Let failed messages be discarded

PLAN.md

@@ -454,7 +454,9 @@ response are stored per server and session on the phone, so leaving and reopenin
 eat the only copy. Once the server accepts the request, the bubble remains in memory until the
 provider event but the phone stops storing it: ownership has crossed to the server, whose transcript
 and driver state survive the screen. Accepted queued messages remain the server transcript's fact
-and are replayed from it on every device.
+and are replayed from it on every device. A failed local bubble can be discarded after an explicit
+confirmation that this removes the phone's only copy; otherwise the persistence that protects it
+would also leave it on screen forever with no way out.
 
 Reconciliation uses the first local message with the same text and attachments because the current
 message route has no caller-supplied id. Identical sends are therefore consumed in wire order. A