@ethora/chat-component-rn 26.8.1 → 26.8.3

package/src/roomStore/persistence.ts

@@ -1,6 +1,8 @@
 import AsyncStorage from '@react-native-async-storage/async-storage';
 import { Middleware } from '@reduxjs/toolkit';
 import { IMessage, IRoom, User } from '../types/types';
+import { encryptForPersist, decryptFromPersist } from '../helpers/persistCrypto';
+import type { FailedMessagePayload } from './roomHeapSlice';
 
 // -------------------------------------------------------------------
 // Lightweight RN persistence layer. Mirrors what redux-persist gives
@@ -11,17 +13,33 @@ import { IMessage, IRoom, User } from '../types/types';
 //   - cap each room's messages to the most recent MESSAGE_LIMIT (100)
 //   - debounced writes (200ms) on relevant action types
 //
-// Not encrypted. We rely on AsyncStorage's per-app sandbox.
+// AES-256-CBC at rest (see `helpers/persistCrypto.ts`): the JSON blob
+// under each key below is encrypted before it reaches AsyncStorage, with
+// the symmetric key held in the platform Keychain/Keystore. `user` here
+// is already secret-free (see `sanitizeUser`) — the encryption is for
+// the message bodies in `rooms`, which aren't.
 // -------------------------------------------------------------------
 
 const KEY_CHAT = '@ethora/persist:chatSettingStore';
 const KEY_ROOMS = '@ethora/persist:rooms';
+// bug #39: a failed send needs to survive a relaunch as "failed / tap
+// to retry", not silently render as delivered. `roomHeapStore.failedMessages`
+// is the map the bubble reads (`isFailed = failedMessages[id]`, see
+// Message.tsx / useMessageHeapState): it lives in a separate, previously
+// non-persisted slice from `rooms`, so it gets its own key here.
+const KEY_HEAP = '@ethora/persist:roomHeap';
 
 // Per-room message cap on disk. Mirror this value in `roomsSlice`'s
 // in-memory cap (see `enforceMessageCap`) so the runtime and persisted
 // shapes stay aligned.
 export const MESSAGE_LIMIT = 100;
 
+// Defensive cap on the number of failed-message payloads written to
+// disk. In practice this map only grows while the user is actively
+// sending offline, but a runaway sender (or a bug that never clears an
+// entry) must not turn this key into an unbounded write.
+export const MAX_PERSISTED_FAILED_MESSAGES = 200;
+
 interface PersistedChatState {
   user: User;
 }
@@ -31,6 +49,14 @@ interface PersistedRoomsState {
   // intentionally NOT persisted: activeRoomJID, editAction, isLoading
 }
 
+interface PersistedHeapState {
+  failedMessages: Record<string, FailedMessagePayload>;
+  // intentionally NOT persisted: messageHeap, a process-lifetime
+  // "in flight" buffer (see roomHeapSlice.ts); anything still in it when
+  // the app dies is handled by the boot-time pending->failed scan below,
+  // not by replaying the heap itself.
+}
+
 const sanitizeUser = (user?: User): User | null => {
   if (!user) {return null;}
   // Drop secrets we don't want at rest — destructure to omit, then
@@ -92,6 +118,13 @@ const PERSISTED_MESSAGE_FIELDS: (keyof IMessage)[] = [
   // paint already be translated, the way the live path already is.
   'translations',
   'callLog',
+  // bug #39: without this, a message that was still in flight (no
+  // server echo yet) at kill time comes back from disk indistinguishable
+  // from a normal delivered message, so the bubble renders it as sent.
+  // Persisting `pending` lets the boot-time scan (see
+  // computeBootTimeFailures below) find exactly the messages that never
+  // got confirmed and flip them to failed instead.
+  'pending',
 ];
 
 // The sender identity that rides along on every message over the wire
@@ -191,6 +224,154 @@ const sanitizeRooms = (
   return out;
 };
 
+// Only the fields retryMessage actually needs to replay the send (see
+// FailedMessagePayload / useSendMessage.retryMessage). In particular, the
+// media `data` blob is trimmed to `uri/type/name/size` (the picker never
+// hands us auth material, but this stays defensive against a future
+// picker change smuggling extra fields, or a huge inline payload, into
+// `data`).
+const sanitizeMediaData = (
+  data: any
+): { uri?: string; type?: string; name?: string; size?: number } => {
+  if (!data || typeof data !== 'object') {return {};}
+  const out: { uri?: string; type?: string; name?: string; size?: number } = {};
+  if (typeof data.uri === 'string') {out.uri = data.uri;}
+  if (typeof data.type === 'string') {out.type = data.type;}
+  if (typeof data.name === 'string') {out.name = data.name;}
+  if (typeof data.size === 'number') {out.size = data.size;}
+  return out;
+};
+
+const sanitizeFailedMessagePayload = (
+  payload: FailedMessagePayload
+): FailedMessagePayload | null => {
+  if (!payload || typeof payload !== 'object') {return null;}
+  if (!payload.id || typeof payload.id !== 'string') {return null;}
+  if (!payload.roomJID || typeof payload.roomJID !== 'string') {return null;}
+  if (payload.kind === 'media') {
+    return {
+      kind: 'media',
+      id: payload.id,
+      roomJID: payload.roomJID,
+      data: sanitizeMediaData(payload.data),
+      type: typeof payload.type === 'string' ? payload.type : '',
+      isReply: payload.isReply,
+      isChecked: payload.isChecked,
+      mainMessage: payload.mainMessage,
+    };
+  }
+  if (payload.kind === 'text') {
+    return {
+      kind: 'text',
+      id: payload.id,
+      roomJID: payload.roomJID,
+      body: typeof payload.body === 'string' ? payload.body : '',
+      isReply: payload.isReply,
+      isChecked: payload.isChecked,
+      mainMessage: payload.mainMessage,
+    };
+  }
+  return null;
+};
+
+const sanitizeFailedMessages = (
+  failedMessages: Record<string, FailedMessagePayload> | undefined
+): Record<string, FailedMessagePayload> => {
+  if (!failedMessages || typeof failedMessages !== 'object') {return {};}
+  const out: Record<string, FailedMessagePayload> = {};
+  let count = 0;
+  for (const [id, payload] of Object.entries(failedMessages)) {
+    if (count >= MAX_PERSISTED_FAILED_MESSAGES) {break;}
+    const clean = sanitizeFailedMessagePayload(payload);
+    if (clean) {
+      out[id] = clean;
+      count++;
+    }
+  }
+  return out;
+};
+
+// -------------------------------------------------------------------
+// Boot-time pending -> failed conversion (bug #39).
+//
+// `messageHeap` (the "still sending" buffer) is intentionally NOT
+// persisted: it's a process-lifetime thing. That means on a cold start
+// there is no such thing as "still sending": a persisted message that
+// carries `pending: true` never got a server echo NOR got the chance to
+// trip the in-session watchdog (see PENDING_WATCHDOG_MS in
+// useSendMessage.tsx) before the process died. It must render as failed
+// with a working retry, not as delivered and not as stuck "sending...".
+//
+// Reconstructs the same FailedMessagePayload shape the live send path
+// builds in useSendMessage (markMessageFailed calls), from the fields we
+// persist per message.
+// -------------------------------------------------------------------
+
+export function reconstructFailedMessagePayload(
+  message: IMessage,
+  roomJID: string
+): FailedMessagePayload | null {
+  if (!message?.id || !roomJID) {return null;}
+  const isReply = !!message.isReply;
+  const isChecked = message.showInChannel === 'true';
+  const mainMessage = message.mainMessage;
+  if (message.isMediafile === 'true') {
+    return {
+      kind: 'media',
+      id: message.id,
+      roomJID,
+      data: sanitizeMediaData({
+        uri: message.location,
+        name: message.fileName,
+        type: message.mimetype,
+        size:
+          message.size !== undefined && message.size !== null
+            ? Number(message.size)
+            : undefined,
+      }),
+      type: message.mimetype || '',
+      isReply,
+      isChecked,
+      mainMessage,
+    };
+  }
+  return {
+    kind: 'text',
+    id: message.id,
+    roomJID,
+    body: message.body || '',
+    isReply,
+    isChecked,
+    mainMessage,
+  };
+}
+
+/**
+ * Scan every persisted room for messages still `pending: true` that
+ * DON'T already have a restored failure entry (those are handled by the
+ * caller separately, from the persisted `failedMessages` map), and
+ * synthesize a retry-able FailedMessagePayload for each. Pure function:
+ * the caller (roomStore/index.ts) is responsible for dispatching
+ * `markMessageFailed` for the results.
+ */
+export function computeBootTimeFailures(
+  rooms: Record<string, IRoom> | null | undefined,
+  alreadyFailed: Record<string, FailedMessagePayload> | null | undefined
+): FailedMessagePayload[] {
+  if (!rooms || typeof rooms !== 'object') {return [];}
+  const out: FailedMessagePayload[] = [];
+  for (const [jid, room] of Object.entries(rooms)) {
+    const messages = Array.isArray(room?.messages) ? room.messages : [];
+    for (const message of messages) {
+      if (!message || !message.pending) {continue;}
+      if (alreadyFailed && alreadyFailed[message.id]) {continue;}
+      const payload = reconstructFailedMessagePayload(message, jid);
+      if (payload) {out.push(payload);}
+    }
+  }
+  return out;
+}
+
 let writeTimer: ReturnType<typeof setTimeout> | null = null;
 
 /**
@@ -205,6 +386,7 @@ export const persistenceMiddleware: Middleware = (storeAPI) => (next) => (
   const type: string = action?.type || '';
   if (
     !type.startsWith('roomMessages/') &&
+    !type.startsWith('roomHeapStore/') &&
     !type.startsWith('chat/setUser') &&
     !type.startsWith('chat/updateUser') &&
     !type.startsWith('chat/refreshTokens') &&
@@ -215,21 +397,34 @@ export const persistenceMiddleware: Middleware = (storeAPI) => (next) => (
 
   if (writeTimer) {clearTimeout(writeTimer);}
   writeTimer = setTimeout(() => {
-    try {
-      const state = storeAPI.getState();
-      const chatPayload: PersistedChatState = {
-        user: sanitizeUser(state.chatSettingStore?.user) as User,
-      };
-      const roomsPayload: PersistedRoomsState = {
-        rooms: sanitizeRooms(state.rooms?.rooms || {}),
-      };
-      AsyncStorage.multiSet([
-        [KEY_CHAT, JSON.stringify(chatPayload)],
-        [KEY_ROOMS, JSON.stringify(roomsPayload)],
-      ]).catch((e) => console.warn('persist write failed', e));
-    } catch (e) {
-      console.warn('persist serialize failed', e);
-    }
+    (async () => {
+      try {
+        const state = storeAPI.getState();
+        const chatPayload: PersistedChatState = {
+          user: sanitizeUser(state.chatSettingStore?.user) as User,
+        };
+        const roomsPayload: PersistedRoomsState = {
+          rooms: sanitizeRooms(state.rooms?.rooms || {}),
+        };
+        const heapPayload: PersistedHeapState = {
+          failedMessages: sanitizeFailedMessages(
+            state.roomHeapSlice?.failedMessages
+          ),
+        };
+        const [chatCipher, roomsCipher, heapCipher] = await Promise.all([
+          encryptForPersist(JSON.stringify(chatPayload)),
+          encryptForPersist(JSON.stringify(roomsPayload)),
+          encryptForPersist(JSON.stringify(heapPayload)),
+        ]);
+        await AsyncStorage.multiSet([
+          [KEY_CHAT, chatCipher],
+          [KEY_ROOMS, roomsCipher],
+          [KEY_HEAP, heapCipher],
+        ]);
+      } catch (e) {
+        console.warn('persist write failed', e);
+      }
+    })();
   }, 200);
 
   return result;
@@ -243,29 +438,44 @@ export const persistenceMiddleware: Middleware = (storeAPI) => (next) => (
 export async function readPersistedState(): Promise<{
   chat: PersistedChatState | null;
   rooms: PersistedRoomsState | null;
+  heap: PersistedHeapState | null;
 }> {
   try {
-    const [chatRaw, roomsRaw] = await AsyncStorage.multiGet([
+    const [chatRaw, roomsRaw, heapRaw] = await AsyncStorage.multiGet([
       KEY_CHAT,
       KEY_ROOMS,
+      KEY_HEAP,
     ]);
-    const chat = chatRaw[1] ? (JSON.parse(chatRaw[1]) as PersistedChatState) : null;
-    const rooms = roomsRaw[1]
-      ? (JSON.parse(roomsRaw[1]) as PersistedRoomsState)
+    const [chatPlain, roomsPlain, heapPlain] = await Promise.all([
+      chatRaw[1] ? decryptFromPersist(chatRaw[1]) : Promise.resolve(null),
+      roomsRaw[1] ? decryptFromPersist(roomsRaw[1]) : Promise.resolve(null),
+      heapRaw[1] ? decryptFromPersist(heapRaw[1]) : Promise.resolve(null),
+    ]);
+    // `decryptFromPersist` returns null both for "nothing stored" and
+    // for "stored value isn't a valid envelope for the current key" —
+    // notably a plaintext blob left over from a pre-encryption install.
+    // Either way there is nothing safe to parse, so the caller treats it
+    // as a cold start and re-hydrates from the server.
+    const chat = chatPlain ? (JSON.parse(chatPlain) as PersistedChatState) : null;
+    const rooms = roomsPlain
+      ? (JSON.parse(roomsPlain) as PersistedRoomsState)
+      : null;
+    const heap = heapPlain
+      ? (JSON.parse(heapPlain) as PersistedHeapState)
       : null;
-    return { chat, rooms };
+    return { chat, rooms, heap };
   } catch (e) {
     console.warn('persist read failed', e);
-    return { chat: null, rooms: null };
+    return { chat: null, rooms: null, heap: null };
   }
 }
 
 export async function clearPersistedState(): Promise<void> {
   try {
-    await AsyncStorage.multiRemove([KEY_CHAT, KEY_ROOMS]);
+    await AsyncStorage.multiRemove([KEY_CHAT, KEY_ROOMS, KEY_HEAP]);
   } catch (e) {
     console.warn('persist clear failed', e);
   }
 }
 
-export const PERSIST_KEYS = { KEY_CHAT, KEY_ROOMS };
+export const PERSIST_KEYS = { KEY_CHAT, KEY_ROOMS, KEY_HEAP };

package/src/roomStore/roomsSlice.ts

@@ -2,6 +2,7 @@ import { createAsyncThunk, createSlice, PayloadAction, type Slice } from '@redux
 import type { WritableDraft } from 'immer';
 import { EditAction, HistoryPreloadState, IMessage, IRoom } from '../types/types';
 import { insertMessageWithDelimiter } from '../helpers/insertMessageWithDelimiter';
+import { msgSortableMs } from '../helpers/msgSortableMs';
 import type XmppClient from '../networking/xmppClient';
 
 // Per-room runtime message cap. Mirrors the persistence layer's
@@ -13,7 +14,7 @@ import type XmppClient from '../networking/xmppClient';
 // older history added via unshift/splice is exempt, so the user can
 // page backward arbitrarily far without instantly losing what they
 // just fetched. After cap eviction we drop from the head (oldest).
-const RUNTIME_MESSAGE_LIMIT = 100;
+export const RUNTIME_MESSAGE_LIMIT = 100;
 
 // Body strings the server uses for call signaling broadcasts (call-token,
 // call-state ringing/ended, etc). These should never reach the chat
@@ -142,7 +143,6 @@ function mergeHistoryIntoCache(
   const ex = stripCallSignals(existing);
   const fe = stripCallSignals(fetched);
 
-  const pending = ex.filter((m) => m?.pending);
   const realExisting = ex.filter(
     (m) => m && !m.pending && m.id !== 'delimiter-new'
   );
@@ -151,6 +151,29 @@ function mergeHistoryIntoCache(
   // Nothing usable came back → keep the cache exactly as it was.
   if (realFetched.length === 0) {return ex;}
 
+  // Optimistic sends are preserved across a history merge - EXCEPT the
+  // ones the fetched page proves the server already has. That happens
+  // whenever a send reached the server but its echo did not reach us
+  // before the process died: the optimistic bubble is restored from disk
+  // still `pending: true` (and, since bug #39, flagged failed at boot),
+  // while MAM hands back the very same message under its ARCHIVE id.
+  // Keying only on `id` never matched those two, so the room ended up
+  // showing the message twice - once for real and once as a bubble stuck
+  // on "sending…"/"Failed" that nothing could ever clear. The archived
+  // copy carries our original stanza id as `xmppId` (getDataFromXml), so
+  // match on that too and drop the local ghost.
+  const fetchedKeys = new Set<string>();
+  for (const m of realFetched) {
+    if (m?.id != null) {fetchedKeys.add(String(m.id));}
+    if ((m as any)?.xmppId) {fetchedKeys.add(String((m as any).xmppId));}
+  }
+  const pending = ex.filter(
+    (m) =>
+      m?.pending &&
+      !fetchedKeys.has(String(m.id)) &&
+      !(m.xmppId && fetchedKeys.has(String(m.xmppId)))
+  );
+
   const byMs = (a: IMessage, b: IMessage) =>
     msgSortableMs(a) - msgSortableMs(b);
   const capTail = (arr: IMessage[]) =>
@@ -214,6 +237,33 @@ export interface RoomMessagesState {
   // — see `applyPrivateStoreMarkers`. Re-fetched every init/reconnect,
   // so it is intentionally NOT persisted.
   privateStoreMarkers: Record<string, number>;
+  // The single source of truth for "read up to here, but the user
+  // hasn't reached the bottom yet" (`{ roomJID: boundaryMs }`).
+  // Set by MessageList (via ChatRoom's `onReadBoundaryChange`) the
+  // moment the user first scrolls away from the bottom, to the
+  // msgSortableMs of the newest message they'd actually seen. Every
+  // path that stamps a read marker for a room the user is leaving
+  // (ChatRoom unmount, xmppProvider's AppState background handler and
+  // `isVisible=false` handler, the live `advance()` effect, and
+  // `useChatRoomFocus`'s `leaveRoom`) must consult this instead of
+  // unconditionally stamping "the newest acked message" - otherwise
+  // leaving a room while scrolled up marks messages the user never
+  // reached as read (customer #42, a regression of #33 reintroduced by
+  // #38's server-timestamp marker). See `getReadMarkerTimestamp` in
+  // helpers/getServerReadTimestamp.ts.
+  //
+  // Cleared when the boundary no longer applies: the user scrolls back
+  // to the bottom, the visible room changes, or the room is truly left
+  // (ChatRoom unmounts, or a tab-navigator focus hook releases the
+  // room). NOT cleared merely because the app backgrounds or a host's
+  // `isVisible` flips false - MessageList typically stays mounted
+  // through those, so its own scroll-tracking ref (the only thing that
+  // could re-derive this value) is still intact and the boundary must
+  // stay in sync with it. Deliberately NOT persisted (this key isn't
+  // read by `persistence.ts`, which only ever picks `rooms` back out of
+  // this slice) - it's meaningless across a process restart, where
+  // MessageList always mounts fresh at the bottom.
+  readBoundaries: Record<string, number>;
 }
 
 const initialState: RoomMessagesState = {
@@ -230,6 +280,7 @@ const initialState: RoomMessagesState = {
   },
   pendingNotificationJid: null,
   privateStoreMarkers: {},
+  readBoundaries: {},
 };
 
 const isValidRoomJid = (jid: unknown): jid is string => {
@@ -317,6 +368,8 @@ const reducers = {
         : [];
       state.rooms[roomData.jid] = {
         ...roomData,
+        icon: roomData.icon !== undefined ? roomData.icon : existing?.icon,
+        roomBg: roomData.roomBg !== undefined ? roomData.roomBg : existing?.roomBg,
         messages:
           existingMessages.length > 0 ? existingMessages : incomingMessages,
         lastViewedTimestamp: lastViewed,
@@ -494,7 +547,7 @@ const reducers = {
           state.visibleRoomJID === roomJID
             ? null
             : lastViewedValue
-              ? new Date(lastViewedValue)
+              ? lastViewedValue
               : null;
 
         insertMessageWithDelimiter(roomMessages, message, lastViewedTimestamp);
@@ -512,6 +565,7 @@ const reducers = {
       state.rooms = {};
       state.visibleRoomJID = null;
       state.privateStoreMarkers = {};
+      state.readBoundaries = {};
       state.isUnreadSyncing = false;
     },
     setComposing(
@@ -578,7 +632,19 @@ const reducers = {
      *
      * Monotonic: a marker only ever moves a baseline FORWARD, so a stale
      * server value can't resurrect already-read messages and a more-recent
-     * local read (tab blur stamping Date.now()) always wins.
+     * local read (tab blur stamping the server read timestamp) always wins.
+     *
+     * Bug #38 self-heal: forward-only is correct for a SANE existing
+     * value, but a device whose clock was ahead may have already stamped
+     * a marker in the future (either persisted locally from a previous
+     * session, or fetched from the server before this fix existed). To
+     * "only ever move forward" from a corrupt future value is to never
+     * move at all - the room would stay stuck at `unreadMessages: 0`
+     * forever. When the room is loaded, detect a marker that sits well
+     * past the newest message we actually know it has and waive the
+     * forward-only check for that one comparison, so the incoming
+     * (already-clamped, see xmppClient.getChatsPrivateStoreRequestStanza)
+     * value can correct it even though it's numerically smaller.
      */
     applyPrivateStoreMarkers: (
       state: WritableDraft<RoomMessagesState>,
@@ -590,20 +656,72 @@ const reducers = {
       for (const jid of Object.keys(markers)) {
         const ts = Number(markers[jid]);
         if (!jid || !Number.isFinite(ts) || ts <= 0) {continue;}
+
+        const room = state.rooms[jid];
+        const newestKnownMs = room ? newestAckedMessageMs(room.messages) : 0;
+        // Mirrors isCorruptFutureReadMarker in helpers/getServerReadTimestamp.ts
+        // (duplicated to avoid a roomStore <-> helpers import cycle):
+        // BOTH signals are required. "Further ahead than the newest
+        // message this room has locally" happens all the time on a room
+        // whose history hasn't synced yet, and healing on that alone
+        // would drop a legitimate marker another device wrote after
+        // reading newer messages. A real read marker can never be ahead
+        // of real time, so that second signal is what distinguishes a
+        // stale cache from a wrong clock.
+        const nowMs = Date.now();
+        const looksCorrupt = (existing: number) =>
+          newestKnownMs > 0 &&
+          existing > newestKnownMs + FUTURE_MARKER_TOLERANCE_MS &&
+          existing > nowMs + FUTURE_MARKER_TOLERANCE_MS;
+
         // Remember the marker so rooms that load LATER (via addRoom)
         // inherit it even though they don't exist in the store yet.
-        if (ts > (state.privateStoreMarkers[jid] || 0)) {
+        const cachedMarker = state.privateStoreMarkers[jid] || 0;
+        if (ts > cachedMarker || looksCorrupt(cachedMarker)) {
           state.privateStoreMarkers[jid] = ts;
         }
         // Upgrade an already-loaded room's baseline + recompute its badge.
-        // Only ever forward, so a later local read isn't clobbered.
-        const room = state.rooms[jid];
-        if (room && ts > (room.lastViewedTimestamp || 0)) {
+        // Forward-only, unless the room's CURRENT baseline is itself the
+        // corrupt value being corrected.
+        if (room && (ts > (room.lastViewedTimestamp || 0) || looksCorrupt(room.lastViewedTimestamp || 0))) {
           room.lastViewedTimestamp = ts;
           room.unreadMessages = countNewerMessages(room.messages, ts);
         }
       }
     },
+    /**
+     * Set (or clear) the "read up to here, but not further" boundary for
+     * a room - see `readBoundaries` on `RoomMessagesState` for the full
+     * contract. `ts` is the msgSortableMs of the newest message the user
+     * actually reached before scrolling away from the bottom; `null`/`0`
+     * clears it (the user is at the bottom, or nothing was reached yet).
+     */
+    setReadBoundary: (
+      state: WritableDraft<RoomMessagesState>,
+      action: PayloadAction<{ jid: string; ts: number | null }>
+    ) => {
+      const { jid, ts } = action.payload;
+      if (!jid) {return;}
+      if (!state.readBoundaries) {state.readBoundaries = {};}
+      if (typeof ts === 'number' && Number.isFinite(ts) && ts > 0) {
+        state.readBoundaries[jid] = ts;
+      } else {
+        delete state.readBoundaries[jid];
+      }
+    },
+    /**
+     * Release a room's read boundary once it has been consumed by a
+     * genuine "leave" (ChatRoom unmount, or a tab-navigator focus hook
+     * switching to a different room) - see `readBoundaries` for why the
+     * background/`isVisible=false` paths deliberately do NOT call this.
+     */
+    clearReadBoundary: (
+      state: WritableDraft<RoomMessagesState>,
+      action: PayloadAction<{ jid: string }>
+    ) => {
+      const { jid } = action.payload;
+      if (jid && state.readBoundaries) {delete state.readBoundaries[jid];}
+    },
     setRoomRole: (
       state: WritableDraft<RoomMessagesState>,
       action: PayloadAction<{ chatJID: string; role: string }>
@@ -697,6 +815,7 @@ const reducers = {
       state.isLoading = false;
       state.isUnreadSyncing = false;
       state.privateStoreMarkers = {};
+      state.readBoundaries = {};
     },
     setActiveMessage: (
       state: WritableDraft<RoomMessagesState>,
@@ -818,27 +937,13 @@ export const roomsStore: Slice<RoomMessagesState, typeof reducers, 'roomMessages
   reducers,
 });
 
-// Count messages strictly newer than the given millisecond timestamp.
-// Uses `msg.id` (server-authoritative microsecond timestamp prefixed by
-// 13-digit millis — see helpers/dateComparison `getHighResolutionTimestamp`)
-// because `msg.date` can be derived client-side (createMessageFromXml
-// falls back to `Date.now()` for realtime stanzas without a `date`
-// attr), which makes the comparison drift vs what the server assigned.
-// Excludes the "delimiter-new" sentinel, pending sends, and the current
-// user's own messages (parity with unreadMiddleware's isOwnMessage
-// filter — without this, the reducer and the middleware disagree about
-// the count and we get a flicker as the badge gets written twice with
-// different values on every message).
-export const msgSortableMs = (msg: any): number => {
-  const id = String(msg?.id || '');
-  const m = /^(\d{13})/.exec(id);
-  if (m) {return Number(m[1]);}
-  if (msg?.date) {
-    const t = new Date(msg.date as any).getTime();
-    if (Number.isFinite(t)) {return t;}
-  }
-  return 0;
-};
+// Re-exported for backward compatibility - every existing call site
+// imports `msgSortableMs` from here. The implementation now lives in
+// helpers/msgSortableMs.ts (imported above), so insertMessageWithDelimiter.ts
+// (which this file itself imports) can use the SAME ordering source
+// without a roomStore <-> helpers import cycle. See that file for the
+// full rationale (server id vs. client `date`).
+export { msgSortableMs };
 
 const norm = (s: any): string => {
   if (s == null) {return '';}
@@ -870,6 +975,31 @@ const isOwn = (
   return false;
 };
 
+// Bug #38 tolerance: a stored read marker more than this far past the
+// newest message a room actually has is not "the user is a little
+// ahead" - it's a leftover from a device whose clock was wrong when it
+// stamped the marker. Kept in sync with (but duplicated from, to avoid
+// a roomStore ↔ helpers import cycle) FUTURE_READ_MARKER_TOLERANCE_MS
+// in helpers/getServerReadTimestamp.ts.
+const FUTURE_MARKER_TOLERANCE_MS = 5 * 60 * 1000;
+
+// Newest message in `messages` this room actually has proof the server
+// accepted - used only to sanity-check an already-stored read marker
+// against reality (see applyPrivateStoreMarkers's self-heal). Excludes
+// pending/optimistic sends via the `pending` flag alone: unlike
+// getServerReadTimestamp, this runs inside a reducer and can't reach
+// across to the roomHeapSlice slice, but `pending` already identifies
+// every optimistic send that matters for this comparison.
+const newestAckedMessageMs = (messages: IMessage[] | undefined): number => {
+  let newest = 0;
+  for (const m of messages || []) {
+    if (!m || m.id === 'delimiter-new' || m.pending) {continue;}
+    const ms = msgSortableMs(m);
+    if (ms > newest) {newest = ms;}
+  }
+  return newest;
+};
+
 const countNewerMessages = (
   messages: IMessage[],
   timestamp: number,
@@ -900,6 +1030,8 @@ export const {
   setUnreadSyncing,
   setLastViewedTimestamp,
   applyPrivateStoreMarkers,
+  setReadBoundary,
+  clearReadBoundary,
   setRoomNoMessages,
   setCurrentRoom,
   setVisibleRoom,