fix(hub): re-read the roster before saying a key changed

A member invited after the roster was read showed "key changed" on each
message until a reload. Read it again once per account and device on the
connection, shared by concurrent messages, and pin only the final verdict.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

3 files changed, 62 insertions, 20 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js
index f079f80..3d56f69 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-devices.js
@@ -68,28 +68,39 @@ extendTransport(class {
       return 'unknown';
     }
     const known = await _readPinnedAccount(this.nodePk, userId);
-    const entry = roster.byAccount.get(userId);
-    if (known && known.includes(devicePk)) return 'pinned';
-    if (!known) {
-      // First sight, so **everything the node says** is pinned — not only what
-      // a chain reaches. There is nothing to compare against yet: that is what
-      // trust-on-first-use means, and pinning only the verified subset would
-      // raise "key changed" on a legitimate second device whose
-      // countersignature simply predates it being kept. What TOFU buys is that
-      // a substitution *later* is visible; it cannot buy anything now.
-      if (entry) await _writePinnedAccount(this.nodePk, userId, entry.all);
-      return entry && entry.all.includes(devicePk) ? 'first' : 'changed';
+    let verdict = _judgeDevice(known, roster.byAccount.get(userId), devicePk);
+    // The roster is this connection's copy, read once. Somebody who joined the
+    // group, or added a device, since it was read is absent from it, and their
+    // first message raised "key changed" — found live, twice in one
+    // conversation, on a member invited after the page was opened. So the
+    // roster is read again before that is said, once per account and device
+    // on this connection: a node substituting keys gets one more read for each
+    // key it makes up, and the same answer.
+    if (verdict.status === 'changed') {
+      try {
+        roster = await this._rosterRecheckedFor(userId, devicePk);
+        verdict = _judgeDevice(known, roster.byAccount.get(userId), devicePk);
+      } catch { /* the verdict on the copy we had stands */ }
     }
-    if (entry && entry.verified.includes(devicePk)
-        && entry.chain.get(devicePk)
-        && known.includes(entry.chain.get(devicePk))) {
-      // Countersigned by a key we already trust for this account: a second
-      // device of someone we know, admitted without anybody comparing digits.
-      await _writePinnedAccount(this.nodePk, userId,
-                                [...new Set([...known, devicePk])]);
-      return 'linked';
+    if (verdict.pin) await _writePinnedAccount(this.nodePk, userId, verdict.pin);
+    return verdict.status;
+  }
+
+  /**
+   * The roster as re-read for this key, read once per connection. Held as the
+   * promise, not as "done": live messages are opened concurrently, and two from
+   * a device that just joined must both wait for the one read, not have the
+   * second answer "changed" while the first is still asking.
+   */
+  _rosterRecheckedFor(userId, devicePk) {
+    if (!this._rosterRechecks) this._rosterRechecks = new Map();
+    const key = `${userId} ${devicePk}`;
+    let read = this._rosterRechecks.get(key);
+    if (!read) {
+      read = this.groupRoster({ fresh: true });
+      this._rosterRechecks.set(key, read);
     }
-    return 'changed';
+    return read;
   }
 
   /**
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-roster.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-roster.js
index cac3b52..d2e8c94 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-roster.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-roster.js
@@ -103,6 +103,36 @@ async function _writePinnedAccount(nodePk, userId, keys) {
 }
 
 /**
+ * How `devicePk` stands against what is pinned for its account (`known`, null
+ * at first sight) and what the roster lists for it (`entry`): `{ status, pin }`,
+ * `pin` being the keys to keep if that answer stands. Decides and writes
+ * nothing, so a verdict reached on a stale roster can be taken again on a fresh
+ * one without having pinned half a set first. The statuses are
+ * `accountDeviceStatus`'s.
+ */
+function _judgeDevice(known, entry, devicePk) {
+  if (known && known.includes(devicePk)) return { status: 'pinned', pin: null };
+  if (!known) {
+    // First sight, so **everything the node says** is pinned — not only what
+    // a chain reaches. There is nothing to compare against yet: that is what
+    // trust-on-first-use means, and pinning only the verified subset would
+    // raise "key changed" on a legitimate second device whose
+    // countersignature simply predates it being kept. What TOFU buys is that
+    // a substitution *later* is visible; it cannot buy anything now.
+    const pin = entry ? entry.all : null;
+    return { status: entry && entry.all.includes(devicePk) ? 'first' : 'changed', pin };
+  }
+  if (entry && entry.verified.includes(devicePk)
+      && entry.chain.get(devicePk)
+      && known.includes(entry.chain.get(devicePk))) {
+    // Countersigned by a key we already trust for this account: a second
+    // device of someone we know, admitted without anybody comparing digits.
+    return { status: 'linked', pin: [...new Set([...known, devicePk])] };
+  }
+  return { status: 'changed', pin: null };
+}
+
+/**
  * A wire payload as text.
  *
  * A plaintext message arrives as a string from the node; msgpack `bin` arrives
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index 9dcea4f..fa5d28b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -1247,6 +1247,7 @@ class MeshBayTransport {
       this._chatKeysInFlight = null;
       this._roster = null;
       this._rosterInFlight = null;
+      this._rosterRechecks = null;
       // Tell the node which of this account's devices is on this connection,
       // after the ack and unconditionally: a peer `check_version` admitted
       // speaks this message, and identifying the device is what makes chat