@oxidezap/baileyrs 0.2.11 → 0.2.13

package/lib/Utils/use-bridge-store.js

@@ -1,11 +1,13 @@
 import { Buffer } from 'node:buffer';
-import { mkdir, readdir, readFile, unlink, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { mkdir, open, readdir, readFile, rename, unlink } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+import { dirname, join } from 'node:path';
 /**
  * Stores whose loss on SIGKILL produces undecryptable messages or
  * permanent app-state divergence. Each entry below carries a reason —
- * promoting a store to "critical" doubles disk I/O, so don't add
- * anything here that can be re-derived from the network.
+ * promoting a store to "critical" multiplies disk I/O (write + fsync +
+ * atomic rename per key), so don't add anything here that can be
+ * re-derived from the network.
  *
  *   `session` / `identity` — Signal session ratchet steps. Lose
  *      one step → next inbound message from peer undecryptable.
@@ -37,113 +39,562 @@ const CRITICAL_STORES = new Set([
     'mutation_mac'
 ]);
 /**
- * `ENOENT` is the only error tolerated on a write/readdir: it means the auth
- * folder was removed (e.g. during shutdown/cleanup). Any other error (ENOSPC,
- * EACCES, EIO, ENOTDIR) is a real persistence failure that MUST propagate —
- * swallowing it would silently lose Signal session state or message secrets
- * while the caller believes the write succeeded.
+ * `ENOENT` is legitimate only where absence is a valid answer: reading a
+ * key that was never written (or was deleted), deleting a key that is
+ * already gone, and enumerating a folder that was removed. Everywhere
+ * else — writes, flushes, non-ENOENT read/delete failures (ENOTDIR,
+ * EACCES, EIO, ENOSPC) — the error MUST propagate. A write that resolves
+ * without durable bytes while the caller believes it persisted silently
+ * loses Signal session state or message secrets.
  */
 const isEnoent = (e) => e?.code === 'ENOENT';
+const errnoOf = (e) => e?.code;
+const bytesEqual = (a, b) => a.length === b.length && Buffer.compare(a, b) === 0;
+// Real copy for both Uint8Array and Buffer. `Buffer.prototype.slice`
+// deliberately returns a view over the same memory, so `.slice()` is NOT
+// a valid snapshot for caller-owned buffers.
+const copyBytes = (value) => Uint8Array.from(value);
+/**
+ * Pure classifier for directory-barrier failures: does this error mean
+ * "this platform cannot sync directory handles" (degrade to process-crash
+ * atomicity) or "the durability barrier did not hold" (propagate)?
+ *
+ * - `ENOSYS` / `ENOTSUP` on any platform: the operation is not
+ *   implemented — genuinely unsupported, safe to degrade.
+ * - `EINVAL` / `EPERM` / `EISDIR` on `win32` only: Windows directory
+ *   handles reject open-for-read and FlushFileBuffers with these codes,
+ *   so they are the documented platform fallback there. On Linux/macOS
+ *   the same codes from a freshly opened directory handle mean something
+ *   is genuinely wrong and they propagate.
+ * - Everything else propagates everywhere: `EIO`, `ENOSPC`, `EROFS`,
+ *   `EACCES`, `ENOENT`, and notably `EBADF` (a bad handle is a real bug,
+ *   never evidence of an unsupported platform).
+ *
+ * `platform` defaults to the running platform; tests pass explicit values
+ * to cover the matrix deterministically on any OS.
+ */
+export const isUnsupportedDirSync = (e, platform = process.platform) => {
+    const code = errnoOf(e);
+    if (code === 'ENOSYS' || code === 'ENOTSUP')
+        return true;
+    if (platform === 'win32' && (code === 'EINVAL' || code === 'EPERM' || code === 'EISDIR'))
+        return true;
+    return false;
+};
+// Thrown by `durableWrite` when the temp file was published (rename
+// attempted) but the post-rename barrier did not certify. At that point
+// the target may or may not hold the new bytes, so prior durable
+// knowledge for the key is invalid. Carries the original failure.
+class BarrierUncertainty extends Error {
+    constructor(detail) {
+        super('use-bridge-store: post-rename barrier uncertified; prior durable knowledge invalidated');
+        this.name = 'BarrierUncertainty';
+        this.detail = detail;
+    }
+}
+const defaultSyncDir = async (dir) => {
+    let handle;
+    try {
+        handle = await open(dir, 'r');
+    }
+    catch (e) {
+        // A store folder that cannot even be opened is not a platform
+        // quirk, except where the platform cannot open directory handles
+        // at all (classified above).
+        if (!isUnsupportedDirSync(e))
+            throw e;
+        return;
+    }
+    try {
+        await handle.sync();
+    }
+    catch (e) {
+        if (!isUnsupportedDirSync(e))
+            throw e;
+    }
+    finally {
+        await handle.close().catch(() => { });
+    }
+};
+// Exclusive temp creation with a restrictive mode for sensitive auth
+// bytes. `0o600` regardless of umask: replacement renames this inode over
+// the target, so an existing `0600` file can never be widened (a previously
+// wider file narrows to `0600`, the safe direction for session secrets;
+// POSIX only — Windows ignores mode bits).
+const realOpenTmp = async (tmpPath) => open(tmpPath, 'wx', 0o600);
+const defaultWriteTmp = async (tmpPath, value, openTmp) => {
+    // Exclusive create: never truncate a temp file this operation did
+    // not create. Temp names are unique per attempt (see durableWrite),
+    // so EEXIST is not expected — but if it ever happens the caller
+    // retries with a fresh name instead of touching foreign bytes.
+    const handle = await openTmp(tmpPath);
+    try {
+        await handle.writeFile(value);
+        await handle.sync();
+        await handle.close();
+    }
+    catch (e) {
+        // Owned (we just created it exclusively): close best-effort and
+        // remove our own temp, never anyone else's. Cleanup failures
+        // cannot mask the original error — it always propagates.
+        await handle.close().catch(() => { });
+        await unlink(tmpPath).catch(() => { });
+        throw e;
+    }
+};
+const defaultPublishTmp = async (tmpPath, finalPath) => {
+    await rename(tmpPath, finalPath);
+};
+let tmpSeq = 0;
 /**
  * Creates a file-based store for the WASM bridge.
  *
  * Each (store, key) pair maps to a file: `<folder>/<store>-<key>.bin`
  *
- * Uses a write-through in-memory cache to avoid redundant disk reads.
- * Writes go to both cache and disk. Reads hit cache first, disk on miss.
+ * Durability model:
+ * - Caller buffers are copied synchronously at admission (`set`/`setMany`
+ *   copy before queueing), so mutating a buffer after the call — even
+ *   before awaiting it — can never change what gets persisted.
+ * - Critical stores write through `durableWrite` before `set`/`setMany`
+ *   resolve. The in-memory map only records bytes AFTER the full barrier
+ *   (write + fsync + atomic rename + directory sync) succeeds, so an
+ *   identical retry following a failure is never skipped and always
+ *   re-attempts the write.
+ * - If the post-rename barrier fails, the key is marked uncertain: prior
+ *   durable knowledge is discarded, reads serve best-available bytes
+ *   without re-certifying them, and no identical set is skipped until a
+ *   later operation completes the full barrier for that key.
+ * - Non-critical stores are debounced (50ms coalescing) and readable
+ *   immediately (read-your-write), but such reads are NOT durable until
+ *   `flush()` succeeds. A failed flush keeps the pending entry and throws,
+ *   so the next `flush()` retries the same bytes.
+ * - `flush()` first waits for every operation admitted before it
+ *   (barrier), then drains the pending writes those operations produced.
+ *   Failures observed by the barrier propagate — a failed admitted write
+ *   fails the flush — but only operations outstanding during that flush
+ *   are reported, so history never poisons later flushes. A drain pass
+ *   with any failure stops at that pass and leaves the failed entries
+ *   for the next explicit flush. `flush()` never reports quiescence
+ *   while prior admitted work is still running.
+ * - All operations on one key (set, delete, flush, concurrent batches) run
+ *   through a per-key chain, so a stale failure can never erase newer
+ *   state and an in-flight write can never resurrect a deleted key.
+ * - A failed delete restores the preceding pending/durable state, so an
+ *   acknowledged value stays readable and flushable; only a successful
+ *   delete (unlink + directory barrier) clears it. A delete retried while
+ *   the key is uncertain re-runs the directory barrier instead of
+ *   swallowing the uncertainty as idempotent absence — except that a
+ *   directory removed externally surfaces ENOENT rather than success.
+ * - Every byte array handed back to callers is a copy.
  *
  * @param folder Directory to store bridge state files
+ * @param options Optional per-store file-I/O steps. Test/fault-injection
+ *   seam only: the default implementation is the sole provider of the
+ *   durability contract above.
  */
-export async function useBridgeStore(folder) {
+export async function useBridgeStore(folder, options) {
     await mkdir(folder, { recursive: true });
-    // Write-through cache with LRU eviction to bound memory
+    const openTmp = options?.io?.openTmp ?? realOpenTmp;
+    const io = {
+        writeTmp: options?.io?.writeTmp ?? ((tmpPath, value) => defaultWriteTmp(tmpPath, value, openTmp)),
+        publishTmp: options?.io?.publishTmp ?? defaultPublishTmp,
+        syncDir: options?.io?.syncDir ?? defaultSyncDir
+    };
+    /**
+     * Durable file replacement: write + fsync an exclusively-created temp
+     * file in the same directory, then atomically rename it over the
+     * target and sync the directory. The temp uses a short fixed-shape
+     * basename (independent of key length, so long-but-valid final names
+     * still fit NAME_MAX) created with mode `0600` (POSIX; Windows ignores
+     * mode bits), so replacing a hardened auth file never widens its
+     * permissions. The previous file (or its absence) is untouched until the rename succeeds, so a crash
+     * or a failed write can never leave a torn target behind — readers
+     * always see the old intact file or the new intact file. Cleanup only
+     * ever removes a temp this operation created; a temp that already
+     * existed is left alone.
+     *
+     * Guarantees are scoped honestly: the rename is atomic against a dead
+     * process, and the file + directory syncs raise the bar toward
+     * power-loss durability on platforms that honor them. No file-level
+     * test can prove power-loss survival — that would need a physical
+     * harness — so tests assert the checkable half (failure atomicity,
+     * retryability) and the code does not claim more.
+     *
+     * Every error propagates, including ENOENT: resolving a write whose
+     * bytes never reached disk would let the caller believe state is
+     * durable. A failure at or after the rename throws BarrierUncertainty
+     * so the caller invalidates prior durable knowledge for the key.
+     */
+    const durableWrite = async (finalPath, value) => {
+        const MAX_TMP_ATTEMPTS = 5;
+        for (let attempt = 0; attempt < MAX_TMP_ATTEMPTS; attempt++) {
+            // Short fixed-shape basename in the same directory (rename stays
+            // atomic): independent of the target key length so keys whose
+            // valid final names approach NAME_MAX still fit. Uniqueness from
+            // pid + sequence + randomness; the final stored name is untouched.
+            const tmpPath = join(dirname(finalPath), `.bstore-${process.pid.toString(36)}-${(tmpSeq++).toString(36)}-${randomBytes(4).toString('hex')}.tmp`);
+            try {
+                await io.writeTmp(tmpPath, value);
+            }
+            catch (e) {
+                // EEXIST means a foreign temp owns this name (we create
+                // exclusively and never overwrite): retry with a fresh name
+                // instead of deleting or reusing it. Any earlier failure
+                // left the target untouched; `writeTmp` already cleaned up
+                // its own temp.
+                if (errnoOf(e) === 'EEXIST')
+                    continue;
+                throw e;
+            }
+            try {
+                await io.publishTmp(tmpPath, finalPath);
+                await io.syncDir(dirname(finalPath));
+            }
+            catch (e) {
+                // Our own temp failed to publish or certify: remove only our
+                // temp. If the rename itself succeeded, the temp is already
+                // gone and this unlink is a tolerated no-op — but the
+                // barrier is uncertified either way.
+                await unlink(tmpPath).catch(() => { });
+                throw new BarrierUncertainty(e);
+            }
+            return;
+        }
+        throw new Error(`use-bridge-store durableWrite could not claim a unique temp name for ${finalPath}`);
+    };
+    // Last bytes known to have passed the FULL barrier per key (written,
+    // flushed, or read from disk outside uncertainty). Private copies only
+    // — never a caller-owned reference. Bounded by LRU eviction; eviction
+    // only drops knowledge, disk stays canonical.
     const MAX_CACHE_ENTRIES = 5000;
-    const cache = new Map();
-    const touchCache = (key, value) => {
+    const durable = new Map();
+    const rememberDurable = (key, value) => {
         // LRU: delete + re-insert moves to end of insertion order
-        cache.delete(key);
-        cache.set(key, value);
-        // Evict oldest entries if over limit
-        if (cache.size > MAX_CACHE_ENTRIES) {
-            const first = cache.keys().next().value;
-            cache.delete(first);
+        durable.delete(key);
+        durable.set(key, value);
+        if (durable.size > MAX_CACHE_ENTRIES) {
+            const first = durable.keys().next().value;
+            durable.delete(first);
         }
     };
+    // Keys whose last mutation never completed the full barrier (post-rename
+    // or post-unlink failure). Durable knowledge is discarded; reads serve
+    // best-available bytes without re-certifying them; identical sets are
+    // never skipped. Cleared only by a later operation that completes the
+    // full barrier for the key (write, flush, or certified delete).
+    const uncertain = new Set();
     const filePath = (store, key) => join(folder, `${store}-${encodeURIComponent(key)}.bin`);
-    // Durable write that propagates real failures but tolerates the folder
-    // having been removed (shutdown race). Used by both `set` and `setMany`.
-    const writeCritical = async (store, key, value) => {
+    // Per-key serialization chain. Every key operation runs inside
+    // `withKeyLock` for that key; different keys never block each other.
+    // The tail swallows rejections so one failed op cannot wedge later ops
+    // for the same key. Every admitted op is also tracked in `admitted`
+    // until it settles so `flush()` can wait for work admitted before it.
+    const chains = new Map();
+    const admitted = new Set();
+    const withKeyLock = (cacheKey, fn) => {
+        const prev = chains.get(cacheKey) ?? Promise.resolve();
+        const next = prev.then(fn, fn);
+        const tail = next.then(() => undefined, () => undefined);
+        chains.set(cacheKey, tail);
+        tail.then(() => {
+            if (chains.get(cacheKey) === tail)
+                chains.delete(cacheKey);
+        });
+        admitted.add(next);
+        next.then(() => {
+            admitted.delete(next);
+        }, () => {
+            admitted.delete(next);
+        });
+        return next;
+    };
+    // Debounced non-critical writes not yet flushed to disk.
+    const pendingWrites = new Map();
+    const WRITE_DELAY_MS = 50;
+    const armTimer = (cacheKey, entry) => {
+        if (entry.timer)
+            clearTimeout(entry.timer);
+        entry.timer = setTimeout(() => {
+            void flushOne(cacheKey).catch(() => {
+                // No caller to report to; the entry stays pending and the
+                // next explicit flush() retries it and surfaces the error.
+            });
+        }, WRITE_DELAY_MS);
+        entry.timer.unref(); // Don't keep the process alive for debounced writes
+    };
+    // Full-barrier write shared by critical `set` and the flush drain.
+    // Certifies the key on success; on post-rename failure discards durable
+    // knowledge, marks uncertainty, and rethrows the original error.
+    const certifyWrite = async (cacheKey, path, value) => {
         try {
-            await writeFile(filePath(store, key), value);
+            await durableWrite(path, value);
         }
         catch (e) {
-            if (!isEnoent(e))
-                throw e;
-            // folder removed during shutdown — nothing to persist into
+            if (e instanceof BarrierUncertainty) {
+                durable.delete(cacheKey);
+                uncertain.add(cacheKey);
+                throw e.detail;
+            }
+            throw e;
         }
+        uncertain.delete(cacheKey);
+        rememberDurable(cacheKey, copyBytes(value));
     };
-    // Batch write queue: coalesces rapid writes to the same key
-    const pendingWrites = new Map();
-    const WRITE_DELAY_MS = 50;
-    const flushWrite = async (cacheKey) => {
+    // Flush one pending key. Runs under the key lock (not tracked in
+    // `admitted`: the drain loop drives it, so tracking it would make
+    // `flush()` wait on itself). On failure the entry is RETAINED (timer
+    // cleared) so an explicit `flush()` retries the same bytes, and the
+    // error propagates to that caller.
+    const flushOne = (cacheKey) => withKeyLockInternal(cacheKey, async () => {
         const pending = pendingWrites.get(cacheKey);
         if (!pending)
             return;
-        clearTimeout(pending.timer);
-        pendingWrites.delete(cacheKey);
-        try {
-            await writeFile(pending.path, pending.value);
+        if (pending.timer) {
+            clearTimeout(pending.timer);
+            pending.timer = undefined;
         }
-        catch {
-            // Ignore — folder may have been deleted during cleanup
+        await certifyWrite(cacheKey, pending.path, pending.value);
+        if (pendingWrites.get(cacheKey) === pending)
+            pendingWrites.delete(cacheKey);
+    });
+    // Same as `withKeyLock` but invisible to the flush admission barrier.
+    // Only the flush drain loop may use this; key operations use
+    // `withKeyLock` so `flush()` observes them.
+    const withKeyLockInternal = (cacheKey, fn) => {
+        const prev = chains.get(cacheKey) ?? Promise.resolve();
+        const next = prev.then(fn, fn);
+        const tail = next.then(() => undefined, () => undefined);
+        chains.set(cacheKey, tail);
+        tail.then(() => {
+            if (chains.get(cacheKey) === tail)
+                chains.delete(cacheKey);
+        });
+        return next;
+    };
+    const FLUSH_MAX_PASSES = 32;
+    const flushAll = async () => {
+        // Each pass first waits for every operation admitted so far
+        // (barrier), then drains the pending writes those operations
+        // produced. A `set()` queued just before `flush()` is therefore
+        // observed even if it had not reached `pendingWrites` yet, and an
+        // already-running critical write completes before quiescence is
+        // declared. `flushOne` internals are not admitted, so the barrier
+        // never waits on the drain loop itself (no self-deadlock).
+        // Failures observed by the barrier propagate: a failed admitted
+        // write fails the flush. Only operations outstanding during this
+        // flush are reported — settled history never poisons later flushes.
+        // After a drain pass with any failure, stop and leave the failed
+        // entries for a subsequent explicit flush: retrying them inside the
+        // same call would resolve-or-reject on a stale error while hiding
+        // whether the retry itself persisted. A fully successful pass loops,
+        // since new work may have landed during the drain. The pass cap only
+        // guards a caller emitting writes in a tight loop —
+        // `Socket/index.ts.end()` waits on this and must return.
+        const errors = [];
+        for (let i = 0; i < FLUSH_MAX_PASSES; i++) {
+            const outstanding = [...admitted];
+            if (outstanding.length > 0) {
+                const settled = await Promise.allSettled(outstanding);
+                for (const result of settled) {
+                    if (result.status === 'rejected')
+                        errors.push(result.reason);
+                }
+            }
+            if (pendingWrites.size === 0) {
+                if (admitted.size === 0)
+                    break;
+                continue;
+            }
+            const keys = [...pendingWrites.keys()];
+            let failed = false;
+            await Promise.all(keys.map(key => flushOne(key).then(() => { }, e => {
+                failed = true;
+                errors.push(e);
+            })));
+            if (failed)
+                break;
+        }
+        if (errors.length > 0)
+            throw errors[0];
+        if (pendingWrites.size > 0 || admitted.size > 0) {
+            throw new Error(`use-bridge-store flushAll did not quiesce after ${FLUSH_MAX_PASSES} passes (${pendingWrites.size} pending writes, ${admitted.size} in-flight operations remain)`);
         }
     };
-    // Delete many keys concurrently (shared by `deleteMany` and `deletePrefix`).
-    // Defined as a closure rather than a method so callers don't depend on
-    // `this` — the bridge invokes every store callback with `this = null`.
-    const doDeleteMany = async (store, keys) => {
-        if (keys.length === 0)
-            return;
-        await Promise.all(keys.map(async (key) => {
-            const cacheKey = `${store}\0${key}`;
-            cache.delete(cacheKey);
-            const existing = pendingWrites.get(cacheKey);
-            if (existing) {
-                clearTimeout(existing.timer);
+    // Write path shared by `set` and `setMany`. `incoming` is already a
+    // private admission-time copy. Must run under the key lock — callers
+    // wrap it via `withKeyLock`.
+    const doSetLocked = async (store, key, cacheKey, incoming) => {
+        // Skip only when the identical bytes are already barrier-certified
+        // or already queued. Uncertainty discards certification, so a
+        // retry after an uncertified barrier always re-attempts instead of
+        // resolving without persisting.
+        const pending = pendingWrites.get(cacheKey);
+        if (pending) {
+            if (bytesEqual(pending.value, incoming))
+                return;
+        }
+        else {
+            const known = durable.get(cacheKey);
+            if (known && bytesEqual(known, incoming))
+                return;
+        }
+        if (CRITICAL_STORES.has(store)) {
+            if (pending) {
+                if (pending.timer)
+                    clearTimeout(pending.timer);
                 pendingWrites.delete(cacheKey);
             }
+            // Propagate every failure (ENOSPC/EACCES/EIO/ENOTDIR/ENOENT) —
+            // losing a critical Signal write silently corrupts next decrypt.
+            await certifyWrite(cacheKey, filePath(store, key), incoming);
+            return;
+        }
+        // Non-critical writes: coalesce rapid writes to the same key
+        if (pending?.timer)
+            clearTimeout(pending.timer);
+        const entry = {
+            store,
+            key,
+            path: filePath(store, key),
+            value: incoming,
+            timer: undefined
+        };
+        armTimer(cacheKey, entry);
+        pendingWrites.set(cacheKey, entry);
+    };
+    const doSet = (store, key, value) => {
+        // Admission-time copy, synchronous with the call: a caller mutating
+        // its buffer immediately after (even before awaiting) cannot change
+        // what this operation persists. `Uint8Array.from` copies Buffer
+        // inputs too — `Buffer.slice` would only create a shared view.
+        const incoming = copyBytes(value);
+        const cacheKey = `${store}\0${key}`;
+        return withKeyLock(cacheKey, () => doSetLocked(store, key, cacheKey, incoming));
+    };
+    // Read path shared by `get` and `getMany`. Runs under the key lock so
+    // a concurrent delete cannot leave stale bytes resurrected in `durable`.
+    // Returns a copy — callers can never mutate the cache or in-flight data.
+    // A pending (debounced, not yet durable) value satisfies read-your-write
+    // immediately; it is exposed as pending, and `flush()` is the call that
+    // makes it durable. Under uncertainty, disk bytes are served
+    // best-available WITHOUT re-certifying them: caching them as durable
+    // would let a later identical set skip its still-required barrier.
+    const doGetLocked = async (store, key, cacheKey) => {
+        const pending = pendingWrites.get(cacheKey);
+        if (pending)
+            return copyBytes(pending.value);
+        const keyUncertain = uncertain.has(cacheKey);
+        if (!keyUncertain) {
+            const known = durable.get(cacheKey);
+            if (known)
+                return copyBytes(known);
+        }
+        let data;
+        try {
+            data = await readFile(filePath(store, key));
+        }
+        catch (e) {
+            // Absent key is a legitimate null. Any other read failure
+            // (EACCES/EIO/ENOTDIR) must NOT masquerade as "no value", or the
+            // core would treat persisted state as gone.
+            if (isEnoent(e))
+                return null;
+            throw e;
+        }
+        const arr = copyBytes(new Uint8Array(data.buffer, data.byteOffset, data.byteLength));
+        if (!keyUncertain)
+            rememberDurable(cacheKey, copyBytes(arr));
+        return arr;
+    };
+    const doGet = (store, key) => {
+        const cacheKey = `${store}\0${key}`;
+        return withKeyLock(cacheKey, () => doGetLocked(store, key, cacheKey));
+    };
+    // Delete path shared by `delete`, `deleteMany` and `deletePrefix`.
+    // Runs under the key lock. The preceding pending/durable state is only
+    // cleared once the unlink succeeds; if the unlink fails with a real
+    // error, that state is restored (timer re-armed) so an acknowledged
+    // value stays readable and flushable, and the error propagates. A
+    // successful unlink completes the directory barrier; if that barrier
+    // fails, the key is marked uncertain. A delete retried while uncertain
+    // re-runs the directory barrier instead of mistaking ENOENT for
+    // certified absence — but a directory removed externally still surfaces
+    // ENOENT rather than success, by explicit policy. Certain absence stays
+    // idempotent.
+    const doDeleteOne = (store, key) => {
+        const cacheKey = `${store}\0${key}`;
+        return withKeyLock(cacheKey, async () => {
+            const prevPending = pendingWrites.get(cacheKey);
+            const prevDurable = durable.get(cacheKey);
+            const wasUncertain = uncertain.has(cacheKey);
+            if (prevPending?.timer)
+                clearTimeout(prevPending.timer);
+            pendingWrites.delete(cacheKey);
+            durable.delete(cacheKey);
+            // Reinstate the state captured above after any delete failure
+            // that leaves the key's fate undecided, so an acknowledged
+            // value stays readable and flushable. Not used when absence is
+            // certified (the delete won) or when the unlink itself succeeded
+            // (the file is genuinely gone; only the barrier is uncertain).
+            const restoreDeleteState = () => {
+                if (prevDurable)
+                    rememberDurable(cacheKey, prevDurable);
+                if (prevPending) {
+                    armTimer(cacheKey, prevPending);
+                    pendingWrites.set(cacheKey, prevPending);
+                }
+            };
             try {
                 await unlink(filePath(store, key));
             }
-            catch {
-                // ignore if file doesn't exist
+            catch (e) {
+                if (isEnoent(e) && !wasUncertain)
+                    return;
+                if (isEnoent(e)) {
+                    // Absent on disk, but a prior barrier was never
+                    // certified: certify the absence now instead of
+                    // swallowing the uncertainty.
+                    try {
+                        await io.syncDir(folder);
+                    }
+                    catch (syncError) {
+                        restoreDeleteState();
+                        throw syncError;
+                    }
+                    uncertain.delete(cacheKey);
+                    return;
+                }
+                restoreDeleteState();
+                throw e;
+            }
+            try {
+                await io.syncDir(folder);
+            }
+            catch (e) {
+                uncertain.add(cacheKey);
+                throw e;
             }
-        }));
+            uncertain.delete(cacheKey);
+        });
     };
-    const FLUSH_MAX_PASSES = 32;
-    const flushAll = async () => {
-        // Drain in a loop because new sets can land while we're awaiting the
-        // previous batch's writeFile. Bounded so a caller emitting writes in
-        // a tight loop can't lock us forever — `Socket/index.ts.end()` waits
-        // on this and must always return. If the cap is hit with writes
-        // still pending, surface that to the caller — silently dropping
-        // them would lose Signal session steps and corrupt next decrypt.
-        for (let i = 0; i < FLUSH_MAX_PASSES && pendingWrites.size > 0; i++) {
-            const keys = [...pendingWrites.keys()];
-            await Promise.all(keys.map(flushWrite));
-        }
-        if (pendingWrites.size > 0) {
-            throw new Error(`use-bridge-store flushAll did not quiesce after ${FLUSH_MAX_PASSES} passes (${pendingWrites.size} pending writes remain)`);
-        }
+    // Delete many keys concurrently (shared by `deleteMany` and
+    // `deletePrefix`). Defined as a closure rather than a method so callers
+    // don't depend on `this` — the bridge invokes every store callback with
+    // `this = null`. Best-effort across keys: every key is attempted even
+    // when a sibling fails, and the first error propagates.
+    const doDeleteMany = async (store, keys) => {
+        if (keys.length === 0)
+            return;
+        await Promise.all(keys.map(key => doDeleteOne(store, key)));
     };
     // Enumerate live keys in a namespace (shared by `listKeys` and
     // `deletePrefix`). Closure, not a method, so it never depends on `this`.
     // Files are `<store>-<encodeURIComponent(key)>.bin`; store names never
     // contain a hyphen, so split on the FIRST hyphen and decode the remainder.
-    // readdir (durable view) is unioned with not-yet-flushed debounced writes
-    // so a key written <50ms ago isn't missed; a flush is awaited first so a
-    // torn debounce window can't drop a key. Pending deletes both cancel their
-    // `pendingWrites` entry AND unlink immediately, so they never appear here.
+    // A flush is awaited first so admitted and debounced writes are durable
+    // before the readdir; its failure propagates rather than enumerating a
+    // stale view. Pending deletes both cancel their `pendingWrites` entry
+    // AND unlink immediately, so they never appear here.
     const doListKeys = async (store, prefix) => {
         await flushAll();
         const filePrefix = `${store}-`;
@@ -190,150 +641,39 @@ export async function useBridgeStore(folder) {
         return [...found];
     };
     return {
-        async get(store, key) {
-            const cacheKey = `${store}\0${key}`;
-            // Check cache first
-            const cached = cache.get(cacheKey);
-            if (cached)
-                return cached;
-            const pending = pendingWrites.get(cacheKey);
-            if (pending)
-                return pending.value;
-            try {
-                const data = await readFile(filePath(store, key));
-                const arr = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-                touchCache(cacheKey, arr);
-                return arr;
-            }
-            catch {
-                return null;
-            }
-        },
-        async set(store, key, value) {
-            const cacheKey = `${store}\0${key}`;
-            // Skip write if value is identical to cached version
-            const prev = cache.get(cacheKey);
-            if (prev && Buffer.from(prev).equals(Buffer.from(value))) {
-                return;
-            }
-            touchCache(cacheKey, value);
-            if (CRITICAL_STORES.has(store)) {
-                const existing = pendingWrites.get(cacheKey);
-                if (existing) {
-                    clearTimeout(existing.timer);
-                    pendingWrites.delete(cacheKey);
-                }
-                // Propagate real failures (ENOSPC/EACCES/…) — losing a critical
-                // Signal write silently corrupts the next decrypt.
-                await writeCritical(store, key, value);
-                return;
-            }
-            // Non-critical writes: coalesce rapid writes to the same key
-            const existing = pendingWrites.get(cacheKey);
-            if (existing) {
-                clearTimeout(existing.timer);
-            }
-            const path = filePath(store, key);
-            const timer = setTimeout(() => void flushWrite(cacheKey), WRITE_DELAY_MS);
-            timer.unref(); // Don't keep the process alive for debounced writes
-            pendingWrites.set(cacheKey, { path, value, timer });
-        },
-        async delete(store, key) {
-            const cacheKey = `${store}\0${key}`;
-            cache.delete(cacheKey);
-            // Cancel pending write
-            const existing = pendingWrites.get(cacheKey);
-            if (existing) {
-                clearTimeout(existing.timer);
-                pendingWrites.delete(cacheKey);
-            }
-            try {
-                await unlink(filePath(store, key));
-            }
-            catch {
-                // ignore if file doesn't exist
-            }
-        },
+        get: doGet,
+        set: doSet,
+        delete: doDeleteOne,
         // Batched variant of `set`. The bridge calls this (when present) to
         // persist a burst of entries in a single FFI crossing instead of N
-        // round-trips (e.g. ~20k messageSecrets from a history sync). Per-entry
-        // semantics are identical to `set` — same skip-if-equal, same cache
-        // touch, same critical-vs-debounced write policy.
+        // round-trips (e.g. ~20k messageSecrets from a history sync).
+        // Per-entry semantics are identical to `set` — admission copies are
+        // taken synchronously for every entry, in order. Best-effort across
+        // keys per the bridge contract: every entry is attempted even when
+        // a sibling fails (writes are idempotent by key, so the core can
+        // retry the batch), and the first error propagates. No multi-key
+        // transaction is attempted — the filesystem does not provide one.
         async setMany(store, entries) {
             // Empty batch is a valid no-op.
             if (entries.length === 0)
                 return;
-            const critical = CRITICAL_STORES.has(store);
-            // Collect critical writes so we can run them concurrently with
-            // Promise.all instead of awaiting each writeFile serially in a loop.
-            const criticalWrites = [];
-            for (const [key, value] of entries) {
-                const cacheKey = `${store}\0${key}`;
-                // Skip write if value is identical to cached version.
-                // Buffer.compare accepts Uint8Array directly (no copy), unlike
-                // Buffer.from(prev).equals(Buffer.from(value)) which copied both.
-                const prev = cache.get(cacheKey);
-                if (prev && prev.length === value.length && Buffer.compare(prev, value) === 0) {
-                    continue;
-                }
-                touchCache(cacheKey, value);
-                if (critical) {
-                    // Cancel any pending debounced write for this key first,
-                    // exactly like `set` does, then write immediately.
-                    const existing = pendingWrites.get(cacheKey);
-                    if (existing) {
-                        clearTimeout(existing.timer);
-                        pendingWrites.delete(cacheKey);
-                    }
-                    // Propagate real failures: if a critical write in the batch
-                    // fails, setMany rejects, and the Rust core skips the
-                    // follow-up self-index rewrite (so the index can't claim a
-                    // value exists that was never persisted).
-                    criticalWrites.push(writeCritical(store, key, value));
-                    continue;
-                }
-                // Non-critical writes: coalesce rapid writes to the same key.
-                // The debounce already coalesces a burst, so scheduling each
-                // entry is fine — no immediate flush needed.
-                const existing = pendingWrites.get(cacheKey);
-                if (existing) {
-                    clearTimeout(existing.timer);
-                }
-                const path = filePath(store, key);
-                const timer = setTimeout(() => void flushWrite(cacheKey), WRITE_DELAY_MS);
-                timer.unref(); // Don't keep the process alive for debounced writes
-                pendingWrites.set(cacheKey, { path, value, timer });
-            }
-            // Run all critical writes concurrently.
-            if (criticalWrites.length > 0) {
-                await Promise.all(criticalWrites);
-            }
+            // Schedule every entry synchronously so same-key duplicates chain
+            // in batch order; per-key locks serialize against concurrent
+            // sets, deletes and flushes.
+            await Promise.all(entries.map(([key, value]) => doSet(store, key, value)));
         },
         // Batched variant of `delete`. Per-key semantics are identical to
         // `delete`; unlinks run concurrently via Promise.all.
         deleteMany: doDeleteMany,
         // Read many keys at once. Cache-aside per key (like `get`), so a hit
-        // never touches disk; misses read the file. Missing keys are omitted.
+        // never touches disk; misses read the file. Missing keys are omitted;
+        // real read failures propagate rather than silently dropping keys.
         async getMany(store, keys) {
             if (keys.length === 0)
                 return [];
             const results = await Promise.all(keys.map(async (key) => {
-                const cacheKey = `${store}\0${key}`;
-                const cached = cache.get(cacheKey);
-                if (cached)
-                    return [key, cached];
-                const pending = pendingWrites.get(cacheKey);
-                if (pending)
-                    return [key, pending.value];
-                try {
-                    const data = await readFile(filePath(store, key));
-                    const arr = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-                    touchCache(cacheKey, arr);
-                    return [key, arr];
-                }
-                catch {
-                    return null;
-                }
+                const value = await doGet(store, key);
+                return value === null ? null : [key, value];
             }));
             return results.filter((r) => r !== null);
         },