Hello Jake
The root of the first error you encountered is the fact that a client’s time can be ahead or behind the replica’s time which receives the message. Moreover the time certified by the subnet’s nodes can differ from both those times as well. We are aware of the problem and we’re discussing different options to improve the situation. We should be able to communicate a more concrete plan soon.
For the second problem, please note that the ingress expiry ensures that a subnet will not start executing a message if the subnet time is higher than the expiry. It is not guaranteed though, that a message will be executed if its ingress expiry is within the bounds of the replica that got it first.
Since I don’t know the agents’ code, I cannot answer your question about the code.