Keep sent messages visible until received

PLAN.md

@@ -397,6 +397,22 @@ in the right place. The echo driver models both shapes: `/peer` and
 
 ### Taking a queued message back (2026-08-31)
 
+**Pressing Send always makes a quiet local bubble first (2026-09-10).** It remains until the
+provider's `UserMessage` records that the message was received. A server `MessageQueued` replaces
+the local bridge with its durable queue entry rather than adding a second bubble; an immediate
+`UserMessage` removes it directly. If the request cannot reach the server, the local bubble stays
+and carries that network failure underneath the message. Local bridges without a successful server
+response are stored per server and session on the phone, so leaving and reopening the screen cannot
+eat the only copy. Once the server accepts the request, the bubble remains in memory until the
+provider event but the phone stops storing it: ownership has crossed to the server, whose transcript
+and driver state survive the screen. Accepted queued messages remain the server transcript's fact
+and are replayed from it on every device.
+
+Reconciliation uses the first local message with the same text and attachments because the current
+message route has no caller-supplied id. Identical sends are therefore consumed in wire order. A
+client id on the route and events would make cross-device identical simultaneous sends unambiguous,
+but expanding the protocol solely for a transient display bridge was rejected.
+
 `POST /sessions/{id}/unqueue`, answered by `Driver::unqueue` and recorded as
 `Event::MessageDropped` so every device loses the bubble and a reconnect does
 not replay it.