@ethora/chat-component-rn 26.8.1 → 26.8.3

package/src/networking/authRefresh.ts

@@ -0,0 +1,451 @@
+import http from './apiClient';
+import { store } from '../roomStore';
+import { refreshTokens } from '../roomStore/chatSettingsSlice';
+import { secureUserStorage } from '../helpers/secureUserStorage';
+import { pushLog } from '../utils/devLogger';
+import { User } from '../types/types';
+
+/**
+ * THE single refresh-token rotation point for the SDK.
+ *
+ * The backend now runs refresh-token ROTATION with REUSE DETECTION:
+ * every successful `/users/login/refresh` burns the presented refresh
+ * token and issues a new one. Presenting an already-rotated token is
+ * indistinguishable, server-side, from a stolen token — so it is
+ * treated as theft and (once the backend leaves monitor mode and
+ * enables enforcing mode) kills the whole token family.
+ *
+ * That puts three hard obligations on the client:
+ *
+ *   1. Persist the NEW refreshToken from every response, immediately,
+ *      before any other logic can throw and drop it on the floor.
+ *   2. Never rotate concurrently. Two parallel refreshes both start
+ *      from the same token; the loser presents a burned one and looks
+ *      like an attacker. React Native is single-process, so a shared
+ *      in-flight promise is the whole lock — no Web Locks needed (the
+ *      web build of this component does need them, see its own
+ *      `authRefresh.ts`).
+ *   3. Route EVERY refresh path through here. One "side" refresh
+ *      elsewhere in the codebase breaks the scheme for everyone.
+ *
+ * Callers must also stop treating 401 as "log out". Two of the four
+ * refresh error codes are race signals, not auth failures — see
+ * `RefreshErrorCode` below and `RefreshFatalError`.
+ */
+
+export type RefreshErrorCode =
+  | 'REFRESH_IN_PROGRESS'
+  | 'REFRESH_TOKEN_ALREADY_ROTATED'
+  | 'REFRESH_TOKEN_REUSE_DETECTED'
+  | 'REFRESH_TOKEN_NOT_FOUND';
+
+export interface RefreshResult {
+  token: string;
+  refreshToken: string;
+  /**
+   * Present in the backend response but not currently consumed
+   * anywhere in the SDK. Passed through so callers can use it without
+   * a second round trip.
+   * TODO(phase-7): decide whether to persist this on `User`.
+   */
+  wsToken?: string;
+  xmppPassword?: string;
+  fileToken?: string;
+}
+
+/**
+ * Thrown when the session is genuinely dead and the caller must do a
+ * hard logout (clear storage, drop XMPP, send the user to login).
+ *
+ * Anything else this module rejects with — network errors, 5xx, an
+ * unrecognised 401 — is NOT fatal and must NOT trigger a logout.
+ */
+export class RefreshFatalError extends Error {
+  code: RefreshErrorCode;
+
+  constructor(code: RefreshErrorCode, message?: string) {
+    super(message || `Refresh failed: ${code}`);
+    this.name = 'RefreshFatalError';
+    this.code = code;
+    // Required for `instanceof` to survive TS's ES5 class-extends-builtin
+    // downlevelling, which RN's babel preset still applies.
+    Object.setPrototypeOf(this, RefreshFatalError.prototype);
+  }
+}
+
+export const isRefreshFatalError = (
+  error: unknown
+): error is RefreshFatalError =>
+  error instanceof RefreshFatalError ||
+  (error as RefreshFatalError)?.name === 'RefreshFatalError';
+
+const REFRESH_ENDPOINT = '/v1/users/login/refresh';
+
+/** `REFRESH_IN_PROGRESS` retry budget, per backend guidance (~300ms x 2-3). */
+const IN_PROGRESS_MAX_ATTEMPTS = 3;
+const IN_PROGRESS_BASE_DELAY_MS = 300;
+/**
+ * Jitter matters: after a network blip every client in the app retries
+ * on the same schedule and would hammer the rotation mutex in lockstep.
+ */
+const IN_PROGRESS_JITTER_MS = 150;
+
+const KNOWN_CODES: RefreshErrorCode[] = [
+  'REFRESH_IN_PROGRESS',
+  'REFRESH_TOKEN_ALREADY_ROTATED',
+  'REFRESH_TOKEN_REUSE_DETECTED',
+  'REFRESH_TOKEN_NOT_FOUND',
+];
+
+const sleep = (ms: number) =>
+  new Promise<void>((resolve) => setTimeout(resolve, ms));
+
+const inProgressDelay = (attempt: number) =>
+  IN_PROGRESS_BASE_DELAY_MS * attempt +
+  Math.floor(Math.random() * IN_PROGRESS_JITTER_MS);
+
+/**
+ * All four codes come back as HTTP 401, so the status alone tells us
+ * nothing — the code in the body is the only signal.
+ *
+ * TODO(backend-confirm): the exact location of `code` in the payload is
+ * not documented yet. Until it is, probe every shape the API uses
+ * elsewhere and take the first hit. Once confirmed, collapse this to
+ * the single real path.
+ */
+export const parseRefreshErrorCode = (
+  error: unknown
+): RefreshErrorCode | null => {
+  const response = (error as any)?.response;
+  if (!response) {
+    return null;
+  }
+
+  const data = response.data;
+  const candidates = [
+    data?.code,
+    data?.error?.code,
+    data?.errors?.[0]?.code,
+    data?.error,
+    data?.message,
+    response.headers?.['x-error-code'],
+  ];
+
+  for (const candidate of candidates) {
+    if (typeof candidate !== 'string') {
+      continue;
+    }
+    const match = KNOWN_CODES.find((code) => candidate.includes(code));
+    if (match) {
+      return match;
+    }
+  }
+
+  return null;
+};
+
+const getStoreUser = (): Partial<User> =>
+  (store.getState().chatSettingStore?.user as Partial<User>) || {};
+
+/**
+ * The refresh token as of RIGHT NOW. Read at the moment of use, never
+ * captured ahead of time — that is the single-process equivalent of the
+ * web build's "re-read inside the lock".
+ *
+ * Redux is the source of truth in RN (one process, one store);
+ * AsyncStorage is only consulted as a cold-start fallback, before
+ * `resolveInitBeforeLoadUser` has hydrated the store.
+ */
+const readCurrentRefreshToken = async (): Promise<string> => {
+  const fromStore = getStoreUser().refreshToken;
+  if (fromStore) {
+    return fromStore;
+  }
+
+  const stored = await secureUserStorage().get();
+  return stored?.refreshToken || '';
+};
+
+/**
+ * Persist BEFORE resolving. The dispatch updates redux (and, until
+ * phase 6 lands, fires its own best-effort AsyncStorage write); the
+ * awaited write below is the one that actually guarantees the rotated
+ * token survives the app being killed a moment later. Losing it means
+ * the next launch presents a burned token — i.e. looks like theft.
+ */
+const persistTokens = async (result: RefreshResult): Promise<void> => {
+  store.dispatch(
+    refreshTokens({
+      token: result.token,
+      refreshToken: result.refreshToken,
+      xmppPassword: result.xmppPassword,
+      fileToken: result.fileToken,
+    })
+  );
+
+  try {
+    // Write the post-dispatch snapshot rather than a read-modify-write
+    // merge, so this can't race the reducer's own write back to a
+    // stale copy of the surrounding user fields.
+    await secureUserStorage().set(
+      store.getState().chatSettingStore.user as User
+    );
+  } catch (error) {
+    pushLog('warn', 'authRefresh: failed to persist rotated tokens', error);
+  }
+};
+
+/**
+ * A rotation that happened somewhere we didn't drive — currently only
+ * reachable via the ALREADY_ROTATED recovery path, kept separate so the
+ * web build and this one stay structurally identical.
+ */
+const adoptStoredTokens = async (): Promise<RefreshResult | null> => {
+  const stored = await secureUserStorage().get();
+  if (!stored?.refreshToken || !stored?.token) {
+    return null;
+  }
+
+  const user = getStoreUser();
+  if (user.refreshToken !== stored.refreshToken) {
+    store.dispatch(
+      refreshTokens({
+        token: stored.token,
+        refreshToken: stored.refreshToken,
+      })
+    );
+  }
+
+  return {
+    token: stored.token,
+    refreshToken: stored.refreshToken,
+    xmppPassword: stored.xmppPassword,
+    fileToken: stored.fileToken,
+  };
+};
+
+/** Host-supplied rotation, mirrors `IConfig['refreshTokens']['refreshFunction']`. */
+type ConsumerRefreshFn = () => Promise<{
+  accessToken: string;
+  refreshToken?: string;
+  xmppPassword?: string;
+  fileToken?: string;
+} | null>;
+
+const runConsumerRefresh = async (
+  refreshFunction: ConsumerRefreshFn
+): Promise<RefreshResult> => {
+  const refreshed = await refreshFunction();
+
+  if (!refreshed?.accessToken) {
+    throw new Error('Custom refresh function did not return an access token');
+  }
+
+  if (!refreshed.refreshToken) {
+    // Not fatal — some hosts still run non-rotating backends — but on a
+    // rotating one this silently keeps a burned token around, which is
+    // exactly the failure the new scheme punishes.
+    pushLog(
+      'warn',
+      'authRefresh: custom refreshFunction returned no refreshToken; ' +
+        'keeping the existing one. On a rotating backend this will be ' +
+        'seen as token reuse.'
+    );
+  }
+
+  const result: RefreshResult = {
+    token: refreshed.accessToken,
+    refreshToken:
+      refreshed.refreshToken || (await readCurrentRefreshToken()) || '',
+    xmppPassword: refreshed.xmppPassword,
+    fileToken: refreshed.fileToken,
+  };
+
+  await persistTokens(result);
+  return result;
+};
+
+const requestRotation = async (
+  refreshToken: string
+): Promise<RefreshResult> => {
+  const response = await http.post(
+    REFRESH_ENDPOINT,
+    {},
+    { headers: { Authorization: refreshToken } }
+  );
+
+  const result: RefreshResult = {
+    token: response?.data?.token || '',
+    refreshToken: response?.data?.refreshToken || '',
+    wsToken: response?.data?.wsToken,
+    xmppPassword: response?.data?.xmppPassword,
+    fileToken: response?.data?.fileToken,
+  };
+
+  if (!result.token || !result.refreshToken) {
+    throw new Error('Refresh response did not contain both tokens');
+  }
+
+  // Persist first, resolve second. Every early return between here and
+  // the caller is a chance to lose the rotation.
+  await persistTokens(result);
+  return result;
+};
+
+const performRefresh = async (
+  overrideToken?: string
+): Promise<RefreshResult> => {
+  const consumerRefresh =
+    store.getState().chatSettingStore?.config?.refreshTokens?.refreshFunction;
+
+  if (consumerRefresh) {
+    // A configured host function wins unconditionally — including over
+    // an explicit bootstrap token. Hosts that embed this SDK often own
+    // the Ethora refresh token themselves (their own storage, their own
+    // rotation) and only hand us a copy; rotating it here would burn
+    // THEIR token behind their back and leave them holding a dead one.
+    //
+    // It still has to be serialised — it hits the same backend mutex —
+    // hence running it inside the shared in-flight promise.
+    return runConsumerRefresh(consumerRefresh);
+  }
+
+  for (let attempt = 1; attempt <= IN_PROGRESS_MAX_ATTEMPTS; attempt++) {
+    const refreshToken = overrideToken || (await readCurrentRefreshToken());
+
+    if (!refreshToken) {
+      // Deliberately NOT fatal: a missing token mid-bootstrap must not
+      // nuke a session that is still being hydrated.
+      throw new Error('Refresh token is missing');
+    }
+
+    try {
+      return await requestRotation(refreshToken);
+    } catch (error) {
+      const code = parseRefreshErrorCode(error);
+
+      if (code === 'REFRESH_IN_PROGRESS') {
+        if (attempt < IN_PROGRESS_MAX_ATTEMPTS) {
+          await sleep(inProgressDelay(attempt));
+          continue;
+        }
+        // Budget spent. Whoever holds the mutex has very likely
+        // finished and written a newer token — take it if so. Skipped
+        // for an explicit token: it may belong to a different session
+        // than whatever is currently in storage.
+        const adopted = overrideToken ? null : await adoptStoredTokens();
+        if (adopted && adopted.refreshToken !== refreshToken) {
+          return adopted;
+        }
+        throw error;
+      }
+
+      if (code === 'REFRESH_TOKEN_ALREADY_ROTATED') {
+        // Our copy is stale. If something already wrote a newer token,
+        // this is a benign race — use it. Otherwise the session really
+        // is unrecoverable.
+        const adopted = overrideToken ? null : await adoptStoredTokens();
+        if (adopted && adopted.refreshToken !== refreshToken) {
+          return adopted;
+        }
+        throw new RefreshFatalError(code);
+      }
+
+      if (
+        code === 'REFRESH_TOKEN_REUSE_DETECTED' ||
+        code === 'REFRESH_TOKEN_NOT_FOUND'
+      ) {
+        throw new RefreshFatalError(code);
+      }
+
+      // Network error, 5xx, plain 401 without a code — pass through
+      // untouched. The caller must not log out on these.
+      throw error;
+    }
+  }
+
+  // Unreachable: the loop either returns or throws.
+  throw new Error('Refresh attempts exhausted');
+};
+
+export interface RefreshOptions {
+  /**
+   * Rotate THIS token instead of the one in the store/storage.
+   *
+   * Only for bootstrap, where the session being restored isn't in the
+   * store yet (a host-supplied `userLogin.user`, a persisted record).
+   * Everywhere else, omitting it is the correct and safer choice: the
+   * module then always presents the newest token it knows about.
+   */
+  refreshToken?: string;
+}
+
+let inflight: Promise<RefreshResult> | null = null;
+
+let lastRotationAt = 0;
+const QUIET_ROTATION_MIN_INTERVAL_MS = 5 * 60 * 1000;
+
+/**
+ * Rotate the tokens. Concurrent callers share ONE request — this is the
+ * lock the new backend scheme requires.
+ *
+ * Rejects with `RefreshFatalError` when the session is dead (caller
+ * should hard-logout) and with a plain error otherwise (caller should
+ * surface the failure and leave the session alone).
+ */
+export function refreshAuthTokens(
+  options?: RefreshOptions
+): Promise<RefreshResult> {
+  if (inflight) {
+    // Whatever that rotation produces is at least as fresh as anything
+    // this caller could have asked for.
+    return inflight;
+  }
+
+  inflight = performRefresh(options?.refreshToken)
+    .then((result) => {
+      lastRotationAt = Date.now();
+      return result;
+    })
+    .finally(() => {
+      inflight = null;
+    });
+
+  return inflight;
+}
+
+/**
+ * Fire-and-forget variant for call sites that only want "make sure the
+ * tokens are fresh" and have no meaningful error handling — chat
+ * bootstrap, XMPP reconnect. Never rejects.
+ */
+export interface QuietRefreshOptions {
+  force?: boolean;
+}
+
+export async function refreshAuthTokensQuietly(
+  options?: QuietRefreshOptions
+): Promise<RefreshResult | null> {
+  if (
+    !options?.force &&
+    Date.now() - lastRotationAt < QUIET_ROTATION_MIN_INTERVAL_MS
+  ) {
+    return null;
+  }
+  try {
+    return await refreshAuthTokens();
+  } catch (error) {
+    pushLog(
+      isRefreshFatalError(error) ? 'error' : 'warn',
+      'authRefresh: background refresh failed',
+      error
+    );
+    return null;
+  }
+}
+
+/** Test seam — drops any shared in-flight promise between cases. */
+export function __resetAuthRefreshStateForTests(): void {
+  inflight = null;
+  lastRotationAt = 0;
+}

package/src/networking/stanzaHandlers.ts

@@ -8,9 +8,8 @@ import {
   setComposing,
   setCurrentRoom,
   setRoomRole,
-  updateRoom,
 } from '../roomStore/roomsSlice';
-import { IRoom, RoomMember } from '../types/types';
+import { IRoom } from '../types/types';
 import { createMessageFromXml } from '../helpers/createMessageFromXml';
 import { getDataFromXml } from '../helpers/getDataFromXml';
 import { setDeleteModal } from '../roomStore/chatSettingsSlice';
@@ -238,11 +237,11 @@ const onMessageHistory = async (stanza: any) => {
     // what senderJID would have held — fall back to it. createMessageFromXml
     // already derives a display name from the jid when senderFirstName/
     // senderLastName are absent.
-    const innerFrom =
-      stanza
-        .getChild('result')
-        ?.getChild('forwarded')
-        ?.getChild('message')?.attrs?.from || stanza.attrs.from;
+    const forwardedMessage = stanza
+      .getChild('result')
+      ?.getChild('forwarded')
+      ?.getChild('message');
+    const innerFrom = forwardedMessage?.attrs?.from || stanza.attrs.from;
     const senderJID = data?.attrs?.senderJID || innerFrom;
     if (!data?.attrs || !senderJID) {
       // console.log(
@@ -251,27 +250,44 @@ const onMessageHistory = async (stanza: any) => {
       // );
       return;
     }
-    // Parse the FULL stanza the same way the realtime path does (and the
-    // web SDK's history path does): the positional call used here before
-    // read only <data> attrs + <body>, so the <translations> payload and
-    // the <translate source> tag never made it onto archived messages.
-    // Since every transcript is MAM-backfilled on room open, that alone
-    // made translation look completely dead — the translations existed on
-    // the wire and were dropped at this exact parse. getDataFromXml also
-    // supplies xmppId (dedupe against the optimistic copy) and the
-    // resource||senderJID-localpart sender id.
-    const parsed = await getDataFromXml(stanza);
-    const { data: pData, id: pId, body: pBody, ...pRest } =
-      parsed ?? ({} as Partial<NonNullable<typeof parsed>>);
-    const mergedData: Record<string, unknown> = { ...(pData || data.attrs) };
-    if (!mergedData.senderJID) {mergedData.senderJID = senderJID;}
-    const rawMessage = await createMessageFromXml({
-      data: mergedData,
-      id: pId || id,
-      body: pBody ?? (typeof body === 'string' ? body : body?.getText?.() || ''),
-      ...pRest,
-      isDeleted: !!deleted || !!pRest?.deleted,
-    } as Parameters<typeof createMessageFromXml>[0]);
+    const mergedAttrs = { ...data.attrs };
+    if (!mergedAttrs.senderJID) {mergedAttrs.senderJID = senderJID;}
+    // The forwarded <message>'s own stanza id is our original send id
+    // (what `xmppId` holds on the live/wrapped paths) - capture it so
+    // this MAM-replayed message dedupes against its live echo /
+    // optimistic pending bubble the same way, instead of never carrying
+    // an xmppId at all.
+    if (forwardedMessage?.attrs?.id) {mergedAttrs.xmppId = forwardedMessage.attrs.id;}
+    const positionalMessage = await createMessageFromXml(
+      mergedAttrs,
+      body,
+      id,
+      // Bug #41: pass the resource-bearing occupant `from`
+      // (room@conference/sender-id) here, not the outer envelope's
+      // `stanza.attrs.from` (which has no resource for a MAM result).
+      // createMessageFromXml derives `user.id` from this field's
+      // resource - the same authoritative source getDataFromXml uses
+      // for live messages - so catch-up rows resolve the correct
+      // sender from the very first render instead of needing a later
+      // correction once the "official" history fetch lands.
+      innerFrom,
+      !!deleted
+    );
+
+    // Translations ride on the archived stanza too (<translations> +
+    // <translate source>), but the positional parse above only reads
+    // <data> attrs + <body>, so every MAM-backfilled message lost them -
+    // translation looked dead on every room open. Parse the full stanza
+    // the way the realtime path does and carry ONLY those two fields over,
+    // so sender/xmppId resolution above (bug #41) stays exactly as is.
+    const parsedFull = await getDataFromXml(stanza).catch(() => undefined);
+    const rawMessage = {
+      ...positionalMessage,
+      ...(parsedFull?.translations
+        ? { translations: parsedFull.translations }
+        : {}),
+      ...(parsedFull?.langSource ? { langSource: parsedFull.langSource } : {}),
+    };
 
     // Same call-log transform as the realtime path, applied to archived
     // history so calls received while offline still render as log entries.

package/src/networking/xmpp/flushLastViewedToPrivateStore.ts

@@ -1,21 +1,45 @@
 import { getChatsPrivateStoreRequest } from './getChatsPrivateStoreRequest.xmpp';
 import { setChatsPrivateStoreRequest } from './setChatsPrivateStoreRequest.xmpp';
+import {
+  getServerReadTimestamp,
+  isCorruptFutureReadMarker,
+  type ReadTimestampHeapState,
+} from '../../helpers/getServerReadTimestamp';
+import type { IMessage } from '../../types/types';
 
 interface RoomLike {
   jid: string;
   lastViewedTimestamp?: number;
   unreadMessages?: number;
+  // Needed to resolve a SERVER-timestamp read marker via
+  // getServerReadTimestamp instead of the device clock - see bug #38.
+  messages?: IMessage[];
 }
 
 interface FlushOpts {
   // When visibleRoomJID is set, treat it as "user just viewed everything
-  // up to now" and stamp it with Date.now() — even if its in-memory
-  // lastViewedTimestamp has not been updated yet.
+  // up to now" and stamp it with the newest server-acknowledged message
+  // timestamp for that room - even if its in-memory lastViewedTimestamp
+  // has not been updated yet.
   visibleRoomJID?: string | null;
+  // Explicit read boundary for the visible room, used INSTEAD of the
+  // newest-message fallback. ChatRoom passes the timestamp of the newest
+  // message the user actually reached when they leave a room while
+  // scrolled up - without it, the default writes "read everything" to
+  // the server and the messages they never scrolled down to come back as
+  // read on the next login, even though the local count was correct.
+  // Customer-reported #33 (server half).
+  visibleRoomTs?: number | null;
   // If true, only write entries for rooms where unreadMessages === 0
   // (or the visible room). Used at logout time: rooms with outstanding
   // unread keep their old marker so the next login still surfaces them.
   onlyIfNoUnread?: boolean;
+  // Pending/failed-send state (store.getState().roomHeapSlice), combined
+  // with each room's `messages` to resolve the newest SERVER-acked
+  // message timestamp via getServerReadTimestamp. Passed in rather than
+  // read from the store here so this module stays a pure function of its
+  // arguments - existing jest coverage builds `rooms` by hand.
+  heapState?: ReadTimestampHeapState;
 }
 
 /**
@@ -25,8 +49,11 @@ interface FlushOpts {
  * each other's entries.
  *
  * Called on: tab change away from chat, AppState background/inactive,
- * and (with onlyIfNoUnread=true) logout. ChatRoom's own unmount path
- * still uses actionSetTimestampToPrivateStore for the single-room case.
+ * and (with onlyIfNoUnread=true) logout. ChatRoom's own unmount path also
+ * goes through this (via flushLastViewedToPrivateStoreStanza) for the
+ * single-room case - actionSetTimestampToPrivateStore is a separate,
+ * unconditional low-level write primitive kept for direct/external use
+ * and is not part of this merge path.
  */
 export async function flushLastViewedToPrivateStore(
   client: any,
@@ -34,7 +61,7 @@ export async function flushLastViewedToPrivateStore(
   opts: FlushOpts = {}
 ): Promise<boolean> {
   if (!client?.client) {return false;}
-  const { visibleRoomJID, onlyIfNoUnread } = opts;
+  const { visibleRoomJID, visibleRoomTs, onlyIfNoUnread, heapState } = opts;
   const roomList = Object.values(rooms || {});
   if (roomList.length === 0) {return false;}
 
@@ -46,7 +73,6 @@ export async function flushLastViewedToPrivateStore(
   }
   if (!storeObj || typeof storeObj !== 'object') {storeObj = {};}
 
-  const nowMs = Date.now();
   let dirty = false;
 
   for (const room of roomList) {
@@ -54,21 +80,56 @@ export async function flushLastViewedToPrivateStore(
     const isVisible = !!visibleRoomJID && room.jid === visibleRoomJID;
     const hasUnread = Number(room.unreadMessages || 0) > 0;
 
-    // For the visible room, persist "now" — read state is driven by
-    // room visibility, not by a sentinel timestamp.
+    // Newest message this room actually has server-side proof of. Used
+    // both as the "read up to now" fallback for the visible room and as
+    // the yardstick for detecting a corrupt (future) stored marker below
+    // - never as a substitute for the device clock (bug #38: a device
+    // with a fast clock previously stamped Date.now() here, and once
+    // that future value reached the server the forward-only check a few
+    // lines down rejected every later correct write, forever).
+    const newestAckedMs = getServerReadTimestamp(room as any, heapState);
+
+    // For the visible room, persist "read up to the newest message we
+    // know the server has" - read state is driven by room visibility,
+    // not by a sentinel timestamp. The exception is an explicit
+    // `visibleRoomTs`: the caller knows the user only read up to a
+    // certain point (left the room while scrolled up), so stamping
+    // "everything" here would mark genuinely-unread messages as read.
     let ts: number | undefined;
     if (isVisible) {
-      ts = nowMs;
+      ts =
+        typeof visibleRoomTs === 'number' && visibleRoomTs > 0
+          ? visibleRoomTs
+          : newestAckedMs || undefined;
     } else if (room.lastViewedTimestamp && room.lastViewedTimestamp > 0) {
       ts = room.lastViewedTimestamp;
     }
 
+    // Nothing to anchor a write to (no boundary, no existing marker, no
+    // known messages yet) - skip rather than write a device-clock guess.
     if (!ts) {continue;}
     if (onlyIfNoUnread && hasUnread && !isVisible) {continue;}
 
     const prev = storeObj[room.jid];
     const prevNum = prev != null ? Number(prev) : 0;
-    if (Number.isFinite(prevNum) && prevNum >= ts) {continue;}
+    // A currently-stored value that sits well past the newest message we
+    // know this room has is not "fresher" - it's a leftover future
+    // marker (bug #38). Forward-only logic normally protects a fresher
+    // read from being clobbered by a stale fetch, but applied to a
+    // corrupt future value it does the opposite: it permanently blocks
+    // the correct (smaller) value from ever landing. Detect that case
+    // and waive the forward-only check for it specifically; sane values
+    // keep the normal forward-only protection.
+    //
+    // "Well past the newest message we know about" is deliberately NOT
+    // sufficient on its own - see isCorruptFutureReadMarker. THIS device's
+    // copy of the room can simply be stale (history not synced yet this
+    // session), in which case a legitimate marker written by another
+    // device that HAS seen newer messages looks exactly like a corrupt
+    // one, and "healing" it here would push the server marker BACKWARDS
+    // and resurrect already-read messages on every device.
+    const prevLooksCorrupt = isCorruptFutureReadMarker(prevNum, newestAckedMs);
+    if (!prevLooksCorrupt && Number.isFinite(prevNum) && prevNum >= ts) {continue;}
     storeObj[room.jid] = String(ts);
     dirty = true;
   }