@@ -188,6 +188,89 @@ rmw_ret_t rmw_destroy_publisher(rmw_node_t * node, rmw_publisher_t * publisher)
   return RMW_RET_OK;
 }
 
+// Cache a TRANSIENT_LOCAL message for late-joiner replay and send it now.
+// Shared by rmw_publish and rmw_publish_serialized_message. Large payloads
+// (>= SHM_PAYLOAD_THRESHOLD) are staged into a dedicated durable shm segment
+// (shm_stage_durable) so the cached entry and its replays are a small
+// descriptor rather than a datagram the kernel would reject; small payloads and
+// the shm-unavailable fallback are cached inline. `payload` is taken by value:
+// callers std::move a serialized vector in, so the common path is one move, and
+// the inline branch keeps the bytes with no copy. Returns RMW_RET_ERROR if the
+// live send of the current message hits the kernel size cap (EMSGSIZE),
+// mirroring the non-TL path; replay of previously-cached messages to a new
+// subscriber is best-effort and not reflected in the return code.
+static rmw_ret_t transient_local_publish(
+  rmw_uds::UdsPublisher * pub_data,
+  rmw_uds::WireHeader hdr,
+  std::vector<uint8_t> payload,
+  const std::shared_ptr<const std::vector<std::string>> & sub_paths)
+{
+  std::lock_guard<std::mutex> lock(pub_data->cache_mutex);
+
+  rmw_uds::CachedMessage cached;
+  cached.header = hdr;
+  if (payload.size() >= rmw_uds::SHM_PAYLOAD_THRESHOLD) {
+    rmw_uds::ShmPayloadDescriptor desc;
+    auto seg = rmw_uds::shm_stage_durable(
+      pub_data->context->domain_id, payload.data(), payload.size(), desc);
+    if (seg) {
+      cached.header.msg_type |= rmw_uds::SHM_PAYLOAD_FLAG;
+      cached.header.payload_size = static_cast<uint32_t>(sizeof(desc));
+      cached.payload.assign(
+        reinterpret_cast<const uint8_t *>(&desc),
+        reinterpret_cast<const uint8_t *>(&desc) + sizeof(desc));
+      cached.shm_seg = std::move(seg);
+    } else {
+      cached.payload = std::move(payload);  // inline fallback
+    }
+  } else {
+    cached.payload = std::move(payload);
+  }
+  pub_data->message_cache.push_back(std::move(cached));
+  while (pub_data->message_cache.size() > pub_data->qos.depth) {
+    pub_data->message_cache.pop_front();
+  }
+
+  if (sub_paths) {
+    for (const auto & path : *sub_paths) {
+      if (pub_data->known_subscriber_paths.count(path) == 0) {
+        pub_data->known_subscriber_paths.insert(path);
+        for (size_t i = 0; i + 1 < pub_data->message_cache.size(); ++i) {
+          const auto & cm = pub_data->message_cache[i];
+          rmw_uds::send_to(
+            pub_data->context->send_socket_fd,
+            path, cm.header, cm.payload.data(), cm.payload.size());
+        }
+      }
+    }
+  }
+
+  // Send the current message, read from the cached copy since payload was
+  // moved. Trimming never disturbs back(), so it is the message just pushed.
+  // Surface EMSGSIZE the way the non-TL path does so a latched payload the
+  // kernel rejects is not reported as a successful publish.
+  const auto & current = pub_data->message_cache.back();
+  bool config_error = false;
+  if (sub_paths) {
+    for (const auto & path : *sub_paths) {
+      if (rmw_uds::send_to(
+          pub_data->context->send_socket_fd,
+          path, current.header, current.payload.data(), current.payload.size())
+        == rmw_uds::SendResult::ConfigError)
+      {
+        config_error = true;
+      }
+    }
+  }
+  if (config_error) {
+    RMW_SET_ERROR_MSG(
+      "UDS send: TRANSIENT_LOCAL message too large for kernel send buffer "
+      "(EMSGSIZE). Raise net.core.wmem_max or reduce message size.");
+    return RMW_RET_ERROR;
+  }
+  return RMW_RET_OK;
+}
+
 rmw_ret_t rmw_publish(
   const rmw_publisher_t * publisher,
   const void * ros_message,
@@ -266,64 +349,9 @@ rmw_ret_t rmw_publish(
     sub_paths = pub_data->cached_subscriber_paths;  // refcount copy under lock
   }
 
-  // TRANSIENT_LOCAL: cache message and replay to late-joining subscribers
+  // TRANSIENT_LOCAL: cache message and replay to late-joining subscribers.
   if (pub_data->qos.durability == RMW_QOS_POLICY_DURABILITY_TRANSIENT_LOCAL) {
-    std::lock_guard<std::mutex> lock(pub_data->cache_mutex);
-
-    rmw_uds::CachedMessage cached;
-    cached.header = hdr;
-    // Large payloads are staged into a dedicated durable shm segment so the
-    // cache entry — and every replay of it to a late joiner — is a small
-    // descriptor rather than a multi-megabyte datagram the kernel would drop.
-    // The segment lives as long as this cache entry (unlinked on eviction).
-    // Falls back to caching the payload inline when shm is unavailable.
-    if (payload.size() >= rmw_uds::SHM_PAYLOAD_THRESHOLD) {
-      rmw_uds::ShmPayloadDescriptor desc;
-      auto seg = rmw_uds::shm_stage_durable(
-        pub_data->context->domain_id, payload.data(), payload.size(), desc);
-      if (seg) {
-        cached.header.msg_type |= rmw_uds::SHM_PAYLOAD_FLAG;
-        cached.header.payload_size = static_cast<uint32_t>(sizeof(desc));
-        cached.payload.assign(
-          reinterpret_cast<const uint8_t *>(&desc),
-          reinterpret_cast<const uint8_t *>(&desc) + sizeof(desc));
-        cached.shm_seg = std::move(seg);
-      } else {
-        cached.payload = std::move(payload);  // inline fallback
-      }
-    } else {
-      cached.payload = std::move(payload);  // last use of payload
-    }
-    pub_data->message_cache.push_back(std::move(cached));
-    while (pub_data->message_cache.size() > pub_data->qos.depth) {
-      pub_data->message_cache.pop_front();
-    }
-
-    if (sub_paths) {
-      for (const auto & path : *sub_paths) {
-        if (pub_data->known_subscriber_paths.count(path) == 0) {
-          pub_data->known_subscriber_paths.insert(path);
-          for (size_t i = 0; i + 1 < pub_data->message_cache.size(); ++i) {
-            const auto & cm = pub_data->message_cache[i];
-            rmw_uds::send_to(
-              pub_data->context->send_socket_fd,
-              path, cm.header, cm.payload.data(), cm.payload.size());
-          }
-        }
-      }
-    }
-
-    // Send the current message, read from the cached copy since payload was
-    // moved. Trimming never disturbs back(), so it is the message just pushed.
-    const auto & current = pub_data->message_cache.back();
-    if (sub_paths) {
-      for (const auto & path : *sub_paths) {
-        rmw_uds::send_to(
-          pub_data->context->send_socket_fd,
-          path, current.header, current.payload.data(), current.payload.size());
-      }
-    }
-    return RMW_RET_OK;
+    return transient_local_publish(pub_data, hdr, std::move(payload), sub_paths);
   }
 
   // Large payloads travel through the publisher's shm ring: stage the bytes
@@ -413,18 +441,42 @@ rmw_ret_t rmw_publish_serialized_message(
       }
       pub_data->cached_generation = current_gen;
       pub_data->cached_subscriber_paths = std::move(fresh);
+
+      // TRANSIENT_LOCAL: prune known subscribers no longer present, mirroring
+      // rmw_publish (nested lock order sub_cache_mutex -> cache_mutex) so a
+      // concurrent refresh cannot make the pruning set stale.
+      if (pub_data->qos.durability == RMW_QOS_POLICY_DURABILITY_TRANSIENT_LOCAL) {
+        std::lock_guard<std::mutex> prune_lock(pub_data->cache_mutex);
+        std::set<std::string> current(
+          pub_data->cached_subscriber_paths->begin(),
+          pub_data->cached_subscriber_paths->end());
+        for (auto it = pub_data->known_subscriber_paths.begin();
+          it != pub_data->known_subscriber_paths.end(); )
+        {
+          it = (current.count(*it) == 0) ?
+            pub_data->known_subscriber_paths.erase(it) : std::next(it);
+        }
+      }
     }
     sub_paths = pub_data->cached_subscriber_paths;
   }
 
-  // Same large-payload fork as rmw_publish: stage once, fan out descriptors.
-  // TRANSIENT_LOCAL keeps the inline path for consistency with rmw_publish
-  // (this entry point does not feed the replay cache).
+  // TRANSIENT_LOCAL: cache + replay through the same durable-shm path as
+  // rmw_publish, so a serialized latched payload (including one above the
+  // datagram cap) reaches late joiners too.
+  if (pub_data->qos.durability == RMW_QOS_POLICY_DURABILITY_TRANSIENT_LOCAL) {
+    return transient_local_publish(
+      pub_data, hdr,
+      std::vector<uint8_t>(
+        serialized_message->buffer,
+        serialized_message->buffer + serialized_message->buffer_length),
+      sub_paths);
+  }
+
+  // Large non-TL payloads: stage once into the cycling ring, fan out descriptors.
   rmw_uds::ShmPayloadDescriptor desc;
   bool staged = false;
-  if (serialized_message->buffer_length >= rmw_uds::SHM_PAYLOAD_THRESHOLD &&
-    pub_data->qos.durability != RMW_QOS_POLICY_DURABILITY_TRANSIENT_LOCAL)
-  {
+  if (serialized_message->buffer_length >= rmw_uds::SHM_PAYLOAD_THRESHOLD) {
     std::lock_guard<std::mutex> lock(pub_data->shm_mutex);
     staged = rmw_uds::shm_stage_payload(
       pub_data->shm_ring, pub_data->context->domain_id,
 
@@ -17,6 +17,7 @@
 #include <cerrno>
 #include <chrono>
 #include <cstdio>
+#include <cstdlib>
 #include <cstring>
 
 #include <dirent.h>
@@ -205,6 +206,12 @@ std::unique_ptr<DurableShmSegment> shm_stage_durable(
   if (payload_size > UINT32_MAX) {
     return nullptr;
   }
+  // Test seam (cold path, large latched publishes only): when this env var is
+  // set, behave as if shared memory were unavailable so tests can exercise the
+  // inline fallback deterministically. Never set in production.
+  if (std::getenv("RMW_UDS_TEST_FORCE_SHM_FAILURE") != nullptr) {
+    return nullptr;
+  }
 
   // One record at offset 0; the segment holds nothing else and never grows.
   const size_t record_bytes =
 
@@ -228,6 +228,156 @@ TEST_F(QosTest, TransientLocalHugeMessageLateJoiner)
   auto _r2 [[maybe_unused]] = rmw_destroy_publisher(node, pub);
 }
 
+TEST_F(QosTest, TransientLocalPublishReturnsErrorOnEMSGSIZE)
+{
+  // A latched publish whose live send is rejected by the kernel size cap must
+  // return RMW_RET_ERROR, not a lying RMW_RET_OK. Before the fix the TL path
+  // ignored send_to's result entirely. Shrink SO_SNDBUF so a sub-threshold
+  // (inline) latched message hits EMSGSIZE deterministically, independent of
+  // the machine's net.core.wmem_max.
+  auto * ctx_impl = reinterpret_cast<rmw_uds::UdsContext *>(context.impl);
+  int small_buf = 2048;
+  ASSERT_EQ(
+    0,
+    setsockopt(
+      ctx_impl->send_socket_fd, SOL_SOCKET, SO_SNDBUF,
+      &small_buf, sizeof(small_buf)));
+
+  auto seq_ts = rosidl_typesupport_cpp::get_message_type_support_handle<
+    test_msgs::msg::UnboundedSequences>();
+  auto qos = make_qos(
+    RMW_QOS_POLICY_RELIABILITY_RELIABLE,
+    RMW_QOS_POLICY_DURABILITY_TRANSIENT_LOCAL, 5);
+  auto pub_opts = rmw_get_default_publisher_options();
+  auto * pub = rmw_create_publisher(node, seq_ts, "/tl_emsgsize", &qos, &pub_opts);
+  ASSERT_NE(nullptr, pub);
+  auto sub_opts = rmw_get_default_subscription_options();
+  auto * sub = rmw_create_subscription(node, seq_ts, "/tl_emsgsize", &qos, &sub_opts);
+  ASSERT_NE(nullptr, sub);
+
+  // 32 KiB: above the shrunken buffer, below SHM_PAYLOAD_THRESHOLD so it stays
+  // on the inline datagram path (a durable-staged payload would bypass the cap).
+  test_msgs::msg::UnboundedSequences msg;
+  msg.uint8_values.resize(32 * 1024);
+  EXPECT_EQ(RMW_RET_ERROR, rmw_publish(pub, &msg, nullptr));
+
+  auto _r1 [[maybe_unused]] = rmw_destroy_subscription(node, sub);
+  auto _r2 [[maybe_unused]] = rmw_destroy_publisher(node, pub);
+}
+
+TEST_F(QosTest, TransientLocalLargeMessageInlineFallbackWhenShmUnavailable)
+{
+  // When shm staging is unavailable, a large latched payload falls back to
+  // caching inline (no durable segment, no SHM_PAYLOAD_FLAG) and is still
+  // delivered byte-equal to a late joiner. The test seam forces the failure.
+  auto seq_ts = rosidl_typesupport_cpp::get_message_type_support_handle<
+    test_msgs::msg::UnboundedSequences>();
+  auto qos = make_qos(
+    RMW_QOS_POLICY_RELIABILITY_RELIABLE,
+    RMW_QOS_POLICY_DURABILITY_TRANSIENT_LOCAL, 5);
+  auto pub_opts = rmw_get_default_publisher_options();
+  auto * pub = rmw_create_publisher(node, seq_ts, "/tl_fallback", &qos, &pub_opts);
+  ASSERT_NE(nullptr, pub);
+
+  setenv("RMW_UDS_TEST_FORCE_SHM_FAILURE", "1", 1);
+  test_msgs::msg::UnboundedSequences msg;
+  msg.uint8_values.resize(100 * 1024);
+  for (size_t i = 0; i < msg.uint8_values.size(); ++i) {
+    msg.uint8_values[i] = static_cast<uint8_t>((i * 5 + 2) & 0xFF);
+  }
+  EXPECT_EQ(RMW_RET_OK, rmw_publish(pub, &msg, nullptr));
+  unsetenv("RMW_UDS_TEST_FORCE_SHM_FAILURE");  // reset before it leaks to other tests
+
+  auto * pub_data = static_cast<rmw_uds::UdsPublisher *>(pub->data);
+  {
+    std::lock_guard<std::mutex> lock(pub_data->cache_mutex);
+    ASSERT_EQ(1u, pub_data->message_cache.size());
+    const auto & cm = pub_data->message_cache.back();
+    EXPECT_EQ(nullptr, cm.shm_seg)
+      << "shm forced unavailable — the large payload must be cached inline";
+    EXPECT_FALSE(cm.header.msg_type & rmw_uds::SHM_PAYLOAD_FLAG);
+  }
+
+  auto sub_opts = rmw_get_default_subscription_options();
+  auto * sub = rmw_create_subscription(node, seq_ts, "/tl_fallback", &qos, &sub_opts);
+  ASSERT_NE(nullptr, sub);
+  test_msgs::msg::UnboundedSequences trigger;
+  trigger.uint8_values = {5, 6, 7};
+  EXPECT_EQ(RMW_RET_OK, rmw_publish(pub, &trigger, nullptr));
+
+  test_msgs::msg::UnboundedSequences recv;
+  bool taken = false;
+  EXPECT_EQ(RMW_RET_OK, rmw_take(sub, &recv, &taken, nullptr));
+  ASSERT_TRUE(taken) << "late joiner must receive the inline-fallback message";
+  EXPECT_EQ(msg.uint8_values, recv.uint8_values);
+
+  auto _r1 [[maybe_unused]] = rmw_destroy_subscription(node, sub);
+  auto _r2 [[maybe_unused]] = rmw_destroy_publisher(node, pub);
+}
+
+TEST_F(QosTest, TransientLocalSerializedLargeMessageLateJoiner)
+{
+  // rmw_publish_serialized_message now feeds the TL replay cache and stages
+  // large latched payloads durably, so a >cap serialized latched message
+  // reaches a late joiner. Previously that entry point never cached, so the
+  // message was sent inline once and dropped for anyone who joined later.
+  auto qos = make_qos(
+    RMW_QOS_POLICY_RELIABILITY_RELIABLE,
+    RMW_QOS_POLICY_DURABILITY_TRANSIENT_LOCAL, 5);
+  auto pub_opts = rmw_get_default_publisher_options();
+  auto * pub = rmw_create_publisher(node, ts, "/tl_serialized_huge", &qos, &pub_opts);
+  ASSERT_NE(nullptr, pub);
+
+  constexpr size_t big_size = 5 * 1024 * 1024;
+  rmw_serialized_message_t serialized;
+  serialized.buffer_capacity = big_size;
+  serialized.buffer_length = big_size;
+  serialized.buffer = static_cast<uint8_t *>(std::malloc(big_size));
+  ASSERT_NE(nullptr, serialized.buffer);
+  for (size_t i = 0; i < big_size; ++i) {
+    serialized.buffer[i] = static_cast<uint8_t>((i * 131 + 7) & 0xFF);
+  }
+  serialized.allocator = rcutils_get_default_allocator();
+
+  // Publish BEFORE any subscriber — must be cached in a durable segment.
+  EXPECT_EQ(RMW_RET_OK, rmw_publish_serialized_message(pub, &serialized, nullptr));
+  auto * pub_data = static_cast<rmw_uds::UdsPublisher *>(pub->data);
+  {
+    std::lock_guard<std::mutex> lock(pub_data->cache_mutex);
+    ASSERT_EQ(1u, pub_data->message_cache.size());
+    EXPECT_NE(nullptr, pub_data->message_cache.back().shm_seg);
+  }
+
+  auto sub_opts = rmw_get_default_subscription_options();
+  auto * sub = rmw_create_subscription(node, ts, "/tl_serialized_huge", &qos, &sub_opts);
+  ASSERT_NE(nullptr, sub);
+
+  uint8_t trig_bytes[] = {1, 2, 3, 4};
+  rmw_serialized_message_t trig;
+  trig.buffer = trig_bytes;
+  trig.buffer_length = sizeof(trig_bytes);
+  trig.buffer_capacity = sizeof(trig_bytes);
+  trig.allocator = rcutils_get_default_allocator();
+  EXPECT_EQ(RMW_RET_OK, rmw_publish_serialized_message(pub, &trig, nullptr));
+
+  rmw_serialized_message_t received = rmw_get_zero_initialized_serialized_message();
+  ASSERT_EQ(RMW_RET_OK, rmw_serialized_message_init(&received, 0, &serialized.allocator));
+  bool taken = false;
+  EXPECT_EQ(RMW_RET_OK, rmw_take_serialized_message(sub, &received, &taken, nullptr));
+  ASSERT_TRUE(taken) << "late joiner must receive the cached 5 MB serialized message";
+  ASSERT_EQ(big_size, received.buffer_length);
+  EXPECT_EQ(0, std::memcmp(serialized.buffer, received.buffer, big_size));
+
+  EXPECT_EQ(RMW_RET_OK, rmw_take_serialized_message(sub, &received, &taken, nullptr));
+  ASSERT_TRUE(taken);
+  ASSERT_EQ(sizeof(trig_bytes), received.buffer_length);
+
+  auto _f [[maybe_unused]] = rmw_serialized_message_fini(&received);
+  std::free(serialized.buffer);
+  auto _r1 [[maybe_unused]] = rmw_destroy_subscription(node, sub);
+  auto _r2 [[maybe_unused]] = rmw_destroy_publisher(node, pub);
+}
+
 TEST_F(QosTest, KnownSubscriberPathsPrunedOnChurn)
 {
   // The publisher's known_subscriber_paths must not accumulate dead entries as