())
-      if (entry.localSaved.every(Boolean)) localReady.add(entry.id)
       queuedAt.set(entry, Date.now())
     }
     emit()
@@ -432,10 +445,12 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   }
   async function cleanupEntry (entry) {
     if (entry.prepared) { journal.wake(); return }
+    if (!entry.cancelled && !completed(entry)) return
+    if (entry.failed && entry.status === 'saved') return
     if (cleanups.has(entry.id)) return cleanups.get(entry.id)
     const startedAt = Date.now()
     const work = Promise.resolve().then(async () => { await journal.flush(entry); await storage.remove(entry.id) }).then(() => {
-      entries.delete(entry.id); localReady.delete(entry.id); attemptStarts.delete(entry.id)
+      entries.delete(entry.id); localRetries.delete(entry.id); attemptStarts.delete(entry.id)
       debug(entry, 'outbox-cleanup', startedAt)
       emit()
     }).catch(error => {
@@ -447,7 +462,49 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     cleanups.set(entry.id, work)
     return work
   }
-  async function sendEntry (entry, localOnly = false) {
+  async function saveEntry (entry) {
+    if (entry.peer === owner) { entry.status = 'pending'; emit() }
+    const releaseForeground = foreground.enter()
+    const active = async () => {
+      if (storage.has && !await storage.has(entry.id)) { cancelled.add(entry.id); sendControllers.get(entry.id)?.abort() }
+      if (closed || !available || cancelled.has(entry.id) || (entry.peer !== owner && !peers.has(entry.peer))) throw new Error('CHAT_UNAVAILABLE')
+    }
+    const startedAt = Date.now()
+    try {
+      debug(entry, 'local-start', queuedAt.get(entry))
+      for (let index = 0; index < entry.events.length; index++) {
+        await active()
+        if (entry.localSaved[index]) continue
+        const event = entry.events[index]
+        const hearsay = !event.sig && event.pubkey !== owner
+        const result = await messageStorage.save(event, { peerPubkey: entry.peer, hearsay })
+        if (result?.result?.code === 'blocked') { cancelled.add(entry.id); entry.cancelled = true; sendControllers.get(entry.id)?.abort(); await active() }
+        if (!result?.result?.ok) throw Object.assign(new Error('MESSAGE_STORAGE_FAILED'), { code: result?.result?.code?.toUpperCase() })
+        entry.localSaved[index] = true
+      }
+      entry.localFailed = false
+      debug(entry, 'local-stored', startedAt)
+      if (entry.peer === owner) entry.status = 'saved'
+      emit()
+      if (completed(entry)) cleanupEntry(entry)
+      else await journal.write(entry)
+    } catch (error) {
+      if (cancelled.has(entry.id)) { sendControllers.get(entry.id)?.abort(); entry.cancelled = true; cleanupEntry(entry) } else if (!closed && available) {
+        entry.localFailed = true; entry.localRetryable = retryable(error)
+        if (entry.peer === owner) { entry.status = 'error'; entry.retryable = entry.localRetryable }
+        await journal.write(entry).catch(reportError)
+        reportError(error)
+        if (entry.localRetryable) scheduleSendRetry()
+        if (entry.peer === owner && !entry.deletion) onSendError(error, { id: entry.id, peer: entry.peer })
+        emit()
+      }
+    } finally {
+      const retried = localRetries.delete(entry.id)
+      releaseForeground()
+      if (retried && entry.localFailed) emit()
+    }
+  }
+  async function sendEntry (entry) {
     if (entry.status === 'saved') return
     const releaseForeground = foreground.enter()
     entry.status = 'pending'; emit()
@@ -455,36 +512,9 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     sendControllers.set(entry.id, controller)
     try {
       const active = async () => {
-        if (storage.has && !await storage.has(entry.id)) cancelled.add(entry.id)
+        if (storage.has && !await storage.has(entry.id)) { cancelled.add(entry.id); sendControllers.get(entry.id)?.abort() }
         if (closed || !available || cancelled.has(entry.id) || (entry.peer !== owner && !peers.has(entry.peer))) throw new Error('CHAT_UNAVAILABLE')
       }
-      if (localOnly) {
-        debug(entry, 'local-start', queuedAt.get(entry))
-        const startedAt = Date.now()
-        for (let index = 0; index < entry.events.length; index++) {
-          await active()
-          if (entry.localSaved[index]) continue
-          const event = entry.events[index]
-          const hearsay = !event.sig && event.pubkey !== owner
-          const result = await messageStorage.save(event, { peerPubkey: entry.peer, hearsay })
-          if (result?.result?.code === 'blocked') { cancelled.add(entry.id); await active() }
-          if (!result?.result?.ok) throw Object.assign(new Error('MESSAGE_STORAGE_FAILED'), { code: result?.result?.code?.toUpperCase() })
-          entry.localSaved[index] = true
-        }
-        debug(entry, 'local-stored', startedAt)
-        await active()
-        if (entry.peer === owner) {
-          entry.status = 'saved'; emit()
-          cleanupEntry(entry)
-        } else {
-          // Retry this checkpoint even when a preceding attempt saved all copies
-          // but failed to persist progress. Only then admit remote publication.
-          await journal.write(entry)
-          await active()
-          localReady.add(entry.id)
-        }
-        return
-      }
       if (entry.peer !== owner && !preparation.get(entry.peer)) {
         if (preparation.error(entry.peer)) throw preparation.error(entry.peer)
         preparation.request(entry.peer).catch(() => {})
@@ -518,14 +548,10 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
           await active()
           if (entry.prepared) { journal.accept(entry); return }
           await journal.write(entry)
-          if ([...entries.values()].some(pending => !pending.files.length && pending.peer !== owner && !pending.failed && !localReady.has(pending.id))) {
-            await pumpLocal()
-            if (localSaving) await new Promise(resolve => localIdleWaiters.add(resolve))
-          }
           let admitted = 0
           for (const pending of entries.values()) {
             if (closed || !available || admitted >= 8) break
-            if (!localReady.has(pending.id) || pending.peer === owner || pending.status === 'saved' || pending.files.length || pending.failed || cancelled.has(pending.id) || pending.prepared?.accepted || !peers.has(pending.peer)) continue
+            if (pending.peer === owner || pending.status === 'saved' || pending.files.length || pending.failed || cancelled.has(pending.id) || pending.prepared?.accepted || !peers.has(pending.peer)) continue
             admitted++
             await sendEntry(pending)
           }
@@ -539,21 +565,23 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         debug(entry, 'publication-accepted', startedAt)
         await active()
         entry.index++
-        if (entry.index === entry.events.length) { entry.status = 'saved'; emit() }
+        if (entry.index === entry.events.length) { entry.deliveryConfirmed = true; entry.status = 'saved'; emit() }
         if (entry.prepared) { journal.accept(entry); return }
         if (entry.index < entry.events.length) await journal.write(entry)
       }
-      entry.status = 'saved'; emit()
+      entry.deliveryConfirmed = true; entry.status = 'saved'; emit()
+      await journal.write(entry)
       cleanupEntry(entry)
     } catch (cause) {
       // Pauses can surface at any stage (text publication, file authorization
       // or chunk delivery). Normalize all of them into the retryable path.
-      const error = cause?.retryWhenAvailable ? cause : (isUnavailableSend(cause) ? unavailableError(cause, controller.signal) : cause)
+      const error = !available || closed ? unavailableError(cause) : cause?.retryWhenAvailable ? cause : (isUnavailableSend(cause) ? unavailableError(cause, controller.signal) : cause)
       if (cancelled.has(entry.id)) {
         entry.cancelled = true
         if (entry.prepared) { await journal.write(entry); journal.wake() } else { await storage.remove(entry.id); entries.delete(entry.id) }
       } else {
-        entry.status = error.retryWhenAvailable ? 'pending' : 'error'; entry.failed = true; entry.retryable = retryable(error)
+        if (!entry.deliveryConfirmed) entry.status = error.retryWhenAvailable ? 'pending' : 'error'
+        entry.failed = true; entry.retryable = retryable(error)
         await journal.write(entry).catch(reportError)
         if (entry.peer !== owner && error.retryWhenAvailable && messenger?.readStatus().paused) pausedSends.add(entry.id)
         else if (isUnavailableSend(cause) && cause.pauseReasons?.length && available && !closed) {
@@ -566,8 +594,8 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         // The failed wire event may be a quote or file chunk. Report the
         // owning outbox item separately, without mutating the native error.
         if (error.retryWhenOnline) offlineSends.add(entry.id)
-        if (entry.failed && error.retryWhenAvailable && !pausedSends.has(entry.id)) scheduleSendRetry()
-        if (!closed && !entry.deletion && !cancelled.has(entry.id) && !error.retryWhenAvailable) onSendError(error, { id: entry.id, peer: entry.peer })
+        if (entry.failed && (error.retryWhenAvailable || (entry.deliveryConfirmed && entry.retryable)) && !pausedSends.has(entry.id)) scheduleSendRetry()
+        if (!closed && !entry.deletion && !cancelled.has(entry.id) && !entry.deliveryConfirmed && !error.retryWhenAvailable) onSendError(error, { id: entry.id, peer: entry.peer })
       }
       emit()
     } finally { sendControllers.delete(entry.id); releaseForeground() }
@@ -583,7 +611,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     clearSendRetry()
     sendRetryDelay = SEND_RETRY_MIN_MS
   }
-  const pendingRetryable = entry => Boolean(entry.failed && !cancelled.has(entry.id) && (entry.retryable || entry.status === 'pending'))
+  const pendingRetryable = entry => Boolean(!cancelled.has(entry.id) && ((entry.localFailed && entry.localRetryable) || (entry.failed && (entry.retryable || entry.status === 'pending'))))
   function scheduleSendRetry () {
     if (closed || !available || sendRetryTimer) return
     const delay = Math.min(SEND_RETRY_MAX_MS, sendRetryDelay * (0.8 + _random() * 0.4))
@@ -593,13 +621,15 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
       if (closed || !available) return
       let retried = false
       for (const entry of entries.values()) {
-        if (!pendingRetryable(entry) || pausedSends.has(entry.id)) continue
+        if (!pendingRetryable(entry)) continue
+        if (entry.localFailed && entry.localRetryable) { localRetries.add(entry.id); retried = true }
+        if (pausedSends.has(entry.id) || !entry.failed || !(entry.retryable || entry.status === 'pending')) continue
         entry.failed = false
         attemptStarts.set(entry.id, performance.now())
         if (entry.status === 'saved') { cleanupEntry(entry); continue }
         retried = true
       }
-      if (retried) pump()
+      if (retried) { emit(); pump() }
     }, delay)
     sendRetryTimer.unref?.()
   }
@@ -654,14 +684,16 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         relocal = false
         for (const entry of entries.values()) {
           if (closed || !available) break
-          if (entry.failed || cancelled.has(entry.id) || (entry.peer !== owner && !peers.has(entry.peer))) continue
-          if (entry.status === 'saved') { cleanupEntry(entry); continue }
-          if (localReady.has(entry.id) && entry.peer !== owner) continue
-          await sendEntry(entry, true)
+          if ((entry.localFailed && !localRetries.has(entry.id)) || cancelled.has(entry.id) || (entry.peer !== owner && !peers.has(entry.peer))) continue
+          if (localComplete(entry) && !entry.localFailed) { if (entry.status === 'saved') cleanupEntry(entry); continue }
+          await saveEntry(entry)
           pumpRemote()
         }
       } while (relocal)
-    } finally { localSaving = false; for (const resolve of localIdleWaiters) resolve(); localIdleWaiters.clear(); settled() }
+    } finally {
+      if ([...entries.values()].some(entry => (entry.localFailed && entry.localRetryable) || (entry.status === 'saved' && entry.failed && entry.retryable))) scheduleSendRetry()
+      localSaving = false; for (const resolve of localIdleWaiters) resolve(); localIdleWaiters.clear(); settled()
+    }
   }
   async function pumpRemote () {
     if (!available || closed || !storage || !messenger) return
@@ -673,7 +705,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         for (const entry of entries.values()) {
           if (closed || !available) break
           if (entry.prepared?.accepted) { journal.wake(); continue }
-          if (entry.peer === owner || entry.status === 'saved' || !localReady.has(entry.id) || !peers.has(entry.peer) || entry.failed || cancelled.has(entry.id)) continue
+          if (entry.peer === owner || entry.status === 'saved' || !peers.has(entry.peer) || entry.failed || cancelled.has(entry.id)) continue
           if (!preparation.get(entry.peer) && !preparation.error(entry.peer)) {
             preparation.request(entry.peer).catch(() => {})
             continue
@@ -803,15 +835,21 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
       else clearSendRetry()
       if (changed) lifecycle++
       if (!available) {
+        for (const controller of sendControllers.values()) controller.abort()
         journal.setAvailable(false)
         preparation.setAvailable(false)
         for (const peer of channels.keys()) if (!preparation.get(peer)) channels.delete(peer)
-        inboxRecovery.stop(); await messenger?.pause('signer'); return
+        inboxRecovery.stop(); await messenger?.pause('signer')
+        if (localSaving) await new Promise(resolve => localIdleWaiters.add(resolve))
+        return
       }
       await ready()
       journal.setAvailable(true)
       pumpLocal()
-      for (const entry of entries.values()) if (pendingRetryable(entry)) { entry.failed = false; attemptStarts.set(entry.id, performance.now()) }
+      for (const entry of entries.values()) {
+        if (entry.localRetryable) localRetries.add(entry.id)
+        if (entry.failed && (entry.retryable || entry.status === 'pending')) { entry.failed = false; attemptStarts.set(entry.id, performance.now()) }
+      }
       if (storageBlocked) inboxRecovery.start({ immediate: true })
       if (!changed && messenger && !configurationFailed) { preparation.setAvailable(true); pump(); return configuring }
       return schedule()
@@ -829,7 +867,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         const id = getEventHash(main)
         const events = [...context.map(value => wireEvent(value, owner)), main]
         const files = events.filter(value => value.kind === 1063).map(value => ({ ...decodeFileMetadata(value), optional: !requiredFiles.includes(getEventHash(value)) })).filter(file => file.service === 'irfs').flatMap(file => [file, ...(file.thumbnail?.root ? [{ ...file.thumbnail, optional: file.optional }] : [])])
-        const entry = { id, peer, event: { ...main, id }, events, files, index: 0, fileIndex: 0, chunkIndex: 0, localSaved: context.map(() => true).concat(false), status: 'pending', deletion }
+        const entry = { id, peer, event: { ...main, id }, events, files, index: 0, fileIndex: 0, chunkIndex: 0, localSaved: context.map(() => true).concat(false), status: 'pending', deliveryConfirmed: false, deletion }
         const startedAt = Date.now()
         debug(entry, 'outbox-start')
         await storage.put(entry)
@@ -852,6 +890,16 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
       await ready()
       const entry = entries.get(id)
       if (!entry) return
+      journal.retry()
+      if (entry.deliveryConfirmed) {
+        // This action belongs to local recovery, never a fresh network attempt.
+        if (entry.localFailed && !entry.localRetryable) return
+        if (entry.localFailed) localRetries.add(id)
+        entry.failed = false
+        resetSendRetry(); emit()
+        return pumpLocal()
+      }
+      if (entry.localFailed) localRetries.add(id)
       if (entry.peer !== owner && entry.status !== 'saved' && available) networkUrgency.set(id, _now() + 30000)
       // Renew while the old wait is still subscribed, preserving the monitor's
       // generation/backoff even if this session is its only consumer.
@@ -863,16 +911,17 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     },
     async cancel (id) {
       cancelled.add(id)
+      localRetries.delete(id)
       sendControllers.get(id)?.abort()
       offlineSends.delete(id); pausedSends.delete(id); watchOfflineSends()
       await ready()
       const entry = entries.get(id)
-      if (entry?.prepared) { entry.cancelled = true; await journal.write(entry); journal.wake() } else { entries.delete(id); localReady.delete(id); await storage.remove(id) }
+      if (entry?.prepared) { entry.cancelled = true; await journal.write(entry); journal.wake() } else { entries.delete(id); await storage.remove(id) }
       emit()
     },
     close () {
       return (closeWork ??= (async () => {
-        closed = true; available = false; lifecycle++
+        closed = true; available = false; lifecycle++; localRetries.clear()
         stopOnlineRetry(); offlineSends.clear(); networkUrgency.clear(); activeDownloads.clear(); pendingPriorityRanges.clear()
         clearSendRetry(); inboxRecovery.stop(); preparation.close(); foreground.close(); pausedSends.clear()
         for (const controller of sendControllers.values()) controller.abort()