fix(sync): derive the message sync cursor from the server clock

CONTEXT.md

@@ -104,6 +104,23 @@ Independent boolean markers on a Message, orthogonal to its Status — a Message
 | **Room History**    | Older Messages of a Room fetched on demand from the server (distinct from **Server History**)                                      | Message history        |
 | **Jump to Message** | Re-position the Room view onto a target Message that may be far from the Live Tail or not yet synced — fetches a surrounding Chunk | Scroll to message      |
 
+## Timestamp Trust Boundary
+
+Not every `_updatedAt` is worth the same. A Message's `_updatedAt` read out of a **server response** is server truth, and is the only legitimate source for the sync cursor. The same field read off of a **WatermelonDB row** is device-tainted: offline sends, Temp and Error sends, push-inserted rows, and `normalizeMessage`'s `_updatedAt || new Date()` fallback all stamp the device clock.
+
+Therefore the **Last Open** must be taken from the raw payload _before_ `normalizeMessage` / `buildMessage` runs — never from a database row, and never from `Date.now()`.
+
+| Term                 | Definition                                                                                                                   | Aliases to avoid       |
+| -------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ---------------------- |
+| **Last Open**        | The fetch cursor for a Subscription (`lastOpen` column): the newest server `_updatedAt` actually received for that Room      | last open, last update |
+| **Last Seen**        | The Subscription's read receipt (`ls`): the newest Message the user has read, which anchors the Unread Separator             | last read              |
+| **Server Timestamp** | An `_updatedAt` taken from a server response — the only value the server can meaningfully compare a cursor against           | Timestamp (ambiguous)  |
+| **Device Timestamp** | An `_updatedAt` present on a local row but written by the device clock; unusable as a cursor because the server never saw it | Timestamp (ambiguous)  |
+
+A **Last Open** below a change's **Server Timestamp** only costs a re-fetch; one above it makes the server stay silent, and the change is never delivered. When in doubt, the lower cursor is the safe one.
+
+A **Last Open** and a **Last Seen** are not interchangeable — conflating them (one column serving as both fetch cursor and unread anchor) is what produced permanently invisible Messages.
+
 ## Message Action & Position State
 
 Two distinct kinds of transient per-Room state drive how the Room view renders Messages. Keep them apart.
@@ -243,6 +260,7 @@ A **Message Action** is the active mode on a Message in the Room view. The three
 - **"Forward"** in omnichannel context means **Transfer** (reassigning a room to another agent/department). The codebase uses both `forwardRoom` and "transfer" — prefer **Transfer** as the domain term.
 - **"History"** is overloaded: **Server History** is the recent-Servers reconnection list; **Room History** is older Messages fetched on demand. The action `roomHistoryRequest` and saga `ROOM.HISTORY_REQUEST` refer to **Room History**.
 - **"Window"** is used metaphorically in the Subscriptions dialogue ("a Subscription is the user's window into it"); a **Message Window** is the concrete observed Message range in the Room view. Disambiguate when both could be meant.
+- **"`lastOpen`"** names a database column, not a concept: it stores the **Last Open**, a server-clock fetch cursor. It has never meant "when the user last opened the room". The Unread Separator anchor is **Last Seen** (`ls`). Do not read `lastOpen` as a read receipt or write a device clock into it.
 - **"Load more"** is directional: older Messages are an **Older Loader** (`MORE`/`PREVIOUS_CHUNK`), newer Messages are a **Newer Loader** (`NEXT_CHUNK`). Avoid bare "load more".
 - **"System message" vs "Info message"** — **System Message** is the umbrella (any `t`-bearing server Message); **Info Message** is the narrower set of room-event System Messages. The typed events `e2e`, `discussion-created`, `jitsi_call_started`, and `videoconf` are System Messages but NOT Info Messages — each gets its own rendering branch.
 - **"Thread reply"** is overloaded. The glossary's **Thread Message** is the data concept (any Message with `tmid`); the code's `isThreadReply` is a _rendering position_ — the first Thread Message in a run shown in the parent Room, which gets the "in reply to" header. Do not use "thread reply" for the data concept.

app/containers/MessageActions/index.tsx

@@ -249,7 +249,7 @@
 
 						await db.write(async () => {
 							try {
-								await subRecord.update(sub => (sub.lastOpen = ts as Date)); // TODO: reevaluate IMessage
+								await subRecord.update(sub => (sub.ls = ts as Date));
 							} catch {
 								// do nothing
 							}
@@ -400,7 +400,7 @@
 				});
 			};
 
 			const getOptions = (message: TAnyMessageModel) => {
 				const options: TActionSheetOptionsItem[] = [];
 				const videoConfBlock = message.t === 'videoconf';
 

app/lib/methods/loadMessagesForRoom.test.ts

@@ -5,6 +5,7 @@ import { getMessageById } from '../database/services/Message';
 import { getSubscriptionByRoomId } from '../database/services/Subscription';
 import updateMessages from './updateMessages';
 import { store } from '../store/auxStore';
+import { updateLastOpen } from './updateLastOpen';
 
 jest.mock('../services/sdk', () => ({
 	__esModule: true,
@@ -31,6 +32,10 @@ jest.mock('../store/auxStore', () => ({
 }));
 
 jest.mock('./updateMessages', () => jest.fn());
+jest.mock('./updateLastOpen', () => ({
+	...jest.requireActual('./updateLastOpen'),
+	updateLastOpen: jest.fn()
+}));
 
 const mockedSdkGet = sdk.get as jest.MockedFunction<typeof sdk.get>;
 const mockedGetMessageById = getMessageById as jest.MockedFunction<typeof getMessageById>;
@@ -232,4 +237,76 @@ describe('loadMessagesForRoom', () => {
 		expect(mockedDispatch).not.toHaveBeenCalledWith(expect.objectContaining({ type: ROOM.HISTORY_UI_LOADER_PUSH }));
 		expect(mockedDispatch).not.toHaveBeenCalledWith(expect.objectContaining({ type: ROOM.HISTORY_UI_LOADER_POP }));
 	});
+
+	describe('last open', () => {
+		const mockedUpdateLastOpen = updateLastOpen as jest.MockedFunction<typeof updateLastOpen>;
+
+		const buildStampedBatch = (prefix: string, hour: number, length: number) =>
+			Array.from(
+				{ length },
+				(_, index) =>
+					({
+						_id: `${prefix}-${index + 1}`,
+						rid: 'ROOM_ID',
+						ts: new Date(Date.UTC(2024, 0, 1, hour, 0, length - index)).toISOString(),
+						_updatedAt: new Date(Date.UTC(2024, 0, 1, hour, 0, length - index)).toISOString(),
+						t: 'uj'
+					} as any)
+			);
+
+		it('writes the Last Open from every fetched batch on the initial tail load', async () => {
+			const firstBatch = buildStampedBatch('first', 11, 50);
+			const secondBatch = buildStampedBatch('second', 10, 50);
+
+			mockedSdkGet
+				.mockResolvedValueOnce({ success: true, messages: firstBatch } as any)
+				.mockResolvedValueOnce({ success: true, messages: secondBatch } as any);
+
+			await loadMessagesForRoom({ rid: 'ROOM_ID', t: 'c' });
+
+			expect(mockedUpdateLastOpen).toHaveBeenCalledTimes(1);
+			// Every batch's server stamps contribute to the cursor, not just the newest page.
+			expect(mockedUpdateLastOpen).toHaveBeenCalledWith(
+				'ROOM_ID',
+				expect.arrayContaining([
+					...firstBatch.map(message => ({ _updatedAt: message._updatedAt })),
+					...secondBatch.map(message => ({ _updatedAt: message._updatedAt }))
+				])
+			);
+		});
+
+		it('uses the highest _updatedAt even when it arrives in an older batch', async () => {
+			const firstBatch = buildStampedBatch('first', 11, 50);
+			const secondBatch = buildStampedBatch('second', 10, 50).map(message => ({
+				...message,
+				_updatedAt: new Date(Date.UTC(2024, 0, 1, 12, 0, 0)).toISOString()
+			}));
+
+			mockedSdkGet
+				.mockResolvedValueOnce({ success: true, messages: firstBatch } as any)
+				.mockResolvedValueOnce({ success: true, messages: secondBatch } as any);
+
+			await loadMessagesForRoom({ rid: 'ROOM_ID', t: 'c' });
+
+			const received = mockedUpdateLastOpen.mock.calls[0][1];
+			const timestamps = received.map(m => new Date(m._updatedAt as string | Date).getTime()).filter(t => !Number.isNaN(t));
+			expect(new Date(Math.max(...timestamps))).toEqual(new Date(Date.UTC(2024, 0, 1, 12, 0, 0)));
+		});
+
+		it('does not write when loading an older page (latest)', async () => {
+			mockedSdkGet.mockResolvedValueOnce({ success: true, messages: buildStampedBatch('older', 9, 10) } as any);
+
+			await loadMessagesForRoom({ rid: 'ROOM_ID', t: 'c', latest: new Date(Date.UTC(2024, 0, 1, 10, 0, 0)) });
+
+			expect(mockedUpdateLastOpen).not.toHaveBeenCalled();
+		});
+
+		it('does not write when filling a gap (loaderItem)', async () => {
+			mockedSdkGet.mockResolvedValueOnce({ success: true, messages: buildStampedBatch('gap', 9, 10) } as any);
+
+			await loadMessagesForRoom({ rid: 'ROOM_ID', t: 'c', loaderItem: { id: 'tapped-load-more' } as any });
+
+			expect(mockedUpdateLastOpen).not.toHaveBeenCalled();
+		});
+	});
 });

app/lib/methods/loadMessagesForRoom.ts

@@ -10,6 +10,7 @@ import sdk from '../services/sdk';
 import { store } from '../store/auxStore';
 import updateMessages from './updateMessages';
 import { generateLoadMoreId } from './helpers/generateLoadMoreId';
+import { snapshotServerTimestamps, type TServerTimestamps, updateLastOpen } from './updateLastOpen';
 
 const COUNT = 50;
 const MAX_BATCHES = 10;
@@ -32,15 +33,16 @@ async function load(args: {
 	t: RoomTypes;
 	loaderItem?: TMessageModel;
 	onUiLoaderPushed?: (loaderId: string) => void;
-}): Promise<{ messages: IMessage[]; lastBatchWasFull: boolean }> {
+}): Promise<{ messages: IMessage[]; serverTimestamps: TServerTimestamps; lastBatchWasFull: boolean }> {
 	const roomId = args.rid;
 	const hideSystemMessages = await resolveHideSystemMessages(roomId);
 	const apiType = roomTypeToApiType(args.t);
 	if (!apiType) {
-		return { messages: [], lastBatchWasFull: false };
+		return { messages: [], serverTimestamps: [], lastBatchWasFull: false };
 	}
 
 	const allMessages: IMessage[] = [];
+	const serverTimestamps: TServerTimestamps = [];
 	let visibleMainMessagesCount = 0;
 	let batchesFetched = 0;
 	let lastBatchWasFull = false;
@@ -73,6 +75,7 @@ async function load(args: {
 		}
 
 		const batch = data.messages as IMessage[];
+		serverTimestamps.push(...snapshotServerTimestamps(batch));
 		allMessages.push(...batch);
 		lastBatchWasFull = batch.length === COUNT;
 
@@ -108,7 +111,7 @@ async function load(args: {
 
 	const startTimestamp = args.latest ? new Date(args.latest).toISOString() : undefined;
 	await fetchBatch(startTimestamp);
-	return { messages: allMessages, lastBatchWasFull };
+	return { messages: allMessages, serverTimestamps, lastBatchWasFull };
 }
 
 export async function loadMessagesForRoom(args: {
@@ -119,7 +122,7 @@ export async function loadMessagesForRoom(args: {
 }): Promise<void> {
 	let uiLoaderId: string | null = null;
 	try {
-		const { messages, lastBatchWasFull } = await load({
+		const { messages, serverTimestamps, lastBatchWasFull } = await load({
 			...args,
 			onUiLoaderPushed: id => {
 				uiLoaderId = id;
@@ -139,6 +142,10 @@ export async function loadMessagesForRoom(args: {
 			}
 			await updateMessages({ rid: args.rid, update: messages, loaderItem: args.loaderItem });
 		}
+
+		if (!args.latest && !args.loaderItem) {
+			await updateLastOpen(args.rid, serverTimestamps);
+		}
 	} catch (e) {
 		log(e);
 		throw e;

app/lib/methods/loadMissedMessages.test.ts

@@ -0,0 +1,188 @@
+import { loadMissedMessages } from './loadMissedMessages';
+import sdk from '../services/sdk';
+import updateMessages from './updateMessages';
+import { getSubscriptionByRoomId } from '../database/services/Subscription';
+import { updateLastOpen } from './updateLastOpen';
+import { store } from '../store/auxStore';
+
+jest.mock('../services/sdk', () => ({
+	__esModule: true,
+	default: {
+		get: jest.fn()
+	}
+}));
+
+jest.mock('../database/services/Subscription', () => ({
+	getSubscriptionByRoomId: jest.fn()
+}));
+
+jest.mock('../store/auxStore', () => ({
+	store: {
+		getState: jest.fn(() => ({ server: { version: '7.4.0' } })),
+		dispatch: jest.fn()
+	}
+}));
+
+jest.mock('./updateMessages', () => jest.fn());
+jest.mock('./updateLastOpen', () => ({
+	...jest.requireActual('./updateLastOpen'),
+	updateLastOpen: jest.fn()
+}));
+jest.mock('./helpers/log', () => ({ __esModule: true, default: jest.fn() }));
+
+const mockedSdkGet = sdk.get as jest.MockedFunction<typeof sdk.get>;
+const mockedUpdateMessages = updateMessages as jest.MockedFunction<typeof updateMessages>;
+const mockedGetSubscriptionByRoomId = getSubscriptionByRoomId as jest.MockedFunction<typeof getSubscriptionByRoomId>;
+const mockedUpdateLastOpen = updateLastOpen as jest.MockedFunction<typeof updateLastOpen>;
+
+const RID = 'ROOM_ID';
+
+describe('loadMissedMessages', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+		mockedUpdateMessages.mockResolvedValue(0);
+		mockedGetSubscriptionByRoomId.mockResolvedValue(null as never);
+		(store.getState as jest.Mock).mockReturnValue({ server: { version: '7.4.0' } });
+	});
+
+	it('routes a deleted-only recursion payload to remove, not update', async () => {
+		mockedGetSubscriptionByRoomId.mockResolvedValue({ lastOpen: null, t: 'p' } as never);
+		const deletedMessage = { _id: 'deleted-1', rid: RID, _updatedAt: new Date(Date.UTC(2024, 0, 1, 12, 0, 0)) };
+		mockedSdkGet.mockResolvedValue({
+			result: { updated: [], deleted: [deletedMessage], cursor: { next: null } }
+		} as never);
+
+		await loadMissedMessages({ rid: RID, deletedNext: 1704110400000 });
+
+		expect(mockedSdkGet).toHaveBeenCalledTimes(1);
+		expect(mockedSdkGet).toHaveBeenCalledWith('chat.syncMessages', expect.objectContaining({ roomId: RID, type: 'DELETED' }));
+		expect(mockedUpdateMessages).toHaveBeenCalledWith(
+			expect.objectContaining({
+				rid: RID,
+				update: [],
+				remove: [deletedMessage]
+			})
+		);
+	});
+
+	it('fetches nothing when the subscription has no cursor', async () => {
+		mockedGetSubscriptionByRoomId.mockResolvedValue({ lastOpen: null, t: 'p' } as never);
+
+		await loadMissedMessages({ rid: RID });
+
+		expect(mockedSdkGet).not.toHaveBeenCalled();
+	});
+
+	describe('last open', () => {
+		const CURSOR = new Date(Date.UTC(2024, 0, 1, 11, 0, 0));
+		const flush = () => new Promise(resolve => setImmediate(resolve));
+
+		const message = (id: string, updatedAt: string) => ({ _id: id, rid: RID, _updatedAt: updatedAt });
+
+		beforeEach(() => {
+			mockedGetSubscriptionByRoomId.mockResolvedValue({ lastOpen: CURSOR, t: 'c' } as never);
+		});
+
+		it('writes the Last Open from the updated payload once the cursor has drained', async () => {
+			mockedSdkGet.mockResolvedValue({
+				result: { updated: [message('a', '2024-01-01T11:30:00.000Z')], deleted: [], cursor: { next: null } }
+			} as never);
+
+			await loadMissedMessages({ rid: RID });
+
+			expect(mockedUpdateLastOpen).toHaveBeenCalledTimes(1);
+			expect(mockedUpdateLastOpen).toHaveBeenCalledWith(RID, [{ _updatedAt: '2024-01-01T11:30:00.000Z' }]);
+		});
+
+		it('does not write mid-pagination, only after the final page of a paginated run', async () => {
+			const PAGE_2 = Date.UTC(2024, 0, 1, 11, 30, 0);
+			mockedSdkGet.mockImplementation(((_endpoint: string, params: { type?: string; next?: number }) => {
+				if (params.type === 'DELETED') {
+					return Promise.resolve({ result: { deleted: [], cursor: { next: null } } });
+				}
+				if (params.next === PAGE_2) {
+					return Promise.resolve({
+						result: { updated: [message('b', '2024-01-01T11:45:00.000Z')], deleted: [], cursor: { next: null } }
+					});
+				}
+				return Promise.resolve({
+					result: { updated: [message('a', '2024-01-01T11:30:00.000Z')], deleted: [], cursor: { next: PAGE_2 } }
+				});
+			}) as never);
+
+			await loadMissedMessages({ rid: RID });
+
+			// First page still has a next cursor, so nothing may be persisted yet.
+			expect(mockedUpdateLastOpen).not.toHaveBeenCalled();
+
+			await flush();
+
+			expect(mockedUpdateLastOpen).toHaveBeenCalledTimes(1);
+			// Every page walked contributes its stamps, not only the last one.
+			expect(mockedUpdateLastOpen).toHaveBeenCalledWith(RID, [
+				{ _updatedAt: '2024-01-01T11:30:00.000Z' },
+				{ _updatedAt: '2024-01-01T11:45:00.000Z' }
+			]);
+		});
+
+		it('keeps the highest _updatedAt when it arrives on an earlier page', async () => {
+			const PAGE_2 = Date.UTC(2024, 0, 1, 11, 30, 0);
+			mockedSdkGet.mockImplementation(((_endpoint: string, params: { type?: string; next?: number }) => {
+				if (params.type === 'DELETED') {
+					return Promise.resolve({ result: { deleted: [], cursor: { next: null } } });
+				}
+				if (params.next === PAGE_2) {
+					return Promise.resolve({
+						result: { updated: [message('b', '2024-01-01T11:10:00.000Z')], deleted: [], cursor: { next: null } }
+					});
+				}
+				return Promise.resolve({
+					result: { updated: [message('a', '2024-01-01T11:59:00.000Z')], deleted: [], cursor: { next: PAGE_2 } }
+				});
+			}) as never);
+
+			await loadMissedMessages({ rid: RID });
+			await flush();
+
+			const received = mockedUpdateLastOpen.mock.calls[0][1];
+			const timestamps = received.map(m => new Date(m._updatedAt as string | Date).getTime()).filter(t => !Number.isNaN(t));
+			expect(new Date(Math.max(...timestamps))).toEqual(new Date('2024-01-01T11:59:00.000Z'));
+		});
+
+		it('does not write again on a deleted-only continuation page', async () => {
+			mockedSdkGet.mockResolvedValue({
+				result: { updated: [], deleted: [message('gone', '2024-01-01T11:30:00.000Z')], cursor: { next: null } }
+			} as never);
+
+			await loadMissedMessages({ rid: RID, deletedNext: Date.UTC(2024, 0, 1, 11, 30, 0) });
+
+			expect(mockedUpdateLastOpen).not.toHaveBeenCalled();
+		});
+
+		it('writes nothing derived from deleted rows when the payload is deleted-only', async () => {
+			mockedSdkGet.mockResolvedValue({
+				result: { updated: [], deleted: [message('gone', '2024-01-01T11:30:00.000Z')], cursor: { next: null } }
+			} as never);
+
+			await loadMissedMessages({ rid: RID });
+
+			expect(mockedUpdateLastOpen).toHaveBeenCalledWith(RID, []);
+		});
+
+		it('writes once on the legacy unpaginated server branch', async () => {
+			(store.getState as jest.Mock).mockReturnValue({ server: { version: '7.0.0' } });
+			mockedSdkGet.mockResolvedValue({
+				result: { updated: [message('a', '2024-01-01T11:30:00.000Z')], deleted: [] }
+			} as never);
+
+			await loadMissedMessages({ rid: RID });
+
+			expect(mockedSdkGet).toHaveBeenCalledWith(
+				'chat.syncMessages',
+				expect.objectContaining({ lastUpdate: CURSOR.toISOString() })
+			);
+			expect(mockedUpdateLastOpen).toHaveBeenCalledTimes(1);
+			expect(mockedUpdateLastOpen).toHaveBeenCalledWith(RID, [{ _updatedAt: '2024-01-01T11:30:00.000Z' }]);
+		});
+	});
+});