@@ -3,7 +3,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { Source } from './sources';
 
 const storage = vi.hoisted(() => new Map<string, string>());
-const net = vi.hoisted(() => ({ offline: false, user: 'user-a' as string | null, uuids: 0 }));
+const net = vi.hoisted(() => ({ offline: false, user: 'user-a' as string | null, uuids: 0, failGet: 0, failSet: 0 }));
 // supabase-js answers a request that never reached the server with status 0; readFailed marks it unreachable.
 // The saved copies, kept in memory so a test can see what an offline relaunch would show.
 const copies = vi.hoisted(() => new Map<string, unknown>());
@@ -35,8 +35,20 @@ const sources = vi.hoisted(() => ({
 
 vi.mock('@react-native-async-storage/async-storage', () => ({
   default: {
-    getItem: async (key: string) => storage.get(key) ?? null,
-    setItem: async (key: string, value: string) => void storage.set(key, value),
+    getItem: async (key: string) => {
+      if (net.failGet > 0 && key.includes('user-')) {
+        net.failGet -= 1;
+        throw new Error('storage unavailable');
+      }
+      return storage.get(key) ?? null;
+    },
+    setItem: async (key: string, value: string) => {
+      if (net.failSet > 0) {
+        net.failSet -= 1;
+        throw new Error('storage full');
+      }
+      storage.set(key, value);
+    },
     removeItem: async (key: string) => void storage.delete(key),
     getAllKeys: async () => [...storage.keys()],
     multiRemove: async (keys: string[]) => keys.forEach((key) => storage.delete(key)),
@@ -84,6 +96,8 @@ beforeEach(async () => {
   net.offline = false;
   net.user = 'user-a';
   net.uuids = 0;
+  net.failGet = 0;
+  net.failSet = 0;
   vi.clearAllMocks();
   sources.addSource.mockImplementation(async (_userId: string, input: { id: string; title: string; content: string; debateId: string }) => row(input.id, input));
   sources.updateSource.mockResolvedValue(undefined);
@@ -174,6 +188,38 @@ describe('offline queue', () => {
     expect(sent()).toEqual(['edit s9 {"title":"Other debate"}']);
   });
 
+  it('tells the caller when a change cannot be kept on the phone, and keeps nothing half-saved', async () => {
+    const queue = await load();
+    copies.set('sources:d1', []);
+    net.offline = true;
+    // The save fails, and so does its retry.
+    net.failSet = 2;
+    await expect(queue.queueAddSource('user-a', { title: 'Lost?', content: 'Text', type: 'text', debateId: 'd1' })).rejects.toThrow('could not be kept');
+    await cache.copiesWritten();
+    expect(queue.getQueueSnapshot().items).toEqual([]);
+    expect(copies.get('sources:d1')).toEqual([]);
+  });
+
+  it('never writes over a stored queue it could not read, and keeps it once a read works', async () => {
+    let queue = await load();
+    net.offline = true;
+    await queue.queueAddSource('user-a', { title: 'From last week', content: 'Text', type: 'text', debateId: 'd1' });
+    const stored = [...storage.values()].join('');
+    expect(stored).toContain('From last week');
+
+    // A relaunch whose reads keep failing (at launch and again before the write, each with its retry):
+    // an offline write is refused and the store is untouched.
+    net.failGet = 4;
+    queue = await load();
+    await expect(queue.queueAddSource('user-a', { title: 'Today', content: 'Text', type: 'text', debateId: 'd1' })).rejects.toThrow();
+    expect([...storage.values()].join('')).toContain('From last week');
+
+    // The next write reads the store again, keeps last week's note first and adds today's.
+    await queue.queueAddSource('user-a', { title: 'Today again', content: 'Text', type: 'text', debateId: 'd1' });
+    const titles = queue.getQueueSnapshot().items.map((item) => (item.kind === 'add' ? item.input.title : ''));
+    expect(titles).toEqual(['From last week', 'Today again']);
+  });
+
   it('puts back what the copies showed before a refused change, even when the server cannot be read again', async () => {
     const queue = await load();
     copies.set('sources:d1', [row('s1', { title: 'Old', content: 'Text', debateId: 'd1' })]);
 
@@ -125,6 +125,10 @@ let snapshot: QueueSnapshot = { owner, items, synced };
 let running: Promise<void> | null = null;
 // While Clear all asks the server, nothing replays: a queued note must not land in a Library being cleared.
 let paused = 0;
+// Whether this account's stored queue has been read. Until it has, nothing is written over it.
+let hydrated = false;
+// Writes that wait for the connection, told "queued" only once the queue holding them is saved.
+let awaitingSave: { key: string; waiter: Waiter }[] = [];
 let again = false;
 let keys = 0;
 
@@ -163,12 +167,52 @@ function persist() {
   const gen = generation;
   const saved = items.map((item) => ({ ...item }));
   const savedBefore = { ...before };
+  const confirming = awaitingSave;
+  awaitingSave = [];
   if (!userId) return;
   void storage(async () => {
     if (gen !== generation) return;
-    if (saved.length === 0) await AsyncStorage.removeItem(storageKey(userId));
-    else await AsyncStorage.setItem(storageKey(userId), JSON.stringify({ userId, items: saved, before: savedBefore }));
-  }).catch(warn('Could not keep the offline changes'));
+    // A stored queue that could not be read is never written over: it may hold unsynced work.
+    if (!hydrated) throw new Error('The offline changes on this phone could not be read.');
+    const write = () =>
+      saved.length === 0
+        ? AsyncStorage.removeItem(storageKey(userId))
+        : AsyncStorage.setItem(storageKey(userId), JSON.stringify({ userId, items: saved, before: savedBefore }));
+    // One retry for a passing storage error before anyone hears the change was not kept.
+    await write().catch(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 200));
+      await write();
+    });
+  }).then(
+    () => confirming.forEach(({ waiter }) => waiter.resolve('queued')),
+    (cause: unknown) => {
+      warn('Could not keep the offline changes')(cause);
+      if (gen === generation && confirming.length > 0) void unkeep(userId, confirming, cause);
+    },
+  );
+}
+
+/**
+ * Writes that were to wait for the connection but could not be kept on the phone: they leave the
+ * queue, the copies go back to what they showed, and whoever made them hears it, so a draft
+ * stays open instead of being lost on the next launch.
+ */
+async function unkeep(userId: string, failed: { key: string; waiter: Waiter }[], cause: unknown) {
+  const keys = new Set(failed.map((one) => one.key));
+  const gone = items.filter((item) => keys.has(item.key) && item.key !== inFlight);
+  for (const item of gone) {
+    if (item.kind === 'add') {
+      dropWrites(item.tempId, item.key);
+      updateCopy<Source[]>(userId, 'sources', item.input.debateId, (list) => list?.filter((source) => source.id !== item.tempId));
+    } else {
+      items = items.filter((other) => other.key !== item.key);
+    }
+  }
+  await copiesWritten();
+  for (const item of gone) if (item.kind !== 'add') settleBefore(userId, item, true);
+  const error = new Error('This change could not be kept on this phone. Try again.', { cause });
+  failed.forEach(({ waiter }) => waiter.reject(error));
+  emit();
 }
 
 function parse(raw: string | null, userId: string): { items: QueuedWrite[]; before: Record<string, Restorable> } {
@@ -186,6 +230,32 @@ function parse(raw: string | null, userId: string): { items: QueuedWrite[]; befo
   }
 }
 
+/**
+ * Reads the account's stored queue, once more after a passing failure. Writes from an earlier
+ * launch go ahead of any made since; until a read succeeds nothing is written over the store.
+ */
+async function hydrate(userId: string, gen: number) {
+  let raw: string | null;
+  try {
+    raw = await AsyncStorage.getItem(storageKey(userId)).catch(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 200));
+      return AsyncStorage.getItem(storageKey(userId));
+    });
+  } catch (cause) {
+    warn('Could not read the offline changes')(cause);
+    return;
+  }
+  if (gen !== generation) return;
+  const loaded = parse(raw, userId);
+  hydrated = true;
+  if (loaded.items.length === 0) return;
+  // Nobody waits for writes from an earlier launch: they show as waiting until they sync.
+  const known = new Set(items.map((item) => item.key));
+  items = [...loaded.items.filter((item) => !known.has(item.key)).map((item) => ({ ...item, waiting: true })), ...items];
+  before = { ...loaded.before, ...before };
+  emit();
+}
+
 /**
  * Called with the signed-in account once auth has settled. Another account's
  * queue, or one left with no account, is removed; the same account after a
@@ -204,16 +274,13 @@ export function setQueueOwner(userId: string | null) {
   synced = new Map();
   inFlight = null;
   emit();
+  hydrated = false;
+  awaitingSave = [];
   ready = storage(async () => {
     const stale = (await AsyncStorage.getAllKeys()).filter((key) => key.startsWith(`${PREFIX}:`) && (userId === null || key !== storageKey(userId)));
     if (stale.length > 0) await AsyncStorage.multiRemove(stale);
     if (!userId) return;
-    const loaded = parse(await AsyncStorage.getItem(storageKey(userId)), userId);
-    if (gen !== generation || loaded.items.length === 0) return;
-    // Nobody waits for writes from an earlier launch: they show as waiting until they sync.
-    items = loaded.items.map((item) => ({ ...item, waiting: true }));
-    before = loaded.before;
-    emit();
+    await hydrate(userId, gen);
   }).catch(warn('Could not read the offline changes'));
 }
 
@@ -223,13 +290,20 @@ async function adopt(userId: string) {
   else if (owner !== userId) throw new Error('This change belongs to another account.');
   await ready;
   if (owner !== userId) throw new Error('This change belongs to another account.');
+  // The stored queue could not be read at launch: try again before adding to it.
+  if (!hydrated) {
+    const gen = generation;
+    ready = storage(() => hydrate(userId, gen)).catch(warn('Could not read the offline changes'));
+    await ready;
+  }
 }
 
 const isWaitingForNetwork = () => isKnownOffline() || items.some((item) => item.waiting);
 
 function attach(key: string, waiter: Waiter, waiting: boolean) {
   if (waiting) {
-    waiter.resolve('queued');
+    // Told "queued" once the queue holding it is saved (persist), never before.
+    awaitingSave.push({ key, waiter });
     return;
   }
   waiters.set(key, [...(waiters.get(key) ?? []), waiter]);
@@ -247,7 +321,7 @@ function parkAll() {
   items = items.map((item) => (item.waiting ? item : { ...item, waiting: true }));
   const parked = waiters;
   waiters = new Map();
-  parked.forEach((list) => list.forEach((waiter) => waiter.resolve('queued')));
+  parked.forEach((list, key) => list.forEach((waiter) => awaitingSave.push({ key, waiter })));
   persist();
   emit();
 }