libp2r2p 0.11.29 → 0.11.31

package/README.md

@@ -1270,3 +1270,17 @@ and writes in groups of at most 100. Batched checks combine one recovery-type
 AND filter with coordinate OR filters, preserve input order and continue to
 decode and validate every returned snapshot. Custom adapters without batched
 methods retain the sequential fallback.
+
+The 0.11.30 session archives each publication's recovery rows through one
+`putMany` call and treats pending journal rows as present in batched `hasMany`
+checks. Publication routing also keeps a runtime-only, per-messenger relay health
+circuit: explicit bans/refusals open immediately, repeated transport failures
+open after three attempts, and a fully quarantined route reports
+`RELAY_CIRCUIT_OPEN` with `retryAt` before another envelope is prepared. Reads and
+receive routing are unaffected. See [session relay fallback](private-messenger/session/README.md#relay-fallback).
+
+The 0.11.31 pending-decryption retry groups records by
+`(receiverPubkey, ownContentPubkey)` for one pass. A FIFO probe may skip the
+remaining records only when the local signer confirms `CONTENT_KEY_NOT_FOUND`
+with `hasOwnContentKey: false`. MAC, proof, parsing and operational failures are
+never generalized to the group, and every deferred record remains persisted.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libp2r2p",
-  "version": "0.11.29",
+  "version": "0.11.31",
   "description": "Peer-to-relay-to-peer",
   "keywords": [
     "p2r2p",

package/private-messenger/event-store/README.md

@@ -24,10 +24,11 @@ without decrypting the archive; the store may also purge expired wrappers itself
 - Authorizations: the same operations plus `find(query)`, choosing the newest
   valid share, then the shorter expiry and lexicographically smaller record ID.
 - Batched methods preserve input order and process at most 100 coordinates per
-  query. Identical inputs share one immutable result; expired inputs return
-  `undefined` without a query or write. Batched checks use the recovery type
-  as an AND filter and the record coordinates as an OR filter, then still decode
-  and validate every returned snapshot.
+  query. Identical inputs share one immutable result. `putMany` returns
+  `undefined` for an expired input without querying or writing; `hasMany` returns
+  `false` for expired snapshots. Batched checks use the recovery type as an AND
+  filter and the record coordinates as an OR filter, then still decode and
+  validate every returned snapshot.
 - `iterate` is an async generator. Queries can name `recordId`, `channelPubkey`,
   `receiverPubkey`, `since`/`until`, or the file tuple `controlChannelPubkey`,
   `fileChannelPubkey`, `receiverPubkey`, and `indices`. `signal` cancels reads.

package/private-messenger/event-store/index.js

@@ -132,7 +132,7 @@ export function createPersonalCopyRecoveryStorage ({ eventStore, signer, now = n
       const recordIds = rows.map(row => row.recordId || encodeRecord(type, row).tags[0][1])
       const present = new Set()
       for (const batch of chunks([...new Set(recordIds)])) {
-        for await (const { row } of records(type, { recordIds: batch, includeExpired: true })) present.add(row.recordId)
+        for await (const { row } of records(type, { recordIds: batch })) present.add(row.recordId)
       }
       return recordIds.map(recordId => present.has(recordId))
     }

package/private-messenger/helpers/fallback-race.js

@@ -2,7 +2,7 @@ import { isReplaceableRelayFailure } from '../../relay/helpers/failure.js'
 
 // Each invocation owns one already signed outer event and its encrypted subset.
 // Lanes share coverage and the tried set; only started reports outlive the race.
-export function publishWithEarlyFallback ({ event, receivers, first, mirrors, tried, nextPrimary, nextFallback, sendEvent, isOnline, isCurrent, signal, pauseSignal, remember, delay, attemptStartedAt, monotonicNow = () => performance.now(), now, setTimer, clearTimer }) {
+export function publishWithEarlyFallback ({ event, receivers, first, mirrors, tried, nextPrimary, nextFallback, sendEvent, isOnline, isCurrent, signal, pauseSignal, remember, rememberSuccess = () => {}, delay, attemptStartedAt, monotonicNow = () => performance.now(), now, setTimer, clearTimer }) {
   const pending = new Set(receivers)
   const summaries = []
   const transportSignal = signal && pauseSignal ? AbortSignal.any([signal, pauseSignal]) : signal || pauseSignal
@@ -65,6 +65,7 @@ export function publishWithEarlyFallback ({ event, receivers, first, mirrors, tr
     const settled = Promise.resolve(result.promise).catch(reason => ({ fulfilled: 0, errors: [{ reason }] }))
     slot.resolve(settled)
     settled.then(async report => {
+      rememberSuccess(report.succeededRelays || [])
       const failed = (report.errors || []).filter(item => isReplaceableRelayFailure(item.reason))
       // Late redundant failures can inform later sends after this race wins.
       if (failed.length && (result.success || (done && !pending.size)) && !transportSignal?.aborted && isCurrent()) {

package/private-messenger/helpers/publication-relay-health.js

@@ -0,0 +1,96 @@
+import { normalizeRelayUrl } from '../../url/index.js'
+
+const PERMANENT_PREFIXES = new Set(['banned', 'blocked', 'restricted', 'auth-required', 'pow'])
+const TRANSIENT_CATEGORIES = new Set(['connection', 'transport', 'timeout'])
+const RELAY_LIMIT = 256
+const INITIAL_COOLDOWN_MS = 5 * 60 * 1000
+const MAX_COOLDOWN_MS = 30 * 60 * 1000
+const TIMEOUT_THRESHOLD = 3
+
+const prefix = error => {
+  for (const value of [error?.message, error?.code]) {
+    const match = typeof value === 'string' && /^([a-z-]+):/.exec(value)
+    if (match) return match[1]
+  }
+  return ''
+}
+const relayUrl = value => {
+  try { return normalizeRelayUrl(value) } catch { return '' }
+}
+const cooldown = level => Math.min(MAX_COOLDOWN_MS, INITIAL_COOLDOWN_MS * 2 ** Math.max(0, level - 1))
+
+// Publication-only, runtime relay health shared by one PrivateMessenger.
+// Permanent refusals open immediately; transport failures open after three
+// consecutive attempts. Expired entries become one half-open probe.
+export function createPublicationRelayHealth ({ now = Date.now, limit = RELAY_LIMIT } = {}) {
+  const relays = new Map()
+
+  function save (relay, state) {
+    relays.delete(relay)
+    relays.set(relay, state)
+    while (relays.size > limit) relays.delete(relays.keys().next().value)
+  }
+
+  function isExcluded (relay, at = now()) {
+    relay = relayUrl(relay)
+    const state = relay ? relays.get(relay) : undefined
+    return Boolean(state?.until && state.until > at)
+  }
+
+  function retryAt (candidates, at = now()) {
+    let earliest = 0
+    for (const candidate of candidates || []) {
+      const relay = relayUrl(candidate)
+      const until = relay ? relays.get(relay)?.until : 0
+      if (until > at && (!earliest || until < earliest)) earliest = until
+    }
+    return earliest
+  }
+
+  function recordFailure (relay, reason, at = now()) {
+    relay = relayUrl(relay)
+    if (!relay) return 0
+    const previous = relays.get(relay) || { failures: 0, level: 0, until: 0 }
+    const halfOpen = previous.until > 0 && previous.until <= at
+    const permanent = PERMANENT_PREFIXES.has(prefix(reason))
+    const transient = TRANSIENT_CATEGORIES.has(reason?.category)
+    const retryAfter = Number.isSafeInteger(reason?.retryAt)
+      ? reason.retryAt
+      : Number.isSafeInteger(reason?.retryAfterMs)
+        ? at + Math.max(0, reason.retryAfterMs)
+        : 0
+    let next = previous
+    if (permanent || retryAfter > at) {
+      const level = halfOpen ? Math.min(previous.level + 1, 5) : Math.max(1, previous.level)
+      next = { failures: 0, level, until: Math.min(at + cooldown(level), retryAfter > at ? retryAfter : Infinity) }
+    } else if (transient || prefix(reason) === 'error') {
+      const failures = previous.failures + 1
+      if (halfOpen) {
+        const level = Math.min(previous.level + 1, 5)
+        next = { failures: 0, level, until: at + cooldown(level) }
+      } else if (failures >= TIMEOUT_THRESHOLD) {
+        next = { failures: 0, level: Math.max(1, previous.level), until: at + cooldown(Math.max(1, previous.level)) }
+      } else next = { failures, level: previous.level, until: 0 }
+    }
+    save(relay, next)
+    return next.until > at ? next.until : 0
+  }
+
+  function recordSuccess (relay) {
+    relay = relayUrl(relay)
+    if (relay) relays.delete(relay)
+  }
+
+  function clear () {
+    relays.clear()
+  }
+
+  return { isExcluded, retryAt, recordFailure, recordSuccess, clear }
+}
+
+export {
+  INITIAL_COOLDOWN_MS as PUBLICATION_RELAY_INITIAL_COOLDOWN_MS,
+  MAX_COOLDOWN_MS as PUBLICATION_RELAY_MAX_COOLDOWN_MS,
+  RELAY_LIMIT as PUBLICATION_RELAY_HEALTH_LIMIT,
+  TIMEOUT_THRESHOLD as PUBLICATION_TIMEOUT_THRESHOLD
+}

package/private-messenger/helpers/publication.js

@@ -68,6 +68,9 @@ export function sanitizePublicationError (error, context = {}) {
     ...(safeToken(source.reason) ? { reason: source.reason } : {}),
     ...(safeToken(source.eventId) ? { eventId: source.eventId } : {}),
     ...(Number.isSafeInteger(source.eventKind) ? { eventKind: source.eventKind } : {}),
+    ...(safeToken(source.category) ? { category: source.category } : {}),
+    ...(Number.isSafeInteger(source.retryAt) ? { retryAt: source.retryAt } : {}),
+    ...(Number.isSafeInteger(source.retryAfterMs) ? { retryAfterMs: source.retryAfterMs } : {}),
     ...(source.retryWhenAvailable === true ? { retryWhenAvailable: true } : {}),
     ...(source.retryWhenOnline === true ? { retryWhenOnline: true } : {}),
     reports: reports.map(sanitizedReport)
@@ -85,7 +88,8 @@ export function publicationFailureDiagnostic (error) {
     if (safeToken(value) && contextFields.includes(key)) result[key] = value
     else if (Number.isSafeInteger(value) && contextNumbers.includes(key)) result[key] = value
   }
-  for (const key of ['code', 'reason', 'eventId']) if (safeToken(error?.[key])) result[key] = error[key]
+  for (const key of ['code', 'reason', 'eventId', 'category']) if (safeToken(error?.[key])) result[key] = error[key]
+  for (const key of ['retryAt', 'retryAfterMs']) if (Number.isSafeInteger(error?.[key])) result[key] = error[key]
   for (const key of ['retryWhenAvailable', 'retryWhenOnline']) if (error?.[key] === true) result[key] = true
   result.reports = (Array.isArray(error?.reports) ? error.reports : []).map(sanitizedReport)
   return result

package/private-messenger/helpers/send-routing.js

@@ -8,6 +8,15 @@ const normalized = relay => { try { return normalizeRelayUrl(relay) } catch { re
 
 export { isReplaceableRelayFailure }
 
+export function relayCircuitError (retryAt) {
+  return Object.assign(new Error('RELAY_CIRCUIT_OPEN'), {
+    code: 'RELAY_CIRCUIT_OPEN',
+    category: 'timeout',
+    retryAt,
+    retryWhenAvailable: true
+  })
+}
+
 export function normalizeFallbackRelays (value = []) {
   if (!Array.isArray(value)) throw new ValidationError('INVALID_FALLBACK_RELAYS')
   return [...new Set(Array.from(value, normalizeRelayUrl))]
@@ -32,11 +41,13 @@ function routeGroups (routes) {
   return [...groups.values()]
 }
 
-export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey, primaryRelays, primaryRelayToReceivers, fallbackRelays = [], fallbackDelayMs = null, exclusions, pickRelays, recoveryRelays, publish, publishNymEvent, sendEvent, isOnline, isCurrent, signal, pauseSignal, attemptStartedAt, monotonicNow = () => performance.now(), now = Date.now, setTimer = setTimeout, clearTimer = clearTimeout }) {
+export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey, primaryRelays, primaryRelayToReceivers, fallbackRelays = [], fallbackDelayMs = null, exclusions, relayHealth, pickRelays, recoveryRelays, publish, publishNymEvent, sendEvent, isOnline, isCurrent, signal, pauseSignal, attemptStartedAt, monotonicNow = () => performance.now(), now = Date.now, setTimer = setTimeout, clearTimer = clearTimeout }) {
   // Keep discovery's defaults when NIP-65 is unavailable. Explicit maps/lists
   // retain their fanout; configured fallbacks are a separate last-resort stage.
   fallbackDelayMs = normalizeFallbackDelay(fallbackDelayMs)
   if (attemptStartedAt !== undefined && (!Number.isFinite(attemptStartedAt) || attemptStartedAt < 0)) throw new ValidationError('INVALID_ATTEMPT_STARTED_AT')
+  exclusions ??= new Map()
+  relayHealth ??= { isExcluded: () => false, retryAt: () => 0, recordFailure: () => 0, recordSuccess: () => {} }
   const transportSignal = signal && pauseSignal ? AbortSignal.any([signal, pauseSignal]) : signal || pauseSignal
   const explicit = Boolean(primaryRelays || primaryRelayToReceivers)
   const primaryRoutes = primaryRelayToReceivers || (primaryRelays
@@ -49,12 +60,17 @@ export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey,
   const candidates = [...new Set([...Object.values(primaryByPeer).flatMap(value => value.read), ...fallbackRelays])]
   const candidateSet = new Set(candidates)
   for (const [relay, expires] of exclusions) if (expires <= now() || !candidateSet.has(relay)) exclusions.delete(relay)
-  // A fresh attempt can recheck an exhausted list; each outer event still owns
-  // a tried set so concurrent sends/fragments cannot create a retry loop.
-  if (peers.some(pubkey => {
-    const available = [...primaryByPeer[pubkey].read, ...fallbackRelays]
-    return available.length && available.every(relay => exclusions.has(relay))
-  })) exclusions.clear()
+  const unavailable = relay => exclusions.has(relay) || relayHealth.isExcluded(relay, now())
+  const initialExcluded = new Set(candidates.filter(unavailable))
+  const blockedPeers = peers.filter(pubkey => {
+    const available = [...primaryByPeer[pubkey]?.read || [], ...fallbackRelays]
+    return available.length > 0 && available.every(unavailable)
+  })
+  const circuitCandidates = blockedPeers.length
+    ? [...new Set(blockedPeers.flatMap(pubkey => [...primaryByPeer[pubkey]?.read || [], ...fallbackRelays]))]
+    : candidates
+  const circuitOpen = (candidates.length > 0 && candidates.every(relay => initialExcluded.has(relay))) || blockedPeers.length > 0
+  const circuitRetryAt = circuitOpen ? relayHealth.retryAt(circuitCandidates, now()) : 0
   const select = (receivers, excluded, staged = false) => {
     const excludedRelays = [...excluded]
     const excludeRelaysByPubkey = new Map(receivers.map(pubkey => [pubkey, excludedRelays]))
@@ -69,10 +85,20 @@ export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey,
     for (const [relay, pubkeys] of fallback) routes.set(relay, [...new Set([...(routes.get(relay) || []), ...pubkeys])])
     return routes
   }
-  const relayToReceivers = primaryRelayToReceivers || select(peers, exclusions.keys())
+  const relayToReceivers = primaryRelayToReceivers || select(peers, initialExcluded)
   const current = () => !transportSignal?.aborted && isCurrent()
   const rejected = report => (report?.errors || []).filter(item => candidateSet.has(normalized(item.relay)) && isReplaceableRelayFailure(item.reason))
-  const remember = errors => { for (const item of errors) if (candidateSet.has(normalized(item.relay))) exclusions.set(normalized(item.relay), now() + EXCLUSION_MS) }
+  const remember = errors => {
+    for (const item of errors) {
+      const relay = normalized(item.relay)
+      if (!candidateSet.has(relay)) continue
+      exclusions.set(relay, now() + EXCLUSION_MS)
+      relayHealth.recordFailure(relay, item.reason, now())
+    }
+  }
+  const rememberSuccess = relays => {
+    for (const relay of relays || []) relayHealth.recordSuccess(relay)
+  }
   const online = async () => {
     if (!current()) return false
     try { return await isOnline({ signal: transportSignal }) && current() } catch { return false }
@@ -85,11 +111,11 @@ export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey,
     const pending = new Set(receivers)
     const mirrors = initialRelays.filter(relay => !candidateSet.has(normalized(relay)))
     const initialPrimary = context.primaryRelays || (primaryRelays || peers.length === 1 ? routeEntries(relayToReceivers).map(([relay]) => relay) : [])
-    const first = [...new Set(initialPrimary.map(normalizeRelayUrl))].filter(relay => !exclusions.has(relay))
+    const first = [...new Set(initialPrimary.map(normalizeRelayUrl))].filter(relay => !unavailable(relay))
     if (!explicit && fallbackDelayMs !== null && fallbackRelays.length) {
       const tried = new Set()
       const pick = (pending, fallback) => {
-        const excluded = [...new Set([...exclusions.keys(), ...tried])]
+        const excluded = [...new Set([...candidates.filter(unavailable), ...exclusions.keys(), ...tried])]
         const routes = pickRelays([...pending], fallback
           ? Object.fromEntries([...pending].map(pubkey => [pubkey, { read: fallbackRelays }]))
           : primaryByPeer, { relayType: 'read', maxPerPubkey: 2, excludeRelaysByPubkey: new Map([...pending].map(pubkey => [pubkey, excluded])), emptyRelaysFallback: [] })
@@ -98,17 +124,16 @@ export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey,
       const result = await publishWithEarlyFallback({
         event, receivers, first: first.length ? { receivers, relays: first } : null, mirrors, tried,
         nextPrimary: pending => pick(pending, false), nextFallback: pending => pick(pending, true),
-        sendEvent, isOnline, isCurrent, signal, pauseSignal, remember,
+        sendEvent, isOnline, isCurrent, signal, pauseSignal, remember, rememberSuccess,
         delay: fallbackDelayMs, attemptStartedAt, monotonicNow, now, setTimer, clearTimer
       })
-      if (!result.success && current()) exclusions.clear()
       return result
     }
     let batch = first.length ? { receivers, relays: first } : null
     const tried = new Set()
     const errors = []
     const summaries = []
-    const next = () => routeGroups(select([...pending], new Set([...exclusions.keys(), ...tried]), true))[0]
+    const next = () => routeGroups(select([...pending], new Set([...candidates.filter(unavailable), ...exclusions.keys(), ...tried]), true))[0]
     const finish = result => ({
       ...result,
       success: summaries.length > 0 && pending.size === 0,
@@ -136,6 +161,7 @@ export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey,
       result = await sendEvent(event, relays, { signal: transportSignal })
       const settled = Promise.resolve(result.promise)
       summaries.push(settled)
+      settled.then(report => rememberSuccess(report?.succeededRelays || [])).catch(() => {})
       if (result.success) {
         for (const pubkey of batch.receivers) pending.delete(pubkey)
         // Keep the first ACK immediate; learn about redundant failures later.
@@ -148,10 +174,10 @@ export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey,
         const report = await settled
         const failed = rejected(report)
         errors.push(...(report?.errors || []))
+        if (failed.length) remember(failed)
         if (!failed.length || errors.some(item => !isReplaceableRelayFailure(item.reason))) return finished(result)
-        if (!next()) { exclusions.clear(); return finished(result) }
+        if (!next()) return finished(result)
         if (!await online()) return { ...finish(result), retryWhenAvailable: !signal?.aborted, retryWhenOnline: !signal?.aborted }
-        remember(failed)
       }
       if (!current()) return finished(result)
       batch = null
@@ -161,8 +187,10 @@ export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey,
 
   return {
     relayToReceivers,
+    circuitOpen,
+    retryAt: circuitRetryAt,
     // A recovery mirror must not reintroduce refused relays or promote a fallback.
-    recoveryRelays: recoveryRelays.filter(relay => !candidateSet.has(normalized(relay)) || !exclusions.has(normalized(relay))),
+    recoveryRelays: recoveryRelays.filter(relay => !candidateSet.has(normalized(relay)) || !unavailable(normalized(relay))),
     _publish: options => (options.nymSigner ? publishNymEvent : publish)({ ...options, _publish: send })
   }
 }

package/private-messenger/index.js

@@ -49,14 +49,15 @@ import { isOnline, onOnline } from '../network/index.js'
 import { isRetryableRelayFailure, isReplaceableRelayFailure } from '../relay/index.js'
 import { createPauseRecovery, isRecoverableStorageFailure } from './helpers/pause-recovery.js'
 import { backgroundSigner } from './helpers/background-signer.js'
-import { createSendRelayRouting, normalizeFallbackRelays, normalizeFallbackDelay } from './helpers/send-routing.js'
+import { createPublicationRelayHealth } from './helpers/publication-relay-health.js'
+import { createSendRelayRouting, normalizeFallbackRelays, normalizeFallbackDelay, relayCircuitError } from './helpers/send-routing.js'
 import { incompleteFetchError } from '../private-channel/helpers/fetch-error.js'
 import { recoveryRetryDelay, isPermanentRecoveryError } from './helpers/recovery-retry.js'
 import { assertMessagePublished, publicationFailureDiagnostic, sanitizePublicationError } from './helpers/publication.js'
 import { normalizeRelayUrl } from '../url/index.js'
 import { deliveryInfo } from '../private-channel/helpers/rumor.js'
 import { migrateMessageQueue } from './services/migrate-message-queue.js'
-import { createPendingDecryption } from './services/pending-decryption.js'
+import { createPendingDecryption, pendingContentKeyGroup, pendingMissingContentKeyGroup } from './services/pending-decryption.js'
 import { createDecryptionScheduler } from './services/decryption-scheduler.js'
 import { decryptionError, isDeferredDecryptionError } from '../private-channel/helpers/decryption-error.js'
 import { bytesToBase64 } from '../base64/index.js'
@@ -319,9 +320,10 @@ export class PrivateMessenger {
     this._subscribeRelayListUpdates = _subscribeRelayListUpdates
     this._isOnline = _isOnline
     this._waitForForeground = _waitForForeground
-    this.sendRelayExclusions = new Map()
+    this.publicationRelayHealth = createPublicationRelayHealth({ now: _now })
     this.sendRoutingLifetime = new AbortController()
     this.sendRoutingPause = new AbortController()
+    this._now = _now
     this._setTimeout = _setTimeout
     this._clearTimeout = _clearTimeout
     this._setInterval = _setInterval
@@ -800,7 +802,6 @@ export class PrivateMessenger {
       this.stopPresencePublisher(pubkey)
     }
     for (const pubkey of removedPubkeys) this.channels.delete(pubkey)
-    for (const [key, value] of this.sendRelayExclusions) if (removedPubkeys.includes(value.channelPubkey)) this.sendRelayExclusions.delete(key)
     for (const channel of changed) this.channels.set(channel.pubkey, channel)
 
     // Incremental registration must not prune persisted channels whose signers
@@ -894,22 +895,16 @@ export class PrivateMessenger {
   async resolveSendRouting ({ channel, receiverPubkeys, relays, relayToReceivers, signal, attemptStartedAt, onDebug }) {
     if (attemptStartedAt !== undefined && (!Number.isFinite(attemptStartedAt) || attemptStartedAt < 0)) throw new ValidationError('INVALID_ATTEMPT_STARTED_AT')
     const recoveryRelays = await this.recoveryMirrorRelays(channel.pubkey)
-    if (relayToReceivers && !this.fallbackRelays.length) return { relayToReceivers, recoveryRelays }
     const fixed = relayToReceivers ? null : relays?.length ? uniq(relays) : channel.sendRelays.length ? channel.sendRelays : channel.relays.length ? channel.relays : null
-    if (fixed && !this.fallbackRelays.length) return { relays: fixed, recoveryRelays }
     const recipients = uniq(receiverPubkeys?.length ? receiverPubkeys : relayMapReceivers(relayToReceivers))
     const relaysByPubkey = fixed || relayToReceivers ? undefined : await this._getRelaysByPubkey(recipients)
-    const key = `${channel.pubkey}:${[...recipients].sort().join(',')}`
-    if (!this.sendRelayExclusions.has(key)) {
-      if (this.sendRelayExclusions.size >= 256) this.sendRelayExclusions.delete(this.sendRelayExclusions.keys().next().value)
-      this.sendRelayExclusions.set(key, { channelPubkey: channel.pubkey, exclusions: new Map() })
-    }
     const routing = createSendRelayRouting({
       peers: fixed && !recipients.length ? [this.userPubkey] : recipients, relaysByPubkey, recoveryRelays, primaryRelays: fixed?.map(normalizeRelayUrl), primaryRelayToReceivers: relayToReceivers, fallbackRelays: this.fallbackRelays,
       signal: signal ? AbortSignal.any([this.sendRoutingLifetime.signal, signal]) : this.sendRoutingLifetime.signal,
-      exclusions: this.sendRelayExclusions.get(key).exclusions,
+      exclusions: new Map(),
+      relayHealth: this.publicationRelayHealth,
       fallbackDelayMs: this.fallbackDelayMs, attemptStartedAt, pauseSignal: this.sendRoutingPause.signal,
-      setTimer: this._setTimeout, clearTimer: this._clearTimeout,
+      setTimer: this._setTimeout, clearTimer: this._clearTimeout, now: this._now,
       pickRelays: this._pickRelaysForPubkeys,
       publish: this._privateChannel.publish || privateChannel.publish,
       publishNymEvent: this._privateChannel.publishNymEvent || privateChannel.publishNymEvent,
@@ -922,10 +917,11 @@ export class PrivateMessenger {
       isOnline: this._isOnline,
       isCurrent: () => !this.closePromise && !this.pauseReasons.size && this.channels.has(channel.pubkey)
     })
+    if (routing.circuitOpen) throw relayCircuitError(routing.retryAt)
     if (!relayMapRelays(routing.relayToReceivers).length) throw new ValidationError('NO_RELAYS')
     // Fixed lists address the original receiver set as a whole, preserving the
     // existing encryption grouping instead of inventing per-recipient routes.
-    if (fixed) return { relays: fixed, recoveryRelays: routing.recoveryRelays, _publish: routing._publish }
+    if (fixed) return { relays: relayMapRelays(routing.relayToReceivers), recoveryRelays: routing.recoveryRelays, _publish: routing._publish }
     return routing
   }
 
@@ -3263,12 +3259,7 @@ export class PrivateMessenger {
         job.started = true
         const force = job.force
         job.force = false
-        const groups = new Map()
-        for (const record of await this.pendingDecryption.records({ force })) {
-          if (!groups.has(record.channelPubkey)) groups.set(record.channelPubkey, [])
-          groups.get(record.channelPubkey).push(record)
-        }
-        const results = await Promise.allSettled([...groups].map(async ([channelPubkey, records]) => {
+        const replay = async (channelPubkey, records, callbacks = {}) => {
           const channel = this.channels.get(channelPubkey)
           if (!channel || !this.desiredChannels.has(channelPubkey)) return
           const current = () => {
@@ -3306,15 +3297,78 @@ export class PrivateMessenger {
                 return this.receive(channelPubkey, () => this.enqueueRumor('nym', channelPubkey, { event, outer, meta, payload: parseEventContent(event) }), { event, outer }, { trackActivity: false })
               },
               onSeedEvent: seed => { current(); return this.receive(channelPubkey, () => this.enqueueSeed(channelPubkey, seed), seed, { trackActivity: false }) },
-              onRecovered: record => { current(); return this.pendingDecryption.recovered(record) },
-              onFailure: (record, error) => { current(); return this.pendingDecryption.failed(record, error) }
+              onRecovered: async record => {
+                current()
+                await callbacks.onRecovered?.(record)
+                return this.pendingDecryption.recovered(record)
+              },
+              onFailure: async (record, error) => {
+                current()
+                if (await callbacks.onFailure?.(record, error) === false) return
+                return this.pendingDecryption.failed(record, error)
+              }
             })
           } catch (error) {
             if (this.channels.get(channelPubkey) === channel && this.desiredChannels.has(channelPubkey)) throw error
           } finally { this.decryptionScheduler.finish(channelPubkey) }
-        }))
+        }
+
+        const records = await this.pendingDecryption.records({ force })
+        const probes = new Map()
+        for (const record of records) {
+          const channelPubkey = record.channelPubkey
+          if (!this.channels.has(channelPubkey) || !this.desiredChannels.has(channelPubkey)) continue
+          const missingGroup = pendingMissingContentKeyGroup(record)
+          if (missingGroup && !probes.has(missingGroup)) probes.set(missingGroup, record)
+        }
+
+        const unavailableGroups = new Set()
+        const probed = new Set()
+        let probeError
+        for (const [groupKey, candidate] of probes) {
+          signal.throwIfAborted()
+          const current = await this.pendingDecryption.current(candidate, { force })
+          if (!current || pendingMissingContentKeyGroup(current) !== groupKey) continue
+          probed.add(current.id)
+          let missing = false
+          await replay(current.channelPubkey, [current], {
+            onFailure: async (_record, error) => {
+              const failedGroup = pendingMissingContentKeyGroup({
+                code: error.code,
+                receiverPubkey: error.receiverPubkey,
+                ownContentPubkey: error.ownContentPubkey,
+                hasOwnContentKey: error.hasOwnContentKey
+              })
+              if (failedGroup === groupKey) missing = true
+              if (isDeferredDecryptionError(error)) {
+                await this.pendingDecryption.failed(current, error)
+                return false
+              }
+              probeError ||= error
+              return false
+            }
+          })
+          if (missing) unavailableGroups.add(groupKey)
+        }
+
+        const remaining = []
+        for (const record of records) {
+          if (!this.channels.has(record.channelPubkey) || !this.desiredChannels.has(record.channelPubkey)) continue
+          if (probed.has(record.id)) continue
+          const groupKey = pendingContentKeyGroup(record)
+          if (groupKey && unavailableGroups.has(groupKey)) continue
+          remaining.push(record)
+        }
+        const groups = new Map()
+        for (const record of remaining) {
+          if (!groups.has(record.channelPubkey)) groups.set(record.channelPubkey, [])
+          groups.get(record.channelPubkey).push(record)
+        }
+        const results = await Promise.allSettled([...groups].map(([channelPubkey, channelRecords]) =>
+          replay(channelPubkey, channelRecords)))
         const failed = results.find(result => result.status === 'rejected')
         if (failed) throw failed.reason
+        if (probeError) throw probeError
         job.started = false
       } while (job.again)
     }
@@ -3384,7 +3438,7 @@ export class PrivateMessenger {
     if (this.closePromise) return this.closePromise
     const initSettledPromise = this.initSettledPromise
     this.sendRoutingLifetime.abort()
-    this.sendRelayExclusions.clear()
+    this.publicationRelayHealth.clear()
     this.pendingStorageWrites.clear()
     for (const task of this.pauseRecoveries.values()) task.stop()
     for (const task of this.watchRecoveries.values()) task.stop()

package/private-messenger/services/pending-decryption.js

@@ -6,6 +6,8 @@ import { isDeferredDecryptionError } from '../../private-channel/helpers/decrypt
 
 const encoder = new TextEncoder()
 const decoder = new TextDecoder()
+const HEX64 = /^[0-9a-f]{64}$/i
+const CONTENT_KEY_FIELDS = ['receiverPubkey', 'ownContentPubkey', 'peerContentPubkey']
 export const PENDING_DECRYPTION_MAX_BYTES = 16 * 1024 * 1024
 
 function storedBytes (item) {
@@ -30,6 +32,34 @@ function packetSnapshot (packet) {
   return { format: packet.format, channelPubkey: packet.channelPubkey, outer: event(packet.outer), ...(packet.router ? { router: event(packet.router, true) } : {}) }
 }
 
+function errorMetadata (error) {
+  const metadata = {}
+  for (const key of CONTENT_KEY_FIELDS) {
+    const value = error?.[key]
+    if (typeof value === 'string' && HEX64.test(value)) metadata[key] = value.toLowerCase()
+  }
+  if (typeof error?.hasOwnContentKey === 'boolean') metadata.hasOwnContentKey = error.hasOwnContentKey
+  return metadata
+}
+
+function replaceErrorMetadata (item, error) {
+  const next = { ...item, code: error?.code }
+  for (const key of [...CONTENT_KEY_FIELDS, 'hasOwnContentKey']) delete next[key]
+  return Object.assign(next, errorMetadata(error))
+}
+
+export function pendingContentKeyGroup (item) {
+  const receiver = item?.receiverPubkey
+  const own = item?.ownContentPubkey
+  if (typeof receiver !== 'string' || typeof own !== 'string' || !HEX64.test(receiver) || !HEX64.test(own)) return ''
+  return `${receiver.toLowerCase()}:${own.toLowerCase()}`
+}
+
+export function pendingMissingContentKeyGroup (item) {
+  if (item?.code !== 'CONTENT_KEY_NOT_FOUND' || item?.hasOwnContentKey !== false) return ''
+  return pendingContentKeyGroup(item)
+}
+
 // Stable across live, history and synthesized recovery wrappers.
 function packetId (record) {
   const rows = record.format === 'routerRow_v1'
@@ -72,8 +102,19 @@ export async function createPendingDecryption ({ prefix, indexedDB, maxBytes = P
       record = packetSnapshot(record)
       return serial(async () => {
         const id = packetId(record)
-        if (await queue.someBy('byId', id)) return true
-        const item = { id, channelPubkey: record.channelPubkey, packet: structuredClone(record), code: error.code, macAttempts: error.code === 'INVALID_MAC' ? 1 : 0 }
+        const previous = await queue.getBy('byId', id)
+        if (previous) {
+          const updated = replaceErrorMetadata(previous, error)
+          if (JSON.stringify(updated) !== JSON.stringify(previous)) await queue.putBy('byId', updated, { existingOnly: true })
+          return true
+        }
+        const item = {
+          id,
+          channelPubkey: record.channelPubkey,
+          packet: structuredClone(record),
+          macAttempts: error.code === 'INVALID_MAC' ? 1 : 0,
+          ...replaceErrorMetadata({}, error)
+        }
         const requiredBytes = storedBytes(item)
         if (requiredBytes > maxBytes) {
           notify('discarded', { reason: 'oversized', channelPubkey: item.channelPubkey, id }); return true
@@ -115,7 +156,10 @@ export async function createPendingDecryption ({ prefix, indexedDB, maxBytes = P
         if (!isDeferredDecryptionError(error)) throw error
         const current = await queue.getBy('byId', item.id)
         if (!current) return
-        const updated = { ...current, code: error.code, macAttempts: current.macAttempts + (error.code === 'INVALID_MAC' ? 1 : 0) }
+        const updated = {
+          ...replaceErrorMetadata(current, error),
+          macAttempts: current.macAttempts + (error.code === 'INVALID_MAC' ? 1 : 0)
+        }
         await queue.putBy('byId', updated, { existingOnly: true })
         if (updated.macAttempts >= 3 && item.macAttempts < 3) notify('suspended', { id: item.id, code: error.code, channelPubkey: item.channelPubkey })
       })

package/private-messenger/session/README.md

@@ -9,6 +9,13 @@ the account messenger while available. Call after committed content-key changes;
 ordinary availability recovery already requests a pass. Ciphertext stays in the
 separate bounded FIFO until admitted to the normal inbox, evicted or explicitly
 cleared. This does not retry application storage/permission failures as crypto.
+Within one pass, records whose last failure proved the same
+`(receiverPubkey, ownContentPubkey)` is missing share one FIFO probe across all
+channels. An unchanged `CONTENT_KEY_NOT_FOUND` skips only that group's remaining
+records for the pass; none are removed or suspended. If the probe advances past
+the key lookup, including with `INVALID_MAC`, or fails with another error, all
+other records in the group are still attempted. Missing-key suppression never
+survives into another pass.
 
 Construction accepts `pendingDecryptionReady` (default `true`). Pass `false` to
 hold pending queue reads/replay until `setPendingDecryptionReady(true)` releases
@@ -183,8 +190,8 @@ tag or deletion capability is recreated. Confirmed connectivity, exclusions and
 connection cooldowns remain authoritative; a waiting primary is not penalized
 merely because fallback started. Late native failures may inform later sends.
 
-On `blocked`, `restricted`, `auth-required`, `pow`, `rate-limited`, or `error`
-rejections, or connection/transport/timeout failures, replacement requires
+On `banned`, `blocked`, `restricted`, `auth-required`, `pow`, `rate-limited`, or
+`error` rejections, or connection/transport/timeout failures, replacement requires
 `isOnline` to confirm connectivity. Invalid messages, local signer/authentication
 failures and unknown error text retain their original diagnosis.
 
@@ -204,10 +211,18 @@ members, every pending member must be covered before the outer event succeeds;
 a partial ACK cannot hide another member's failure. Remaining primary routes are
 exhausted before configured fallbacks with the default null delay or explicit
 routes. Redundant acknowledgements may update
-future routing preferences without delaying a successfully covered send. Preferences are channel/recipient-scoped, in-memory,
-expire after five minutes, and never alter receive subscriptions. A fresh attempt
-can recheck an exhausted list. Additional fallback relays come only from the
-caller configuration; absent NIP-65 lists retain the existing discovery defaults.
+future routing preferences without delaying a successfully covered send.
+Publication health is shared by the messenger instance and never alters receive
+subscriptions. Explicit bans/refusals open that relay immediately; connection,
+transport and timeout failures open it after three consecutive attempts.
+Cooldown starts at five minutes, doubles after failed half-open probes and caps
+at 30 minutes. A success resets only that relay. When every route available to a
+pending recipient is cooling down, publication returns
+`RELAY_CIRCUIT_OPEN` with `retryAt` before preparing another encrypted envelope;
+the range or outbox item remains pending and is retried no earlier than that
+deadline. Health is bounded, runtime-only and cleared on close. Additional
+fallback relays come only from the caller configuration; absent NIP-65 lists
+retain the existing discovery defaults.
 
 When offline/interrupted with alternatives remaining, reports carry
 `retryWhenAvailable: true`. The outbox remains pending and emits no `onSendError`.
@@ -268,9 +283,11 @@ The existing `onPreparedSeed` callback now also supplies `publication`. The
 session commits that minimal journal before transmitting; direct messengers
 retain their local seed-store durability. Only after that commit can relay
 publication proceed. One independent serial worker converts recovery seeds into
-their configured archive. Pending durable rows participate in recovery reads
-immediately, including during a blocked archive write. No new seeds are enabled
-for modes which did not previously retain them.
+their configured archive. Event-store adapters receive all rows for a publication
+through one `putMany` call; serial `put` remains the external-adapter fallback.
+Pending durable rows participate in recovery reads and batched `hasMany` checks
+immediately, including during a blocked archive write. Expired rows are absent.
+No new seeds are enabled for modes which did not previously retain them.
 
 First acceptance of every required envelope emits saved independently of archive
 or cleanup. ACK progress checkpoints serialize with other entry writes. A crash

package/private-messenger/session/helpers/publication-journal.js

@@ -130,6 +130,19 @@ export function pendingSeedMatches (row, query) {
 }
 
 export function withPendingSeeds (storage, pending) {
+  async function hasMany (rows) {
+    const pendingIds = new Set(pending().map(row => row.recordId).filter(Boolean))
+    const unresolved = rows.filter(row => !row.recordId || !pendingIds.has(row.recordId))
+    let persisted
+    if (typeof storage.hasMany === 'function') persisted = await storage.hasMany(unresolved)
+    else {
+      persisted = []
+      for (const row of unresolved) persisted.push(await storage.has(row))
+    }
+    if (!Array.isArray(persisted) || persisted.length !== unresolved.length) throw new Error('INVALID_RECOVERY_STORAGE_RESULT')
+    let index = 0
+    return rows.map(row => Boolean(row.recordId && pendingIds.has(row.recordId)) || Boolean(persisted[index++]))
+  }
   return {
     ...storage,
     async * iterate (query = {}) {
@@ -138,6 +151,7 @@ export function withPendingSeeds (storage, pending) {
       for (const row of pending()) if (pendingSeedMatches(row, query)) { seen.add(row.recordId); yield row }
       for await (const row of storage.iterate(query)) if (!seen.has(row.recordId)) yield row
     },
-    has: row => pending().some(value => value.recordId === row.recordId) || storage.has(row)
+    hasMany,
+    async has (row) { return (await hasMany([row]))[0] }
   }
 }

package/private-messenger/session/index.js

@@ -153,6 +153,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   let repump
   let draining
   let redrain = false
+  const sendRetryAt = new Map()
   const idleWaiters = new Set()
   const settled = () => { if (!sending && !localSaving && !enqueuing && !draining && !cleanups.size) { for (const resolve of idleWaiters) resolve(); idleWaiters.clear() } }
   const localComplete = entry => entry.localSaved.every(Boolean)
@@ -164,7 +165,10 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   const journal = createPublicationJournal({
     entries, store: () => storage, onError: reportError, debug, setTimer: _setTimeout, clearTimer: _clearTimeout, random: _random,
     archive: async (entry, rows) => {
-      if (recoveryStorage?.seeds) { for (const row of rows) await recoveryStorage.seeds.put(row) } else if (entry.prepared.target.file) {
+      if (recoveryStorage?.seeds) {
+        if (typeof recoveryStorage.seeds.putMany === 'function') await recoveryStorage.seeds.putMany(rows)
+        else for (const row of rows) await recoveryStorage.seeds.put(row)
+      } else if (entry.prepared.target.file) {
         for (const seed of entry.prepared.publication.seeds) await fileTransfers.archiveSeed(entry.prepared.target.file, seed)
       } else {
         for (const seed of entry.prepared.publication.seeds) await messenger.enqueueSeed(seed.channelPubkey, seed)
@@ -450,7 +454,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     if (cleanups.has(entry.id)) return cleanups.get(entry.id)
     const startedAt = Date.now()
     const work = Promise.resolve().then(async () => { await journal.flush(entry); await storage.remove(entry.id) }).then(() => {
-      entries.delete(entry.id); localRetries.delete(entry.id); attemptStarts.delete(entry.id)
+      entries.delete(entry.id); localRetries.delete(entry.id); attemptStarts.delete(entry.id); sendRetryAt.delete(entry.id)
       debug(entry, 'outbox-cleanup', startedAt)
       emit()
     }).catch(error => {
@@ -594,6 +598,8 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         // The failed wire event may be a quote or file chunk. Report the
         // owning outbox item separately, without mutating the native error.
         if (error.retryWhenOnline) offlineSends.add(entry.id)
+        if (Number.isSafeInteger(error.retryAt)) sendRetryAt.set(entry.id, error.retryAt)
+        else sendRetryAt.delete(entry.id)
         if (entry.failed && (error.retryWhenAvailable || (entry.deliveryConfirmed && entry.retryable)) && !pausedSends.has(entry.id)) scheduleSendRetry()
         if (!closed && !entry.deletion && !cancelled.has(entry.id) && !entry.deliveryConfirmed && !error.retryWhenAvailable) onSendError(error, { id: entry.id, peer: entry.peer })
       }
@@ -614,14 +620,28 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   const pendingRetryable = entry => Boolean(!cancelled.has(entry.id) && ((entry.localFailed && entry.localRetryable) || (entry.failed && (entry.retryable || entry.status === 'pending'))))
   function scheduleSendRetry () {
     if (closed || !available || sendRetryTimer) return
-    const delay = Math.min(SEND_RETRY_MAX_MS, sendRetryDelay * (0.8 + _random() * 0.4))
+    let nextRetryAt = 0
+    let unconstrained = false
+    for (const entry of entries.values()) {
+      if (!pendingRetryable(entry)) continue
+      const retryAt = sendRetryAt.get(entry.id)
+      if (!Number.isSafeInteger(retryAt)) { unconstrained = true; continue }
+      if (!nextRetryAt || retryAt < nextRetryAt) nextRetryAt = retryAt
+    }
+    if (unconstrained) nextRetryAt = 0
+    const backoff = Math.min(SEND_RETRY_MAX_MS, sendRetryDelay * (0.8 + _random() * 0.4))
+    const delay = Math.max(backoff, nextRetryAt ? nextRetryAt - Date.now() : 0)
     sendRetryDelay = Math.min(SEND_RETRY_MAX_MS, sendRetryDelay * 2)
     sendRetryTimer = _setTimeout(() => {
       sendRetryTimer = undefined
       if (closed || !available) return
+      const now = Date.now()
       let retried = false
       for (const entry of entries.values()) {
         if (!pendingRetryable(entry)) continue
+        const retryAt = sendRetryAt.get(entry.id)
+        if (Number.isSafeInteger(retryAt) && retryAt > now) continue
+        sendRetryAt.delete(entry.id)
         if (entry.localFailed && entry.localRetryable) { localRetries.add(entry.id); retried = true }
         if (pausedSends.has(entry.id) || !entry.failed || !(entry.retryable || entry.status === 'pending')) continue
         entry.failed = false
@@ -630,6 +650,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
         retried = true
       }
       if (retried) { emit(); pump() }
+      if ([...entries.values()].some(entry => pendingRetryable(entry) && Number.isSafeInteger(sendRetryAt.get(entry.id)))) scheduleSendRetry()
     }, delay)
     sendRetryTimer.unref?.()
   }
@@ -921,7 +942,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     },
     close () {
       return (closeWork ??= (async () => {
-        closed = true; available = false; lifecycle++; localRetries.clear()
+        closed = true; available = false; lifecycle++; localRetries.clear(); sendRetryAt.clear()
         stopOnlineRetry(); offlineSends.clear(); networkUrgency.clear(); activeDownloads.clear(); pendingPriorityRanges.clear()
         clearSendRetry(); inboxRecovery.stop(); preparation.close(); foreground.close(); pausedSends.clear()
         for (const controller of sendControllers.values()) controller.abort()

package/relay/helpers/failure.js

@@ -1,6 +1,6 @@
 const TRANSPORT_CATEGORIES = new Set(['connection', 'transport', 'timeout'])
 const RETRY_PREFIXES = new Set(['rate-limited', 'error'])
-const REPLACEMENT_PREFIXES = new Set(['blocked', 'restricted', 'auth-required', 'pow', ...RETRY_PREFIXES])
+const REPLACEMENT_PREFIXES = new Set(['banned', 'blocked', 'restricted', 'auth-required', 'pow', ...RETRY_PREFIXES])
 
 // Retry and replacement are different policies: a refusal can justify another
 // relay without making the same operation retryable on the refusing relay.
@@ -8,7 +8,8 @@ function matches (error, prefixes) {
   if (error?.name === 'Nip42AuthenticationError') return false
   if (TRANSPORT_CATEGORIES.has(error?.category)) return true
   if (error?.category && error.category !== 'relay') return false
-  return prefixes.has(/^([a-z-]+):/.exec(error?.message || '')?.[1])
+  const name = /^([a-z-]+):/.exec(error?.message || '')?.[1] || /^([a-z-]+):/.exec(error?.code || '')?.[1]
+  return prefixes.has(name)
 }
 
 export const isRetryableRelayFailure = error => matches(error, RETRY_PREFIXES)