fix: propagate metadata clears to receivers; thread inbox id through scoped store

Macroscope re-review round two. The High: clearing the last scoped key
produced a ProfileUpdate with no metadata field, which post-cutover
receivers treated as "no change" - a revoked grant survived forever on
the receiver. The wire cannot distinguish an empty map from an absent
one (proto3 map), but every wire client re-sends its full map on each
update - the legacy receivers replaced the stored map wholesale and the
CLI/agents were built against that (serve.ts merges existing metadata
into every send). The unified-profile cutover silently changed this to
keep-on-absent. Restore replace-including-clear semantics for the
addressed ProfileUpdate paths (stream, NSE, history replay): a winning
update's non-nil map replaces the stored one and an empty map clears it,
while nil (snapshot/appData fill paths) still says nothing. The recency
guard keeps an older replay from clearing newer data.

The Medium: the scoped-metadata store resolved the self inbox id through
its own provider, so a transiently nil answer mid-drain could silently
drop a conversation's scoped keys from a queued send. The scoped store
methods now take the caller's already-resolved inbox id explicitly,
matching the ProfileStore style.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: yewreeka

ConvosCore/Sources/ConvosCore/Inboxes/MessagingService+PushNotifications.swift

@@ -961,7 +961,9 @@ extension MessagingService {
                         name: update.hasName ? update.name : nil,
                         avatar: .addressed(update.hasEncryptedImage ? update.encryptedImage : nil),
                         memberKind: update.memberKind.dbMemberKind,
-                        metadata: metadata.isEmpty ? nil : metadata,
+                        // Authoritative whole map; empty propagates as a clear
+                        // (matches the stream path).
+                        metadata: metadata,
                         receivedAt: receivedAt
                     ),
                     selfInboxId: currentInboxId,

ConvosCore/Sources/ConvosCore/Profiles/Repository/ProfileInboundApplier.swift

@@ -26,6 +26,12 @@ enum ProfileInboundApplier {
 
     /// One inbound identity + avatar event for a member, before merge. Bundled so
     /// the seam's call sites (and `apply`) stay under the parameter-count limit.
+    ///
+    /// `metadata` semantics: non-nil is the sender's authoritative whole map -
+    /// a winning event replaces the stored one, and an empty map clears it
+    /// (ProfileUpdate paths pass the decoded map through untouched). Nil means
+    /// the event says nothing about metadata (snapshot/fill paths collapse an
+    /// empty map to nil so they can never clear).
     struct Incoming {
         let inboxId: String
         let source: ProfileSource

ConvosCore/Sources/ConvosCore/Profiles/Repository/ProfileMerge.swift

@@ -8,6 +8,11 @@ import Foundation
 /// - Guards: an empty/absent name never clears a populated one, a verified
 ///   assistant kind is never downgraded to generic `agent`, and the avatar is
 ///   tri-state (only `set`/`explicitClear` change a slot; `silent` leaves it).
+/// - Metadata: a non-nil incoming map is the sender's authoritative whole map -
+///   a winning event replaces the stored one, and an empty map clears it
+///   (revoked grants must propagate; every wire client re-sends its full map on
+///   each update, matching the legacy replace-wholesale receivers). Nil means
+///   the event says nothing about metadata and the stored map is kept.
 enum ProfileMerge {
     /// Trimmed, non-empty name, or nil. A name that is nil/blank/whitespace is
     /// treated as "no name provided".
@@ -44,7 +49,7 @@ enum ProfileMerge {
                 inboxId: inboxId,
                 name: nonBlank(incoming.name),
                 memberKind: incoming.memberKind,
-                metadata: incoming.metadata,
+                metadata: nonEmpty(incoming.metadata),
                 profileSource: source,
                 updatedAt: sentAt
             )
@@ -54,19 +59,30 @@ enum ProfileMerge {
         if winsOver(existingSource: existing.profileSource, existingUpdatedAt: existing.updatedAt, source: source, sentAt: sentAt) {
             result.name = nonBlank(incoming.name) ?? existing.name
             result.memberKind = preserveVerifiedKind(existing.memberKind, incoming.memberKind)
-            result.metadata = incoming.metadata ?? existing.metadata
+            // A winning event's non-nil map replaces the stored one wholesale;
+            // empty clears it (a revoked grant must not survive as stale
+            // metadata). Nil says nothing and keeps the stored map.
+            if let metadata = incoming.metadata {
+                result.metadata = metadata.isEmpty ? nil : metadata
+            }
             result.profileSource = source
             result.updatedAt = sentAt
         } else {
             // Lower precedence or older: fill blanks only; keep provenance and
             // never let a low-priority event change an existing kind.
             result.name = existing.name ?? nonBlank(incoming.name)
             result.memberKind = existing.memberKind ?? incoming.memberKind
-            result.metadata = existing.metadata ?? incoming.metadata
+            result.metadata = existing.metadata ?? nonEmpty(incoming.metadata)
         }
         return result
     }
 
+    /// Non-empty map, or nil. An empty map only means something (an explicit
+    /// clear) to a winning event; blank-fill and fresh rows treat it as absent.
+    private static func nonEmpty(_ metadata: ProfileMetadata?) -> ProfileMetadata? {
+        metadata.flatMap { $0.isEmpty ? nil : $0 }
+    }
+
     static func mergeAvatar(
         existing: DBProfileAvatar?,
         inboxId: String,

ConvosCore/Sources/ConvosCore/Profiles/Repository/ProfilePublisher.swift

@@ -215,7 +215,7 @@ actor ProfilePublisher {
         }
         let published = PublishedAvatar(url: url, salt: salt, nonce: nonce, key: key)
         let selfProfile = try await selfProfileStore.load()
-        let metadata = try await outgoingMetadata(for: job.conversationId, selfProfile: selfProfile)
+        let metadata = try await outgoingMetadata(for: job.conversationId, selfInboxId: selfInboxId, selfProfile: selfProfile)
         try await session.sendProfileUpdate(name: selfProfile?.name, metadata: metadata, avatar: published, conversationId: job.conversationId)
         let slot = DBProfileAvatar(
             inboxId: selfInboxId,
@@ -235,7 +235,7 @@ actor ProfilePublisher {
         let existing = try await profileStore.avatar(inboxId: selfInboxId, conversationId: job.conversationId)
         let published = publishedAvatar(from: existing)
         let selfProfile = try await selfProfileStore.load()
-        let metadata = try await outgoingMetadata(for: job.conversationId, selfProfile: selfProfile)
+        let metadata = try await outgoingMetadata(for: job.conversationId, selfInboxId: selfInboxId, selfProfile: selfProfile)
         try await session.sendProfileUpdate(name: selfProfile?.name, metadata: metadata, avatar: published, conversationId: job.conversationId)
         await stampPublished(selfProfile, conversationId: job.conversationId)
     }
@@ -277,16 +277,18 @@ actor ProfilePublisher {
             avatar: publishedAvatar(from: slot),
             conversationId: conversationId
         )
-        try await selfProfileStore.saveScopedMetadata(metadata, conversationId: conversationId, updatedAt: now())
+        try await selfProfileStore.saveScopedMetadata(metadata, inboxId: selfInboxId, conversationId: conversationId, updatedAt: now())
     }
 
     /// The metadata map for an outgoing ProfileUpdate to one conversation: the
     /// global self metadata with that conversation's scoped keys merged over it
     /// (scoped wins). Keeps every queue send carrying the conversation's grants
     /// and timezone, so a later name or avatar publish can never wipe them at
-    /// the receiver.
-    private func outgoingMetadata(for conversationId: String, selfProfile: DBMyProfile?) async throws -> ProfileMetadata? {
-        let scoped = try await selfProfileStore.scopedMetadata(conversationId: conversationId)
+    /// the receiver. The caller's already-resolved inbox id is threaded through
+    /// so the store read cannot disagree with the publish about the active
+    /// account mid-flight.
+    private func outgoingMetadata(for conversationId: String, selfInboxId: String, selfProfile: DBMyProfile?) async throws -> ProfileMetadata? {
+        let scoped = try await selfProfileStore.scopedMetadata(inboxId: selfInboxId, conversationId: conversationId)
         return Self.mergedMetadata(global: selfProfile?.metadata, scoped: scoped)
     }
 

ConvosCore/Sources/ConvosCore/Profiles/Repository/Stores/SelfProfileStore.swift

@@ -14,12 +14,15 @@ protocol SelfProfileStoreProtocol: Sendable {
     /// The current user's conversation-scoped metadata map (cloud connection
     /// grants, agent timezone) for one conversation, or nil when none was ever
     /// published there. Scoped keys are merged over the global metadata at send
-    /// time; they never live in `DBMyProfile.metadata`.
-    func scopedMetadata(conversationId: String) async throws -> ProfileMetadata?
+    /// time; they never live in `DBMyProfile.metadata`. Takes the inbox id
+    /// explicitly (unlike `load`) so a publish that already resolved the self
+    /// inbox cannot silently read a different account's rows if the provider's
+    /// answer changes mid-flight.
+    func scopedMetadata(inboxId: String, conversationId: String) async throws -> ProfileMetadata?
 
     /// Persists the conversation-scoped metadata map for one conversation.
     /// A nil or empty map deletes the row.
-    func saveScopedMetadata(_ metadata: ProfileMetadata?, conversationId: String, updatedAt: Date) async throws
+    func saveScopedMetadata(_ metadata: ProfileMetadata?, inboxId: String, conversationId: String, updatedAt: Date) async throws
 }
 
 final class GRDBSelfProfileStore: SelfProfileStoreProtocol {
@@ -75,18 +78,16 @@ final class GRDBSelfProfileStore: SelfProfileStoreProtocol {
         }
     }
 
-    func scopedMetadata(conversationId: String) async throws -> ProfileMetadata? {
-        guard let inboxId = await selfInboxIdProvider() else { return nil }
-        return try await databaseReader.read { db in
+    func scopedMetadata(inboxId: String, conversationId: String) async throws -> ProfileMetadata? {
+        try await databaseReader.read { db in
             try DBSelfConversationMetadata
                 .filter(DBSelfConversationMetadata.Columns.inboxId == inboxId)
                 .filter(DBSelfConversationMetadata.Columns.conversationId == conversationId)
                 .fetchOne(db)?.metadata
         }
     }
 
-    func saveScopedMetadata(_ metadata: ProfileMetadata?, conversationId: String, updatedAt: Date) async throws {
-        guard let inboxId = await selfInboxIdProvider() else { return }
+    func saveScopedMetadata(_ metadata: ProfileMetadata?, inboxId: String, conversationId: String, updatedAt: Date) async throws {
         try await databaseWriter.write { db in
             guard let metadata, !metadata.isEmpty else {
                 _ = try DBSelfConversationMetadata
@@ -107,7 +108,7 @@ final class GRDBSelfProfileStore: SelfProfileStoreProtocol {
 
 actor InMemorySelfProfileStore: SelfProfileStoreProtocol {
     private var current: DBMyProfile?
-    private var scopedByConversation: [String: ProfileMetadata] = [:]
+    private var scopedByInbox: [String: [String: ProfileMetadata]] = [:]
 
     func save(_ profile: DBMyProfile) {
         current = profile
@@ -119,18 +120,18 @@ actor InMemorySelfProfileStore: SelfProfileStoreProtocol {
 
     func clear() {
         current = nil
-        scopedByConversation = [:]
+        scopedByInbox = [:]
     }
 
-    func scopedMetadata(conversationId: String) -> ProfileMetadata? {
-        scopedByConversation[conversationId]
+    func scopedMetadata(inboxId: String, conversationId: String) -> ProfileMetadata? {
+        scopedByInbox[inboxId]?[conversationId]
     }
 
-    func saveScopedMetadata(_ metadata: ProfileMetadata?, conversationId: String, updatedAt: Date) {
+    func saveScopedMetadata(_ metadata: ProfileMetadata?, inboxId: String, conversationId: String, updatedAt: Date) {
         guard let metadata, !metadata.isEmpty else {
-            scopedByConversation[conversationId] = nil
+            scopedByInbox[inboxId]?[conversationId] = nil
             return
         }
-        scopedByConversation[conversationId] = metadata
+        scopedByInbox[inboxId, default: [:]][conversationId] = metadata
     }
 }

ConvosCore/Sources/ConvosCore/Storage/Writers/ConversationWriter.swift

@@ -1204,7 +1204,10 @@ class ConversationWriter: ConversationWriterProtocol, @unchecked Sendable {
                             name: entry.update.hasName ? entry.update.name : nil,
                             avatar: .fillIfPresent(entry.update.hasEncryptedImage ? entry.update.encryptedImage : nil),
                             memberKind: entry.update.memberKind.dbMemberKind,
-                            metadata: metadata.isEmpty ? nil : metadata,
+                            // Authoritative whole map from the newest replayed
+                            // update; empty propagates as a clear. The recency
+                            // guard keeps an older replay from beating live data.
+                            metadata: metadata,
                             receivedAt: entry.sentAt
                         ),
                         selfInboxId: selfInboxId,

ConvosCore/Sources/ConvosCore/Syncing/StreamProcessor.swift

@@ -499,7 +499,10 @@ actor StreamProcessor: StreamProcessorProtocol {
                         name: update.hasName ? update.name : nil,
                         avatar: .addressed(update.hasEncryptedImage ? update.encryptedImage : nil),
                         memberKind: update.memberKind.dbMemberKind,
-                        metadata: metadata.isEmpty ? nil : metadata,
+                        // A ProfileUpdate's map is authoritative; pass it through
+                        // even when empty so a cleared map (e.g. revoked grants)
+                        // propagates as a clear instead of reading as "no change".
+                        metadata: metadata,
                         receivedAt: receivedAt
                     ),
                     selfInboxId: currentInboxId,

ConvosCore/Tests/ConvosCoreTests/ProfileInboundApplierTests.swift

@@ -66,6 +66,7 @@ struct ProfileInboundApplierTests {
         source: ProfileSource = .profileUpdate,
         name: String?,
         avatar: ProfileInboundApplier.AvatarDisposition,
+        metadata: ProfileMetadata? = nil,
         selfInboxId: String? = "me",
         fallbackKey: Data? = nil,
         sentAt: Date
@@ -80,7 +81,7 @@ struct ProfileInboundApplierTests {
                     name: name,
                     avatar: avatar,
                     memberKind: nil,
-                    metadata: nil,
+                    metadata: metadata,
                     receivedAt: sentAt
                 ),
                 selfInboxId: selfInboxId,
@@ -208,4 +209,44 @@ struct ProfileInboundApplierTests {
         let contact = try queue.read { db in try DBContact.fetchOne(db, key: "bob") }
         #expect(contact == nil)
     }
+
+    @Test("a newer update's empty metadata map clears the stored metadata (revoked grants propagate)")
+    func updateEmptyMetadataClears() throws {
+        let queue = try makeQueue()
+        try apply(queue, inboxId: "alice", name: "Alice", avatar: .addressed(nil), metadata: ["connections": .string("grants")], sentAt: Date(timeIntervalSince1970: 1))
+        let seeded = try profile(queue, inboxId: "alice")
+        #expect(seeded?.metadata?["connections"] == .string("grants"))
+
+        // The sender revoked their last grant: the update's map is empty.
+        try apply(queue, inboxId: "alice", name: "Alice", avatar: .addressed(nil), metadata: [:], sentAt: Date(timeIntervalSince1970: 2))
+
+        let cleared = try profile(queue, inboxId: "alice")
+        #expect(cleared?.metadata == nil)
+    }
+
+    @Test("a newer update's non-empty metadata map replaces the stored one wholesale")
+    func updateMetadataReplacesWholesale() throws {
+        let queue = try makeQueue()
+        try apply(queue, inboxId: "alice", name: "Alice", avatar: .addressed(nil), metadata: ["connections": .string("grants")], sentAt: Date(timeIntervalSince1970: 1))
+        try apply(queue, inboxId: "alice", name: "Alice", avatar: .addressed(nil), metadata: ["timezone": .string("Europe/Paris")], sentAt: Date(timeIntervalSince1970: 2))
+
+        let replaced = try profile(queue, inboxId: "alice")
+        #expect(replaced?.metadata?["timezone"] == .string("Europe/Paris"))
+        #expect(replaced?.metadata?["connections"] == nil)
+    }
+
+    @Test("an older replayed update cannot clear newer metadata, and a snapshot never clears")
+    func staleAndSnapshotEventsCannotClearMetadata() throws {
+        let queue = try makeQueue()
+        try apply(queue, inboxId: "alice", name: "Alice", avatar: .addressed(nil), metadata: ["connections": .string("grants")], sentAt: Date(timeIntervalSince1970: 5))
+
+        // A replayed older update (empty map) loses on recency.
+        try apply(queue, inboxId: "alice", name: "Alice", avatar: .addressed(nil), metadata: [:], sentAt: Date(timeIntervalSince1970: 1))
+        // A snapshot path collapses empty to nil before the applier, so it says
+        // nothing about metadata even when newer.
+        try apply(queue, inboxId: "alice", source: .profileSnapshot, name: "Alice", avatar: .fillIfPresent(nil), metadata: nil, sentAt: Date(timeIntervalSince1970: 9))
+
+        let kept = try profile(queue, inboxId: "alice")
+        #expect(kept?.metadata?["connections"] == .string("grants"))
+    }
 }

ConvosCore/Tests/ConvosCoreTests/ProfileMergeTests.swift

@@ -93,6 +93,62 @@ struct ProfileMergeIdentityTests {
         )
         #expect(upgrade.memberKind == .verifiedConvos)
     }
+
+    @Test("a winning event's metadata is authoritative: replaces wholesale, empty clears, nil keeps")
+    func metadataReplaceClearKeep() {
+        let existing = DBProfile(
+            inboxId: "i", name: "Alice", metadata: ["connections": .string("grants")],
+            profileSource: .profileUpdate, updatedAt: t1
+        )
+
+        let replaced = ProfileMerge.mergeIdentity(
+            existing: existing, inboxId: "i", incoming: IncomingIdentity(metadata: ["timezone": .string("Europe/Paris")]),
+            source: .profileUpdate, sentAt: t2
+        )
+        #expect(replaced.metadata?["timezone"] == .string("Europe/Paris"))
+        #expect(replaced.metadata?["connections"] == nil)
+
+        let cleared = ProfileMerge.mergeIdentity(
+            existing: existing, inboxId: "i", incoming: IncomingIdentity(metadata: [:]),
+            source: .profileUpdate, sentAt: t2
+        )
+        #expect(cleared.metadata == nil)
+
+        let kept = ProfileMerge.mergeIdentity(
+            existing: existing, inboxId: "i", incoming: IncomingIdentity(name: "Alice", metadata: nil),
+            source: .profileUpdate, sentAt: t2
+        )
+        #expect(kept.metadata?["connections"] == .string("grants"))
+    }
+
+    @Test("a losing event's empty metadata neither clears nor fills")
+    func losingEmptyMetadataIsInert() {
+        let existing = DBProfile(
+            inboxId: "i", name: "Alice", metadata: ["connections": .string("grants")],
+            profileSource: .profileUpdate, updatedAt: t2
+        )
+
+        // Older same-source event with an empty map: loses on recency, keeps.
+        let stale = ProfileMerge.mergeIdentity(
+            existing: existing, inboxId: "i", incoming: IncomingIdentity(metadata: [:]),
+            source: .profileUpdate, sentAt: t1
+        )
+        #expect(stale.metadata?["connections"] == .string("grants"))
+
+        // Lower-source event with an empty map: fill-only, and empty fills nothing.
+        let lower = ProfileMerge.mergeIdentity(
+            existing: existing, inboxId: "i", incoming: IncomingIdentity(metadata: [:]),
+            source: .profileSnapshot, sentAt: t2
+        )
+        #expect(lower.metadata?["connections"] == .string("grants"))
+
+        // A fresh row from an empty map stores nil, not an empty map.
+        let fresh = ProfileMerge.mergeIdentity(
+            existing: nil, inboxId: "i", incoming: IncomingIdentity(name: "Alice", metadata: [:]),
+            source: .profileUpdate, sentAt: t1
+        )
+        #expect(fresh.metadata == nil)
+    }
 }
 
 @Suite("Profile merge - avatar")