relay-companion 0.1.320 → 0.1.321

package/overlay/inbox.html

@@ -1525,6 +1525,10 @@
   .th-under .th-seen { appearance:none; border:0; padding:0; background:transparent; font-family:var(--sans); font-size:10px; color:var(--muted-2); opacity:.75; }
   .th-under button.th-seen { cursor:pointer; }
   .th-under button.th-seen:hover { color:var(--ink); opacity:1; }
+  /* A message the server refused stays a whisper — it is not an alarm — but it
+     has to read as a problem, and it carries the only two acts left on it. */
+  .th-under .th-seen.warn { color:var(--danger); opacity:.95; }
+  .th-under button.th-seen.act { text-decoration:underline; text-underline-offset:2px; opacity:.95; }
   .th-receipt-panel { width:min(280px, calc(100% - 32px)); margin:5px 16px 2px auto; padding:8px 10px;
     border:1px solid var(--hair); border-radius:var(--r-2); background:var(--wash); font-family:var(--sans); }
   .th-receipt-row { display:flex; justify-content:space-between; gap:16px; padding:3px 0; font-size:10.5px; color:var(--ink-2); }
@@ -6019,32 +6023,45 @@
             textLike:true, request:false, pending:true,
             reactions:{ aggregates:[], events:[] }, preview:"",
           });
+          // Same contract as the room composer: Send commits the reply to this
+          // device's outbox and answers immediately. The queue owes the
+          // delivery, so a dead connection no longer ends with the words back
+          // under the cursor and a red note.
           const res = await window.relay.sendReply({
             text,
             inReplyToRelayId: r.id,
             idempotencyKey,
+            chat: {
+              threadId: r.threadId || r.id,
+              party: sender,
+              partyKey: (r.senderEmail || r.fromEmail)
+                ? `email:${String(r.senderEmail || r.fromEmail).trim().toLowerCase()}`
+                : `name:${String(sender).trim().toLowerCase()}`,
+              isGroup: false,
+              groupName: "",
+            },
           }).catch((error) => ({ ok:false, error:String(error?.message || error) }));
           readerReplySending = false;
           send.disabled = false;
           if (!res?.ok) {
+            // Only a device that cannot hold the message at all gets here.
             optimisticChatReplies.delete(idempotencyKey);
             setRowNote(r.id, res?.error || "Reply did not send.", "err");
             input.focus();
             return;
           }
           const optimistic = optimisticChatReplies.get(idempotencyKey);
-          if (optimistic) {
-            optimistic.relayId = String((res.result && (res.result.relayId || res.result.id)) || "");
-            if (optimistic.relayId) optimistic.id = optimistic.relayId;
-            // Same rule as the room composer: a reply into a group room fans
-            // out, and only the shared groupSendId reliably matches a
-            // canonical transcript row.
-            optimistic.groupSendId = String((res.result && res.result.groupSendId) || "");
-            optimistic.threadId = String((res.result && res.result.threadId) || optimistic.threadId);
-            optimistic.pending = false;
+          if (optimistic && res.entry) {
+            optimistic.fromOutbox = true;
+            optimistic.outboxId = String(res.entry.id || idempotencyKey);
+            optimistic.outboxState = String(res.entry.state || "queued");
+            optimistic.outboxAttempts = Number(res.entry.attempts || 0);
           }
           input.value = "";
           readerHumanDrafts.delete(String(r.id));
+          // "Queued" would be a lie the instant the network is fine, and "Sent"
+          // would be one while it is not. The message's own bubble carries the
+          // state; this note only confirms the composer let go of it.
           setRowNote(r.id, `Sent to ${sender}.`, "ok");
           fadeRowNoteLater(r.id, 3000);
           renderReader();
@@ -6586,6 +6603,13 @@
     const state = String((r && r.state) || "").toLowerCase();
     return state === "read" || state === "acknowledged";
   }
+  // The rung below Read. The server's relay state is a ladder — pending (the
+  // API has it) → delivered (it has been routed to the recipient's device, or
+  // to the email that stands in for one) → read — and "delivered" is the fact
+  // a sender wants when the recipient has not opened it yet.
+  function sentIsDelivered(r) {
+    return String((r && r.state) || "").toLowerCase() === "delivered" || sentIsRead(r);
+  }
   function sentDeliveryLabel(r) {
     const d = (r && r.delivery) || {};
     const state = String(d.state || r.state || "").toLowerCase();
@@ -8060,6 +8084,68 @@
   // canonical relay id appears on either side of the local payload.
   const optimisticChatReplies = new Map(); // idempotencyKey -> thread-message row
   const chatReplySending = new Set(); // visible room/thread id
+
+  /**
+   * Mirror the device's send queue into the room transcript.
+   *
+   * An unsent message used to live ONLY here, in renderer memory, and only for
+   * as long as one send attempt took. That is why a send on weak wifi ended
+   * with the words back in the composer: when the attempt failed there was
+   * nothing left holding them. The queue in the main process is now the record,
+   * and this projects it — so a message typed offline keeps its place in the
+   * conversation across repaints, room switches, and quitting the pill.
+   */
+  function syncOutboxProjection() {
+    const live = new Set();
+    for (const entry of payload.outbox || []) {
+      if (!entry || !entry.id) continue;
+      const key = String(entry.id);
+      live.add(key);
+      const chat = entry.chat || {};
+      const files = Array.isArray(entry.files) ? entry.files : [];
+      const existing = optimisticChatReplies.get(key) || {};
+      optimisticChatReplies.set(key, {
+        ...existing,
+        id: entry.relayId || `outbox:${key}`,
+        fromOutbox: true,
+        outboxId: key,
+        // "queued" is the honest word for what the clock means in every other
+        // messenger: this device has it, the server does not yet.
+        outboxState: String(entry.state || "queued"),
+        outboxAttempts: Number(entry.attempts || 0),
+        outboxError: String(entry.lastError || ""),
+        relayId: String(entry.relayId || ""),
+        groupSendId: String(entry.groupSendId || ""),
+        threadId: String(entry.threadId || chat.threadId || ""),
+        inReplyToRelayId: String(entry.inReplyToRelayId || ""),
+        direction: "out",
+        seen: false,
+        seenAt: null,
+        readReceipts: [],
+        // Render-model field, not the wire title: a text bubble paints m.title.
+        title: entry.text || (files.length === 1 ? String(files[0].name || "1 file") : `${files.length} files`),
+        body: entry.text || "",
+        party: chat.party || "",
+        partyKey: chat.partyKey || "",
+        at: entry.createdAt,
+        isGroup: Boolean(chat.isGroup),
+        groupId: chat.groupId || "",
+        groupName: chat.groupName || "",
+        unread: false,
+        textLike: true,
+        request: false,
+        pending: String(entry.state || "queued") !== "sent",
+        reactions: { aggregates: [], events: [] },
+        preview: "",
+      });
+    }
+    // A row this projection put here and the queue has since retired is gone
+    // for good — its canonical relay is in the Sent list now. Rows the composer
+    // created moments ago are left alone; they retire on the canonical match.
+    for (const [key, row] of optimisticChatReplies) {
+      if (row && row.fromOutbox && !live.has(key)) optimisticChatReplies.delete(key);
+    }
+  }
   // The room composer is wired ONCE and outlives every repaint, so its
   // listeners dispatch through this ref instead of capturing one render's
   // closure. Re-binding per render would stack a stale sender per repaint.
@@ -8103,6 +8189,28 @@
   function receiptFor(m, msgs) {
     return RelayReadReceipts.forLatest(m, msgs, timeAgo);
   }
+  // The rungs BELOW the read receipt: this device has it, and this device is
+  // waiting. Said in the same whisper, because a message on its way is not an
+  // event — only a message that will not go is.
+  //
+  // "Waiting for network" is deliberately the second word rather than the
+  // first: one failed attempt is a hiccup, and a composer that announces the
+  // wifi every time someone presses Send is noise. It appears once the queue
+  // has actually had to wait for a connection.
+  function outboxStatusBits(m) {
+    const state = String(m.outboxState || "");
+    if (state === "failed") {
+      return [
+        `<span class="th-seen warn">Not sent</span>`,
+        `<button type="button" class="th-seen act" data-outbox-retry="${esc(m.outboxId)}" data-stop="1">Retry</button>`,
+        `<button type="button" class="th-seen act" data-outbox-discard="${esc(m.outboxId)}" data-stop="1">Delete</button>`,
+      ];
+    }
+    if (state === "queued" && Number(m.outboxAttempts || 0) >= 1) {
+      return [`<span class="th-seen">Waiting for network</span>`];
+    }
+    return [`<span class="th-seen">Sending…</span>`];
+  }
   function receiptTimestamp(value) {
     const date = new Date(value || "");
     if (!Number.isFinite(date.getTime())) return "Seen";
@@ -8168,11 +8276,18 @@
     // single outbound copy per groupSendId or the transcript shows doubles.
     const seenGroupSends = new Set();
     const groupReceiptMembers = new Map();
+    // A fan-out is delivered when EVERY sibling is — the same rule the two
+    // ticks follow in any group chat. The collapse below keeps one sibling, so
+    // asking that survivor alone would call a room delivered on the strength of
+    // whichever member happened to be sorted first.
+    const groupDelivered = new Map();
     for (const member of payload.sent || []) {
       if (!member.groupSendId) continue;
       const bucket = groupReceiptMembers.get(member.groupSendId) || [];
       bucket.push({ name:sentRecipient(member), seen:sentIsRead(member), readAt:member.readAt || "" });
       groupReceiptMembers.set(member.groupSendId, bucket);
+      const soFar = groupDelivered.get(member.groupSendId);
+      groupDelivered.set(member.groupSendId, soFar === false ? false : sentIsDelivered(member));
     }
     for (const s of payload.sent || []) {
       const id = s.relayId || s.id;
@@ -8189,6 +8304,7 @@
       }
       msgs.push({
         id, threadId: s.threadId || id, direction: "out", seen: sentIsRead(s), seenAt: s.readAt || null,
+        delivered: s.groupSendId ? groupDelivered.get(s.groupSendId) === true : sentIsDelivered(s),
         inReplyToRelayId: s.inReplyToRelayId || "",
         addressRecipient: s.recipientGroupId ? { groupId:s.recipientGroupId } : (s.recipient || null),
         readReceipts: s.groupSendId
@@ -8911,7 +9027,7 @@
         const receipt = receiptFor(m, msgs);
         const bits = [];
         if (!m.request && !groupPostingBlocked) bits.push(`<button type="button" class="th-reply-ghost" data-reply-to="${esc(m.id)}" data-stop="1">reply</button>`);
-        if (mine && m.pending) bits.push(`<span class="th-seen">Sending…</span>`);
+        if (mine && m.pending) bits.push(...outboxStatusBits(m));
         if (receipt) bits.push(receipt.expandable
           ? `<button type="button" class="th-seen" data-receipt-toggle="${esc(m.id)}" data-stop="1" aria-expanded="${expandedReceiptIds.has(m.id) ? "true" : "false"}">${esc(receipt.label)}</button>`
           : `<span class="th-seen">${esc(receipt.label)}</span>`);
@@ -9083,7 +9199,7 @@
           seen: false,
           seenAt: null,
           readReceipts: [],
-          // Render-model field, not the wire title (sendReplyFromPill sends no
+          // Render-model field, not the wire title (the send path sends no
           // title for typed text): textLike bubbles paint m.title as the text.
           title: text || (files.length === 1 ? String(files[0].name || "1 file") : `${files.length} files`),
           body: text,
@@ -9108,15 +9224,34 @@
         thQrInput.relayResize?.();
         threadComposerDrafts.delete(threadStateKey);
         renderThreadDetail();
+        // Send COMMITS the message to this device. The answer is immediate on
+        // any network, because the network is no longer in this path: the
+        // outbox owes the delivery and reports its own progress through the
+        // payload. The old code awaited the send here, and a fifteen-second
+        // timeout on weak wifi ended with the bubble deleted and the words
+        // pushed back under the cursor (David, Granular, 2026-08-20).
         let res;
         try {
-          res = await window.relay.sendReply({ text, recipient, ...(inReplyToRelayId ? { inReplyToRelayId } : {}), files, idempotencyKey });
+          res = await window.relay.sendReply({
+            text, recipient, ...(inReplyToRelayId ? { inReplyToRelayId } : {}), files, idempotencyKey,
+            // The room the queue is speaking into, so a bubble rebuilt from the
+            // queue after a restart knows which conversation it belongs to.
+            chat: {
+              threadId: sendAnchor.threadId || thread.threadId || "",
+              party: sendAnchor.party || thread.party || "",
+              partyKey: sendAnchor.partyKey || thread.partyKey || "",
+              isGroup: Boolean(sendAnchor.isGroup || thread.isGroup),
+              groupId: sendAnchor.groupId || thread.groupId || "",
+              groupName: sendAnchor.groupName || thread.groupName || "",
+            },
+          });
         } catch (error) {
           res = { ok: false, error: error && error.message ? error.message : "Send failed — try again." };
         }
         if (!res || !res.ok) {
-          // The words never left this device. Keep them editable so retrying
-          // cannot silently turn a failed send into a lost draft.
+          // The device itself refused to hold the message — not a network
+          // failure, which the queue absorbs, but something it cannot store at
+          // all. Only then do the words belong back in the composer.
           optimisticChatReplies.delete(idempotencyKey);
           chatReplySending.delete(threadStateKey);
           threadComposerDrafts.set(threadStateKey, text);
@@ -9134,15 +9269,14 @@
           }
           return;
         }
+        // The queue's own record supersedes this bubble from the next payload
+        // onward; until then it keeps the row on screen under the same key.
         const optimistic = optimisticChatReplies.get(idempotencyKey);
-        if (optimistic) {
-          optimistic.relayId = String((res.result && (res.result.relayId || res.result.id)) || "");
-          if (optimistic.relayId) optimistic.id = optimistic.relayId;
-          // A group send's response id names one sibling of the fan-out; the
-          // shared groupSendId is what reconciliation retires the bubble by.
-          optimistic.groupSendId = String((res.result && res.result.groupSendId) || "");
-          optimistic.threadId = String((res.result && res.result.threadId) || optimistic.threadId);
-          optimistic.pending = false;
+        if (optimistic && res.entry) {
+          optimistic.fromOutbox = true;
+          optimistic.outboxId = String(res.entry.id || idempotencyKey);
+          optimistic.outboxState = String(res.entry.state || "queued");
+          optimistic.outboxAttempts = Number(res.entry.attempts || 0);
         }
         threadComposerDrafts.delete(threadStateKey);
         threadReplyTargets.delete(threadStateKey);
@@ -9173,6 +9307,25 @@
         if (box) { box.focus(); box.scrollIntoView({ block: "nearest" }); }
       });
     }
+    // The two acts left on a message the server refused. Retry puts it back in
+    // line; Delete is the only path that ever throws typed words away, and it
+    // is the human's own hand doing it.
+    for (const b of thHistoryEl.querySelectorAll("[data-outbox-retry]")) {
+      b.addEventListener("click", async (e) => {
+        e.stopPropagation();
+        const id = String(b.getAttribute("data-outbox-retry") || "");
+        if (!id || !window.relay.outboxRetry) return;
+        await window.relay.outboxRetry(id).catch(() => {});
+      });
+    }
+    for (const b of thHistoryEl.querySelectorAll("[data-outbox-discard]")) {
+      b.addEventListener("click", async (e) => {
+        e.stopPropagation();
+        const id = String(b.getAttribute("data-outbox-discard") || "");
+        if (!id || !window.relay.outboxDiscard) return;
+        await window.relay.outboxDiscard(id).catch(() => {});
+      });
+    }
     wireReplyCancel(thHistoryEl, threadStateKey);
     for (const b of thHistoryEl.querySelectorAll("[data-reply-ref]")) {
       b.addEventListener("click", (e) => {
@@ -10296,9 +10449,14 @@
       features: next.features || payload.features,
       relays: Array.isArray(next.relays) ? next.relays : [],
       sent: Array.isArray(next.sent) ? next.sent : [],
+      outbox: Array.isArray(next.outbox) ? next.outbox : [],
       requests: Array.isArray(next.requests) ? next.requests : [],
       contacts: Array.isArray(next.contacts) ? next.contacts : (payload.contacts || []),
     };
+    // The device's own queue is the truth about unsent messages; this renderer
+    // only mirrors it. Doing this on every payload is what lets a queued bubble
+    // survive a repaint, a room switch and a restart of the pill itself.
+    syncOutboxProjection();
     if (payload.features?.requests !== true && ["requests", "requestDetail"].includes(activeView)) {
       activeView = "relays";
     }
@@ -10321,6 +10479,10 @@
   }
 
   window.relay.onInbox(onPayload);
+  // The renderer holds the only connectivity signal either process has. A
+  // regained network flushes the queue at once — a message must not sit out
+  // the backoff its last attempt earned during an outage that is over.
+  window.addEventListener("online", () => { window.relay.networkOnline?.().catch?.(() => {}); });
   if (window.relay.onNewRelay) window.relay.onNewRelay((row, opts) => {
     if (opts && opts.ghost) ghostArrival(row); // pill dismissed -> free-standing banner
     else notifyArrival(row, opts);

package/overlay/main.cjs

@@ -99,11 +99,13 @@ const { openingFaceFor } = require("./message-face.cjs");
 const perf = require("./perf-counters.cjs");
 const { fittedOverlayBounds, shouldIgnoreOverlayMouse } = require("./window-fit.cjs");
 const { productFeatures } = require("../src/product-features.cjs");
+const { createOutbox } = require("../src/outbox.cjs");
 
 const RELAY_HOME = process.env.RELAY_HOME || process.env.RELAY_COMPANION_HOME || path.join(os.homedir(), ".relay-companion");
 const STATE_PATH = path.join(RELAY_HOME, "state.json");
 const SCHEDULES_PATH = path.join(RELAY_HOME, "schedules.json");
 const PILL_STATUS_PATH = path.join(RELAY_HOME, "pill-status.json");
+const OUTBOX_PATH = path.join(RELAY_HOME, "outbox.json");
 // The companion CLI entrypoint (same path the overlay resolves its ESM modules
 // from). Spawned with ELECTRON_RUN_AS_NODE so Electron runs it as plain Node.
 const RELAY_CLI = path.resolve(__dirname, "..", "bin", "relay.js");
@@ -1084,6 +1086,16 @@ async function refreshSent() {
     const res = await client.sent({ limit: SENT_FETCH_LIMIT });
     sentCache = Array.isArray(res && res.items) ? res.items : [];
     sentFingerprint = sentFingerprintOf(sentCache);
+    // A queued message retires against the SERVER's own view, never against our
+    // record of a response: the canonical row is the same evidence the renderer
+    // uses to retire the bubble, so the two can never disagree on screen.
+    outbox.retireConfirmed({
+      relayIds: sentCache.map((r) => r && (r.relayId || r.id)).filter(Boolean),
+      groupSendIds: sentCache.map((r) => r && r.groupSendId).filter(Boolean),
+    });
+    // This poll just proved the network is up. Anything still waiting out a
+    // backoff earned during the outage is due now.
+    if (outbox.pendingCount()) outbox.resume();
   } catch (error) {
     console.error("[overlay] listSent failed:", error && error.message);
   }
@@ -1313,6 +1325,21 @@ async function deleteContactFromBook(input) {
   return { ok: true, contacts: await contactsAfterWrite(), deletedContactId: contactId };
 }
 
+// ---- the send outbox ------------------------------------------------------
+
+// Pressing Send commits the message to this device; the queue owes the human
+// the delivery from there, across a dead connection and across a restart. See
+// src/outbox.cjs for why that is the only behaviour that keeps a message when
+// the wifi does not.
+const outbox = createOutbox({
+  file: OUTBOX_PATH,
+  send: (entry) => postQueuedRelay(entry),
+  // Every state change is a bubble changing under someone's eyes: queued to
+  // sent, an attempt that failed, a message that will not go. Repaint.
+  onChange: () => pushInboxQuiet(),
+  log: (message, error) => console.error(`[overlay] ${message}`, (error && error.message) || ""),
+});
+
 // ---- payload assembly + push to renderer ---------------------------------
 
 // buildPayload is synchronous over CACHES so the first paint never waits on the
@@ -1351,6 +1378,11 @@ function buildPayload() {
     features: PRODUCT_FEATURES,
     relays: hydrateReactions(relaysNow),
     sent: hydrateReactions(sentWithMaterializationState(sentCache)),
+    // Messages this device has accepted but the server has not confirmed. They
+    // are the renderer's source of truth for unsent bubbles, which is why they
+    // survive a repaint and a restart where an in-renderer optimistic map did
+    // not.
+    outbox: outbox.list(),
     tasks: [],
     contacts: contactsCache,
   };
@@ -1713,6 +1745,10 @@ async function pushInboxNow(force) {
       reactionStateFingerprint(r.reactions),
     ]),
     contacts: payload.contacts.map((c) => [c.id, c.name, c.email]),
+    // Without these the queue's own progress — waiting, attempted again, sent,
+    // refused — would never reach the renderer: nothing else in the payload
+    // moves while a message sits offline.
+    outbox: (payload.outbox || []).map((e) => [e.id, e.state, e.attempts, e.nextAttemptAt, e.relayId, e.lastError]),
     account: [payload.account.paired, payload.account.email],
     features: payload.features,
   });
@@ -3594,6 +3630,10 @@ function createWindow() {
     pushInbox(true)
       .then(() => reconcileCanonicalCompletionMonitors())
       .catch((error) => console.error("[overlay] initial push failed:", error && error.message));
+    // Anything typed before the last quit — or before the last crash — goes out
+    // now. A message the human already pressed Send on is owed a delivery, and
+    // the app restarting is not their problem.
+    outbox.start();
     pillReady = true;
     // Relay is independently useful and searchable even when no host app happens to
     // be open. A normal login launch still respects the persisted dismissed preference.
@@ -6244,55 +6284,88 @@ ipcMain.handle("relay:taskStatus", async (_e, taskId) => {
 // path. The recipient addresses the room; inReplyToRelayId is present only
 // when the human deliberately selected a message to quote. Files arrive as {path} when
 // the OS gave one (picker, drag), else {name, contentBase64} (paste) — the
-// pasted bytes are written to a temp file so ONE pipeline prepares them all.
-async function sendReplyFromPill(input = {}) {
+// outbox spools both into bytes it owns so ONE pipeline prepares them all.
+//
+// This function is the TRANSPORT ONLY, and it THROWS. Whether a failure is
+// worth waiting out is the outbox's judgement, and it needs the real error —
+// a status, an abort, a DNS code — to make it. Flattening every failure into
+// `{ ok: false, error: "fetch failed" }` here is what left the composer unable
+// to tell a dead wifi from a rejected message.
+async function postQueuedRelay(entry) {
+  const client = await relayClient();
+  const attachmentsUrl = pathToFileURL(path.join(__dirname, "..", "src", "attachments.js")).href;
+  const { prepareOrdinaryRelayAttachments } = await import(attachmentsUrl);
+  const text = String(entry.text || "").trim();
+  const files = Array.isArray(entry.files) ? entry.files : [];
+  // The queue holds its own copy of every attachment, so the send reads from
+  // the spool — the picker's original may have been moved or deleted during a
+  // long offline stretch. `name` rides along because the spool file is stored
+  // under an index-prefixed name and the human's filename is what shows.
+  const prepared = await prepareOrdinaryRelayAttachments({
+    files: files
+      .filter((f) => f && f.spoolPath)
+      .map((f) => ({ path: f.spoolPath, name: f.name, ...(f.contentType ? { contentType: f.contentType } : {}) })),
+  });
+  const explicit = entry.recipient || {};
+  const hasRecipient = explicit.email || explicit.contactId || explicit.relayUserId || explicit.groupId || explicit.chatId;
+  return client.sendRelay({
+    recipient: hasRecipient ? explicit : {},
+    kind: "message",
+    // A typed text sends no title — titlelessness IS what marks it as a
+    // text. A file-only send keeps a label: the file is the content and the
+    // name is the only thing there is to show for it.
+    ...(text
+      ? {}
+      : { title: files.length === 1 ? String(files[0].name || "1 file") : `${files.length} files` }),
+    forHuman: text || " ",
+    attachments: prepared,
+    ...(entry.inReplyToRelayId ? { inReplyToRelayId: String(entry.inReplyToRelayId) } : {}),
+    idempotencyKey: entry.idempotencyKey,
+    // Human-authored pill text must never enter the MCP-only forHuman review
+    // gate. Keep this explicit even though the API now positively gates only
+    // relay-mcp: source also drives trustworthy provider attribution.
+    source: { host: "relay-preview" },
+  });
+}
+
+// Send hands the message to the DEVICE. The queue owes the delivery from there:
+// it retries on its own schedule, resumes across restarts, and never hands the
+// words back to the composer for anything a working connection would have
+// fixed. The composer no longer waits on the network at all, so the answer here
+// is immediate whatever the wifi is doing.
+function enqueueReplyFromPill(input = {}) {
+  const crypto = require("crypto");
+  const text = String(input.text || "").trim();
+  const files = Array.isArray(input.files) ? input.files : [];
+  if (!text && !files.length) return { ok: false, error: "empty reply" };
   try {
-    const client = await relayClient();
-    const attachmentsUrl = pathToFileURL(path.join(__dirname, "..", "src", "attachments.js")).href;
-    const { prepareOrdinaryRelayAttachments } = await import(attachmentsUrl);
-    const os = require("os");
-    const crypto = require("crypto");
-    const text = String(input.text || "").trim();
-    const replyIdempotencyKey = String(input.idempotencyKey || "").trim() || crypto.randomUUID();
-    const files = Array.isArray(input.files) ? input.files : [];
-    if (!text && !files.length) return { ok: false, error: "empty reply" };
-    const localPaths = files.filter((f) => f && f.path).map((f) => String(f.path));
-    for (const f of files) {
-      if (f && !f.path && f.contentBase64) {
-        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "relay-paste-"));
-        const safe = String(f.name || "file").replace(/[\\/]/g, "_");
-        const p2 = path.join(dir, safe);
-        fs.writeFileSync(p2, Buffer.from(String(f.contentBase64), "base64"));
-        localPaths.push(p2);
-      }
-    }
-    const prepared = await prepareOrdinaryRelayAttachments({ files: localPaths });
-    const explicit = input.recipient || {};
-    const hasRecipient = explicit.email || explicit.contactId || explicit.relayUserId || explicit.groupId || explicit.chatId;
-    const res = await client.sendRelay({
-      recipient: hasRecipient ? explicit : {},
-      kind: "message",
-      // A typed text sends no title — titlelessness IS what marks it as a
-      // text. A file-only send keeps a label: the file is the content and the
-      // name is the only thing there is to show for it.
-      ...(text
-        ? {}
-        : { title: files.length === 1 ? String(files[0].name || "1 file") : `${files.length} files` }),
-      forHuman: text || " ",
-      attachments: prepared,
-      ...(input.inReplyToRelayId ? { inReplyToRelayId: String(input.inReplyToRelayId) } : {}),
-      idempotencyKey: replyIdempotencyKey,
-      // Human-authored pill text must never enter the MCP-only forHuman review
-      // gate. Keep this explicit even though the API now positively gates only
-      // relay-mcp: source also drives trustworthy provider attribution.
-      source: { host: "relay-preview" },
+    const entry = outbox.enqueue({
+      idempotencyKey: String(input.idempotencyKey || "").trim() || `pill-reply-${crypto.randomUUID()}`,
+      text,
+      recipient: input.recipient || {},
+      inReplyToRelayId: input.inReplyToRelayId,
+      files,
+      chat: input.chat || {},
     });
-    return { ok: true, result: res };
+    outbox.kick(0);
+    return { ok: true, queued: true, entry };
   } catch (error) {
     return { ok: false, error: error && error.message ? error.message : String(error) };
   }
 }
-ipcMain.handle("relay:sendReply", (_e, input) => sendReplyFromPill(input));
+ipcMain.handle("relay:sendReply", (_e, input) => enqueueReplyFromPill(input));
+// The human pressed Retry on a message the server refused, or asked to throw it
+// away. Both are deliberate acts on a message they can still see.
+ipcMain.handle("relay:outboxRetry", (_e, id) => ({ ok: outbox.retry(String(id || "")) }));
+ipcMain.handle("relay:outboxDiscard", (_e, id) => ({ ok: outbox.retire(String(id || "")) }));
+// The renderer owns the only honest connectivity signal in an Electron app
+// (`window.online`). A regained connection flushes the queue immediately rather
+// than waiting out whatever backoff the last failure earned.
+ipcMain.handle("relay:networkOnline", () => {
+  outbox.reload();
+  outbox.start();
+  return { ok: true };
+});
 ipcMain.handle("relay:react", async (_e, input = {}) => {
   const id = String(input.id || "").trim();
   const emoji = String(input.emoji || "").trim();

package/overlay/preload.cjs

@@ -70,7 +70,16 @@ contextBridge.exposeInMainWorld("relay", {
   scheduleSave: (input) => ipcRenderer.invoke("relay:scheduleSave", input || {}),
   ack: (id) => ipcRenderer.send("relay:ack", id),
   // A REAL send: {text, inReplyToRelayId?, recipient?, files:[{path}|{name,contentBase64,contentType}]}
+  // Answers as soon as the message is committed to this device's outbox, not
+  // when the server has it — the composer never waits on the network.
   sendReply: (payload) => ipcRenderer.invoke("relay:sendReply", payload),
+  // Deliberate acts on a message the server refused: send it again, or bin it.
+  outboxRetry: (id) => ipcRenderer.invoke("relay:outboxRetry", id),
+  outboxDiscard: (id) => ipcRenderer.invoke("relay:outboxDiscard", id),
+  // `window.online` is the only connectivity signal either process actually
+  // has; the renderer forwards it so a regained network flushes the queue at
+  // once instead of waiting out the last failure's backoff.
+  networkOnline: () => ipcRenderer.invoke("relay:networkOnline"),
   react: (id, emoji, action) => ipcRenderer.invoke("relay:react", { id, emoji, action }),
   // Electron>=32 removed File.path — the preload's webUtils is the only way
   // a renderer file picker/drop can yield a real path for the send pipeline.

package/overlay/read-receipts.cjs

@@ -45,7 +45,17 @@
     const readers = members
       .filter((member) => member.seen)
       .sort((a, b) => (timestamp(a.readAt) ?? Infinity) - (timestamp(b.readAt) ?? Infinity) || a.name.localeCompare(b.name));
-    if (!readers.length) return null;
+    if (!readers.length) {
+      // THE LADDER, and the rungs before anyone has read it. The queue owns
+      // what happens on this device; from the moment the server has the
+      // message these two are what is true, and the sender is owed them —
+      // "Sent" alone cannot distinguish a message sitting in the API from one
+      // already on the recipient's device. `delivered` is the server's own
+      // relay state, not a guess: it is set when the relay is routed to the
+      // recipient (their device, or the email that stands in for it).
+      const label = message.delivered ? "Delivered" : "Sent";
+      return { label, readers: [], unread: members, expandable: false };
+    }
     const unread = members.filter((member) => !member.seen);
     const showTime = (value) => (value && typeof formatTime === "function" ? formatTime(value) : "");
     const isGroup = Boolean(message.isGroup) && members.length > 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-companion",
-  "version": "0.1.320",
+  "version": "0.1.321",
   "description": "Companion CLI for Relay (sendrelays.com): pairs this machine with your Relay account so coding agents like Claude Code and Codex can send and receive Relay messages.",
   "homepage": "https://sendrelays.com",
   "repository": {

package/src/outbox.cjs

@@ -0,0 +1,468 @@
+// The send outbox: a message you have typed is COMMITTED, not attempted.
+//
+// Before this, the composer awaited the network. `sendReplyFromPill` made one
+// HTTP attempt with a 15s abort, and on any failure the renderer deleted the
+// optimistic bubble and pushed the words back into the textarea. On a weak or
+// absent connection that is exactly what a person sees: the message says
+// "Sending…" for fifteen seconds, disappears, and reappears as an unsent draft
+// under the cursor (David, Granular group, 2026-08-20). Nothing was lost, but
+// the message did not send itself when the connection came back — the human had
+// to notice and press Send again.
+//
+// Every messenger a person has ever used works the other way. Pressing Send
+// hands the words to the device, the device owes you the delivery, and the
+// ladder of states — waiting on this device, accepted by the server, routed to
+// the recipient, read — is reported honestly while that happens. This module is
+// the "device owes you the delivery" half.
+//
+// WHY THIS IS SAFE TO RETRY. Every entry carries the idempotency key minted when
+// the human pressed Send, and the API keys sends on it — including group fan-out,
+// where each sibling derives `<key>:<targetKey>`. A retry after a lost response
+// therefore converges on the relay the first attempt already created instead of
+// posting a second copy. Retrying without that guarantee would trade a bounced
+// draft for duplicate messages, which is worse.
+//
+// CommonJS so the CJS Electron main process requires it directly, the same way
+// it already shares atomic-json.cjs and state-lock.cjs with the ESM daemon.
+
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { atomicWriteJsonSync } = require("./atomic-json.cjs");
+const { withJsonLock } = require("./state-lock.cjs");
+
+const OUTBOX_VERSION = 1;
+
+// Attempt spacing. The first retry is quick because the commonest failure is a
+// two-second wifi hiccup; the tail is slow because the next commonest is a
+// closed laptop lid in a tunnel, and a queue that retries a dead network every
+// second is a battery bug. There is deliberately NO attempt ceiling: "it sends
+// when you are back online" has to hold for an overnight flight too.
+const BACKOFF_MS = Object.freeze([1_000, 3_000, 8_000, 20_000, 45_000, 90_000, 180_000]);
+const BACKOFF_CAP_MS = 300_000;
+
+// How long a delivered-but-unconfirmed entry is kept before the queue lets it
+// go. Generous enough that the Sent listing has had every chance to name it.
+const RETIRE_SENT_AFTER_MS = 60 * 60 * 1000;
+
+// The error vocabulary of a connection that is down rather than a request that
+// is wrong, measured against undici (which is what both `fetch` and the
+// companion's keep-alive client use): no DNS gives TypeError "fetch failed"
+// with cause.code ENOTFOUND, a black-holed route gives a TimeoutError from
+// AbortSignal.timeout, and a refused port gives TypeError "fetch failed" with
+// no cause code at all.
+const NETWORK_ERROR_CODES = new Set([
+  "ENOTFOUND", "EAI_AGAIN", "ECONNREFUSED", "ECONNRESET", "EHOSTUNREACH",
+  "ENETUNREACH", "ENETDOWN", "EPIPE", "ETIMEDOUT", "EAGAIN",
+  "UND_ERR_CONNECT_TIMEOUT", "UND_ERR_HEADERS_TIMEOUT", "UND_ERR_BODY_TIMEOUT",
+  "UND_ERR_SOCKET",
+]);
+
+// HTTP answers that mean "not now" rather than "not ever".
+const TRANSIENT_STATUS = new Set([408, 425, 429, 500, 502, 503, 504, 507, 522, 524]);
+
+/**
+ * Is this failure worth waiting out?
+ *
+ * The default is PERMANENT, which looks backwards for a queue whose promise is
+ * "keep trying" — but it is the honest default. A connection problem announces
+ * itself in the small, closed vocabulary above; anything else carrying an HTTP
+ * status is the server declining this exact payload, and retrying a declined
+ * payload forever wedges the chat behind a message that can never leave. A
+ * permanent verdict does not throw the words away: the entry stays in the
+ * outbox as `failed`, still holding its text, and the human is told.
+ */
+function classifySendError(error) {
+  if (!error) return "permanent";
+  const status = Number(error.status || error.statusCode || 0);
+  if (status) return TRANSIENT_STATUS.has(status) ? "transient" : "permanent";
+  const name = String(error.name || "");
+  if (name === "TimeoutError" || name === "AbortError") return "transient";
+  if (NETWORK_ERROR_CODES.has(String(error.code || ""))) return "transient";
+  const cause = error.cause;
+  if (cause && NETWORK_ERROR_CODES.has(String(cause.code || ""))) return "transient";
+  // Every undici connect failure surfaces as this exact TypeError, with the
+  // real reason demoted to `cause`. Some of those causes carry no code.
+  if (name === "TypeError" && /fetch failed|network|socket/i.test(String(error.message || ""))) return "transient";
+  return "permanent";
+}
+
+/** The delay before attempt number `attempts + 1`. */
+function backoffMs(attempts) {
+  const index = Math.max(0, Math.trunc(attempts) - 1);
+  return index < BACKOFF_MS.length ? BACKOFF_MS[index] : BACKOFF_CAP_MS;
+}
+
+/**
+ * A wall-clock ISO stamp that keeps its local offset.
+ *
+ * Same rule as every other *At field the companion writes: a bare Z timestamp
+ * read back on a machine in another zone silently retimes the message.
+ */
+function localIso(ms) {
+  const date = new Date(ms);
+  const offset = -date.getTimezoneOffset();
+  const sign = offset >= 0 ? "+" : "-";
+  const pad = (n) => String(Math.floor(Math.abs(n))).padStart(2, "0");
+  return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}`
+    + `T${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}`
+    + `.${String(date.getMilliseconds()).padStart(3, "0")}`
+    + `${sign}${pad(offset / 60)}:${pad(offset % 60)}`;
+}
+
+/** Age of a stamp the queue wrote, or Infinity if it never wrote one. */
+function staleSince(stamp, nowMs = Date.now()) {
+  const at = Date.parse(stamp || "");
+  return Number.isFinite(at) ? nowMs - at : Infinity;
+}
+
+function safeName(name) {
+  return String(name || "file").replace(/[\\/:*?"<>|]/g, "_").slice(0, 120) || "file";
+}
+
+/**
+ * The conversation an entry belongs to, used only for ORDER. Two messages typed
+ * into the same room must land in the order they were typed, so a queued one
+ * holds back the ones behind it; a stall in one room must not hold up another.
+ */
+function chatKeyOf(entry) {
+  const r = (entry && entry.recipient) || {};
+  return String(
+    r.groupId || r.chatId || r.contactId || r.relayUserId || r.email
+    || (entry && entry.chat && entry.chat.threadId) || "unaddressed",
+  ).trim().toLowerCase();
+}
+
+function readStore(file) {
+  try {
+    const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+    const entries = Array.isArray(raw && raw.entries) ? raw.entries : [];
+    return { version: OUTBOX_VERSION, entries: entries.filter((e) => e && e.id) };
+  } catch {
+    return { version: OUTBOX_VERSION, entries: [] };
+  }
+}
+
+/**
+ * A durable, ordered, idempotent send queue.
+ *
+ * `send` is injected rather than imported so this file never reaches for a
+ * network client, a config file or an Electron API: the pill passes the real
+ * transport, and tests pass a fake one.
+ */
+function createOutbox({
+  file,
+  send,
+  now = () => Date.now(),
+  spoolDir,
+  onChange = () => {},
+  log = () => {},
+  scheduleTimer = setTimeout,
+  cancelTimer = clearTimeout,
+} = {}) {
+  if (!file) throw new Error("createOutbox requires a file path");
+  if (typeof send !== "function") throw new Error("createOutbox requires a send function");
+  const spool = spoolDir || path.join(path.dirname(file), "outbox-files");
+
+  let store = readStore(file);
+  let flushing = null;
+  let timer = null;
+  let stopped = false;
+
+  function persist() {
+    withJsonLock(file, () => {
+      atomicWriteJsonSync(file, { version: OUTBOX_VERSION, entries: store.entries });
+    });
+  }
+
+  function changed() {
+    persist();
+    try { onChange(list()); } catch (error) { log("outbox onChange failed", error); }
+  }
+
+  function list() {
+    return store.entries.map((entry) => ({ ...entry }));
+  }
+
+  function entryDir(id) {
+    return path.join(spool, String(id).replace(/[^A-Za-z0-9_.-]/g, "_"));
+  }
+
+  /**
+   * Copy the attachment bytes somewhere the queue owns.
+   *
+   * A queued send may outlive the temp file a paste wrote, the Downloads item a
+   * drag pointed at, or the app itself. The queue cannot promise to deliver a
+   * message whose payload it does not hold, so it takes its own copy and
+   * deletes it when the entry retires.
+   */
+  function spoolFiles(id, files) {
+    const staged = [];
+    const dir = entryDir(id);
+    files.forEach((f, index) => {
+      if (!f) return;
+      const name = safeName(f.name);
+      const target = path.join(dir, `${index}-${name}`);
+      try {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        if (f.path) fs.copyFileSync(String(f.path), target);
+        else if (f.contentBase64) fs.writeFileSync(target, Buffer.from(String(f.contentBase64), "base64"), { mode: 0o600 });
+        else return;
+        staged.push({
+          name: f.name || name,
+          size: Number(f.size || 0) || fs.statSync(target).size,
+          ...(f.contentType ? { contentType: String(f.contentType) } : {}),
+          spoolPath: target,
+        });
+      } catch (error) {
+        log(`outbox could not spool ${name}`, error);
+      }
+    });
+    return staged;
+  }
+
+  function releaseFiles(entry) {
+    if (!entry || !Array.isArray(entry.files) || !entry.files.length) return;
+    try { fs.rmSync(entryDir(entry.id), { recursive: true, force: true }); } catch {}
+  }
+
+  /**
+   * Commit a message to the device. Returns the entry AFTER it is on disk, so a
+   * caller that paints from the return value is painting something that already
+   * survives a crash.
+   */
+  function enqueue(input = {}) {
+    const idempotencyKey = String(input.idempotencyKey || "").trim();
+    if (!idempotencyKey) throw new Error("enqueue requires an idempotencyKey");
+    const existing = store.entries.find((e) => e.idempotencyKey === idempotencyKey);
+    if (existing) return { ...existing };
+    const at = now();
+    const entry = {
+      id: idempotencyKey,
+      idempotencyKey,
+      state: "queued",
+      createdAt: localIso(at),
+      attempts: 0,
+      nextAttemptAt: at,
+      lastError: "",
+      text: String(input.text || ""),
+      recipient: input.recipient && typeof input.recipient === "object" ? input.recipient : {},
+      inReplyToRelayId: String(input.inReplyToRelayId || ""),
+      title: String(input.title || ""),
+      files: spoolFiles(idempotencyKey, Array.isArray(input.files) ? input.files : []),
+      chat: input.chat && typeof input.chat === "object" ? input.chat : {},
+      relayId: "",
+      groupSendId: "",
+      threadId: String((input.chat && input.chat.threadId) || ""),
+    };
+    store.entries.push(entry);
+    changed();
+    return { ...entry };
+  }
+
+  function update(id, patch) {
+    const entry = store.entries.find((e) => e.id === id);
+    if (!entry) return null;
+    Object.assign(entry, patch);
+    return entry;
+  }
+
+  /** Forget an entry (and its spooled bytes) once its canonical relay exists. */
+  function retire(id) {
+    const index = store.entries.findIndex((e) => e.id === id);
+    if (index < 0) return false;
+    releaseFiles(store.entries[index]);
+    store.entries.splice(index, 1);
+    changed();
+    return true;
+  }
+
+  /**
+   * Retire every entry whose canonical relay is now in the Sent projection.
+   *
+   * Retirement is deliberately driven by the SERVER's view rather than by our
+   * own success return: that is the same evidence the renderer uses to retire
+   * an optimistic bubble, so the queued row and the real row can never both be
+   * on screen, and a success we recorded but the server did not keep cannot
+   * quietly vanish from the queue.
+   */
+  function retireConfirmed({ relayIds = [], groupSendIds = [] } = {}) {
+    const ids = new Set([...relayIds].map(String).filter(Boolean));
+    const sends = new Set([...groupSendIds].map(String).filter(Boolean));
+    const survivors = [];
+    let dropped = 0;
+    for (const entry of store.entries) {
+      const confirmed = entry.state === "sent"
+        && ((entry.relayId && ids.has(String(entry.relayId)))
+          || (entry.groupSendId && sends.has(String(entry.groupSendId))))
+        // A `sent` entry the Sent projection never names has still been
+        // ACCEPTED by the server — that is what earned it the state. Holding it
+        // forever on the chance the listing catches up is how a queue file
+        // grows without bound; the room already stops painting it the moment
+        // the canonical row lands.
+        || (entry.state === "sent" && staleSince(entry.sentAt, now()) > RETIRE_SENT_AFTER_MS);
+      if (!confirmed) { survivors.push(entry); continue; }
+      releaseFiles(entry);
+      dropped += 1;
+    }
+    if (!dropped) return 0;
+    store.entries = survivors;
+    changed();
+    return dropped;
+  }
+
+  /** Put a failed entry back in line — the human pressed Retry. */
+  function retry(id) {
+    const entry = store.entries.find((e) => e.id === id);
+    if (!entry || entry.state === "sent") return false;
+    entry.state = "queued";
+    entry.attempts = 0;
+    entry.nextAttemptAt = now();
+    entry.lastError = "";
+    changed();
+    kick(0);
+    return true;
+  }
+
+  async function attempt(entry) {
+    entry.attempts += 1;
+    try {
+      const result = await send({ ...entry });
+      update(entry.id, {
+        state: "sent",
+        sentAt: localIso(now()),
+        lastError: "",
+        relayId: String((result && (result.relayId || result.id)) || ""),
+        groupSendId: String((result && result.groupSendId) || ""),
+        threadId: String((result && result.threadId) || entry.threadId || ""),
+      });
+      changed();
+      return "sent";
+    } catch (error) {
+      const kind = classifySendError(error);
+      const message = (error && error.message) || String(error);
+      if (kind === "permanent") {
+        update(entry.id, { state: "failed", lastError: message, failedAt: localIso(now()) });
+        changed();
+        log(`outbox send rejected (${message})`);
+        return "failed";
+      }
+      update(entry.id, {
+        state: "queued",
+        lastError: message,
+        nextAttemptAt: now() + backoffMs(entry.attempts),
+      });
+      changed();
+      return "waiting";
+    }
+  }
+
+  /**
+   * One pass over everything due. Serialized: a burst of five messages typed
+   * offline must reach the server in the order they were typed, not in whatever
+   * order five parallel sockets happen to finish.
+   */
+  function flush() {
+    if (flushing) return flushing;
+    flushing = (async () => {
+      const blocked = new Set();
+      // Snapshot the ids, not the objects: an attempt writes the store.
+      for (const id of store.entries.map((e) => e.id)) {
+        if (stopped) break;
+        const entry = store.entries.find((e) => e.id === id);
+        if (!entry || entry.state !== "queued") continue;
+        const key = chatKeyOf(entry);
+        // A message still waiting on the network holds back only the messages
+        // behind it IN ITS OWN ROOM. A permanently failed one blocks nothing:
+        // one rejected message must never wedge a conversation forever.
+        if (blocked.has(key)) continue;
+        if (entry.nextAttemptAt > now()) { blocked.add(key); continue; }
+        const outcome = await attempt(entry);
+        if (outcome === "waiting") blocked.add(key);
+      }
+    })().finally(() => {
+      flushing = null;
+      if (!stopped) arm();
+    });
+    return flushing;
+  }
+
+  /** Wake exactly when the earliest waiting entry comes due — no idle polling. */
+  function arm() {
+    if (timer) { cancelTimer(timer); timer = null; }
+    if (stopped) return;
+    const due = store.entries
+      .filter((e) => e.state === "queued")
+      .map((e) => Number(e.nextAttemptAt) || 0);
+    if (!due.length) return;
+    const wait = Math.max(0, Math.min(...due) - now());
+    timer = scheduleTimer(() => { timer = null; flush().catch(() => {}); }, wait);
+    if (timer && typeof timer.unref === "function") timer.unref();
+  }
+
+  function kick(delay = 0) {
+    if (stopped) return;
+    if (delay > 0) { arm(); return; }
+    flush().catch(() => {});
+  }
+
+  /**
+   * Fresh evidence that the network is back — drop the backoff and try now.
+   *
+   * Backoff is a guess about a connection nobody can see. Once something else
+   * has just succeeded against the API, the guess is superseded: a message must
+   * not sit for another five minutes because its last attempt happened to fail
+   * during the outage.
+   */
+  function resume() {
+    if (stopped) return 0;
+    let woken = 0;
+    for (const entry of store.entries) {
+      if (entry.state !== "queued") continue;
+      entry.nextAttemptAt = now();
+      woken += 1;
+    }
+    if (woken) kick(0);
+    return woken;
+  }
+
+  function start() {
+    stopped = false;
+    // Anything left queued by a previous run is due immediately: the commonest
+    // reason the app restarted is that the machine woke up somewhere else.
+    resume();
+    kick(0);
+  }
+
+  function stop() {
+    stopped = true;
+    if (timer) { cancelTimer(timer); timer = null; }
+  }
+
+  /** Reload from disk (another process, or a test, wrote the file). */
+  function reload() {
+    store = readStore(file);
+    return list();
+  }
+
+  function pendingCount() {
+    return store.entries.filter((e) => e.state === "queued").length;
+  }
+
+  return {
+    enqueue, list, flush, retire, retireConfirmed, retry, start, stop, reload,
+    resume, pendingCount, kick,
+  };
+}
+
+module.exports = {
+  createOutbox,
+  classifySendError,
+  backoffMs,
+  chatKeyOf,
+  localIso,
+  BACKOFF_MS,
+  BACKOFF_CAP_MS,
+  OUTBOX_VERSION,
+};