whalibmob 5.5.81 → 5.5.83

package/lib/Client.js

@@ -359,7 +359,23 @@ class WhalibmobClient extends EventEmitter {
       }
     }
     if (attrs.platform) this._platform = attrs.platform;
-    if (attrs.lid)      this._myLid    = String(attrs.lid);
+    if (attrs.lid) {
+      this._myLid = String(attrs.lid);
+      // Record our own PN ↔ LID pair alongside every contact's. Prekey bundles
+      // are only ever answered for phone JIDs, so opening a session with one of
+      // our own LID-addressed linked devices needs this mapping just as much as
+      // a contact's does — without it the bundle IQ goes out addressed to @lid
+      // and is never answered.
+      const ownLidUser = this._myLid.split('@')[0].split(':')[0];
+      const ownPnUser  = String(this._store && this._store.phoneNumber || '');
+      if (ownLidUser && ownPnUser) {
+        this._lidToPn.set(ownLidUser, ownPnUser);
+        this._pnToLid.set(ownPnUser, ownLidUser);
+        if (this._signal && this._signal.store && this._signal.store.setLidMapping) {
+          this._signal.store.setLidMapping(ownPnUser, ownLidUser);
+        }
+      }
+    }
 
     const devIdNode = findChild(node, 'device-identity');
     if (devIdNode) {

package/lib/DeviceManager.js

@@ -674,7 +674,7 @@ class DeviceManager {
   //   3. fetchBundles(fetchList) — only for truly new sessions
   //   4. buildSessionFromBundle for each new session
   //
-  async bulkEnsureSessions(phones, signalProto, allowPkmsg = true) {
+  async bulkEnsureSessions(phones, signalProto, allowPkmsg = true, _isRetry = false) {
     const uniquePhones = [...new Set(phones)];
     if (uniquePhones.length === 0) return [];
 
@@ -692,15 +692,34 @@ class DeviceManager {
     }
 
     if (allowPkmsg && fetchJids.length > 0) {
+      // Keep the requested string for each device: the server echoes JIDs back in
+      // its own normalised form and the participants node has to name the device
+      // the same way we enumerated it.
+      const wanted  = new Map(fetchJids.map(j => [this._jidToAddr(j), j]));
       const bundles = await this.fetchBundles(fetchJids);
       for (const [jid, bundle] of bundles) {
+        const target = wanted.get(this._jidToAddr(jid)) || jid;
         try {
-          await signalProto.buildSessionFromBundle(jid, bundle);
-          readyJids.push(jid);
+          await signalProto.buildSessionFromBundle(target, bundle);
+          readyJids.push(target);
         } catch (_) {}
       }
     }
 
+    // The same guarantee the LID path makes: every enumerated device has to end
+    // up with a session, because every one of them becomes a <to><enc> entry and
+    // a participant list that does not cover the account's current devices comes
+    // back as ack 479. Coming up short means the cached list is out of date — a
+    // device has been unlinked since, so the server has no bundle for it. Drop
+    // the list and enumerate once more against what the account has now.
+    if (allowPkmsg && readyJids.length < deviceJids.length && !_isRetry) {
+      _whaDbg('[DBG] PN_DEVICE_LIST_STALE phones=[' + uniquePhones.join(',') + ']' +
+        ' enumerated=' + deviceJids.length + ' sessions=' + readyJids.length +
+        ' — re-running usync\n');
+      this.clearCache(uniquePhones);
+      return this.bulkEnsureSessions(uniquePhones, signalProto, allowPkmsg, /* _isRetry */ true);
+    }
+
     // Fallback: if still nothing, use main device JIDs directly
     if (readyJids.length === 0) {
       for (const phone of uniquePhones) readyJids.push(makeDeviceJid(phone, 0));
@@ -743,74 +762,7 @@ class DeviceManager {
     _whaDbg('[DBG] LID_DEVICES lidUser=' + lidUser +
       ' deviceJids=[' + deviceJids.join(',') + ']\n');
 
-    // Split: existing sessions (ready) vs new (need bundle fetch)
-    const readyJids = [];
-    const fetchJids = [];
-    for (const jid of deviceJids) {
-      if (signalProto.store.hasSession(this._jidToAddr(jid))) {
-        readyJids.push(jid);
-      } else {
-        fetchJids.push(jid);
-      }
-    }
-
-    if (allowPkmsg && fetchJids.length > 0) {
-      // Ask for the bundles by phone JID. The encrypt IQ is not answered at all
-      // when its <user> entries are @lid — it just times out — while the same
-      // request in phone form comes back in full. Translate through the known
-      // LID→PN mapping, keeping a link back so each bundle is installed under
-      // the LID address the participants node will use.
-      const pnForLid = this._client._lidToPn && this._client._lidToPn.get(lidUser);
-      const wireToLid = new Map();
-      let wireJids = fetchJids;
-      if (pnForLid) {
-        wireJids = fetchJids.map(j => {
-          const at    = j.indexOf('@');
-          const base  = at >= 0 ? j.slice(0, at) : j;
-          const colon = base.indexOf(':');
-          const dev   = colon >= 0 ? (parseInt(base.slice(colon + 1), 10) || 0) : 0;
-          const wire  = makeDeviceJid(pnForLid, dev, 's.whatsapp.net');
-          wireToLid.set(wire, j);
-          return wire;
-        });
-        _whaDbg('[DBG] LID_BUNDLE_VIA_PN lid=' + lidUser + ' pn=' + pnForLid +
-          ' jids=[' + wireJids.join(',') + ']\n');
-      } else {
-        _whaDbg('[DBG] LID_BUNDLE_NO_PN lid=' + lidUser + ' — requesting by LID\n');
-      }
-
-      const bundles = await this.fetchBundles(wireJids);
-      for (const [wireJid, bundle] of bundles) {
-        // Install under the @lid address: that is what the outgoing
-        // participants node — and therefore the encrypt step — looks the
-        // session up by. Stored under the phone user it is a different Signal
-        // address and would never be found.
-        const jid = wireToLid.get(wireJid) || wireJid;
-        try {
-          await signalProto.buildSessionFromBundle(jid, bundle);
-          // ── CRITICAL: remap bundle JID back to @lid format ────────────────────
-          // fetchBundles always returns JIDs in @s.whatsapp.net format (because the
-          // WA server uses its own AD_JID / JID_PAIR encoding in responses).
-          // But the outer <message to="lidUser@lid"> requires ALL participant <to>
-          // nodes to also use @lid format — mixing @s.whatsapp.net participants with
-          // a @lid routing address causes the server to close the connection.
-          //
-          // A Signal address is (user, device) with the @server stripped — but
-          // the user of a LID and the user of a phone JID are different strings,
-          // so a session is NOT reachable under both. That assumption is what
-          // left sends failing: bundles fetched in phone form were stored under
-          // the phone user while the participants node looked them up by LID.
-          // The session is installed under the @lid address above; this only
-          // normalises the JID pushed into readyJids.
-          const jidBase = jid.replace(/@(?:s\.whatsapp\.net|lid)$/, '');
-          const lidJidForDevice = jidBase + '@lid';
-          readyJids.push(lidJidForDevice);
-          _whaDbg('[DBG] LID_SESSION_BUILT jid=' + jid + ' → participant=' + lidJidForDevice);
-        } catch (e) {
-          _whaDbg('[DBG] LID_SESSION_ERR jid=' + jid + ' err=' + e.message);
-        }
-      }
-    }
+    const readyJids = await this._ensureLidSessions(lidUser, deviceJids, signalProto, allowPkmsg);
 
     // Every enumerated device must end up with a session, because every one of
     // them becomes a <to><enc> entry. Coming up short means the cached device
@@ -841,6 +793,177 @@ class DeviceManager {
     return readyJids;
   }
 
+  // ─── Open Signal sessions for a set of @lid device JIDs ────────────────────
+  //
+  // Shared by the recipient path (bulkEnsureSessionsForLid), the own-device path
+  // (ensureOwnLidDeviceSessions) and the repair path (rebuildSessionsForJids).
+  // Returns the device JIDs — always in @lid form — that ended up with a usable
+  // session.
+  //
+  // pnOverride lets a caller supply the phone number to fetch bundles with when
+  // the LID→PN map does not have it yet (our own LID, most notably).
+  async _ensureLidSessions(lidUser, deviceJids, signalProto, allowPkmsg, pnOverride) {
+    const readyJids = [];
+    const fetchJids = [];
+    for (const jid of deviceJids) {
+      if (signalProto.store.hasSession(this._jidToAddr(jid))) {
+        readyJids.push(jid);
+      } else {
+        fetchJids.push(jid);
+      }
+    }
+
+    if (!allowPkmsg || fetchJids.length === 0) return readyJids;
+
+    // Ask for the bundles by phone JID. The encrypt IQ is not answered at all
+    // when its <user> entries are @lid — it just times out — while the same
+    // request in phone form comes back in full. Translate through the known
+    // LID→PN mapping, keeping a link back so each bundle is installed under
+    // the LID address the participants node will use.
+    const pnForLid  = pnOverride || (this._client._lidToPn && this._client._lidToPn.get(lidUser));
+    const wireToLid = new Map();
+    let wireJids = fetchJids;
+    if (pnForLid) {
+      wireJids = fetchJids.map(j => {
+        const at    = j.indexOf('@');
+        const base  = at >= 0 ? j.slice(0, at) : j;
+        const colon = base.indexOf(':');
+        const dev   = colon >= 0 ? (parseInt(base.slice(colon + 1), 10) || 0) : 0;
+        const wire  = makeDeviceJid(pnForLid, dev, 's.whatsapp.net');
+        wireToLid.set(wire, j);
+        return wire;
+      });
+      _whaDbg('[DBG] LID_BUNDLE_VIA_PN lid=' + lidUser + ' pn=' + pnForLid +
+        ' jids=[' + wireJids.join(',') + ']\n');
+    } else {
+      _whaDbg('[DBG] LID_BUNDLE_NO_PN lid=' + lidUser + ' — requesting by LID\n');
+    }
+
+    const bundles = await this.fetchBundles(wireJids);
+    for (const [wireJid, bundle] of bundles) {
+      // Install under the @lid address: that is what the outgoing
+      // participants node — and therefore the encrypt step — looks the
+      // session up by. Stored under the phone user it is a different Signal
+      // address and would never be found.
+      const jid = wireToLid.get(wireJid) || wireJid;
+      try {
+        await signalProto.buildSessionFromBundle(jid, bundle);
+        // ── CRITICAL: remap bundle JID back to @lid format ────────────────────
+        // fetchBundles always returns JIDs in @s.whatsapp.net format (because the
+        // WA server uses its own AD_JID / JID_PAIR encoding in responses).
+        // But the outer <message to="lidUser@lid"> requires ALL participant <to>
+        // nodes to also use @lid format — mixing @s.whatsapp.net participants with
+        // a @lid routing address causes the server to close the connection.
+        //
+        // A Signal address is (user, device) with the @server stripped — but
+        // the user of a LID and the user of a phone JID are different strings,
+        // so a session is NOT reachable under both. That assumption is what
+        // left sends failing: bundles fetched in phone form were stored under
+        // the phone user while the participants node looked them up by LID.
+        // The session is installed under the @lid address above; this only
+        // normalises the JID pushed into readyJids.
+        const jidBase = jid.replace(/@(?:s\.whatsapp\.net|lid)$/, '');
+        const lidJidForDevice = jidBase + '@lid';
+        readyJids.push(lidJidForDevice);
+        _whaDbg('[DBG] LID_SESSION_BUILT jid=' + jid + ' → participant=' + lidJidForDevice);
+      } catch (e) {
+        _whaDbg('[DBG] LID_SESSION_ERR jid=' + jid + ' err=' + e.message);
+      }
+    }
+
+    return readyJids;
+  }
+
+  // ─── Own linked devices, addressed in LID space ────────────────────────────
+  //
+  // ensureOwnDeviceSessions returns @s.whatsapp.net JIDs. Dropping those into a
+  // stanza that is routed to an @lid — a LID-addressed group, or a DM to an @lid
+  // — mixes two address families in one participant list, which the server
+  // rejects with ack 479. This is the LID-space equivalent: same device list,
+  // expressed as <ourLid>:<device>@lid.
+  //
+  // Device 0 is excluded exactly as it is on the phone path: it is the device
+  // doing the sending, and both Baileys and whatsmeow skip the exact sender
+  // device when building participants.
+  async ensureOwnLidDeviceSessions(lidUser, ownPhone, signalProto, allowPkmsg = true) {
+    if (!lidUser) return [];
+    const cacheKey = 'lid:' + lidUser;
+
+    if (!this._dcHas(cacheKey)) {
+      // Our LID and our phone number address the same account, so the device
+      // list is the same one. Reuse it when it is already known rather than
+      // spending a second usync IQ on ourselves.
+      const ownIds = ownPhone ? this._dcGet(ownPhone) : null;
+      if (ownIds && ownIds.length) {
+        this._dcSet(cacheKey, ownIds.slice());
+      } else {
+        await this._doUsyncIqByJid(`${lidUser}@lid`, cacheKey, lidUser);
+      }
+    }
+
+    const deviceIds  = (this._dcGet(cacheKey) || []).filter(d => d !== 0);
+    const deviceJids = deviceIds.map(d => makeDeviceJid(lidUser, d, 'lid'));
+    if (deviceJids.length === 0) return [];
+
+    _whaDbg('[DBG] OWN_LID_DEVICES lid=' + lidUser + ' jids=[' + deviceJids.join(',') + ']');
+    return this._ensureLidSessions(lidUser, deviceJids, signalProto, allowPkmsg, ownPhone);
+  }
+
+  // ─── Rebuild sessions for devices that failed to encrypt ───────────────────
+  //
+  // Drops whatever Signal state is there and opens a brand-new session from a
+  // fresh prekey bundle, in whichever address family the JID came in. Used to
+  // close a gap in the participant list before the stanza is dispatched — a
+  // missing <to> entry is what the server answers with ack 479.
+  //
+  // Returns the JIDs that now have a session, in the same string form they were
+  // requested with, so the caller can use them as participant targets directly.
+  async rebuildSessionsForJids(jids, signalProto) {
+    const unique = [...new Set((jids || []).map(String))].filter(Boolean);
+    if (unique.length === 0) return [];
+
+    for (const jid of unique) {
+      try { await signalProto.deleteSession(jid); } catch (_) {}
+    }
+
+    const ready   = [];
+    const lidJids = unique.filter(j => j.endsWith('@lid'));
+    const pnJids  = unique.filter(j => !j.endsWith('@lid'));
+
+    if (pnJids.length > 0) {
+      // The server echoes JIDs in its own normalised form, so map each bundle
+      // back onto the exact string the caller asked for via (user, device).
+      const wanted = new Map(pnJids.map(j => [this._jidToAddr(j), j]));
+      const bundles = await this.fetchBundles(pnJids).catch(() => new Map());
+      for (const [jid, bundle] of bundles) {
+        const target = wanted.get(this._jidToAddr(jid)) || jid;
+        try {
+          await signalProto.buildSessionFromBundle(target, bundle);
+          ready.push(target);
+        } catch (e) {
+          _whaDbg('[DBG] REBUILD_SESSION_ERR jid=' + target + ' err=' + e.message);
+        }
+      }
+    }
+
+    // LID devices are grouped per LID user so each group can be translated
+    // through that user's phone number when the bundles are requested.
+    const byLidUser = new Map();
+    for (const j of lidJids) {
+      const u = phoneFromJid(j);
+      if (!byLidUser.has(u)) byLidUser.set(u, []);
+      byLidUser.get(u).push(j);
+    }
+    for (const [lidUser, group] of byLidUser) {
+      const got = await this._ensureLidSessions(lidUser, group, signalProto, true)
+        .catch(() => []);
+      ready.push(...got);
+    }
+
+    _whaDbg('[DBG] REBUILD_SESSIONS requested=' + unique.length + ' ready=' + ready.length);
+    return ready;
+  }
+
   // ─── Contact usync fallback ────────────────────────────────────────────────
   // When query/devices usync times out (server silently ignores it for LID
   // accounts), we fall back to query/contact which uses the older

package/lib/messages/MessageSender.js

@@ -165,10 +165,37 @@ function getContent(node) {
   return null;
 }
 
+// The "AD string" form of a JID — user.<agent>:<device>@server — which is what
+// the participant hash is computed over. The agent byte is 0 for both
+// s.whatsapp.net and lid users, so "40712345678.0:2@s.whatsapp.net" and
+// "112713111982325.0:0@lid".
+function adString(jid) {
+  const str    = String(jid);
+  const at     = str.indexOf('@');
+  const raw    = at >= 0 ? str.slice(0, at) : str;
+  const server = at >= 0 ? str.slice(at + 1) : 's.whatsapp.net';
+  const colon  = raw.indexOf(':');
+  const user   = colon >= 0 ? raw.slice(0, colon) : raw;
+  const device = colon >= 0 ? (parseInt(raw.slice(colon + 1), 10) || 0) : 0;
+  return `${user}.0:${device}@${server}`;
+}
+
+// Participant-list hash v2, as whatsmeow's participantListHashV2 computes it:
+// sort the AD strings, sha256 the concatenation, then base64 the FIRST SIX
+// BYTES of the digest — eight characters, prefixed "2:".
+//
+// This previously mirrored Baileys' generateParticipantHashV2, which hashes
+// plain JID strings and then takes the first six CHARACTERS of the base64 of
+// the whole digest. That produces a different, six-character value from
+// different input. Baileys never puts the result on the wire — it assigns it to
+// extraAttrs after the participant nodes are built, so nothing ever reads it —
+// which is why the discrepancy has gone unnoticed there. whalibmob did put it
+// on the wire, so every multi-device send carried a hash the server could not
+// match against its own view of the participant list.
 function computePhash(jids) {
-  const sorted = [...jids].sort();
-  const hash = crypto.createHash('sha256').update(sorted.join('')).digest();
-  return '2:' + hash.toString('base64').slice(0, 6);
+  const sorted = [...new Set(jids.map(adString))].sort();
+  const hash   = crypto.createHash('sha256').update(sorted.join('')).digest();
+  return '2:' + hash.subarray(0, 6).toString('base64').replace(/=+$/, '');
 }
 
 // ─── MessageSender ────────────────────────────────────────────────────────────
@@ -542,9 +569,20 @@ class MessageSender {
           const members = this._client._getGroupMembers
             ? this._client._getGroupMembers(toJid) : [];
           for (const memberJid of members) {
-            await this._clearSignalSessionsForRecipient(phoneFromJid(memberJid)).catch(() => {});
+            await this._clearSignalSessionsForJid(memberJid).catch(() => {});
           }
-          return this._sendGroupMessage(toJid, msgId, plaintext, mediaType,
+          // The sessions the SenderKey distribution rode in on are gone, so the
+          // record of who already holds our key is meaningless — every member
+          // needs a fresh distribution on the retry. Without this the retry sent
+          // a bare skmsg to devices that had just lost their session and drew the
+          // same 479 straight back.
+          if (this._signal && this._signal.senderKeyStore) {
+            this._signal.senderKeyStore.invalidateSKDM(toJid);
+          }
+          // A new id for the same reason the DM path uses one: the server has
+          // already acked the original, and re-using it makes it drop the
+          // connection.
+          return this._sendGroupMessage(toJid, generateMessageId(), plaintext, mediaType,
             Object.assign({}, options, { _479retry: true }));
         }
         // No session could be built for a single member — usually a prekey IQ
@@ -568,9 +606,12 @@ class MessageSender {
     try {
       return await this._sendDMMessage(toJid, msgId, plaintext, mediaType, options);
     } catch (err) {
-      // Same phash-mismatch retry for 1-to-1 messages.
+      // Same phash-mismatch retry for 1-to-1 messages. A LID recipient's device
+      // list is cached under the "lid:" key, not the bare user.
       if (err && /\b421\b/.test(err.message)) {
-        this._devMgr.clearCache([phoneFromJid(toJid)]);
+        this._devMgr.clearCache([
+          toJid.endsWith('@lid') ? 'lid:' + phoneFromJid(toJid) : phoneFromJid(toJid)
+        ]);
         return this._sendDMMessage(toJid, msgId, plaintext, mediaType, options);
       }
       // ── Error 479: stale / dead Signal session ────────────────────────────────
@@ -587,7 +628,7 @@ class MessageSender {
       // _479retry flag prevents infinite loops: if the fresh session also gets
       // 479 (extremely rare — server bug or banned account) we fail cleanly.
       if (err && /\b479\b/.test(err.message) && !options._479retry) {
-        await this._clearSignalSessionsForRecipient(phoneFromJid(toJid));
+        await this._clearSignalSessionsForJid(toJid);
         // CRITICAL: generate a NEW msgId — the server already ACK'd (with error=479)
         // the original ID and will close the connection if we re-send the same ID.
         const retryMsgId = generateMessageId();
@@ -612,6 +653,44 @@ class MessageSender {
     }
   }
 
+  // ─── Encrypt for a device list, closing any gap before it reaches the wire ──
+  //
+  // Every JID handed in becomes a <to><enc> entry, and a stanza whose
+  // participants do not cover the device list the server holds for those users
+  // is nacked with ack 479. bulkEncryptForDevices drops whatever it cannot
+  // encrypt, so a single unusable session silently shrank the participant list
+  // and the whole send failed.
+  //
+  // Anything that fails gets its session torn down and rebuilt from a fresh
+  // prekey bundle, then re-encrypted once. If it still fails there is nothing
+  // left to try — the device is genuinely unreachable — and it is logged rather
+  // than passed over in silence.
+  async _encryptForDevices(jids, plaintext) {
+    if (!jids || jids.length === 0) return [];
+
+    const first = await this._signal.bulkEncryptForDevicesDetailed(jids, plaintext);
+    if (first.failed.length === 0) return first.encrypted;
+
+    _whaDbg('[DBG] ENCRYPT_GAP ' +
+      first.failed.map(f => f.jid + ' (' + f.reason + ')').join(', ') +
+      ' — rebuilding sessions');
+
+    const repaired = await this._devMgr
+      .rebuildSessionsForJids(first.failed.map(f => f.jid), this._signal)
+      .catch(err => {
+        _whaDbg('[DBG] ENCRYPT_GAP_REBUILD_ERR ' + (err && err.message));
+        return [];
+      });
+    if (repaired.length === 0) return first.encrypted;
+
+    const second = await this._signal.bulkEncryptForDevicesDetailed(repaired, plaintext);
+    if (second.failed.length > 0) {
+      _whaDbg('[DBG] ENCRYPT_GAP_UNRESOLVED ' +
+        second.failed.map(f => f.jid).join(', '));
+    }
+    return [...first.encrypted, ...second.encrypted];
+  }
+
   // Drop every cached device list and Signal session for these JIDs so the next
   // send is forced to re-query devices, re-fetch prekey bundles and open new
   // pkmsg sessions from scratch.
@@ -678,6 +757,38 @@ class MessageSender {
     _whaDbg('[DBG] 479_CACHE_FLUSHED phone=' + phone);
   }
 
+  // ─── Clear Signal sessions for a JID in whichever family it is written in ───
+  //
+  // _clearSignalSessionsForRecipient takes a phone number. Group recovery used
+  // to feed it phoneFromJid(memberJid), which for a LID member is the LID user —
+  // it was then looked up as a phone, built @s.whatsapp.net JIDs out of it and
+  // deleted nothing at all, so 479 recovery on a LID-addressed group was a
+  // no-op that resent the identical stanza. This dispatches on the server part
+  // instead.
+  async _clearSignalSessionsForJid(jid) {
+    const str = String(jid);
+    if (!str.endsWith('@lid')) {
+      return this._clearSignalSessionsForRecipient(phoneFromJid(str));
+    }
+
+    const lidUser = phoneFromJid(str);
+    const devIds  = (this._devMgr._dcGet && this._devMgr._dcGet('lid:' + lidUser)) || [0];
+    for (const devId of devIds) {
+      const devJid = (devId === 0) ? `${lidUser}@lid` : `${lidUser}:${devId}@lid`;
+      try {
+        await this._signal.deleteSession(devJid);
+        _whaDbg('[DBG] 479_DEL_LID_SESSION jid=' + devJid);
+      } catch (_) {}
+    }
+    try { await this._signal.deleteSession(`${lidUser}@lid`); } catch (_) {}
+    this._devMgr.clearCache(['lid:' + lidUser]);
+
+    // A LID member we also know by phone has phone-addressed sessions cached
+    // under that number too; clear both so the retry cannot pick up a stale one.
+    const pn = this._client._lidToPn && this._client._lidToPn.get(lidUser);
+    if (pn) await this._clearSignalSessionsForRecipient(pn);
+  }
+
   // ─── 1-to-1 multi-device fanout ───────────────────────────────────────────
 
   async _sendDMMessage(toJid, msgId, plaintext, mediaType, options) {
@@ -693,13 +804,6 @@ class MessageSender {
     // they simply omit the device-identity node (server accepts this for primaries).
     const allowPkmsg = true;
 
-    // Enumerate the recipient's devices and our own in parallel — Baileys does
-    // the same in one getUSyncDevices([senderIdentity, jid]) call.
-    const [_recipientDevicesByPhone, ownDevices] = await Promise.all([
-      this._devMgr.bulkEnsureSessions([recipientPhone], this._signal, allowPkmsg),
-      this._devMgr.ensureOwnDeviceSessions(ownPhone, this._signal, allowPkmsg)
-    ]);
-
     // ── Addressing family ─────────────────────────────────────────────────────
     // Baileys 7.0.0-rc13 — the release that fixed ack 479 on LID addressing —
     // derives the whole address family from the JID the caller passed, and
@@ -714,35 +818,75 @@ class MessageSender {
     // participant <to> entries — stays on phone JIDs. Send to an @lid and it
     // all stays LID.
     //
-    // This used to look the recipient up in _pnToLid and rewrite a
-    // phone-addressed DM into a LID-addressed one, on the reasoning that a
-    // phone-addressed message is accepted but never delivered to a
-    // LID-registered device. That rewrite is what produced the 479s: every
-    // rejected stanza in the traces carried to="...@lid", and both
-    // whatsmeow #859 and the Baileys LID reports describe the ack as appearing
-    // specifically on @lid-addressed sends. Following the caller's JID removes
-    // the mismatch instead of trying to compensate for it.
+    // "Everything" includes OUR OWN devices, which is what was missing here.
+    // The recipient's devices followed the caller's JID but ours were always
+    // enumerated by phone, so a DM to an @lid went out with @lid recipient
+    // entries and @s.whatsapp.net entries for our own linked devices in the same
+    // <participants> list. whatsmeow builds the pair as [to, ownID] with ownID
+    // switched to our LID for @lid destinations precisely to avoid that, and a
+    // participant list the server cannot reconcile is what comes back as 479.
     const isLidTarget  = toJid.endsWith('@lid');
     const routingToJid = toJid;
+    const ownLidUser   = this._client._myLid ? phoneFromJid(this._client._myLid) : null;
+
+    if (isLidTarget && !ownLidUser) {
+      throw new Error(
+        'Cannot send to ' + toJid + ': the recipient is LID-addressed but our own LID ' +
+        'is unknown (the server did not supply lid= on <success>). Reconnect so the ' +
+        'LID is re-issued.'
+      );
+    }
 
-    let otherJids;
+    // Enumerate the recipient's devices and our own in parallel, both in the
+    // address family the destination JID dictates — Baileys does the same in one
+    // getUSyncDevices([senderIdentity, jid]) call.
+    let otherJids, ownLinkedJids, ownPrimaryJid;
     if (isLidTarget) {
       const lidUser = phoneFromJid(toJid);
-      const lidDevices = await this._devMgr.bulkEnsureSessionsForLid(
-        lidUser, this._signal, allowPkmsg, /* skipUsync */ true);
-      otherJids = lidDevices.length > 0 ? lidDevices : [toJid];
+      const [lidDevices, ownLidDevices] = await Promise.all([
+        this._devMgr.bulkEnsureSessionsForLid(lidUser, this._signal, allowPkmsg, /* skipUsync */ true),
+        this._devMgr.ensureOwnLidDeviceSessions(ownLidUser, ownPhone, this._signal, allowPkmsg)
+      ]);
+      otherJids     = lidDevices.length > 0 ? lidDevices : [toJid];
+      ownLinkedJids = ownLidDevices;
+      ownPrimaryJid = `${ownLidUser}@lid`;
     } else {
-      otherJids = _recipientDevicesByPhone.length > 0 ? _recipientDevicesByPhone : [toJid];
+      const [pnDevices, ownDevices] = await Promise.all([
+        this._devMgr.bulkEnsureSessions([recipientPhone], this._signal, allowPkmsg),
+        this._devMgr.ensureOwnDeviceSessions(ownPhone, this._signal, allowPkmsg)
+      ]);
+      otherJids     = pnDevices.length > 0 ? pnDevices : [toJid];
+      ownLinkedJids = ownDevices.filter(j => j !== ownMainJid);
+      ownPrimaryJid = ownMainJid;
     }
 
+    // The device doing the sending is never one of its own recipients. Both
+    // Baileys ("Skipping exact sender device") and whatsmeow drop it explicitly.
+    const ownPrimaryAddr = adString(ownPrimaryJid);
+    otherJids     = otherJids.filter(j => adString(j) !== ownPrimaryAddr);
+    ownLinkedJids = ownLinkedJids.filter(j => adString(j) !== ownPrimaryAddr);
+
+    // A device appears in <participants> exactly once. Writing to our own chat
+    // makes both lists resolve to the same devices; they belong to the own-device
+    // list, which sends them the DeviceSentMessage rather than the bare message.
+    const ownLinkedAddrs = new Set(ownLinkedJids.map(adString));
+    otherJids = otherJids.filter(j => !ownLinkedAddrs.has(adString(j)));
+
     _whaDbg('[DBG] DM_ROUTE to=' + toJid + ' family=' + (isLidTarget ? 'LID' : 'PN') +
-      ' devices=[' + otherJids.join(',') + ']');
+      ' devices=[' + otherJids.join(',') + ']' +
+      ' ownLinked=[' + ownLinkedJids.join(',') + ']');
     // ─────────────────────────────────────────────────────────────────────────
 
-    const ownLinkedJids = ownDevices.filter(j => j !== ownMainJid);
-
-    const allParticipants = [...otherJids, ...ownLinkedJids];
-    const phash = allParticipants.length > 1 ? computePhash(allParticipants) : null;
+    // The hash covers every device the server enumerates for this pair of users,
+    // our own primary included — whatsmeow hashes GetUserDevices([to, ownID]) in
+    // full and only skips the sending device when it encrypts. Excluding it here
+    // produced a hash over a different set than the server's.
+    //
+    // It is not put on the stanza: neither whatsmeow nor Baileys sends phash on a
+    // 1:1 message, only on a group one. It is carried inside the (encrypted)
+    // DeviceSentMessage for our own devices, and compared against the phash the
+    // server echoes back on the ack so a drifted device cache gets flushed.
+    const phash = computePhash([...otherJids, ownPrimaryJid, ...ownLinkedJids]);
 
     const dsmBuf = ownLinkedJids.length > 0
       ? encodeDeviceSentMessage(toJid, plaintext, phash)
@@ -751,9 +895,9 @@ class MessageSender {
     // Acquire mutex before touching Signal sessions — concurrent sends on the
     // same session corrupt the ratchet chain and produce undecryptable messages.
     const [otherEncrypted, ownEncrypted] = await this._encryptMutex.runExclusive(async () => {
-      const other = await this._signal.bulkEncryptForDevices(otherJids, plaintext);
+      const other = await this._encryptForDevices(otherJids, plaintext);
       const own   = ownLinkedJids.length > 0
-        ? await this._signal.bulkEncryptForDevices(ownLinkedJids, dsmBuf)
+        ? await this._encryptForDevices(ownLinkedJids, dsmBuf)
         : [];
       return [other, own];
     });
@@ -764,7 +908,6 @@ class MessageSender {
     // Raw UTF-8 strings are not recognised by the server for LID recipients, causing
     // the message to be accepted (server ACK) but never delivered to the device.
     const stanzaAttrs = { to: jidStrToObj(routingToJid), id: msgId, type: mediaType, t: String(msNow()) };
-    if (phash) stanzaAttrs.phash = phash;
     if (options.edit) stanzaAttrs.edit = String(options.edit);
 
     const hasPkmsg   = encryptedList.some(e => e.type === 'pkmsg');
@@ -833,6 +976,20 @@ class MessageSender {
 
     const dispatchResult = await this._dispatchAndAck(msgNode, msgId);
 
+    // The server echoes its own participant hash on the ack. A difference means
+    // its device list for this chat is not the one we just fanned out to, so the
+    // cached list is stale — drop it and let the next send re-run usync, exactly
+    // as whatsmeow does when the hashes disagree.
+    if (dispatchResult && dispatchResult.phash && dispatchResult.phash !== phash) {
+      _whaDbg('[DBG] PHASH_MISMATCH ours=' + phash + ' server=' + dispatchResult.phash +
+        ' to=' + toJid + ' — flushing device cache');
+      if (isLidTarget) {
+        this._devMgr.clearCache(['lid:' + phoneFromJid(toJid)]);
+      } else {
+        this._devMgr.clearCache([recipientPhone]);
+      }
+    }
+
     // ─── Fire-and-forget: issue privacy token to contact ─────────────────────
     // After each DM send we ask WhatsApp to issue us a trusted-contact token
     // for this JID (one issuance per 7-day bucket is enough).  The token is
@@ -900,7 +1057,10 @@ class MessageSender {
         'Reconnect so the LID is re-issued.'
       );
     }
-    const myLidUser = useLid ? phoneFromJid(this._client._myLid) : null;
+    // Derived whenever the server has given us a LID, not only in LID mode: it
+    // is also what recognises our own entry in a member list that names us by
+    // LID while the group itself is still pn-addressed.
+    const myLidUser = this._client._myLid ? phoneFromJid(this._client._myLid) : null;
     // For LID-mode groups, sender identity is own LID JID; otherwise own PN JID.
     // Normalised to the bare user so it matches the participant targets below.
     const selfJid = useLid ? `${myLidUser}@lid` : ownJid;
@@ -909,12 +1069,28 @@ class MessageSender {
     const rawSKDM   = await this._signal.buildSKDM(groupJid, senderIdentity);
     const skdmMsg   = encodeSenderKeyDistributionMessage(groupJid, rawSKDM);
 
+    // We are a participant of our own group, so our own entry has to be taken
+    // out of the member walk and put back through the own-device path below.
+    // Left in, the walk enumerates our devices starting at device 0 — the very
+    // device doing the sending — and it lands in <participants> as a recipient
+    // of our own SenderKey. Baileys skips the exact sender device explicitly
+    // ("Skipping exact sender device"), whatsmeow does the same with
+    // `jid == ownJID || jid == ownLID`.
+    //
+    // The phone branch already dropped us via `p !== ownPhone`; the LID branch
+    // never did, so this only ever misfired on LID-addressed groups.
+    const isSelfMember = (jid) => {
+      const raw = phoneFromJid(jid);
+      return raw === ownPhone || (myLidUser && raw === myLidUser);
+    };
+
     // Resolve member phones for session/device queries.
     // For LID members without a PN mapping, keep the raw LID user part so
     // bulkEnsureSessionsForLid can still acquire sessions for them.
     const lidMembersWithoutPn = [];
     const memberPhones = [...new Set(
       members.map(jid => {
+        if (isSelfMember(jid)) return null;
         const isLid = jid.endsWith('@lid');
         const raw   = phoneFromJid(jid);
         if (isLid) {
@@ -925,9 +1101,6 @@ class MessageSender {
             const pn = this._client._lidToPn && this._client._lidToPn.get(raw);
             if (pn) return pn;
           }
-          // We are a member of the group ourselves, so our own devices come out
-          // of this same walk — Baileys likewise derives every group target
-          // from the participant list and never appends own devices separately.
           lidMembersWithoutPn.push(jid);
           return null;
         }
@@ -935,7 +1108,7 @@ class MessageSender {
       }).filter(p => p !== null && p !== ownPhone)
     )];
 
-    const [memberDevices, lidDevices, ownDevices] = await Promise.all([
+    const [memberDevices, lidDevices, ownTargets] = await Promise.all([
       memberPhones.length > 0
         ? this._devMgr.bulkEnsureSessions(memberPhones, this._signal)
         : Promise.resolve([]),
@@ -945,18 +1118,39 @@ class MessageSender {
               .catch(() => [])
           )).then(results => results.flat())
         : Promise.resolve([]),
-      this._devMgr.ensureOwnDeviceSessions(ownPhone, this._signal)
+      // Our own linked devices, in the address family the stanza is routed with.
+      // ensureOwnDeviceSessions hands back @s.whatsapp.net JIDs, which cannot go
+      // into a stanza carrying addressing_mode='lid'; both helpers already leave
+      // out device 0.
+      useLid
+        ? this._devMgr.ensureOwnLidDeviceSessions(myLidUser, ownPhone, this._signal)
+        : this._devMgr.ensureOwnDeviceSessions(ownPhone, this._signal)
     ]);
 
-    // Own devices come back as @s.whatsapp.net — re-express them in LID space
-    // so every target in a LID stanza shares one address family.  In LID mode
-    // the participant walk above already covered us, so this only fills the gap
-    // for legacy pn-addressed groups.
-    const ownTargets = useLid ? [] : ownDevices;
-
-    // Dedupe: a device reached through more than one path must still appear
-    // exactly once in <participants>.
-    const allTargets = [...new Set([...memberDevices, ...lidDevices, ...ownTargets])];
+    // Every device this group resolves to, our own primary included, deduped so
+    // a device reached through more than one path is counted once. whatsmeow
+    // hashes GetUserDevices(groupParticipants) in exactly this shape — the whole
+    // enumeration, sending device and all — and drops hosted endpoints first,
+    // since those are bot-side and never real participants.
+    const isHostedJid = (jid) => {
+      const s = String(jid);
+      return s.endsWith('@hosted') || s.endsWith('@hosted.lid');
+    };
+    const enumeratedDevices = [...new Set(
+      [...memberDevices, ...lidDevices, ...ownTargets, selfJid]
+    )].filter(jid => !isHostedJid(jid));
+
+    // The participant hash the server checks the fan-out against. whatsmeow puts
+    // it on group stanzas (sendGroup sets node.Attrs["phash"]) and nowhere else;
+    // it is computed over the enumeration above, not over the encryption targets,
+    // so the sending device counts here even though it is not a recipient.
+    const phash = computePhash(enumeratedDevices);
+
+    // Targets to actually encrypt for: everything but the sending device. Both
+    // Baileys and whatsmeow skip it explicitly at this point and not before.
+    const selfAddrs = new Set([adString(`${ownPhone}@s.whatsapp.net`)]);
+    if (myLidUser) selfAddrs.add(adString(`${myLidUser}@lid`));
+    const allTargets = enumeratedDevices.filter(jid => !selfAddrs.has(adString(jid)));
 
     const skStore        = this._signal.senderKeyStore;
     const existingSkdmMap = skStore.getSKDMMap(groupJid);
@@ -980,8 +1174,13 @@ class MessageSender {
     let skmsgCiphertext;
     await this._encryptMutex.runExclusive(async () => {
       if (skdmRecipients.length > 0) {
-        skdmEncrypted = await this._signal.bulkEncryptForDevices(skdmRecipients, skdmMsg);
-        skStore.markSKDMSent(groupJid, skdmRecipients);
+        skdmEncrypted = await this._encryptForDevices(skdmRecipients, skdmMsg);
+        // Record only the devices whose SenderKey distribution actually made it
+        // into the stanza. Marking the whole intended list meant a device we
+        // failed to encrypt for was remembered as already holding our key, so it
+        // never got another distribution and could not decrypt anything we sent
+        // to the group from then on.
+        skStore.markSKDMSent(groupJid, skdmEncrypted.map(e => e.jid));
       }
       skmsgCiphertext = await this._signal.senderKeyEncrypt(groupJid, senderIdentity, plaintext);
     });
@@ -1009,16 +1208,16 @@ class MessageSender {
     if (mediaSubtype) skmsgAttrs.mediatype = mediaSubtype;
     msgContent.push(new BinaryNode('enc', skmsgAttrs, Buffer.isBuffer(skmsgCiphertext) ? skmsgCiphertext : Buffer.from(skmsgCiphertext)));
 
-    // No phash on group stanzas. Baileys computes a participant hash only on
-    // the 1:1 path; a group message carries id/to/type/addressing_mode and
-    // nothing else. Sending a hash the server did not ask for — over a
-    // participant set it derives itself from the group — is a way to have the
-    // stanza rejected outright.
+    // phash belongs on a group stanza and only on a group stanza — whatsmeow's
+    // sendGroup sets it, sendDM does not. It tells the server which device set we
+    // fanned out to; the server compares it against its own and echoes its hash
+    // back on the ack when they differ.
     const stanzaAttrs = {
       to: jidStrToObj(groupJid),
       id: msgId,
       type: mediaType,
       addressing_mode: groupAddressingMode,
+      phash,
       t:   String(msNow())
     };
     if (options.edit) stanzaAttrs.edit = String(options.edit);
@@ -1040,7 +1239,27 @@ class MessageSender {
     }
 
     const msgNode = new BinaryNode('message', stanzaAttrs, msgContent);
-    return this._dispatchAndAck(msgNode, msgId);
+    const dispatchResult = await this._dispatchAndAck(msgNode, msgId);
+
+    // A hash on the ack that differs from ours means the server's participant
+    // list for this group is not the one we just fanned out to, so some members
+    // did not get the message. whatsmeow drops its group cache on exactly this
+    // signal; the device lists behind the members are dropped too, so the next
+    // send re-runs group metadata and usync rather than repeating the miss.
+    if (dispatchResult && dispatchResult.phash && dispatchResult.phash !== phash) {
+      _whaDbg('[DBG] GROUP_PHASH_MISMATCH ours=' + phash +
+        ' server=' + dispatchResult.phash + ' group=' + groupJid +
+        ' — invalidating group metadata and device caches');
+      if (typeof this._client.invalidateGroupMetadata === 'function') {
+        this._client.invalidateGroupMetadata(groupJid);
+      }
+      const staleKeys = [...new Set(enumeratedDevices.map(jid =>
+        String(jid).endsWith('@lid') ? 'lid:' + phoneFromJid(jid) : phoneFromJid(jid)
+      ))];
+      if (staleKeys.length) this._devMgr.clearCache(staleKeys);
+    }
+
+    return dispatchResult;
   }
 
   // ─── Dispatch and wait for ack ────────────────────────────────────────────
@@ -1154,7 +1373,15 @@ class MessageSender {
           if (error) {
             reject(new Error('Send error ' + error + ' for ' + id));
           } else {
-            resolve({ id, t: ackAttrs && ackAttrs.t, status: 'sent' });
+            resolve({
+              id,
+              t:      ackAttrs && ackAttrs.t,
+              // The server's own participant hash, when it sends one back. The
+              // caller compares it against the list it fanned out to and drops
+              // its device cache when they disagree.
+              phash:  ackAttrs && ackAttrs.phash ? String(ackAttrs.phash) : undefined,
+              status: 'sent'
+            });
           }
         });
 
@@ -1334,4 +1561,8 @@ function guessMime(data, fallback) {
   return map[ext] || fallback;
 }
 
-module.exports = { MessageSender, makeJid, isGroupJid, generateMessageId, buildOrGetAdvIdentity: _buildOrGetAdvIdentity };
+module.exports = {
+  MessageSender, makeJid, isGroupJid, generateMessageId,
+  buildOrGetAdvIdentity: _buildOrGetAdvIdentity,
+  computePhash, adString
+};

package/lib/proto/MessageProto.js

@@ -60,13 +60,19 @@ function encodeDouble(fieldNum, value) {
   return Buffer.concat([t, buf]);
 }
 
+// Plain text goes in conversation (field 1). Text that carries a contextInfo —
+// a quoted reply, a mention — has to be an ExtendedTextMessage instead, which is
+// field 6 of Message: { text=1, contextInfo=17 }.
+//
+// The wrapper was being written to field 38, which is orderMessage, so replies
+// and mentions arrived as an unreadable order rather than as text.
 function encodeText(text, contextInfo) {
   if (contextInfo) {
     const inner = Buffer.concat([
       field(1,  WIRE_LEN, str(text)),
       field(17, WIRE_LEN, encodeContextInfo(contextInfo))
     ]);
-    return field(38, WIRE_LEN, inner);
+    return field(6, WIRE_LEN, inner);
   }
   return field(1, WIRE_LEN, str(text));
 }
@@ -260,8 +266,12 @@ function encodeMessage(type, payload) {
     case 'sticker':      return field(26, WIRE_LEN, payload);
     case 'reaction':     return field(46, WIRE_LEN, payload);
     case 'protocol':     return field(12, WIRE_LEN, payload);
-    case 'extendedText': return field(2,  WIRE_LEN, payload);
-    case 'poll':         return field(85, WIRE_LEN, payload);
+    // extendedTextMessage is field 6. It used to be written to field 2, which is
+    // senderKeyDistributionMessage — so an edited message went out claiming to be
+    // a SenderKey distribution, and field 2 was not free for the real one.
+    case 'extendedText': return field(6,  WIRE_LEN, payload);
+    // pollCreationMessage is field 49; field 85 is eventCoverImage.
+    case 'poll':         return field(49, WIRE_LEN, payload);
     case 'location':     return field(5,  WIRE_LEN, payload);
     case 'contact':      return field(4,  WIRE_LEN, payload);
     default:             return payload;
@@ -380,12 +390,18 @@ function decodeMessageContainer(buf) {
       if (dsm[2]) return decodeMessageContainer(dsm[2]);
     }
 
-    // Field 35: senderKeyDistributionMessage — used to set up sender keys.
+    // Field 2: senderKeyDistributionMessage — used to set up sender keys.
     // In WhatsApp Multi-Device, SKDM is bundled WITH the first real message in a new
     // session (even for 1-on-1 DMs). We extract it and continue decoding the real message.
+    //
+    // This read field 35, which is messageContextInfo. Two things followed: a real
+    // distribution from another member (always at field 2) was never seen, so their
+    // group messages stayed undecryptable; and the messageContextInfo that ordinary
+    // messages carry was fed to processSKDM as if it were a distribution, which
+    // writes junk states into the sender-key record.
     let skdmInfo = null;
-    if (f[35]) {
-      const skdm = _decodeFields(f[35]);
+    if (f[2]) {
+      const skdm = _decodeFields(f[2]);
       // field 1 = groupId (string), field 2 = axolotlSenderKeyDistributionMessage (bytes)
       skdmInfo = {
         groupId: _str(skdm[1]),
@@ -403,10 +419,10 @@ function decodeMessageContainer(buf) {
       if (text) msgResult = { type: 'text', text };
     }
 
-    // Field 2: extendedTextMessage — field 1 = text
-    if (!msgResult && f[2] && Buffer.isBuffer(f[2])) {
+    // Field 6: extendedTextMessage — field 1 = text
+    if (!msgResult && f[6] && Buffer.isBuffer(f[6])) {
       try {
-        const ext = _decodeFields(f[2]);
+        const ext = _decodeFields(f[6]);
         const text = _str(ext[1]);
         if (text) msgResult = { type: 'text', text };
       } catch (_) {}
@@ -552,11 +568,11 @@ function decodeMessageContainer(buf) {
       } catch (_) { msgResult = { type: 'reaction', emoji: '' }; }
     }
 
-    // Field 85: pollCreationMessage
+    // Field 49: pollCreationMessage
     // encKey=1, name=2 (question), options=3 (repeated PollOption{name=1}), selectableOptionsCount=4
-    if (!msgResult && f[85] && Buffer.isBuffer(f[85])) {
+    if (!msgResult && f[49] && Buffer.isBuffer(f[49])) {
       try {
-        const poll = _decodeFields(f[85]);
+        const poll = _decodeFields(f[49]);
         const question = _str(poll[2]);
         const rawOpts  = poll[3];
         const options  = [];
@@ -574,8 +590,8 @@ function decodeMessageContainer(buf) {
       } catch (_) { msgResult = { type: 'poll', question: '', options: [] }; }
     }
 
-    // Field 89: pollUpdateMessage (a vote on an existing poll)
-    if (!msgResult && f[89] && Buffer.isBuffer(f[89])) {
+    // Field 50: pollUpdateMessage (a vote on an existing poll)
+    if (!msgResult && f[50] && Buffer.isBuffer(f[50])) {
       msgResult = { type: 'pollVote' };
     }
 
@@ -595,12 +611,20 @@ function decodeMessageContainer(buf) {
   }
 }
 
+// ─── SenderKeyDistributionMessage (field 2 of Message) ───────────────────────
+// SenderKeyDistributionMessage { groupId=1, axolotlSenderKeyDistributionMessage=2 }
+//
+// This was written to field 35, which in Message is messageContextInfo — an
+// entirely different type. Every group SenderKey we distributed was therefore
+// labelled as context metadata, so no recipient ever saw a distribution, no
+// recipient could open the sender-key session, and every skmsg we sent showed up
+// as "Waiting for this message" on their side. It is field 2 in WAProto.
 function encodeSenderKeyDistributionMessage(groupId, axolotlBytes) {
   const inner = Buffer.concat([
     field(1, WIRE_LEN, str(groupId)),
     field(2, WIRE_LEN, bytes(axolotlBytes))
   ]);
-  return field(35, WIRE_LEN, inner);
+  return field(2, WIRE_LEN, inner);
 }
 
 module.exports = {

package/lib/signal/SenderKey.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { dbg: _whaDbg } = require('../logger');
+
 const crypto = require('crypto');
 const fs     = require('fs');
 const path   = require('path');
@@ -74,6 +76,16 @@ function deriveMessageKeys(messageKey) {
 
 const _SK_DEBOUNCE_MS = 300;
 
+// Bumped whenever a change means the SenderKey distributions we already sent
+// were never usable by their recipients. The stored "who already has our key"
+// map is then dropped once on load, so the next send to each group distributes
+// again instead of trusting a record of deliveries that never landed.
+//
+// v2: the distribution was written to Message field 35 (messageContextInfo)
+//     instead of field 2, so no recipient ever received a readable one.
+const SKDM_DISTRIBUTION_FORMAT = 2;
+const SKDM_FORMAT_KEY          = '__skdmFormat__';
+
 class SenderKeyStore {
   constructor() {
     this._data      = {};
@@ -96,6 +108,27 @@ class SenderKeyStore {
         this._data = {};
       }
     }
+    this._migrateSKDMDistribution();
+  }
+
+  // Drop the "already distributed" bookkeeping once when the format changes.
+  // The sender keys themselves are kept — only the record of who has them is
+  // reset, so the next send to a group re-distributes to every member.
+  _migrateSKDMDistribution() {
+    if (this._data[SKDM_FORMAT_KEY] === SKDM_DISTRIBUTION_FORMAT) return;
+    let dropped = 0;
+    for (const key of Object.keys(this._data)) {
+      if (key.startsWith('__skdm__')) {
+        delete this._data[key];
+        dropped++;
+      }
+    }
+    this._data[SKDM_FORMAT_KEY] = SKDM_DISTRIBUTION_FORMAT;
+    this._save();
+    if (dropped > 0) {
+      _whaDbg('[DBG] SKDM_FORMAT_MIGRATION dropped ' + dropped +
+        ' stale distribution maps — every group re-distributes on next send');
+    }
   }
 
   _flushSync() {

package/lib/signal/SignalProtocol.js

@@ -249,12 +249,31 @@ class SignalProtocol {
   // same JID are still serialized — no Signal session corruption possible.
   // Returns [{jid, type, ciphertext}]
   async bulkEncryptForDevices(jids, plaintext) {
+    const { encrypted } = await this.bulkEncryptForDevicesDetailed(jids, plaintext);
+    return encrypted;
+  }
+
+  // Same fanout, but also reports the devices that could NOT be encrypted.
+  //
+  // A dropped device is not a cosmetic loss: every device handed in here becomes
+  // a <to><enc> entry in the outgoing stanza, and a stanza whose participants do
+  // not cover the recipient's current device list is rejected by the server with
+  // ack 479. The caller needs to know which addresses failed so it can rebuild
+  // their sessions and fill the gap before the stanza goes out.
+  async bulkEncryptForDevicesDetailed(jids, plaintext) {
     const settled = await Promise.allSettled(
       jids.map(jid => this.encrypt(jid, plaintext).then(enc => ({ jid, type: enc.type, ciphertext: enc.ciphertext })))
     );
-    return settled
-      .filter(r => r.status === 'fulfilled')
-      .map(r => r.value);
+    const encrypted = [];
+    const failed    = [];
+    settled.forEach((r, i) => {
+      if (r.status === 'fulfilled') {
+        encrypted.push(r.value);
+      } else {
+        failed.push({ jid: jids[i], reason: (r.reason && r.reason.message) || String(r.reason) });
+      }
+    });
+    return { encrypted, failed };
   }
 
   // ─── SenderKey group encrypt / decrypt ────────────────────────────────────

package/lib/signal/SignalStore.js

@@ -27,6 +27,10 @@ class SignalStore {
     this._identities       = {};
     this._filePath         = null;
     this._lidMappings      = {};   // phone → lid — persisted alongside sessions
+    // address → { value, open } — memoises the haveOpenSession() check below.
+    // Keyed on the stored record value, so storeSession() (which always assigns
+    // a freshly serialised object) invalidates the entry by identity.
+    this._openSessionMemo  = new Map();
 
     // Debounce state
     this._dirty            = false;
@@ -173,8 +177,40 @@ class SignalStore {
     this._save();
   }
 
+  // True only when the stored record still has an OPEN session — i.e. one we can
+  // actually encrypt with.
+  //
+  // A SessionRecord can hold sessions that libsignal has closed: session_builder
+  // closes the current one whenever it processes an incoming prekey bundle or
+  // installs a new outgoing one, and it stays in the record as archived state.
+  // The record therefore keeps existing long after it stops being usable.
+  //
+  // This used to answer `!!this._sessions[addr]`, so DeviceManager treated a
+  // closed session as ready, skipped the prekey fetch, and handed the address to
+  // SessionCipher.encrypt — which throws "No open session". bulkEncryptForDevices
+  // drops whatever it cannot encrypt, so the stanza went out with a <to> entry
+  // missing for that device and the server nacked the whole send with ack 479.
+  // Baileys hit the same class of bug with its peerSessionsCache and fixed it by
+  // validating through haveOpenSession() on every check.
   hasSession(encodedAddress) {
-    return !!this._sessions[encodedAddress];
+    if (!this._openSessionMemo) this._openSessionMemo = new Map();
+    const data = this._sessions[encodedAddress];
+    if (!data) {
+      this._openSessionMemo.delete(encodedAddress);
+      return false;
+    }
+    const memo = this._openSessionMemo.get(encodedAddress);
+    if (memo && memo.value === data) return memo.open;
+
+    let open = false;
+    try {
+      const obj = typeof data === 'string' ? JSON.parse(data) : data;
+      open = SessionRecord.deserialize(obj).haveOpenSession();
+    } catch (_) {
+      open = false;
+    }
+    this._openSessionMemo.set(encodedAddress, { value: data, open });
+    return open;
   }
 
   // ─── PreKeys ──────────────────────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.5.81",
+  "version": "5.5.83",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",