agent-comms 9.0.11 → 9.0.13

package/src/core/issuer-identity-file.ts

@@ -9,6 +9,8 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { createFileExclusive, writeFileAtomic } from "./atomic-file.js";
+import { withWriteLock } from "./pid-lock-file.js";
+import { CommsError } from "./store.js";
 import {
   generateIdentity,
   certifyKeyPair,
@@ -55,13 +57,43 @@ function isErrnoException(value: unknown): value is NodeJS.ErrnoException {
   return value instanceof Error && "code" in value;
 }
 
-/** Reads the file's raw contents, or undefined if it does not exist yet. Any other filesystem error (permissions, a directory in its place) is surfaced rather than treated as absent. */
+/** The `code` of the error thrown when an identity file exists but cannot be used. */
+export const IDENTITY_RECORD_UNUSABLE = "IDENTITY_RECORD_UNUSABLE";
+
+/** Thrown when an identity file exists but does not hold a record this build can use. The file is left exactly as it was: replacing it would mint a new key, which changes the identity's id for every peer that knows it and discards whatever the record held beside the key. */
+export class UnusableIdentityRecordError extends CommsError {
+  constructor(
+    /** The file that could not be used. */
+    public readonly file: string,
+    /** Why it could not be used, as a short clause. */
+    public readonly reason: string,
+  ) {
+    super(
+      `${file} exists but does not hold a usable identity record (${reason}). It has been left as it was. Restore it from a backup, or move it aside to start a new identity, which changes this identity's id for every peer that knows it.`,
+      IDENTITY_RECORD_UNUSABLE,
+    );
+    // No cause is attached and the reason is fixed text: the underlying parse and crypto errors can quote part of the file, which holds a private key, and an error is printed whole by anything that logs it.
+    this.name = "UnusableIdentityRecordError";
+  }
+}
+
+/** The errno code of a failed read, which is all of the failure that is safe to repeat: its message quotes the path and nothing of the content, but the code is what a person can act on. */
+function readFailureCode(err: unknown): string {
+  return isErrnoException(err) && typeof err.code === "string"
+    ? err.code
+    : "unknown error";
+}
+
+/** Reads the file's raw contents, or undefined if it does not exist yet. A file that exists but cannot be read (permissions, a directory in its place) is refused as unusable, never treated as absent. */
 function readRawFile(file: string): string | undefined {
   try {
     return fs.readFileSync(file, "utf-8");
   } catch (err) {
     if (isErrnoException(err) && err.code === "ENOENT") return undefined;
-    throw err;
+    throw new UnusableIdentityRecordError(
+      file,
+      `it cannot be read (${readFailureCode(err)})`,
+    );
   }
 }
 
@@ -82,21 +114,18 @@ function parseIssuerRecord<T>(
   let parsed: unknown;
   try {
     parsed = JSON.parse(raw);
-  } catch (err) {
-    throw unusableRecord(file, err);
+  } catch {
+    throw new UnusableIdentityRecordError(file, "it is not valid JSON");
+  }
+  if (!guard(parsed)) {
+    throw new UnusableIdentityRecordError(
+      file,
+      "a field is missing or is not in a form this version accepts",
+    );
   }
-  if (!guard(parsed)) throw unusableRecord(file);
   return parsed;
 }
 
-/** The error for an identity file that exists but holds no usable record. Moving it aside is the operator's decision, since the next load then mints a new key under a new id. */
-function unusableRecord(file: string, cause?: unknown): Error {
-  return new Error(
-    `${file} exists but does not hold a usable identity record; move it aside to mint a new key, which changes this identity's id for every peer that trusts it`,
-    { cause },
-  );
-}
-
 function serializeRecord(stored: Readonly<object>): string {
   return `${JSON.stringify(stored, null, 2)}\n`;
 }
@@ -132,19 +161,54 @@ export function issuerKeyRecord(
   };
 }
 
-/** Renews a stored identity nearing certificate expiry by re-certifying its existing key pair, so its device-id is unchanged (see identity.ts's certifyKeyPair for why a fresh key pair would be wrong). Every other field in the record is kept. Returns the identity unchanged when it is not yet near expiry. */
-function renewIfNeeded(
+/** The identity a stored record describes, or UnusableIdentityRecordError when its key or certificate cannot be read. */
+function identityOfRecord(
   file: string,
   stored: Readonly<StoredIssuerKey>,
 ): PeerIdentity {
+  try {
+    return issuerPeerIdentity(stored);
+  } catch {
+    throw new UnusableIdentityRecordError(
+      file,
+      "its key or certificate cannot be read",
+    );
+  }
+}
+
+/** Whether a stored record is within the renewal margin of its certificate's expiry, or has an expiry that does not parse. */
+function needsRenewal(stored: Readonly<StoredIssuerKey>): boolean {
   const expiresAt = Date.parse(stored.expiresAt);
-  const needsRenewal =
-    Number.isNaN(expiresAt) || Date.now() > expiresAt - RENEWAL_MARGIN_MS;
-  if (!needsRenewal) return issuerPeerIdentity(stored);
+  return Number.isNaN(expiresAt) || Date.now() > expiresAt - RENEWAL_MARGIN_MS;
+}
 
-  const renewed = certifyKeyPair(stored.privateKey);
-  writeIssuerRecord(file, { ...stored, ...issuerKeyRecord(renewed) });
-  return renewed;
+/** Renews a stored identity nearing certificate expiry by re-certifying its existing key pair, so its device-id is unchanged (see identity.ts's certifyKeyPair for why a fresh key pair would be wrong). Every other field in the record is kept. Returns the identity unchanged when it is not yet near expiry. The record is read again under the file's write lock before it is rewritten, so a field another process wrote since `stored` was read is kept, and a renewal another process has already done is not repeated. A file that has gone since `stored` was read fails the renewal and is not written back: the copy read before the lock was taken is never used in its place, since it may be exactly what an operator has just moved aside. */
+function renewIfNeeded(
+  file: string,
+  stored: Readonly<StoredIssuerKey>,
+  guard: (value: unknown) => value is StoredIssuerKey,
+): PeerIdentity {
+  if (!needsRenewal(stored)) return identityOfRecord(file, stored);
+  return withWriteLock(file, () => {
+    const current = readIssuerRecord(file, guard);
+    if (current === undefined) {
+      throw new Error(
+        `${file} was removed while its certificate was being renewed; nothing was written`,
+      );
+    }
+    if (!needsRenewal(current)) return identityOfRecord(file, current);
+    let renewed: PeerIdentity;
+    try {
+      renewed = certifyKeyPair(current.privateKey);
+    } catch {
+      throw new UnusableIdentityRecordError(
+        file,
+        "its key cannot be certified again",
+      );
+    }
+    writeIssuerRecord(file, { ...current, ...issuerKeyRecord(renewed) });
+    return renewed;
+  });
 }
 
 /** Generates a fresh identity and persists it at file, which does not exist yet. The create is exclusive, so when a concurrent caller creates the file first this caller keeps the winner's key and returns that instead of overwriting it, judging the winner's record with the owning module's guard. */
@@ -166,7 +230,7 @@ function createIssuerIdentity(
   if (winner === undefined) {
     throw new Error(`${file} was created and removed again while loading it`);
   }
-  return renewIfNeeded(file, winner);
+  return renewIfNeeded(file, winner, guard);
 }
 
 /**
@@ -183,5 +247,5 @@ export function loadOrCreateIssuerIdentity(
 
   const stored = readIssuerRecord(file, guard);
   if (stored === undefined) return createIssuerIdentity(file, guard);
-  return renewIfNeeded(file, stored);
+  return renewIfNeeded(file, stored, guard);
 }

package/src/core/machine-identity.ts

@@ -6,6 +6,7 @@
 
 import * as path from "node:path";
 import { resolveDataDir } from "./data-directory.js";
+import { withWriteLockAsync } from "./pid-lock-file.js";
 import type { PeerIdentity } from "./identity.js";
 import {
   isStoredIssuerKey,
@@ -59,19 +60,21 @@ export function loadMachineDisplayName(
 }
 
 /** Sets (or, given undefined, clears) the name this machine asserts for itself, keeping the key material and every other field. Throws if the machine identity has not been created yet. */
-export function saveMachineDisplayName(
+export async function saveMachineDisplayName(
   options: Readonly<MachineIdentityOptions> | undefined,
   displayName: string | undefined,
-): void {
+): Promise<void> {
   const file = machineIdentityFile(options);
-  const stored = readIssuerRecord(file, isStoredMachineIdentity);
-  if (stored === undefined) {
-    throw new Error(
-      `no machine identity persisted yet; call loadOrCreateMachineIdentity first (${file})`,
-    );
-  }
-  const next: StoredMachineIdentity = { ...stored };
-  if (displayName === undefined) delete next.displayName;
-  else next.displayName = displayName;
-  writeIssuerRecord(file, next);
+  await withWriteLockAsync(file, () => {
+    const stored = readIssuerRecord(file, isStoredMachineIdentity);
+    if (stored === undefined) {
+      throw new Error(
+        `no machine identity persisted yet; call loadOrCreateMachineIdentity first (${file})`,
+      );
+    }
+    const next: StoredMachineIdentity = { ...stored };
+    if (displayName === undefined) delete next.displayName;
+    else next.displayName = displayName;
+    writeIssuerRecord(file, next);
+  });
 }

package/src/core/mesh-store.ts

@@ -40,6 +40,7 @@ import type { DeviceId } from "wire-mesh-core/generated/protocol";
 import {
   followLedgerRevocations,
   type AccountLedgerReplica,
+  type LedgerGaps,
 } from "./account-ledger.js";
 import { StaleAgentChecker } from "./stale-agent-checker.js";
 import { PeerLifecycle } from "./peer-lifecycle.js";
@@ -711,7 +712,7 @@ export class MeshStore implements CommsStore {
   }
 
   /** Revokes bearerId's own dm:send grant for real (agent-comms#162), the DM-scope counterpart to kickFromRoom. A no-op if bearerId was never admitted. Deliberately outside the CommsStore interface, like requestDmAccess above. Concrete-only -- reached directly by tests. */
-  async revokeAgentDmAccess(bearerId: string): Promise<void> {
+  async revokeAgentDmAccess(bearerId: string): Promise<LedgerGaps> {
     return this.roomLifecycle.revokeAgentDmAccess(bearerId);
   }
 

package/src/core/peer-lifecycle.ts

@@ -5,6 +5,7 @@
  */
 
 import { normaliseWireState } from "./wire-protocol.js";
+import { parseIsoTimestampMs } from "./iso-timestamp.js";
 import type {
   MeshMessage,
   PeerInfo,
@@ -361,10 +362,14 @@ export class PeerLifecycle {
     );
     if (remainingPeers.length === 0) return;
 
-    // filter() above already returned a fresh array, so sorting it in place is safe.
-    remainingPeers.sort(
-      (a, b) => Date.parse(a.startedAt) - Date.parse(b.startedAt),
-    );
+    // filter() above already returned a fresh array, so sorting it in place is safe. A start time that does not parse sorts last: an unreadable claim never makes a peer the longest-running one.
+    const startedAtMs = (peer: Readonly<PeerInfo>): number =>
+      parseIsoTimestampMs(peer.startedAt) ?? Number.POSITIVE_INFINITY;
+    remainingPeers.sort((a, b) => {
+      const earlier = startedAtMs(a);
+      const later = startedAtMs(b);
+      return earlier === later ? 0 : earlier < later ? -1 : 1;
+    });
     const [successor, ...handoffList] = remainingPeers;
     // remainingPeers.length > 0 (checked above) guarantees at least one entry here -- this narrows the type for TypeScript rather than handling a real runtime case.
     if (successor === undefined) return;

package/src/core/pid-lock-file.ts

@@ -1,24 +1,70 @@
 /**
  * A lock file holding the PID of the process that claimed it: the exclusivity guard for a bridge's identity slot (identity-store.ts) and for appends to the machine's account ledger (ledger-lock.ts). A lock whose recorded process has died is stale and may be taken over, so a holder that crashed never wedges the lock.
  *
- * Every claim writes the PID plus a random nonce, so two claims never leave identical content even when a PID is reused. Removing a stale lock is the one step that could delete a newer, live claim by mistake (the stale file can be released and re-claimed between reading it and removing it), so it happens only under a second, takeover lock file, and only when the lock still holds exactly the content that was read and judged stale. A live holder releasing its own lock never needs the takeover lock: only its own claim can be at that name while it holds it.
+ * Every claim writes the PID, a random nonce, the host name and the process's start marker, one per line. The nonce keeps two claims from ever leaving identical content even when a PID is reused. The host and the start marker are what a later claimant checks before judging the holder dead: a lock is taken over only when its holder can be shown dead, so a holder on another host (the directory is shared) and a holder whose PID still names the process that recorded it are left alone, and a PID that now names a process that started at another time is a holder that died. A lock written without them (an older build) is judged by its PID on this host alone. Two hosts that report the same host name are not told apart. Removing a stale lock is the one step that could delete a newer, live claim by mistake (the stale file can be released and re-claimed between reading it and removing it), so it happens only under a second, takeover lock file, and only when the lock still holds exactly the content that was read and judged stale. A live holder releasing its own lock never needs the takeover lock: only its own claim can be at that name while it holds it.
  */
 
 import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
+import * as os from "node:os";
+import { processStartMarker } from "./process-start.js";
+import { CommsError } from "./store.js";
 
 /** Random bytes in each claim's content, enough that two claims never collide. */
 const CLAIM_NONCE_BYTES = 16;
 
+/** Whether a process with this pid exists on this host. A process this one is not allowed to signal exists, so it counts as alive. */
 export function isPidAlive(pid: number): boolean {
   try {
     process.kill(pid, 0);
     return true;
-  } catch {
-    return false;
+  } catch (err) {
+    return isErrorCode(err, "EPERM");
   }
 }
 
+/** The host name every claim records, read once. */
+const OWN_HOST = os.hostname();
+let ownStartMarker: { value: string | undefined } | undefined;
+
+function ownMarker(): string | undefined {
+  ownStartMarker ??= { value: processStartMarker(process.pid) };
+  return ownStartMarker.value;
+}
+
+interface LockHolder {
+  pid: number | undefined;
+  host: string | undefined;
+  start: string | undefined;
+}
+
+function holderOf(content: string): LockHolder {
+  const [, , host, start] = content.split("\n");
+  return {
+    pid: pidOf(content),
+    host: host === undefined || host === "" ? undefined : host,
+    start: start === undefined || start === "" ? undefined : start,
+  };
+}
+
+/** Whether the holder a lock records cannot be shown dead: it runs on another host, or it runs here and its pid names a live process that started when the claim recorded (or the claim recorded no start). A lock with no readable pid has no holder. */
+function holderMayBeAlive(holder: Readonly<LockHolder>): boolean {
+  if (holder.pid === undefined) return false;
+  if (holder.host !== undefined && holder.host !== OWN_HOST) return true;
+  if (!isPidAlive(holder.pid)) return false;
+  if (holder.start === undefined) return true;
+  const current = processStartMarker(holder.pid);
+  return current === undefined || current === holder.start;
+}
+
+/** The pid recorded by the lock at lockFile when its holder cannot be shown dead (see holderMayBeAlive), including this process; undefined when there is no lock or its holder is shown dead. */
+export function liveLockHolder(lockFile: string): number | undefined {
+  const content = readLockContent(lockFile);
+  if (content === undefined) return undefined;
+  const holder = holderOf(content);
+  return holderMayBeAlive(holder) ? holder.pid : undefined;
+}
+
 function readLockContent(lockFile: string): string | undefined {
   try {
     return fs.readFileSync(lockFile, "utf-8");
@@ -33,8 +79,7 @@ function pidOf(content: string): number | undefined {
   return Number.isInteger(pid) ? pid : undefined;
 }
 
-/** Read the PID holding the lock, or undefined when absent or unreadable. */
-export function readLockPid(lockFile: string): number | undefined {
+function readLockPid(lockFile: string): number | undefined {
   const content = readLockContent(lockFile);
   return content === undefined ? undefined : pidOf(content);
 }
@@ -51,7 +96,7 @@ function claimExclusive(file: string): boolean {
   const tmpFile = `${file}.${String(process.pid)}.tmp`;
   fs.writeFileSync(
     tmpFile,
-    `${String(process.pid)}\n${randomBytes(CLAIM_NONCE_BYTES).toString("hex")}\n`,
+    `${[String(process.pid), randomBytes(CLAIM_NONCE_BYTES).toString("hex"), OWN_HOST, ownMarker() ?? ""].join("\n")}\n`,
     "utf-8",
   );
   try {
@@ -65,10 +110,13 @@ function claimExclusive(file: string): boolean {
   }
 }
 
-/** Whether content names a process that can no longer be holding the lock: one that has died, this process itself (which claims a lock only after releasing it, so a lock naming it is left over from before), or no readable PID at all. */
+/** Whether content names a holder that can be shown to no longer be holding the lock: one that has died (see holderMayBeAlive), this process itself on this host (which claims a lock only after releasing it, so a lock naming it is left over from before), or no readable PID at all. */
 function isStale(content: string): boolean {
-  const pid = pidOf(content);
-  return pid === undefined || pid === process.pid || !isPidAlive(pid);
+  const holder = holderOf(content);
+  const isThisProcess =
+    holder.pid === process.pid &&
+    (holder.host === undefined || holder.host === OWN_HOST);
+  return isThisProcess || !holderMayBeAlive(holder);
 }
 
 /** Removes `file` if it still holds exactly `content`, the content a caller read and judged stale. Any newer claim has different content (each carries its own nonce), so it is left alone. */
@@ -114,9 +162,89 @@ export function tryAcquireLock(
   return { acquired: false, heldBy: readLockPid(lockFile) };
 }
 
-/** Removes lockFile if this process holds it; a lock another PID has since taken over is left alone. The release half of tryAcquireLock. */
+/** Total time a writer waits for another process's write to the same file to finish. A write is one small file read and one atomic rename, so this is far above its real cost, and bounded so a holder that never releases cannot wedge every other writer. */
+export const WRITE_LOCK_WAIT_MS = 5000;
+/** Poll interval while waiting for a write lock. */
+const WRITE_LOCK_POLL_MS = 10;
+/** One Int32 element's worth of bytes: all Atomics.wait needs to block on. */
+const INT32_BYTE_LENGTH = 4;
+/** The `code` of the error thrown when a write lock stays held beyond the wait budget. */
+export const WRITE_LOCK_TIMEOUT = "WRITE_LOCK_TIMEOUT";
+
+/** Thrown when the write lock of a file stays held by a live process beyond WRITE_LOCK_WAIT_MS. Nothing was written. */
+export class WriteLockTimeoutError extends CommsError {
+  constructor(public readonly file: string) {
+    super(
+      `Timed out waiting for another process to finish writing ${file}; nothing was written. If no other agent-comms process is running, remove ${writeLockFor(file)}.`,
+      WRITE_LOCK_TIMEOUT,
+    );
+    this.name = "WriteLockTimeoutError";
+  }
+}
+
+/** Blocks this thread for `ms` milliseconds. Only for callers that are themselves synchronous. */
+export function sleepSync(ms: number): void {
+  Atomics.wait(
+    new Int32Array(new SharedArrayBuffer(INT32_BYTE_LENGTH)),
+    0,
+    0,
+    ms,
+  );
+}
+
+/**
+ * The lock file serialising writes to `file`. Its name ends in `.write-lock`, which no lock file this package names for a bridge slot (`.lock`) or any other file ends in, so it cannot equal another file's name whatever the slot's working directory is called.
+ */
+export function writeLockFor(file: string): string {
+  return `${file}.write-lock`;
+}
+
+/**
+ * Runs `action` holding the write lock of `file`, so the read-modify-write it performs cannot interleave with another process's. The lock is not reentrant: `action` must not take the same lock again (this process would count as having left it stale). A lock whose holder process has died is taken over (see tryAcquireLock). Throws WriteLockTimeoutError when the lock stays held by a live process beyond WRITE_LOCK_WAIT_MS. Blocks this thread while it waits, so a caller that is asynchronous uses withWriteLockAsync.
+ */
+export function withWriteLock<T>(file: string, action: () => T): T {
+  const lockFile = writeLockFor(file);
+  const deadline = Date.now() + WRITE_LOCK_WAIT_MS;
+  while (!tryAcquireLock(lockFile).acquired) {
+    if (Date.now() >= deadline) throw new WriteLockTimeoutError(file);
+    sleepSync(WRITE_LOCK_POLL_MS);
+  }
+  try {
+    return action();
+  } finally {
+    releaseLockFile(lockFile);
+  }
+}
+
+/** withWriteLock for an asynchronous caller: waits on timers, so the event loop keeps running while another process holds the lock. `action` is synchronous, so the lock is never held across an await. */
+export async function withWriteLockAsync<T>(
+  file: string,
+  action: () => T,
+): Promise<T> {
+  const lockFile = writeLockFor(file);
+  const deadline = Date.now() + WRITE_LOCK_WAIT_MS;
+  while (!tryAcquireLock(lockFile).acquired) {
+    if (Date.now() >= deadline) throw new WriteLockTimeoutError(file);
+    await new Promise<void>((resolve) => {
+      setTimeout(resolve, WRITE_LOCK_POLL_MS);
+    });
+  }
+  try {
+    return action();
+  } finally {
+    releaseLockFile(lockFile);
+  }
+}
+
+/** Removes lockFile if this process holds it; a lock another process has since taken over, on this host or another, is left alone. The release half of tryAcquireLock. */
 export function releaseLockFile(lockFile: string): void {
-  if (readLockPid(lockFile) === process.pid) {
+  const content = readLockContent(lockFile);
+  if (content === undefined) return;
+  const holder = holderOf(content);
+  if (
+    holder.pid === process.pid &&
+    (holder.host === undefined || holder.host === OWN_HOST)
+  ) {
     fs.rmSync(lockFile, { force: true });
   }
 }

package/src/core/process-start.ts

@@ -0,0 +1,45 @@
+/**
+ * A marker for when a process started, so a lock that records it tells its holder from an unrelated process that was later given the same pid.
+ */
+
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+
+/** Zero-based index of the start time among the fields of /proc/<pid>/stat that follow the parenthesised command name (field 22 of the file, field 3 being the first after the name). */
+const PROC_STAT_START_TIME_INDEX = 19;
+/** How long the process table listing may take; it reads one entry and returns at once on a healthy host. */
+const PS_TIMEOUT_MS = 2000;
+
+/**
+ * An opaque string that is the same for as long as the process lives and differs from the marker of any process that started at another time, or undefined when the process does not exist or this host offers no way to read it. Two markers are only compared with each other for equality.
+ *
+ * Linux reads the kernel's own start time (clock ticks since boot, so it holds across a clock change); elsewhere the process table's start time is read through `ps`, which has whole-second resolution, so a pid reused within the same second as its predecessor is not told apart.
+ */
+export function processStartMarker(pid: number): string | undefined {
+  return process.platform === "linux" ? procStartTime(pid) : psStartTime(pid);
+}
+
+function procStartTime(pid: number): string | undefined {
+  try {
+    const stat = fs.readFileSync(`/proc/${String(pid)}/stat`, "utf-8");
+    // The command name is parenthesised and may itself hold spaces and parentheses, so the fields are counted from the last closing one.
+    const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+    return fields[PROC_STAT_START_TIME_INDEX];
+  } catch {
+    return undefined;
+  }
+}
+
+function psStartTime(pid: number): string | undefined {
+  try {
+    const out = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+      encoding: "utf-8",
+      env: { ...process.env, LC_ALL: "C" },
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: PS_TIMEOUT_MS,
+    }).trim();
+    return out === "" ? undefined : out.replace(/\s+/g, " ");
+  } catch {
+    return undefined;
+  }
+}

package/src/core/room-lifecycle.ts

@@ -2,6 +2,7 @@
  * RoomLifecycle — room CRUD and the requester's own outbound half of the wire protocol: create/get/list, join/leave (local CRDT mutation for an already-known room, or a real wire-level room.join/room.leave round trip via joinRemoteRoom/leaveRemoteRoom when this store's own identity isn't yet admitted), invite/decline, membership-grant revocation, kick, and destroy. Split out of mesh-store.ts to reduce it under the repo's max-lines cap.
  */
 
+import type { LedgerGaps } from "./account-ledger.js";
 import {
   deviceIdFromHex,
   deviceIdToHex,
@@ -115,7 +116,7 @@ export class RoomLifecycle {
         `MeshStore: failed to mint room owner grant for ${roomPath}: ${verdict.reason}`,
       );
     }
-    saveRoomToken(slot, roomPath, verdict.token);
+    await saveRoomToken(slot, roomPath, verdict.token);
   }
 
   async createRoom(
@@ -254,7 +255,7 @@ export class RoomLifecycle {
       parsedOutcome.data;
 
     const { slot } = this.deps.requireIdentity();
-    saveRoomToken(slot, roomPath, grantedToken);
+    await saveRoomToken(slot, roomPath, grantedToken);
 
     const members = memberList.map((member) => deviceIdToHex(member.device));
     const roomState = parseRoomStateExtension(parsedOutcome.data["room-state"]);
@@ -375,7 +376,7 @@ export class RoomLifecycle {
       );
     }
     const { slot } = this.deps.requireIdentity();
-    saveRoomToken(slot, dmPath, parsedOutcome.data["granted-token"]);
+    await saveRoomToken(slot, dmPath, parsedOutcome.data["granted-token"]);
   }
 
   /**
@@ -542,7 +543,7 @@ export class RoomLifecycle {
         "LEAVE_FAILED",
       );
     }
-    deleteRoomToken(slot, roomPath);
+    await deleteRoomToken(slot, roomPath);
     this.deps.rooms.delete(roomPath);
     this.deps.messages.delete(roomPath);
   }
@@ -597,7 +598,7 @@ export class RoomLifecycle {
         "MINT_FAILED",
       );
     }
-    saveIssuedRoomGrant(slot, roomId, targetId, tokenId);
+    await saveIssuedRoomGrant(slot, roomId, targetId, tokenId);
 
     const inviter = this.deps.agents.get(inviterId);
     const params: Record<string, unknown> = {
@@ -658,7 +659,7 @@ export class RoomLifecycle {
     });
     await revocation.record(entry, { identity });
     await this.deps.requireTransport().broadcastRevocation([entry]);
-    deleteIssuedRoomGrant(slot, roomId, memberId);
+    await deleteIssuedRoomGrant(slot, roomId, memberId);
   }
 
   /**
@@ -818,12 +819,13 @@ export class RoomLifecycle {
   }
 
   /**
-   * Revokes every dm:send grant for bearerId that the account's replicated ledger holds as outstanding, whichever machine of the account minted it: mints a revocation-entry for each token-id, records it in this store's own RevocationView immediately, announces it to every connected peer, and appends it to the ledger so every machine of the account sees it revoked and a later re-admission starts from nothing outstanding. The same revocation shape revokeMemberGrant gives room:member grants, applied to the user principal's own dm:send grants. Does nothing when the ledger holds no outstanding grant for bearerId.
+   * Revokes every dm:send grant for bearerId that the account's replicated ledger holds as outstanding, whichever machine of the account minted it: mints a revocation-entry for each token-id, records it in this store's own RevocationView immediately, announces it to every connected peer, and appends it to the ledger so every machine of the account sees it revoked and a later re-admission starts from nothing outstanding. The same revocation shape revokeMemberGrant gives room:member grants, applied to the user principal's own dm:send grants. Does nothing when the ledger holds no outstanding grant for bearerId. A ledger entry that cannot be read does not stop the revocation (account-ledger.ts): every grant the readable entries record is still revoked, and one recorded only in an unreadable entry is not, which the result says (`unreadable` above zero means the revocation is incomplete).
    */
-  async revokeAgentDmAccess(bearerId: string): Promise<void> {
+  async revokeAgentDmAccess(bearerId: string): Promise<LedgerGaps> {
     const { userIdentity, accountLedger, clock, revocation } =
       this.deps.requireIdentity();
-    const outstanding = await accountLedger.outstandingGrants("dm", bearerId);
+    const { grants: outstanding, unreadable } =
+      await accountLedger.outstandingGrantsChecked("dm", bearerId);
     for (const { tokenId } of outstanding) {
       const entry = await mintRevocationEntry({
         identity: userIdentity,
@@ -834,5 +836,6 @@ export class RoomLifecycle {
       await this.deps.requireTransport().broadcastRevocation([entry]);
       await accountLedger.recordRevocation("dm", bearerId, tokenId, entry);
     }
+    return { unreadable };
   }
 }

package/src/core/room-protocol.ts

@@ -18,6 +18,7 @@ import type {
   CapabilityToken,
   MessageRef,
 } from "wire-mesh-core/generated/protocol";
+import { WriteLockTimeoutError } from "./pid-lock-file.js";
 import { parseRoomPath } from "./room-path.js";
 import {
   ROOM_MEMBER_CAPABILITY,
@@ -203,7 +204,12 @@ export class RoomProtocol {
     const replyTo = RoomProtocol.replyToFromRefs(params.refs);
     const streamingBehavior = RoomProtocol.streamingBehaviorFromParams(params);
     const id = bytesToHex(params["message-id"]);
-    const timestamp = new Date(params["sent-at"]).toISOString();
+    const sentAt = new Date(params["sent-at"]);
+    // A number outside the range of dates is an invalid date, and formatting one throws.
+    if (Number.isNaN(sentAt.getTime())) {
+      return { result: "error", code: "malformed_params" };
+    }
+    const timestamp = sentAt.toISOString();
     const peerId = this.deps.getPeerId();
 
     const parsedPath = parseRoomPath(roomPath);
@@ -691,7 +697,14 @@ export class RoomProtocol {
     if (!verdict.ok) {
       return { result: "error", code: "mint_failed" };
     }
-    saveIssuedRoomGrant(slot, roomPath, handle.id, tokenId);
+    try {
+      await saveIssuedRoomGrant(slot, roomPath, handle.id, tokenId);
+    } catch (err) {
+      if (err instanceof WriteLockTimeoutError) {
+        return { result: "error", code: "storage_busy" };
+      }
+      throw err;
+    }
 
     const room = this.deps.rooms.get(roomPath);
     if (room !== undefined) {
@@ -745,7 +758,14 @@ export class RoomProtocol {
     if (!verdict.ok) {
       return { result: "error", code: "unauthorized" };
     }
-    saveRoomToken(slot, roomPath, token);
+    try {
+      await saveRoomToken(slot, roomPath, token);
+    } catch (err) {
+      if (err instanceof WriteLockTimeoutError) {
+        return { result: "error", code: "storage_busy" };
+      }
+      throw err;
+    }
 
     const parsed = parseRoomPath(roomPath);
     const inviterId = parsed.kind === "owner-named" ? parsed.owner : peerId;

package/src/core/stale-agent-checker.ts

@@ -3,6 +3,7 @@
  */
 
 import type { AgentIdentity, AgentStatus, DeliveryEvent } from "./types.js";
+import { parseIsoTimestampMs } from "./iso-timestamp.js";
 import type { MeshStatePatch, PeerInfo } from "./wire-protocol.js";
 
 /** The state and collaborators StaleAgentChecker needs from MeshStore -- the core agent/delivery/peer/identity Maps it reads and mutates directly (shared references into MeshStore's own fields), plus the two DeliveryEngine operations a status change and an offline patch need to broadcast. */
@@ -84,7 +85,8 @@ export class StaleAgentChecker {
     const purgeIds: string[] = [];
     for (const [id, agent] of agents) {
       if (agent.status !== "offline") continue;
-      const startedAt = new Date(agent.startedAt).getTime();
+      // A start time that does not parse cannot show the agent is recent, so it is purged like an old one.
+      const startedAt = parseIsoTimestampMs(agent.startedAt) ?? 0;
       if (startedAt < offlineThreshold) {
         purgeIds.push(id);
       }