0.2.1: the outbox retries token-endpoint refusals instead of rejecting the event

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex cb8c1d8..dd4d999 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -3,6 +3,11 @@
  All notable changes to `openvibe-sdk`. The package follows semver; while it is `0.x`, a minor
  release may change an API and says so here.
  
++## 0.2.1 (2026-09-23)
++
++- Outbox: a refusal from the Network token endpoint (for example a grant not provisioned yet) is
++  retried, never treated as Events rejecting the envelope.
++
  ## 0.2.0 (2026-09-23)
  
  - `openvibe-sdk/events`: `createOutbox(db, { events })` and `createInbox(db)` — the transactional
ddiff --git a/package.json b/package.json
iindex ba354d9..0d375f7 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.2.0",
++  "version": "0.2.1",
    "description": "Supported browser and server clients for the OpenVibe platform: auth, registry discovery, identity, user modules, events, realtime, media and community, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/outbox.js b/src/outbox.js
iindex a262f67..0db0c40 100644
---- a/src/outbox.js
++++ b/src/outbox.js
@@@ -25,8 +25,11 @@ const TRACEPARENT_RE = /^00-([0-9a-f]{32})-[0-9a-f]{16}-[0-9a-f]{2}$/;
  const TABLE_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
  const RETRYABLE_4XX = new Set([401, 408, 409, 425, 429]);
  
++// Only Events refusing the envelope is permanent. A failure to get a token (no grant yet, Network
++// restarting) says nothing about the event, so it is always retried.
  function isPermanent(err) {
      const s = err && err.status;
++    if (err && typeof err.url === 'string' && /\/oauth\/token(\?|$)/.test(err.url)) return false;
      return Number.isInteger(s) && s >= 400 && s < 500 && !RETRYABLE_4XX.has(s);
  }
  
ddiff --git a/test/outbox.test.js b/test/outbox.test.js
iindex 948fe6c..67d5189 100644
---- a/test/outbox.test.js
++++ b/test/outbox.test.js
@@@ -97,6 +97,16 @@ run([
          assert.equal(outbox.rejected(), 1);
          assert.equal(platform.state.events.length, 2);
      }],
++    ['a token-endpoint refusal is retried, never rejected', async () => {
++        const { events, db } = setup();
++        const noGrant = { prepare: events.prepare, publish: () => Promise.reject(Object.assign(new Error('unauthorized_client'), { status: 400, url: 'http://127.0.0.1:4000/oauth/token' })) };
++        const outbox = createOutbox(db, { events: noGrant });
++        outbox.ensureSchema();
++        db.transaction(() => outbox.enqueue({ event_type: 'live.stream.started', actor, subject }))();
++        assert.deepEqual(await outbox.flush(), { sent: 0, failed: 1, rejected: 0 });
++        assert.equal(outbox.rejected(), 0);
++        assert.equal(outbox.pending(), 1);
++    }],
      ['inbox runs a handler exactly once and rolls back with it', async () => {
          const { db } = setup();
          const inbox = createInbox(db);