Function seal_message 

pub fn seal_message(
    author_keys: &Keys,
    channel_key: &ChannelKey,
    channel_id: &ChannelId,
    epoch: Epoch,
    content: &str,
    ms: u64,
) -> Result<Event, EnvelopeError>

Seal a plaintext message into an outer wire event. The outer event is signed by a fresh one-time key (no persistent author↔channel linkage on the wire).

This convenience form discards that key, so the resulting message is NOT self-deletable. The product send path should use seal_message_with_ephemeral and RETAIN the key (like Vector’s nip17_wrap_keys for DMs) so the sender can later NIP-09-delete their own message. Ephemeral-on-the-wire and retained-locally are complementary: the relay still sees only one-time keys (no corpus-wide deletion authority), while the sender keeps a per-message key to delete just their own.