@ethora/chat-component-rn 26.7.3 → 26.7.5

package/src/components/Modals/UserProfileModal/EditUserModal.tsx

@@ -8,10 +8,23 @@ import { updateProfile } from '../../../networking/api-requests/user.api';
 import { useDispatch } from 'react-redux';
 import { updateUser } from '../../../roomStore/chatSettingsSlice';
 import { View } from 'react-native';
-import { pickImageAsset, PickedImage } from '../../../helpers/pickImageAsset';
 import { AddPhotoIcon } from '../../../assets/icons';
 // import { actionUpdateUser } from '../actions';
 
+const base64ToFile = (base64String: string, fileName: string) => {
+  const byteString = atob(base64String.split(',')[1]);
+  const arrayBuffer = new ArrayBuffer(byteString.length);
+  const uintArray = new Uint8Array(arrayBuffer);
+  for (let i = 0; i < byteString.length; i++) {
+    uintArray[i] = byteString.charCodeAt(i);
+  }
+  const blob = new Blob([uintArray], { type: 'image/jpeg' });
+  return new File([blob], fileName, {
+    type: 'image/jpeg',
+    lastModified: Date.now(),
+  });
+};
+
 interface EditUserModalProps {
   setIsEditing: React.Dispatch<React.SetStateAction<boolean>>;
   modalUser: any;
@@ -28,7 +41,7 @@ const EditUserModal: React.FC<EditUserModalProps> = ({
   const [firstName, setFirstName] = useState(modalUser?.firstName || '');
   const [lastName, setLastName] = useState(modalUser?.lastName || '');
   const [description, setDescription] = useState(modalUser?.description || '');
-  const [profileImage, setProfileImage] = useState<string | PickedImage>(
+  const [profileImage, setProfileImage] = useState<string | File>(
     modalUser?.profileImage
   );
 
@@ -36,8 +49,14 @@ const EditUserModal: React.FC<EditUserModalProps> = ({
     try {
       let fd = new FormData();
 
-      if (profileImage && typeof profileImage !== 'string') {
-        fd.append('file', profileImage as any);
+      if (
+        typeof profileImage === 'string' &&
+        profileImage.startsWith('data:image/')
+      ) {
+        const file = base64ToFile(profileImage, 'profileImage.jpg');
+        fd.append('file', file);
+      } else if (profileImage instanceof File) {
+        fd.append('file', profileImage);
       }
 
       fd.append('firstName', firstName);
@@ -63,11 +82,8 @@ const EditUserModal: React.FC<EditUserModalProps> = ({
     }
   };
 
-  const handleProfileImageChange = async () => {
-    const picked = await pickImageAsset();
-    if (picked) {
-      setProfileImage(picked);
-    }
+  const handleProfileImageChange = (image: File) => {
+    setProfileImage(image);
   };
 
   return (

package/src/components/styled/SendInput.tsx

@@ -265,6 +265,16 @@ const SendInput: React.FC<SendInputProps> = ({
     if (pickingDocRef.current) {return;}
     pickingDocRef.current = true;
     try {
+      // Let the attach-sheet's modal finish its NATIVE dismissal before we
+      // present the picker. The sheet fires this handler right after its
+      // slide-out animation, but the underlying RN Modal view-controller
+      // dismissal is async — presenting the document picker over a still-
+      // dismissing modal makes iOS tear it down without a cancel callback,
+      // which strands expo-document-picker's pickingContext and makes every
+      // subsequent open throw "Different document picking in progress".
+      if (Platform.OS === 'ios') {
+        await new Promise((resolve) => setTimeout(resolve, 350));
+      }
       const result = await DocumentPicker.getDocumentAsync({
         type: '*/*',
         multiple: false,

package/src/context/xmppProvider.tsx

@@ -557,7 +557,9 @@ export const XmppProvider: React.FC<XmppProviderProps> = ({ children, config, is
         devPushLog('rn', `watchdog: client ${client.status} → forceReconnect`);
         client.forceReconnect();
       } else {
-        client.ensureStreamAlive?.();
+        // The periodic health check is the probe's primary owner, so it
+        // bypasses the throttle that keeps send-path probes rare.
+        client.ensureStreamAlive?.({ force: true, reason: 'watchdog' });
       }
     }, 30000);
     return () => clearInterval(id);
@@ -622,9 +624,19 @@ export const XmppProvider: React.FC<XmppProviderProps> = ({ children, config, is
       // the provider so consumers using the component as a package get
       // correct unread without reaching into the chat store themselves.
       visibleBeforeBackground = visibleRoomJID;
+      // Prefer the read boundary the user actually reached. Stamping
+      // `Date.now()` while they are scrolled up marks unseen messages as
+      // read, and because we flush to the server private store below the
+      // loss survives an app restart. Customer-reported #33.
+      const bgBoundaryTs = visibleRoomJID
+        ? rooms?.[visibleRoomJID]?.readBoundaryTs ?? null
+        : null;
       if (visibleRoomJID) {
         store.dispatch(
-          setLastViewedTimestamp({ chatJID: visibleRoomJID, timestamp: Date.now() })
+          setLastViewedTimestamp({
+            chatJID: visibleRoomJID,
+            timestamp: bgBoundaryTs ?? Date.now(),
+          })
         );
         // Drop the "New messages" divider for the room we're leaving so it
         // doesn't linger when the user comes back (mirrors ChatRoom's
@@ -636,9 +648,10 @@ export const XmppProvider: React.FC<XmppProviderProps> = ({ children, config, is
       }
       // Fire-and-forget — we're going to the background and don't
       // care about the resolution path.
-      c.flushLastViewedToPrivateStoreStanza(rooms, { visibleRoomJID }).catch(
-        () => {}
-      );
+      c.flushLastViewedToPrivateStoreStanza(rooms, {
+        visibleRoomJID,
+        visibleRoomTs: bgBoundaryTs,
+      }).catch(() => {});
     });
     return () => sub.remove();
   }, [client]);
@@ -669,9 +682,16 @@ export const XmppProvider: React.FC<XmppProviderProps> = ({ children, config, is
         store.dispatch(setVisibleRoom({ roomJID: activeRoomJID }));
       }
     } else {
+      // Same read-boundary rule as the AppState path above (#33).
+      const hideBoundaryTs = activeRoomJID
+        ? rooms?.[activeRoomJID]?.readBoundaryTs ?? null
+        : null;
       if (wasVisible && activeRoomJID) {
         store.dispatch(
-          setLastViewedTimestamp({ chatJID: activeRoomJID, timestamp: Date.now() })
+          setLastViewedTimestamp({
+            chatJID: activeRoomJID,
+            timestamp: hideBoundaryTs ?? Date.now(),
+          })
         );
         // Drop the "New messages" divider so it's gone when the user
         // returns to the chat (mirrors ChatRoom's unmount cleanup).
@@ -683,7 +703,10 @@ export const XmppProvider: React.FC<XmppProviderProps> = ({ children, config, is
       store.dispatch(clearVisibleRoom());
       if (wasVisible && client?.flushLastViewedToPrivateStoreStanza) {
         client
-          .flushLastViewedToPrivateStoreStanza(rooms, { visibleRoomJID: activeRoomJID })
+          .flushLastViewedToPrivateStoreStanza(rooms, {
+            visibleRoomJID: activeRoomJID,
+            visibleRoomTs: hideBoundaryTs,
+          })
           .catch(() => {});
       }
     }
@@ -704,6 +727,15 @@ export const XmppProvider: React.FC<XmppProviderProps> = ({ children, config, is
       if (room.messages === lastMessagesRef) {return;}
       lastMessagesRef = room.messages;
 
+      // "Chat is on screen" does NOT mean "user is looking at the newest
+      // message". While they are scrolled up, MessageList publishes a read
+      // boundary; advancing the marker to `now` here would clear the very
+      // unread messages the scroll-up state exists to preserve — and the
+      // 2s flush below would push that loss to the server, making it
+      // survive an app restart. Leave the marker alone until they come
+      // back to the bottom (boundary back to null). Customer-reported #33.
+      if (room.readBoundaryTs != null) {return;}
+
       let newest = 0;
       const list = room.messages || [];
       for (const m of list) {
@@ -762,7 +794,8 @@ export const XmppProvider: React.FC<XmppProviderProps> = ({ children, config, is
         devPushLog('rn', `NetInfo: reachable & client ${client.status} → forceReconnect`);
         client.forceReconnect();
       } else if (client.status === 'online') {
-        client.ensureStreamAlive?.();
+        // Connectivity just came back — worth an immediate check.
+        client.ensureStreamAlive?.({ force: true, reason: 'netinfo' });
       }
     });
     return () => unsub();

package/src/helpers/updateMessagesTillLast.tsx

@@ -1,6 +1,6 @@
 import XmppClient from '../networking/xmppClient';
 import { store } from '../roomStore';
-import { setRoomMessages } from '../roomStore/roomsSlice';
+import { applyRoomsPreloadBatch } from '../roomStore/roomsSlice';
 import { IMessage, IRoom } from '../types/types';
 import { checkUniqueUsers } from './checkUniqueUsers';
 
@@ -76,22 +76,47 @@ export const updateMessagesTillLast = async (
                   Number(message.id) === Number(lastCachedMessagesTimeStamp)
               );
 
-              if (!isMessageFound && !(counter <= maxFetchAttempts - 1)) {
-                // Fire-and-forget — checkUniqueUsers resolves to an
-                // updated RoomMember list, but there's no slice
-                // action wired to receive it on RN yet (the web SDK
-                // has one; the port left a TODO). Keep the call so
-                // the API request goes out (it warms the cache for
-                // later renders) but stop short of dispatching.
-                await checkUniqueUsers(currentJidNewMessages);
-
-                store.dispatch(
-                  setRoomMessages({
-                    roomJID: jid,
-                    messages: currentJidNewMessages,
-                  })
-                );
-              }
+            }
+
+            // Publish whatever the catch-up actually retrieved.
+            //
+            // This used to sit INSIDE the loop behind
+            // `!isMessageFound && !(counter <= maxFetchAttempts - 1)`,
+            // i.e. it only ran when the walk-back gave up. In the common
+            // case — the gap is small and the anchor is found on the first
+            // fetch — `isMessageFound` flips true immediately and NOTHING
+            // was ever dispatched, so the reconnect catch-up silently
+            // dropped its own result. The messages still appeared, but only
+            // as a side effect of the always-on `onMessageHistory` stanza
+            // handler, which parses the same stanza a different way
+            // (positional form, no explicit `user` object) and inserts via
+            // addRoomMessage. That copy could carry a wrong sender identity
+            // and, being treated as an own-message, was excluded from the
+            // unread count — the "wrong sender + no unread after reconnect,
+            // both correct after restart" symptom, because only a fresh
+            // start re-runs the preload scheduler that overwrites it.
+            //
+            // Dispatching through `applyRoomsPreloadBatch` (rather than the
+            // previous `setRoomMessages` array-replace) reuses
+            // mergeHistoryIntoCache: it dedupes by id with "fetched wins",
+            // preserves locally-pending sends and older cached history, and
+            // is already a trigger for the unread middleware — exactly what
+            // the startup path does, so reconnect and cold start now agree.
+            // Customer-reported #32.
+            if (currentJidNewMessages.length > 0) {
+              // Fire-and-forget — checkUniqueUsers resolves to an
+              // updated RoomMember list, but there's no slice
+              // action wired to receive it on RN yet (the web SDK
+              // has one; the port left a TODO). Keep the call so
+              // the API request goes out (it warms the cache for
+              // later renders) but stop short of dispatching.
+              await checkUniqueUsers(currentJidNewMessages);
+
+              store.dispatch(
+                applyRoomsPreloadBatch({
+                  rooms: [{ jid, messages: currentJidNewMessages }],
+                })
+              );
             }
           } catch (error) {
             console.error(`Error processing room ${jid}:`, error);

package/src/hooks/useChatRoomFocus.ts

@@ -59,12 +59,20 @@ export const useChatRoomFocus = ({
   });
 
   const leaveRoom = (jid: string) => {
-    const timestamp = Date.now();
+    const rooms = store.getState().rooms?.rooms;
+    // Only mark read as far as the user actually scrolled. Blindly
+    // stamping `Date.now()` here clears messages they never reached, and
+    // the server flush below makes that permanent across a restart.
+    // Customer-reported #33.
+    const boundaryTs = rooms?.[jid]?.readBoundaryTs ?? null;
+    const timestamp = boundaryTs ?? Date.now();
     dispatch(setLastViewedTimestamp({ chatJID: jid, timestamp }));
     dispatch(clearVisibleRoom());
-    const rooms = store.getState().rooms?.rooms;
     (store.getState().chatSettingStore as any)?.client
-      ?.flushLastViewedToPrivateStoreStanza(rooms, { visibleRoomJID: jid })
+      ?.flushLastViewedToPrivateStoreStanza(rooms, {
+        visibleRoomJID: jid,
+        visibleRoomTs: boundaryTs,
+      })
       .catch(() => {});
   };
 

package/src/hooks/useLogout.tsx

@@ -63,6 +63,13 @@ const logoutService = {
         await Promise.race([
           client.flushLastViewedToPrivateStoreStanza(rooms, {
             visibleRoomJID,
+            // `onlyIfNoUnread` deliberately exempts the visible room, so
+            // without this the open-but-scrolled-up room would still be
+            // stamped "read up to now" on logout and come back read on
+            // the next login. Customer-reported #33.
+            visibleRoomTs: visibleRoomJID
+              ? rooms?.[visibleRoomJID]?.readBoundaryTs ?? null
+              : null,
             onlyIfNoUnread: true,
           }),
           new Promise((res) => setTimeout(res, 2000)),

package/src/hooks/useSendMessage.tsx

@@ -10,7 +10,11 @@ import {
   markMessageFailed,
 } from '../roomStore/roomHeapSlice';
 import { uploadFileV2 } from '../networking/api-requests/auth.api';
-import { enqueueOutboundSend, removeOutboundSend } from '../networking/outboundQueue';
+import {
+  enqueueOutboundSend,
+  markOutboundSentLive,
+  removeOutboundSend,
+} from '../networking/outboundQueue';
 import { RootState, store } from '../roomStore';
 import { getGlobalXmppClient } from '../utils/clientRegistry';
 import { useEventHandlers } from './useEventHandlers';
@@ -304,15 +308,36 @@ export const useSendMessage = (_configOverride?: IConfig) => {
         }
 
         replaySend(effectiveClient);
+        // The stanza is on the wire from here on. Mark the buffered copy
+        // so a later reconnect flush won't blind-replay it — see
+        // markOutboundSentLive / flushOutboundSends. Customer-reported #31.
+        markOutboundSentLive(optimisticId);
         try {
-          effectiveClient.ensureStreamAlive?.();
+          // Throttled + config-gated: a burst of sends starts at most one
+          // probe, and a single missed probe no longer tears the stream
+          // down. See ensureStreamAliveAfterSend / ensureStreamAlive.
+          effectiveClient.ensureStreamAliveAfterSend?.();
         } catch {}
-        await handleMessageSent({
-          message,
-          roomJID: activeRoomJID,
-          user,
-          messageType: 'text',
-        });
+        // Post-send notification ONLY. Deliberately outside the try below:
+        // `handleMessageSent` re-throws whatever the host app's
+        // `eventHandlers.onMessageSent` callback throws, and this runs
+        // AFTER the stanza was already delivered — letting that reach the
+        // catch marked a delivered message "Failed → tap to retry" purely
+        // because a consumer's analytics/webhook hook was slow or errored.
+        // Customer-reported #31 ("delivered but shows as failed").
+        try {
+          await handleMessageSent({
+            message,
+            roomJID: activeRoomJID,
+            user,
+            messageType: 'text',
+          });
+        } catch (notifyError) {
+          console.warn(
+            'onMessageSent handler threw after a successful send; not failing the message',
+            notifyError
+          );
+        }
       } catch (error) {
         clearTimeout(watchdogTimer);
         // Same reasoning as the watchdog: once the bubble shows failed,
@@ -580,7 +605,7 @@ export const useSendMessage = (_configOverride?: IConfig) => {
               id
             );
             try {
-              effectiveMediaClient.ensureStreamAlive?.();
+              effectiveMediaClient.ensureStreamAliveAfterSend?.();
             } catch {}
           } else {
             const anyMediaClient: any =
@@ -603,21 +628,32 @@ export const useSendMessage = (_configOverride?: IConfig) => {
           }
         }
 
-        await handleMessageSent({
-          message: 'media',
-          roomJID: activeRoomJID,
-          user,
-          messageType: 'media',
-          metadata: {
-            isReply,
-            isChecked,
-            mainMessage,
-            fileData: data,
-            fileType: type,
-            messageId: id,
-            uploadResults: response.data.results,
-          },
-        });
+        // Post-send notification ONLY — see the text path: the upload and
+        // stanza send have already succeeded here, so a throw from the
+        // host's `onMessageSent` callback must not flip this to "Failed".
+        // Customer-reported #31.
+        try {
+          await handleMessageSent({
+            message: 'media',
+            roomJID: activeRoomJID,
+            user,
+            messageType: 'media',
+            metadata: {
+              isReply,
+              isChecked,
+              mainMessage,
+              fileData: data,
+              fileType: type,
+              messageId: id,
+              uploadResults: response.data.results,
+            },
+          });
+        } catch (notifyError) {
+          console.warn(
+            'onMessageSent handler threw after a successful media send; not failing the message',
+            notifyError
+          );
+        }
       } catch (error: any) {
         // Upload (or stanza send) threw an explicit error. Clear the
         // watchdog so it doesn't double-fire `markMessageFailed`.

package/src/main.ts

@@ -32,7 +32,7 @@ export { XmppProvider } from './context/xmppProvider';
 // Hooks that consumers usually need (badge counts, logout, push, etc.).
 export { useUnread } from './hooks/useUnreadMessagesCounter';
 export { useChatRoomFocus } from './hooks/useChatRoomFocus';
-export { logoutService, useLogout } from './hooks/useLogout';
+export { logoutService } from './hooks/useLogout';
 export { useQRCodeChat, handleQRChatId } from './hooks/useQRCodeChatHandler';
 export { resendMessage } from './utils/resendMessage';
 // Font loader, exposed so hosts can also load the font outside <Chat> if needed.

package/src/networking/outboundQueue.ts

@@ -46,6 +46,21 @@ export interface QueuedSend {
    * OUTBOUND_QUEUE_TTL_MS when omitted.
    */
   ttlMs?: number;
+  /**
+   * True once the stanza was actually written to a live, online stream.
+   *
+   * Such a send has most likely reached the server already — only its
+   * echo may still be in flight. Blind-replaying it on the next 'online'
+   * event is what produced real duplicates on the recipient side: a send
+   * is followed by a liveness probe which, at the time, force-reconnected
+   * a perfectly healthy but quiet stream on a single missed 4s round trip
+   * — and the resulting reconnect flushed the queue. (That probe has since
+   * been throttled and confirmation-gated, but this guard is the one that
+   * actually makes a duplicate impossible.) The queue exists for
+   * sends that never made it onto the wire, so those are the only ones
+   * safe to replay unattended. Customer-reported #31.
+   */
+  sentLive?: boolean;
   /** Replays the original send against a live, online client. */
   send: (client: OutboundQueueClient) => void;
 }
@@ -88,6 +103,14 @@ export function flushOutboundSends(
       // Stale — the send watchdog owns the failure; don't duplicate.
       continue;
     }
+    if (item.sentLive) {
+      // Already written to a live stream: the server very likely has it
+      // and we'd be sending a second copy. Let the pending watchdog own
+      // this one — if no echo ever arrives it surfaces as "Failed → tap
+      // to retry" and the USER decides, which is what the customer asked
+      // for ("a message the server accepted is never sent again").
+      continue;
+    }
     try {
       item.send(client);
     } catch (err) {
@@ -103,6 +126,12 @@ export function flushOutboundSends(
  * the send went through, so the buffered replay is no longer needed and must
  * not fire on a later reconnect. No-op if the id isn't queued.
  */
+export function markOutboundSentLive(optimisticId: string): void {
+  if (!optimisticId) {return;}
+  const item = queue.find((q) => q.optimisticId === optimisticId);
+  if (item) {item.sentLive = true;}
+}
+
 export function removeOutboundSend(optimisticId: string): void {
   if (!optimisticId) {return;}
   const idx = queue.findIndex((q) => q.optimisticId === optimisticId);

package/src/networking/stanzaHandlers.ts

@@ -246,7 +246,15 @@ const onMessageHistory = async (stanza: any) => {
       mergedAttrs,
       body,
       id,
-      stanza.attrs.from,
+      // `innerFrom` (the forwarded message's own `room@conference/nick`),
+      // NOT the outer MAM envelope's `from` — for an archive query the
+      // envelope is the BARE room jid with no resource, so passing it here
+      // stripped the sender out of `xmppFrom` and left `roomJid` derived
+      // from a value that carries no occupant identity. The correct
+      // occupant jid is already computed above for the senderJID fallback;
+      // use the same one so the archived copy carries the same sender
+      // identity the realtime path produces. Customer-reported #32.
+      innerFrom,
       !!deleted
     );
 

package/src/networking/xmppClient.ts

@@ -211,6 +211,13 @@ export class XmppClient {
       this.devServer = xmppSettings?.devServer;
     }
     this.disableLastRead = this.xmppSettings?.disableLastRead === true;
+    // `xmppPingOnSendEnabled` was declared in the public settings type but
+    // never read. It now controls the SEND-path liveness probe only; the
+    // periodic watchdog and the NetInfo check always run, so turning this
+    // off cannot leave a zombie socket undetected — it only removes the
+    // extra probe a send would otherwise trigger. Defaults to on
+    // (previous behaviour), just throttled and confirmation-gated now.
+    this.pingOnSendEnabled = this.xmppSettings?.xmppPingOnSendEnabled !== false;
 
     const qos = this.xmppSettings?.historyQoS;
     if (qos) {
@@ -494,6 +501,10 @@ export class XmppClient {
       this.status = 'online';
       this.presencesReady = true;
       this.reconnectAttempts = 0;
+      // Fresh stream: forget any probe failures from the dead one, and
+      // don't let the throttle suppress the first probe on it.
+      this.failedProbeStreak = 0;
+      this.lastStreamProbeAt = 0;
       try {
         devPushLog(
           'xmpp',
@@ -655,8 +666,54 @@ export class XmppClient {
   }
 
   private streamAliveProbe: Promise<boolean> | null = null;
+  /** Wall-clock of the last probe, for throttling. */
+  private lastStreamProbeAt = 0;
+  /** Consecutive failed probes; a reconnect needs confirmation, not one miss. */
+  private failedProbeStreak = 0;
+
+  // --- liveness-probe tuning -------------------------------------------
+  // The probe exists to catch a ZOMBIE socket: the WebSocket still reads
+  // `online` but nothing traverses it (iOS suspending a backgrounded
+  // socket, the JS debugger pausing the runtime). Without it the client
+  // sits "online" forever and every send silently vanishes.
+  //
+  // The original settings were far too trigger-happy: a 4s budget for a
+  // ping round-trip, fired after EVERY send, with a single timeout
+  // immediately calling `forceReconnect()` — a full teardown, rebuild,
+  // MUC re-join and private-store refetch. On a slow or congested mobile
+  // link a perfectly healthy but quiet stream would miss that 4s window
+  // and get torn down mid-conversation, repeatedly. (That reconnect is
+  // also what used to replay the outbound queue and duplicate a message
+  // that had already been delivered — customer-reported #31.)
+  //
+  // Tuned to: a realistic timeout, a throttle so bursts of sends can't
+  // each start a probe, and a required second failure before we tear a
+  // connection down. Zombie sockets fail every probe, so they are still
+  // caught — just after confirmation rather than on one unlucky RTT.
+  /** Per-probe budget. 4s was under a slow-network ping RTT. */
+  private streamProbeTimeoutMs = 10_000;
+  /** Minimum gap between probes, so a burst of sends probes at most once. */
+  private minStreamProbeIntervalMs = 15_000;
+  /** Delay before the confirmation probe that a teardown requires. */
+  private streamProbeConfirmDelayMs = 2_000;
+  /** Failures needed before `forceReconnect()`. */
+  private streamProbeFailuresForReconnect = 2;
+  /** Host opt-out for the send-path probe (`xmppPingOnSendEnabled`). */
+  private pingOnSendEnabled = true;
 
-  verifyStreamAlive(timeoutMs: number = 4000): Promise<boolean> {
+  /**
+   * Send-path liveness check. Throttled and skippable by config — unlike
+   * the watchdog, this fires from user activity and must not turn a chatty
+   * room into a probe storm.
+   */
+  ensureStreamAliveAfterSend(): void {
+    if (!this.pingOnSendEnabled) {return;}
+    this.ensureStreamAlive({ reason: 'send' }).catch(() => {});
+  }
+
+  verifyStreamAlive(
+    timeoutMs: number = this.streamProbeTimeoutMs
+  ): Promise<boolean> {
     if (this.status !== 'online' || !this.client) {
       return Promise.resolve(false);
     }
@@ -688,16 +745,70 @@ export class XmppClient {
     return this.streamAliveProbe;
   }
 
-  async ensureStreamAlive(timeoutMs: number = 4000): Promise<void> {
+  /**
+   * Check that the stream is really carrying traffic, and tear it down only
+   * if that is confirmed false.
+   *
+   * `force` skips the throttle — used by the periodic watchdog and the
+   * NetInfo "we're reachable again" signal, which are already rare and
+   * genuinely want to know right now. Send-path callers leave it off so a
+   * burst of messages triggers at most one probe.
+   */
+  async ensureStreamAlive(opts?: {
+    force?: boolean;
+    reason?: string;
+  }): Promise<void> {
     if (this.suppressReconnect || this.status !== 'online') {return;}
-    const alive = await this.verifyStreamAlive(timeoutMs);
-    // Re-check state: a reconnect may have started meanwhile.
-    if (!alive && this.status === 'online' && !this.suppressReconnect) {
+
+    const now = Date.now();
+    if (
+      !opts?.force &&
+      now - this.lastStreamProbeAt < this.minStreamProbeIntervalMs
+    ) {
+      // Probed recently — a healthy answer is still fresh, and a dead
+      // socket will be caught by the next watchdog tick anyway.
+      return;
+    }
+    this.lastStreamProbeAt = now;
+
+    const alive = await this.verifyStreamAlive();
+
+    // Re-check state: a reconnect may have started while we waited.
+    if (this.status !== 'online' || this.suppressReconnect) {return;}
+
+    if (alive) {
+      this.failedProbeStreak = 0;
+      return;
+    }
+
+    this.failedProbeStreak += 1;
+    if (this.failedProbeStreak < this.streamProbeFailuresForReconnect) {
+      // One missed probe is not proof of a dead socket — a congested link
+      // or a busy server can blow the budget on a stream that is fine.
+      // Confirm with a second probe shortly, instead of tearing down a
+      // working connection on a single unlucky round trip.
       try {
-        devPushLog('xmpp', 'stream is zombie (ping unanswered) → forceReconnect');
+        devPushLog(
+          'xmpp',
+          `stream probe missed (${this.failedProbeStreak}/${this.streamProbeFailuresForReconnect}) — confirming before reconnect`
+        );
       } catch {}
-      this.forceReconnect();
+      setTimeout(() => {
+        this.ensureStreamAlive({ force: true, reason: 'probe-confirm' }).catch(
+          () => {}
+        );
+      }, this.streamProbeConfirmDelayMs);
+      return;
     }
+
+    this.failedProbeStreak = 0;
+    try {
+      devPushLog(
+        'xmpp',
+        'stream is zombie (probe unanswered twice) → forceReconnect'
+      );
+    } catch {}
+    this.forceReconnect();
   }
 
   async reconnect() {