fix: add try/catch to delayed PreKey deletion to prevent unhandled rejection

The setTimeout async callback in removePreKey could cause unhandled promise
rejection if the keystore was destroyed (connection closed) before the
5-min grace period expired.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

WAProto/WAProto.proto

@@ -1,7 +1,7 @@
 syntax = "proto3";
 package proto;
 
-/// WhatsApp Version: 2.3000.1034274421
+/// WhatsApp Version: 2.3000.1034302344
 
 message ADVDeviceIdentity {
     optional uint32 rawId = 1;

src/Defaults/baileys-version.json

@@ -1 +1 @@
-{"version":[2,3000,1034279434]}
+{"version":[2,3000,1034382497]}

src/Defaults/index.ts

@@ -56,10 +56,33 @@ export const PROCESSABLE_HISTORY_TYPES = [
 // 6 hours in milliseconds
 const SIX_HOURS_MS = 6 * 60 * 60 * 1000
 
+/**
+ * Resolves the default browser tuple from the BAILEYS_BROWSER env var.
+ * Default: Android companion (SMB_ANDROID) — matches upstream PR #2201.
+ * Pair code auto-detects Android and falls back to Chrome in socket.ts.
+ *
+ *   unset / 'android'    → Browsers.android('14')
+ *   'android:15'         → Browsers.android('15')
+ *   'chrome' / 'macos'   → Browsers.macOS('Chrome')
+ */
+const resolveDefaultBrowser = (): [string, string, string] => {
+	const env = process.env.BAILEYS_BROWSER?.trim().toLowerCase()
+	if (env === 'chrome' || env === 'macos') {
+		return Browsers.macOS('Chrome')
+	}
+
+	if (env?.startsWith('android:')) {
+		const apiLevel = env.split(':')[1] || '14'
+		return Browsers.android(apiLevel)
+	}
+
+	return Browsers.android('14')
+}
+
 export const DEFAULT_CONNECTION_CONFIG: SocketConfig = {
 	version: version as WAVersion,
 	versionCheckIntervalMs: SIX_HOURS_MS,
-	browser: Browsers.macOS('Chrome'),
+	browser: resolveDefaultBrowser(),
 	waWebSocketUrl: 'wss://web.whatsapp.com/ws/chat',
 	connectTimeoutMs: 20_000,
 	keepAliveIntervalMs: 15_000,

src/Signal/libsignal.ts

@@ -302,6 +302,25 @@ export function makeLibSignalRepository(
 	// Promise instead of each spawning their own DB transactions.
 	const migrationInFlight = new Map<string, Promise<{ migrated: number; skipped: number; total: number }>>()
 
+	// Resolve PN JID to its canonical LID JID for transaction locking.
+	// This prevents PN/LID race conditions where concurrent operations for the
+	// same logical contact acquire different mutex locks because one uses PN
+	// and the other uses LID. (Aligned with WABA behavior — all operations use LID internally.)
+	const resolveCanonicalJid = async(jid: string): Promise<string> => {
+		if (isAnyLidUser(jid)) {
+			return jid
+		}
+
+		if (isAnyPnUser(jid)) {
+			const lid = await lidMapping.getLIDForPN(jid)
+			if (lid) {
+				return lid
+			}
+		}
+
+		return jid
+	}
+
 	const repository: SignalRepositoryWithLIDStore = {
 		decryptGroupMessage({ group, authorJid, msg }) {
 			const senderName = jidToSignalSenderKeyName(group, authorJid)
@@ -396,23 +415,24 @@ export function makeLibSignalRepository(
 				return result
 			}
 
-			// If it's not a sync message, we need to ensure atomicity
-			// For regular messages, we use a transaction to ensure atomicity
+			// Use canonical JID (PN→LID resolved) as transaction key to prevent
+			// PN/LID race conditions on the same logical session.
+			const canonicalJid = await resolveCanonicalJid(jid)
 			return parsedKeys.transaction(async () => {
 				return await doDecrypt()
-			}, jid)
+			}, canonicalJid)
 		},
 
 		async encryptMessage({ jid, data }) {
 			const addr = jidToSignalProtocolAddress(jid)
 			const cipher = new libsignal.SessionCipher(storage, addr)
 
-			// Use transaction to ensure atomicity
+			const canonicalJid = await resolveCanonicalJid(jid)
 			return parsedKeys.transaction(async () => {
 				const { type: sigType, body } = await cipher.encrypt(data)
 				const type = sigType === 3 ? 'pkmsg' : 'msg'
 				return { type, ciphertext: Buffer.from(body, 'binary') }
-			}, jid)
+			}, canonicalJid)
 		},
 
 		async encryptGroupMessage({ group, meId, data }) {
@@ -654,9 +674,10 @@ export function makeLibSignalRepository(
 								// Session exists (guaranteed from device discovery)
 								const fromSession = libsignal.SessionRecord.deserialize(pnSession)
 								if (fromSession.haveOpenSession()) {
-									// Queue for bulk update: copy to LID, delete from PN
+									// Queue for bulk update: copy to LID, retain PN session.
+									// WABA retains both PN and LID sessions during migration to avoid
+									// No Session errors if messages arrive via PN before migration completes.
 									sessionUpdates[lidAddrStr] = fromSession.serialize()
-									sessionUpdates[pnAddrStr] = null
 
 									migratedCount++
 								}
@@ -776,6 +797,13 @@ function signalStorage(
 		return id
 	}
 
+	// Delayed PreKey deletion: grace period to handle race conditions
+	// where two pkmsg with the same preKeyId arrive nearly simultaneously.
+	// WABA deletes immediately (33ms), but we add a 5-min grace period
+	// because we can't handle "Invalid PreKey ID" errors at the native level.
+	const PREKEY_GRACE_PERIOD_MS = 5 * 60 * 1000 // 5 minutes
+	const pendingPreKeyDeletions = new Map<string, ReturnType<typeof setTimeout>>()
+
 	return {
 		loadSession: async (id: string) => {
 			try {
@@ -808,7 +836,26 @@ function signalStorage(
 				}
 			}
 		},
-		removePreKey: (id: number) => keys.set({ 'pre-key': { [id]: null } }),
+		removePreKey: (id: number) => {
+			const keyId = id.toString()
+			// Clear any existing timer for this key
+			const existing = pendingPreKeyDeletions.get(keyId)
+			if (existing) {
+				clearTimeout(existing)
+			}
+
+			// Schedule deletion after grace period
+			const timer = setTimeout(async () => {
+				pendingPreKeyDeletions.delete(keyId)
+				try {
+					await keys.set({ 'pre-key': { [id]: null } })
+				} catch {
+					// Keystore may be destroyed if connection closed — safe to ignore
+				}
+			}, PREKEY_GRACE_PERIOD_MS)
+
+			pendingPreKeyDeletions.set(keyId, timer)
+		},
 		loadSignedPreKey: () => {
 			const key = creds.signedPreKey
 			return {
@@ -898,14 +945,24 @@ function signalStorage(
 					// IDENTITY KEY CHANGED - contact reinstalled WhatsApp or switched devices
 					const previousFingerprint = generateKeyFingerprint(existingKey)
 
-					// Delete old session and save new identity key atomically
+					// Delete old session and save new identity key atomically.
+					// Store identity in BOTH LID and PN addresses (WABA stores in both
+					// recipient_account_type=0 and type=1 with CONFLICT_REPLACE).
+					const identityUpdates: Record<string, Uint8Array> = { [wireJid]: identityKey }
+					if (wireJid !== id) {
+						identityUpdates[id] = identityKey
+					}
+
 					await keys.set({
 						session: { [wireJid]: null },
-						'identity-key': { [wireJid]: identityKey }
+						'identity-key': identityUpdates
 					})
 
-					// Update cache
+					// Update cache for both addresses
 					identityKeyCache.set(wireJid, identityKey)
+					if (wireJid !== id) {
+						identityKeyCache.set(id, identityKey)
+					}
 
 					// Record metrics
 					metrics.signalIdentityChanges?.inc({ type: 'changed' })
@@ -941,10 +998,19 @@ function signalStorage(
 
 				if (!existingKey) {
 					// NEW CONTACT - Trust On First Use (TOFU)
-					await keys.set({ 'identity-key': { [wireJid]: identityKey } })
+					// Store in both LID and PN addresses (aligned with WABA dual identity storage)
+					const identityUpdates: Record<string, Uint8Array> = { [wireJid]: identityKey }
+					if (wireJid !== id) {
+						identityUpdates[id] = identityKey
+					}
 
-					// Update cache
+					await keys.set({ 'identity-key': identityUpdates })
+
+					// Update cache for both addresses
 					identityKeyCache.set(wireJid, identityKey)
+					if (wireJid !== id) {
+						identityKeyCache.set(id, identityKey)
+					}
 
 					// Record metrics
 					metrics.signalIdentityChanges?.inc({ type: 'new' })

src/Socket/messages-recv.ts

@@ -31,6 +31,7 @@ import {
 	aesDecryptCTR,
 	aesEncryptGCM,
 	cleanMessage,
+	cleanupCorruptedSession,
 	Curve,
 	decodeMediaRetryNode,
 	decodeMessageNode,
@@ -41,6 +42,7 @@ import {
 	encodeSignedDeviceIdentity,
 	extractAddressingContext,
 	getCallStatusFromNode,
+	getDecryptionJid,
 	getHistoryMsg,
 	getNextPreKeys,
 	getStatusFromReceiptType,
@@ -67,7 +69,7 @@ import {
 	recordMessageReceived,
 	recordMessageRetry
 } from '../Utils/prometheus-metrics.js'
-import { isTcTokenExpired, resolveTcTokenJid } from '../Utils/tc-token-utils'
+import { isTcTokenExpired, resolveTcTokenJid, storeTcTokensFromIqResult } from '../Utils/tc-token-utils'
 import {
 	areJidsSameUser,
 	type BinaryNode,
@@ -162,6 +164,12 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 	const TC_TOKEN_PRUNE_TS_KEY = '__prune_ts'
 	const tcTokenKnownJids = new Set<string>()
 	const tcTokenRetriedMsgIds = new Set<string>()
+
+	// Deduplicates retry requests per JID within a short window.
+	// When a burst of Bad MAC errors arrives for the same contact,
+	// only the first retry request is sent — the peer resends everything
+	// with a single pkmsg, avoiding the close-session cascade.
+	const retryRequestActiveJids = new Set<string>()
 	let tcTokenIndexSaveTimer: ReturnType<typeof setTimeout> | undefined
 	let lastTcTokenPruneTs = 0
 
@@ -1209,12 +1217,50 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 		const { key: msgKey } = fullMessage
 		const msgId = msgKey.id!
 
+		// Per-JID deduplication: when multiple messages from the same contact
+		// fail with Bad MAC simultaneously, only send ONE retry request.
+		// The peer will resend all failed messages when it receives the retry receipt.
+		// For group messages, scope by participant (each participant has its own Signal session).
+		const retryDedupeJid = msgKey.participant
+			? jidNormalizedUser(msgKey.participant)
+			: jidNormalizedUser(node.attrs.from!)
+		if (retryRequestActiveJids.has(retryDedupeJid)) {
+			logger.debug(
+				{ fromJid: retryDedupeJid, msgId },
+				'Skipping duplicate retry request — already in-flight for this JID'
+			)
+			return
+		}
+
 		if (messageRetryManager) {
 			// Check if we've exceeded max retries using the new system
 			if (messageRetryManager.hasExceededMaxRetries(msgId)) {
 				logger.debug({ msgId }, 'reached retry limit with new retry manager, clearing')
 				messageRetryManager.markRetryFailed(msgId)
 				recordMessageFailure('retry', 'max_retries_reached')
+
+				// Safety net: clean up corrupted sessions only after all retries exhausted.
+				// This avoids the cascading delete loop that occurs when cleanup runs
+				// on every Bad MAC in the hot path (decode-wa-message.ts).
+				// The Signal Protocol recovers naturally via retry+pkmsg for most cases;
+				// this cleanup only runs as a last resort.
+				// For group messages, use participant JID (Signal sessions are per-participant, not per-group).
+				if (autoCleanCorrupted) {
+					const senderJid = msgKey.participant ? jidNormalizedUser(msgKey.participant) : jidNormalizedUser(node.attrs.from!)
+					try {
+						const decryptionJid = await getDecryptionJid(senderJid, signalRepository)
+						const deletedCount = await cleanupCorruptedSession(decryptionJid, signalRepository, logger)
+						if (deletedCount > 0) {
+							logger.info(
+								{ msgId, jid: decryptionJid, targetedDevices: deletedCount },
+								`🔄 Session cleanup (retry exhausted) | Targeted: ${deletedCount} devices`
+							)
+						}
+					} catch (cleanupErr) {
+						logger.warn({ msgId, senderJid, err: cleanupErr }, 'Failed to cleanup session after retry exhaustion')
+					}
+				}
+
 				return
 			}
 
@@ -1233,6 +1279,18 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 				logger.debug({ retryCount, msgId }, 'reached retry limit, clearing')
 				await msgRetryCache.del(key)
 				recordMessageFailure('retry', 'max_retries_reached')
+
+				// Safety net cleanup (same as new system above)
+				if (autoCleanCorrupted) {
+					const senderJid = msgKey.participant ? jidNormalizedUser(msgKey.participant) : jidNormalizedUser(node.attrs.from!)
+					try {
+						const decryptionJid = await getDecryptionJid(senderJid, signalRepository)
+						await cleanupCorruptedSession(decryptionJid, signalRepository, logger)
+					} catch (cleanupErr) {
+						logger.warn({ msgId, senderJid, err: cleanupErr }, 'Failed to cleanup session after retry exhaustion')
+					}
+				}
+
 				return
 			}
 
@@ -1241,6 +1299,11 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 			recordMessageRetry('retry')
 		}
 
+		// Register dedup AFTER early-return checks so that max-retries paths
+		// don't block subsequent messages from the same JID for 5 seconds.
+		retryRequestActiveJids.add(retryDedupeJid)
+		setTimeout(() => retryRequestActiveJids.delete(retryDedupeJid), 5_000)
+
 		const key = `${msgId}:${msgKey?.participant}`
 		const retryCount = (await msgRetryCache.get<number>(key)) || 1
 
@@ -1251,7 +1314,7 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 		let shouldRecreateSession = false
 		let recreateReason = ''
 
-		if (enableAutoSessionRecreation && messageRetryManager && retryCount > 1) {
+		if (enableAutoSessionRecreation && messageRetryManager && retryCount >= 1) {
 			try {
 				// Check if we have a session with this JID
 				const sessionId = signalRepository.jidToSignalProtocolAddress(fromJid)
@@ -1390,6 +1453,7 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 			})
 
 			// When a session is refreshed (identity change), re-issue tctoken fire-and-forget
+			// WABA Android: reissue stores senderTimestamp + realIssueTimestamp after IQ success
 			if (result.action === 'session_refreshed') {
 				const normalizedJid = jidNormalizedUser(from)
 				resolveTcTokenJid(normalizedJid, getLIDForPN)
@@ -1399,9 +1463,36 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 						if (entry?.token?.length && !isTcTokenExpired(entry.timestamp)) {
 							const senderTs = unixTimestampSeconds()
 							logTcToken('reissue', { jid: normalizedJid, reason: 'session_refreshed' })
-							getPrivacyTokens([normalizedJid], senderTs).catch(err => {
-								logTcToken('reissue_fail', { jid: normalizedJid, error: err?.message })
-							})
+							getPrivacyTokens([normalizedJid], senderTs)
+								.then(async (iqResult) => {
+									await storeTcTokensFromIqResult({
+										result: iqResult,
+										fallbackJid: normalizedJid,
+										keys: authState.keys,
+										getLIDForPN,
+										onNewJidStored: (storedJid) => {
+											tcTokenKnownJids.add(storedJid)
+											scheduleTcTokenIndexSave()
+										}
+									})
+									// Persist senderTimestamp + realIssueTimestamp after IQ success
+									const currentData = await authState.keys.get('tctoken', [tcJid])
+									const currentEntry = currentData[tcJid]
+									await authState.keys.set({
+										tctoken: {
+											[tcJid]: {
+												...currentEntry,
+												token: currentEntry?.token ?? Buffer.alloc(0),
+												senderTimestamp: senderTs,
+												realIssueTimestamp: 0
+											}
+										}
+									})
+									logTcToken('reissue_ok', { jid: normalizedJid, reason: 'session_refreshed' })
+								})
+								.catch(err => {
+									logTcToken('reissue_fail', { jid: normalizedJid, error: err?.message })
+								})
 						}
 					})
 					.catch(() => {
@@ -1849,7 +1940,10 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 						[storageJid]: {
 							...existing,
 							token: Buffer.from(content),
-							timestamp
+							timestamp,
+							// WABA Android: resets real_issue_timestamp when a new incoming token arrives
+							// (UPDATE wa_trusted_contacts_send SET real_issue_timestamp=null)
+							realIssueTimestamp: null
 						}
 					}
 				})
@@ -1939,7 +2033,7 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 		let shouldRecreateSession = false
 		let recreateReason = ''
 
-		if (enableAutoSessionRecreation && messageRetryManager && retryCount > 1) {
+		if (enableAutoSessionRecreation && messageRetryManager && retryCount >= 1) {
 			try {
 				const sessionId = signalRepository.jidToSignalProtocolAddress(participant)
 
@@ -2171,7 +2265,6 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 			authState.creds.me!.lid || '',
 			signalRepository,
 			logger,
-			autoCleanCorrupted
 		)
 
 		const alt = msg.key.participantAlt || msg.key.remoteJidAlt
@@ -2761,6 +2854,24 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 				const jid = jidNormalizedUser(attrs.from)
 				logTcToken('error_463', { jid, msgId })
 
+				// WABA Android: error 463 triggers getPrivacyTokens() fire-and-forget
+				// to ensure token is available for the retry below
+				getPrivacyTokens([jid])
+					.then(async (result) => {
+						await storeTcTokensFromIqResult({
+							result,
+							fallbackJid: jid,
+							keys: authState.keys,
+							getLIDForPN,
+							onNewJidStored: (storedJid) => {
+								tcTokenKnownJids.add(storedJid)
+								scheduleTcTokenIndexSave()
+							}
+						})
+						logTcToken('fetched', { jid, reason: 'error_463' })
+					})
+					.catch(() => { /* fire-and-forget */ })
+
 				// Single-retry: wait 1.5s for the server's tctoken notification to arrive,
 				// then resend. A Set prevents infinite retry loops.
 				// Composite key (jid:msgId) ensures retries are isolated per destination.
@@ -2796,7 +2907,24 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 					return
 				}
 			} else if (attrs.error === SERVER_ERROR_CODES.SmaxInvalid) {
-				logTcToken('error_479', { jid: attrs.from, msgId: attrs.id })
+				const jid479 = jidNormalizedUser(attrs.from)
+				logTcToken('error_479', { jid: jid479, msgId: attrs.id })
+				// WABA Android: error 479 (SmaxInvalid) also triggers token re-fetch
+				getPrivacyTokens([jid479])
+					.then(async (result) => {
+						await storeTcTokensFromIqResult({
+							result,
+							fallbackJid: jid479,
+							keys: authState.keys,
+							getLIDForPN,
+							onNewJidStored: (storedJid) => {
+								tcTokenKnownJids.add(storedJid)
+								scheduleTcTokenIndexSave()
+							}
+						})
+						logTcToken('fetched', { jid: jid479, reason: 'error_479' })
+					})
+					.catch(() => { /* fire-and-forget */ })
 			} else {
 				logger.warn({ attrs }, 'received error in ack')
 			}

src/Socket/messages-send.ts

@@ -1611,6 +1611,8 @@ export const makeMessagesSocket = (config: SocketConfig) => {
 
 						// Persist senderTimestamp unconditionally — WA Web stores it in the chat table
 						// regardless of whether a token exists. Spread preserves token+timestamp if present.
+						// WABA Android: INSERT INTO wa_trusted_contacts_send (jid, sent_tc_token_timestamp, real_issue_timestamp)
+						// VALUES (?, ?, 0) — realIssueTimestamp=0 means issued but not yet confirmed by server
 						const currentData = await authState.keys.get('tctoken', [tcTokenJid])
 						const currentEntry = currentData[tcTokenJid]
 						await authState.keys.set({
@@ -1618,7 +1620,8 @@ export const makeMessagesSocket = (config: SocketConfig) => {
 								[tcTokenJid]: {
 									...currentEntry,
 									token: currentEntry?.token ?? Buffer.alloc(0),
-									senderTimestamp: issueTimestamp
+									senderTimestamp: issueTimestamp,
+									realIssueTimestamp: 0
 								}
 							}
 						})

src/Socket/socket.ts

@@ -38,7 +38,7 @@ import {
 	signedKeyPair,
 	xmppSignedPreKey
 } from '../Utils'
-import { getPlatformId } from '../Utils/browser-utils'
+import { getPlatformId, isAndroidBrowser } from '../Utils/browser-utils'
 import {
 	CircuitBreaker,
 	CircuitOpenError,
@@ -634,8 +634,6 @@ export const makeSocket = (config: SocketConfig) => {
 		}
 		helloMsg = proto.HandshakeMessage.fromObject(helloMsg)
 
-		logger.info({ browser, helloMsg }, 'connected to WA')
-
 		const init = proto.HandshakeMessage.encode(helloMsg).finish()
 
 		const result = await awaitNextMessage<Uint8Array>(init)
@@ -1352,6 +1350,25 @@ export const makeSocket = (config: SocketConfig) => {
 			id: jidEncode(phoneNumber, 's.whatsapp.net'),
 			name: '~'
 		}
+
+		// Pair code companion_platform_id must be Chrome (1) when using Android
+		// browser preset. ANDROID_PHONE (16) causes silent timeout (server ignores),
+		// UWP (21) causes "cannot connect device" rejection. Only Chrome (1) works
+		// for pair code via web protocol (WA\x06\x03). The device still appears as
+		// "Android" in linked devices because DeviceProps.platformType=ANDROID_PHONE
+		// is set separately in the registration node.
+		const isAndroid = isAndroidBrowser(browser)
+		const pairPlatformId = isAndroid ? getPlatformId('Chrome') : getPlatformId(browser[1])
+		const pairPlatformDisplay = isAndroid ? 'Chrome (Mac OS)' : `${browser[1]} (${browser[0]})`
+
+		logger.info({
+			pairCode: pairingCode,
+			jid: authState.creds.me.id,
+			companionPlatformId: pairPlatformId,
+			companionPlatformDisplay: pairPlatformDisplay,
+			isAndroid,
+		}, `pair code requested | companion: ${pairPlatformDisplay} | ${isAndroid ? 'android override -> Chrome' : 'native platform'}`)
+
 		ev.emit('creds.update', authState.creds)
 		await sendNode({
 			tag: 'iq',
@@ -1384,12 +1401,12 @@ export const makeSocket = (config: SocketConfig) => {
 						{
 							tag: 'companion_platform_id',
 							attrs: {},
-							content: getPlatformId(browser[1])
+							content: pairPlatformId
 						},
 						{
 							tag: 'companion_platform_display',
 							attrs: {},
-							content: `${browser[1]} (${browser[0]})`
+							content: pairPlatformDisplay
 						},
 						{
 							tag: 'link_code_pairing_nonce',
@@ -1519,7 +1536,9 @@ export const makeSocket = (config: SocketConfig) => {
 	})
 	// login complete
 	ws.on('CB:success', async (node: BinaryNode) => {
-		logger.info('opened connection to WA')
+		const isAndroid = isAndroidBrowser(browser)
+		const phoneId = authState.creds.me?.id?.split(':')[0]?.split('@')[0] || 'new session'
+		logger.info(`${isAndroid ? '\uD83D\uDCF1' : '\uD83D\uDDA5\uFE0F'} Connected to WA | ${phoneId} | platform: ${isAndroid ? 'SMB_ANDROID' : 'MACOS'} | device: ${isAndroid ? 'Android' : 'Desktop'} | platformType: ${isAndroid ? 'ANDROID_PHONE' : 'CHROME'}`)
 		clearTimeout(qrTimer) // will never happen in all likelyhood -- but just in case WA sends success on first try
 
 		ev.emit('creds.update', { me: { ...authState.creds.me!, lid: node.attrs.lid } })

src/Types/Auth.ts

@@ -80,7 +80,7 @@ export type SignalDataTypeMap = {
 	'app-state-sync-version': LTHashState
 	'lid-mapping': string
 	'device-list': string[]
-	tctoken: { token: Buffer; timestamp?: string; senderTimestamp?: number }
+	tctoken: { token: Buffer; timestamp?: string; senderTimestamp?: number; realIssueTimestamp?: number | null }
 	/** Identity key for Signal Protocol - used for detecting contact reinstalls */
 	'identity-key': Uint8Array
 }

src/Types/index.ts

@@ -23,6 +23,7 @@ export type BrowsersMap = {
 	baileys(browser: string): [string, string, string]
 	windows(browser: string): [string, string, string]
 	appropriate(browser: string): [string, string, string]
+	android(apiLevel: string): [string, string, string]
 }
 
 export enum DisconnectReason {

src/Utils/browser-utils.ts

@@ -94,7 +94,13 @@ const BROWSER_TO_PLATFORM_ID: ReadonlyMap<string, string> = (() => {
 		}
 	}
 
-	return new Map(entries)
+	const map = new Map(entries)
+	// ANDROID → ANDROID_PHONE alias (DeviceProps.PlatformType has ANDROID_PHONE but not ANDROID)
+	if (!map.has('ANDROID') && map.has('ANDROID_PHONE')) {
+		map.set('ANDROID', map.get('ANDROID_PHONE')!)
+	}
+
+	return map
 })()
 
 // ============================================================
@@ -331,7 +337,8 @@ export const Browsers: BrowsersMap = {
 	macOS: (browser: string): [string, string, string] => ['Mac OS', browser, OS_VERSIONS.macOS],
 	windows: (browser: string): [string, string, string] => ['Windows', browser, OS_VERSIONS.windows],
 	baileys: (browser: string): [string, string, string] => ['Baileys', browser, OS_VERSIONS.baileys],
-	appropriate: (browser: string): [string, string, string] => [getPlatformName(), browser, getAppropriateVersion()]
+	appropriate: (browser: string): [string, string, string] => [getPlatformName(), browser, getAppropriateVersion()],
+	android: (apiLevel: string): [string, string, string] => [apiLevel, 'Android', '']
 } as const
 
 /**
@@ -378,7 +385,7 @@ export const getPlatformId = (browser: unknown): string => {
  * properties like 'toString' or 'constructor'.
  *
  * @param value - Value to check
- * @returns True if value is a valid browser preset key ('ubuntu', 'macOS', 'windows', 'baileys', 'appropriate')
+ * @returns True if value is a valid browser preset key ('ubuntu', 'macOS', 'windows', 'baileys', 'appropriate', 'android')
  *
  * @example
  * isValidBrowserPreset('ubuntu')      // true
@@ -391,6 +398,16 @@ export const getPlatformId = (browser: unknown): string => {
  *   const config = Browsers[userInput]('MyApp')
  * }
  */
+/**
+ * Checks if the browser tuple represents an Android companion device.
+ *
+ * @param browser - Browser tuple [os, platform, version]
+ * @returns True if platform is 'Android' (case-insensitive)
+ */
+export const isAndroidBrowser = (browser: [string, string, string]): boolean => {
+	return browser[1]?.toUpperCase() === 'ANDROID'
+}
+
 export const isValidBrowserPreset = (value: unknown): value is keyof BrowsersMap => {
 	return typeof value === 'string' && Object.prototype.hasOwnProperty.call(Browsers, value)
 }

src/Utils/decode-wa-message.ts

@@ -14,7 +14,6 @@ import {
 	isJidStatusBroadcast,
 	isLidUser,
 	isPnUser,
-	jidDecode
 	//	transferDevice
 } from '../WABinary'
 import { unpadRandomMax16 } from './generics'
@@ -276,7 +275,6 @@ export const decryptMessageNode = (
 	meLid: string,
 	repository: SignalRepositoryWithLIDStore,
 	logger: ILogger,
-	autoCleanCorrupted = true
 ) => {
 	const { fullMessage, author, sender } = decodeMessageNode(stanza, meId, meLid)
 	return {
@@ -422,34 +420,19 @@ export const decryptMessageNode = (
 							if (isRetryExhausted) {
 								logger.error(
 									errorContext,
-									`⚠️ Session corrupted and recovery failed after ${err.attempts} attempts. Auto-cleanup will attempt to recover.`
+									`⚠️ Session corrupted after ${err.attempts} attempts. Retry+pkmsg flow will recover.`
 								)
 							} else {
 								// First occurrence - log as warning since auto-recovery will attempt
 								logger.warn(errorContext, '⚠️ Corrupted session detected - attempting auto-recovery')
 							}
 
-							// Automatic cleanup of corrupted session (if enabled)
-							// eslint-disable-next-line max-depth
-							if (autoCleanCorrupted) {
-								// eslint-disable-next-line max-depth
-								try {
-									const deletedCount = await cleanupCorruptedSession(decryptionJid, repository, logger)
-
-									// Mask only user portion of JID for privacy (preserve domain info)
-									const { user, server } = jidDecode(decryptionJid) || {}
-									const maskedUser =
-										user && user.length > 8 ? `${user.substring(0, 4)}****${user.substring(user.length - 4)}` : user
-									const maskedJid = maskedUser && server ? `${maskedUser}@${server}` : decryptionJid
-
-									logger.info(
-										{ jid: decryptionJid, maskedJid, targetedDevices: deletedCount },
-										`🔄 Session Reset | JID: ${maskedJid} | Targeted: ${deletedCount} devices | Will recreate on next message`
-									)
-								} catch (cleanupErr) {
-									logger.error({ decryptionJid, err: cleanupErr }, '❌ Failed to cleanup corrupted session')
-								}
-							}
+							// Session cleanup is deferred to retry exhaustion (safety net).
+							// The Signal Protocol handles recovery naturally via retry+pkmsg:
+							// Bad MAC -> retry receipt -> sender re-sends as pkmsg -> new session.
+							// Deleting sessions here (hot path) causes cascading failures when
+							// multiple messages from the same contact arrive simultaneously.
+							// See: messages-recv.ts sendRetryRequest() for deferred cleanup.
 						} else if (isSessionRecord) {
 							// Session record errors are transient - retry should handle them
 							// eslint-disable-next-line max-depth
@@ -504,53 +487,20 @@ export function isCorruptedSessionError(error: any): boolean {
 }
 
 /**
- * Clean up corrupted session by deleting all device sessions for a JID
- * Signal Protocol will automatically recreate the session on next message
+ * Clean up corrupted session for a specific device JID.
+ * WABA behavior: DELETE sessions WHERE recipient_id=? AND device_id=?
+ * Only deletes the exact device that was corrupted, not all devices.
+ *
+ * NOTE: This should NOT be called on every Bad MAC error (hot path).
+ * Instead, let the retry+pkmsg flow handle recovery naturally (like WhatsApp does).
+ * Only call this as a safety net when retries are exhausted.
  */
-async function cleanupCorruptedSession(
+export async function cleanupCorruptedSession(
 	jid: string,
 	repository: SignalRepositoryWithLIDStore,
 	logger: ILogger
 ): Promise<number> {
-	const { user, device } = jidDecode(jid) || {}
-	if (!user) {
-		logger.warn({ jid }, 'Cannot cleanup session - invalid JID')
-		return 0
-	}
-
-	// Build list of JIDs to delete (primary + secondary devices)
-	const jidsToDelete: string[] = []
-
-	// Determine domain type correctly (handle hosted JIDs)
-	// JID formats:
-	//   - PN: user@s.whatsapp.net
-	//   - LID: user@lid
-	//   - Hosted PN: user@hosted
-	//   - Hosted LID: user@hosted.lid
-	const isLID = jid.endsWith('@lid') || jid.endsWith('@hosted.lid')
-	const isHosted = jid.includes('@hosted')
-
-	let domain: string
-	if (isLID) {
-		domain = isHosted ? 'hosted.lid' : 'lid'
-	} else {
-		domain = isHosted ? 'hosted' : 's.whatsapp.net'
-	}
-
-	// Primary device (0)
-	jidsToDelete.push(`${user}@${domain}`)
-
-	// Secondary devices (1-5 common range for Web/Desktop/etc)
-	for (let i = 1; i <= 5; i++) {
-		jidsToDelete.push(`${user}:${i}@${domain}`)
-	}
-
-	// If specific device was identified and > 5, ensure it's included
-	if (device !== undefined && device > 5) {
-		jidsToDelete.push(`${user}:${device}@${domain}`)
-	}
-
-	await repository.deleteSession(jidsToDelete)
-
-	return jidsToDelete.length
+	await repository.deleteSession([jid])
+	logger.info({ jid }, 'Cleaned up corrupted session for specific device')
+	return 1
 }

src/Utils/message-retry-manager.ts

@@ -211,15 +211,33 @@ export class MessageRetryManager {
 			}
 		}
 
-		// MAC errors require IMMEDIATE session recreation regardless of history
-		// This handles the case where contact reinstalled WhatsApp (identity key changed)
+		// MAC errors require session recreation, but rate-limited to prevent loops.
+		// When multiple messages fail with Bad MAC simultaneously, only the first
+		// should trigger recreation; subsequent ones within the cooldown window
+		// piggyback on the same new session established by the retry+pkmsg flow.
 		if (errorCode !== undefined && MAC_ERROR_CODES.has(errorCode)) {
-			this.sessionRecreateHistory.set(jid, Date.now())
+			const now = Date.now()
+			const prevTime = this.sessionRecreateHistory.get(jid)
+			const MAC_ERROR_COOLDOWN_MS = 1_000 // 1 second — WABA recovers faster
+
+			if (prevTime && now - prevTime < MAC_ERROR_COOLDOWN_MS) {
+				const reasonName = RetryReason[errorCode] || `code_${errorCode}`
+				this.logger.debug(
+					{ jid, errorCode: reasonName, msSinceLast: now - prevTime },
+					'MAC error session recreation skipped — cooldown active'
+				)
+				return {
+					reason: '',
+					recreate: false
+				}
+			}
+
+			this.sessionRecreateHistory.set(jid, now)
 			this.statistics.sessionRecreations++
 			const reasonName = RetryReason[errorCode] || `code_${errorCode}`
 			metrics.signalMacErrors?.inc({ action: 'session_recreation' })
 			metrics.signalSessionRecreations?.inc({ reason: 'mac_error' })
-			this.logger.warn({ jid, errorCode: reasonName }, 'MAC error detected, forcing immediate session recreation')
+			this.logger.warn({ jid, errorCode: reasonName }, 'MAC error detected, recreating session')
 			return {
 				reason: `MAC error (${reasonName}) - contact may have reinstalled WhatsApp`,
 				recreate: true

src/Utils/tc-token-utils.ts

@@ -159,7 +159,10 @@ export async function storeTcTokensFromIqResult({
 				[storageJid]: {
 					...existingEntry,
 					token: Buffer.from(tokenNode.content),
-					timestamp: tokenNode.attrs.t
+					timestamp: tokenNode.attrs.t,
+					// WABA Android: resets real_issue_timestamp to null when storing a new token
+					// (UPDATE wa_trusted_contacts_send SET real_issue_timestamp=null)
+					realIssueTimestamp: null
 				}
 			}
 		})

src/Utils/validate-connection.ts

@@ -14,6 +14,12 @@ import { encodeBigEndian } from './generics'
 import { createSignalIdentity } from './signal'
 
 const getUserAgent = (config: SocketConfig): proto.ClientPayload.IUserAgent => {
+	// Always use MACOS/Desktop identity for UserAgent — we connect via web
+	// protocol (WA\x06\x03) so the server expects a web-like UserAgent.
+	// Using SMB_ANDROID here causes pair code registration to fail with
+	// "não é possível conectar" even though the phone shows the confirmation.
+	// Android identity is only set in DeviceProps (registration node) which
+	// determines the display name in "Linked Devices".
 	return {
 		appVersion: {
 			primary: config.version[0],
@@ -26,7 +32,6 @@ const getUserAgent = (config: SocketConfig): proto.ClientPayload.IUserAgent => {
 		device: 'Desktop',
 		osBuildNumber: '0.1',
 		localeLanguageIso6391: 'en',
-
 		mnc: '000',
 		mcc: '000',
 		localeCountryIso31661Alpha2: config.countryCode
@@ -55,11 +60,10 @@ const getClientPayload = (config: SocketConfig) => {
 	const payload: proto.IClientPayload = {
 		connectType: proto.ClientPayload.ConnectType.WIFI_UNKNOWN,
 		connectReason: proto.ClientPayload.ConnectReason.USER_ACTIVATED,
-		userAgent: getUserAgent(config)
+		userAgent: getUserAgent(config),
+		webInfo: getWebInfo(config)
 	}
 
-	payload.webInfo = getWebInfo(config)
-
 	return payload
 }
 
@@ -84,6 +88,10 @@ export const generateLoginNode = (userJid: string, config: SocketConfig): proto.
 
 const getPlatformType = (platform: string): proto.DeviceProps.PlatformType => {
 	const platformType = platform.toUpperCase()
+	if (platformType === 'ANDROID') {
+		return proto.DeviceProps.PlatformType.ANDROID_PHONE
+	}
+
 	return (
 		proto.DeviceProps.PlatformType[platformType as keyof typeof proto.DeviceProps.PlatformType] ||
 		proto.DeviceProps.PlatformType.CHROME