Extract BLE packet handlers and migrate coordinators to narrow contexts

BLEService's per-packet-type orchestration moves into owned, tested
components (BLEAnnounceHandler, BLEPublicMessageHandler,
BLENoisePacketHandler, BLEFileTransferHandler, BLEFragmentHandler),
each taking an environment struct of closures so every queue hop stays
in BLEService and the handlers are synchronously testable. Behavior is
preserved verbatim, including Noise session recovery on decrypt failure
and single-block UI event ordering. handleLeave/handleRequestSync stay
in place as already-thin delegations. BLEService drops to 3393 lines.

Four coordinators (delivery, private conversation, Nostr, public
conversation) drop their unowned/weak ChatViewModel back-references for
narrow @MainActor context protocols, with ChatViewModel conformances as
single shared witnesses for overlapping members. Their true coupling is
now an explicit, reviewable surface, and each gains a mock-context test
suite covering flows previously testable only through the full view
model. Delivery/read acks now also clear the router's retained-send
outbox via the delivery context.

New LargeTopologyTests exercise production-shaped meshes with the
in-memory harness: an 8-peer relay chain with per-hop TTL decay, a
14-peer cyclic mesh with exactly-once delivery, partition/heal, and
topology churn.

App-layer runtime/model files updated alongside.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bitchat/App/AppArchitecture.swift

@@ -207,9 +207,14 @@ final class ConversationStore: ObservableObject {
     private var directHandlesByConversation: [ConversationID: PeerHandle] = [:]
 
     func setActiveChannel(_ channelID: ChannelID) {
-        activeChannel = channelID
+        if activeChannel != channelID {
+            activeChannel = channelID
+        }
         if selectedPrivatePeerID == nil {
-            selectedConversationID = ConversationID(channelID: channelID)
+            let conversationID = ConversationID(channelID: channelID)
+            if selectedConversationID != conversationID {
+                selectedConversationID = conversationID
+            }
         }
     }
 
@@ -218,21 +223,33 @@ final class ConversationStore: ObservableObject {
         activeChannel: ChannelID,
         identityResolver: IdentityResolver
     ) {
-        self.activeChannel = activeChannel
-        selectedPrivatePeerID = peerID
+        if self.activeChannel != activeChannel {
+            self.activeChannel = activeChannel
+        }
+        if selectedPrivatePeerID != peerID {
+            selectedPrivatePeerID = peerID
+        }
 
         if let peerID {
-            selectedConversationID = directConversationID(
+            let conversationID = directConversationID(
                 for: peerID,
                 identityResolver: identityResolver
             )
+            if selectedConversationID != conversationID {
+                selectedConversationID = conversationID
+            }
         } else {
-            selectedConversationID = ConversationID(channelID: activeChannel)
+            let conversationID = ConversationID(channelID: activeChannel)
+            if selectedConversationID != conversationID {
+                selectedConversationID = conversationID
+            }
         }
     }
 
     func replaceMessages(_ messages: [BitchatMessage], for conversationID: ConversationID) {
-        messagesByConversation[conversationID] = normalized(messages)
+        let normalizedMessages = normalized(messages)
+        guard messagesByConversation[conversationID] != normalizedMessages else { return }
+        messagesByConversation[conversationID] = normalizedMessages
     }
 
     func replaceMessages(_ messages: [BitchatMessage], for channelID: ChannelID) {
@@ -296,7 +313,7 @@ final class ConversationStore: ObservableObject {
             let conversationID = ConversationID.direct(handle)
             liveConversations.insert(conversationID)
             directHandlesByConversation[conversationID] = handle
-            messagesByConversation[conversationID] = normalized(messages)
+            replaceMessages(messages, for: conversationID)
         }
 
         let staleDirectConversations = messagesByConversation.keys.filter { conversationID in
@@ -319,10 +336,13 @@ final class ConversationStore: ObservableObject {
             }
         }
 
-        unreadConversations = unreadPeerIDs.reduce(into: publicUnread) { result, peerID in
+        let nextUnreadConversations = unreadPeerIDs.reduce(into: publicUnread) { result, peerID in
             let handle = identityResolver.canonicalHandle(for: peerID)
             result.insert(.direct(handle))
         }
+        if unreadConversations != nextUnreadConversations {
+            unreadConversations = nextUnreadConversations
+        }
     }
 
     func markRead(_ conversationID: ConversationID) {

bitchat/App/PrivateConversationModels.swift

@@ -63,6 +63,7 @@ final class PrivateInboxModel: ObservableObject {
             nextMessagesByPeerID[peerID] = []
         }
 
+        guard messagesByPeerID != nextMessagesByPeerID else { return }
         messagesByPeerID = nextMessagesByPeerID
     }
 }

bitchat/App/PublicChatModel.swift

@@ -36,6 +36,8 @@ final class PublicChatModel: ObservableObject {
     }
 
     private func refreshMessages() {
-        messages = conversationStore.messages(for: ConversationID(channelID: activeChannel))
+        let nextMessages = conversationStore.messages(for: ConversationID(channelID: activeChannel))
+        guard messages != nextMessages else { return }
+        messages = nextMessages
     }
 }

bitchat/Services/BLE/BLEAnnounceHandler.swift

@@ -0,0 +1,209 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+/// Narrow environment for `BLEAnnounceHandler`.
+///
+/// All queue hops (collections barrier, BLE-queue link-state reads, main-actor
+/// UI notification, delayed re-announce) live inside the closures supplied by
+/// `BLEService`, keeping the handler queue-agnostic and synchronously testable.
+struct BLEAnnounceHandlerEnvironment {
+    /// Local peer identity at the time the announce is handled.
+    let localPeerID: () -> PeerID
+    /// TTL value used for direct (non-relayed) packets.
+    let messageTTL: UInt8
+    /// Current time source.
+    let now: () -> Date
+    /// Noise public key already recorded for the peer, if any (registry read).
+    let existingNoisePublicKey: (PeerID) -> Data?
+    /// Verifies the packet signature against the announced signing key.
+    let verifySignature: (_ packet: BitchatPacket, _ signingPublicKey: Data) -> Bool
+    /// Direct link state for the peer (BLE-queue read).
+    let linkState: (PeerID) -> (hasPeripheral: Bool, hasCentral: Bool)
+    /// Runs the registry mutation phase under the collections barrier.
+    let withRegistryBarrier: (() -> Void) -> Void
+    /// Upserts the verified announce into the peer registry.
+    /// Must only be called from inside `withRegistryBarrier`.
+    let upsertVerifiedAnnounce: (
+        _ peerID: PeerID,
+        _ announcement: AnnouncementPacket,
+        _ isConnected: Bool,
+        _ now: Date
+    ) -> BLEPeerAnnounceUpdate
+    /// Debounced reconnect-log decision.
+    /// Must only be called from inside `withRegistryBarrier`.
+    let shouldEmitReconnectLog: (_ peerID: PeerID, _ now: Date) -> Bool
+    /// Records verified direct-neighbor claims in the mesh topology.
+    let updateTopology: (_ peerID: PeerID, _ neighbors: [Data]) -> Void
+    /// Persists the announced cryptographic identity for offline verification.
+    let persistIdentity: (AnnouncementPacket) -> Void
+    /// Announce-back dedup check.
+    let dedupContains: (String) -> Bool
+    /// Announce-back dedup marking.
+    let dedupMarkProcessed: (String) -> Void
+    /// Delivers the announce UI events as one ordered main-actor hop:
+    /// `.peerConnected` (if flagged) → initial gossip sync scheduling (if
+    /// flagged) → peer-ID snapshot + data publish + `.peerListUpdated`.
+    /// A single closure keeps the original in-order delivery guarantee that
+    /// separate unstructured tasks would not provide.
+    let deliverAnnounceUIEvents: (
+        _ peerID: PeerID,
+        _ notifyPeerConnected: Bool,
+        _ scheduleInitialSync: Bool
+    ) -> Void
+    /// Tracks the announce packet for gossip sync.
+    let trackPacketSeen: (BitchatPacket) -> Void
+    /// Reciprocates the announce for bidirectional discovery.
+    let sendAnnounceBack: () -> Void
+    /// Schedules a delayed re-announce (afterglow) after the given delay.
+    let scheduleAfterglow: (TimeInterval) -> Void
+}
+
+/// Orchestrates inbound announce packets: preflight validation, signature
+/// trust, registry/topology updates, identity persistence, UI notification,
+/// gossip tracking, and the reciprocal announce response.
+final class BLEAnnounceHandler {
+    private let environment: BLEAnnounceHandlerEnvironment
+
+    init(environment: BLEAnnounceHandlerEnvironment) {
+        self.environment = environment
+    }
+
+    func handle(_ packet: BitchatPacket, from peerID: PeerID) {
+        let env = environment
+        let now = env.now()
+        let preflight = BLEAnnouncePreflightPolicy.evaluate(
+            packet: packet,
+            from: peerID,
+            localPeerID: env.localPeerID(),
+            now: now
+        )
+
+        let announcement: AnnouncementPacket
+        switch preflight {
+        case .accept(let acceptance):
+            announcement = acceptance.announcement
+        case .reject(.malformed):
+            SecureLogger.error("❌ Failed to decode announce packet from \(peerID.id.prefix(8))…", category: .session)
+            return
+        case .reject(.senderMismatch(let derivedFromKey)):
+            SecureLogger.warning("⚠️ Announce sender mismatch: derived \(derivedFromKey.id.prefix(8))… vs packet \(peerID.id.prefix(8))…", category: .security)
+            return
+        case .reject(.selfAnnounce):
+            return
+        case .reject(.stale(let ageSeconds)):
+            SecureLogger.debug("⏰ Ignoring stale announce from \(peerID.id.prefix(8))… (age: \(ageSeconds)s)", category: .session)
+            return
+        }
+
+        // Suppress announce logs to reduce noise
+
+        // Precompute signature verification outside barrier to reduce contention
+        let existingNoisePublicKey = env.existingNoisePublicKey(peerID)
+        let hasSignature = packet.signature != nil
+        let signatureValid: Bool
+        if hasSignature {
+            signatureValid = env.verifySignature(packet, announcement.signingPublicKey)
+            if !signatureValid {
+                SecureLogger.warning("⚠️ Signature verification for announce failed \(peerID.id.prefix(8))", category: .security)
+            }
+        } else {
+            signatureValid = false
+        }
+        let trustDecision = BLEAnnounceTrustPolicy.evaluate(
+            hasSignature: hasSignature,
+            signatureValid: signatureValid,
+            existingNoisePublicKey: existingNoisePublicKey,
+            announcedNoisePublicKey: announcement.noisePublicKey
+        )
+        if case .reject(.keyMismatch) = trustDecision {
+            SecureLogger.warning("⚠️ Announce key mismatch for \(peerID.id.prefix(8))… — keeping unverified", category: .security)
+        }
+        let verifiedAnnounce = trustDecision.isVerified
+
+        var isNewPeer = false
+        var isReconnectedPeer = false
+        let directLinkState = env.linkState(peerID)
+        let isDirectAnnounce = packet.ttl == env.messageTTL
+
+        env.withRegistryBarrier {
+            let hasPeripheralConnection = directLinkState.hasPeripheral
+            let hasCentralSubscription = directLinkState.hasCentral
+
+            // Require verified announce; ignore otherwise (no backward compatibility)
+            if !verifiedAnnounce {
+                SecureLogger.warning("❌ Ignoring unverified announce from \(peerID.id.prefix(8))…", category: .security)
+                // Reset flags to prevent post-barrier code from acting on unverified announces
+                isNewPeer = false
+                isReconnectedPeer = false
+                return
+            }
+
+            let update = env.upsertVerifiedAnnounce(
+                peerID,
+                announcement,
+                isDirectAnnounce || hasPeripheralConnection || hasCentralSubscription,
+                now
+            )
+            isNewPeer = update.isNewPeer
+            isReconnectedPeer = update.wasDisconnected
+
+            // Log connection status only for direct connectivity changes; debounce to reduce spam
+            if isDirectAnnounce || hasPeripheralConnection || hasCentralSubscription {
+                let now = env.now()
+                if update.isNewPeer {
+                    SecureLogger.debug("🆕 New peer: \(announcement.nickname)", category: .session)
+                } else if update.wasDisconnected {
+                    if env.shouldEmitReconnectLog(peerID, now) {
+                        SecureLogger.debug("🔄 Peer \(announcement.nickname) reconnected", category: .session)
+                    }
+                } else if let previousNickname = update.previousNickname, previousNickname != announcement.nickname {
+                    SecureLogger.debug("🔄 Peer \(peerID.id.prefix(8))… changed nickname: \(previousNickname) -> \(announcement.nickname)", category: .session)
+                }
+            }
+        }
+
+        // Update topology with verified neighbor claims (only for authenticated announces)
+        if verifiedAnnounce, let neighbors = announcement.directNeighbors {
+            env.updateTopology(peerID, neighbors)
+        }
+
+        // Persist cryptographic identity and signing key for robust offline verification
+        env.persistIdentity(announcement)
+
+        let announceBackID = "announce-back-\(peerID)"
+        let shouldSendBack = !env.dedupContains(announceBackID)
+        if shouldSendBack {
+            env.dedupMarkProcessed(announceBackID)
+        }
+        let responsePlan = BLEAnnounceResponsePolicy.plan(
+            isDirectAnnounce: isDirectAnnounce,
+            isNewPeer: isNewPeer,
+            isReconnectedPeer: isReconnectedPeer,
+            shouldSendAnnounceBack: shouldSendBack
+        )
+
+        // Only notify of connection for new or reconnected peers when it is a
+        // direct announce; the list update always follows in the same hop.
+        env.deliverAnnounceUIEvents(
+            peerID,
+            responsePlan.shouldNotifyPeerConnected,
+            responsePlan.shouldNotifyPeerConnected && responsePlan.shouldScheduleInitialSync
+        )
+
+        // Track for sync (include our own and others' announces)
+        env.trackPacketSeen(packet)
+
+        if responsePlan.shouldSendAnnounceBack {
+            // Reciprocate announce for bidirectional discovery
+            // Force send to ensure the peer receives our announce
+            env.sendAnnounceBack()
+        }
+
+        // Afterglow: on first-seen peers, schedule a short re-announce to push presence one more hop
+        if responsePlan.shouldScheduleAfterglow {
+            let delay = Double.random(in: 0.3...0.6)
+            env.scheduleAfterglow(delay)
+        }
+    }
+}

bitchat/Services/BLE/BLEFileTransferHandler.swift

@@ -0,0 +1,123 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+/// Narrow environment for `BLEFileTransferHandler`.
+///
+/// All queue hops (collections registry reads/writes, main-actor UI
+/// notification) live inside the closures supplied by `BLEService`, keeping
+/// the handler queue-agnostic and synchronously testable.
+struct BLEFileTransferHandlerEnvironment {
+    /// Local peer identity at the time the transfer is handled.
+    let localPeerID: () -> PeerID
+    /// Local nickname used for sender resolution and collision checks.
+    let localNickname: () -> String
+    /// Snapshot of known peers keyed by ID (registry read).
+    let peersSnapshot: () -> [PeerID: BLEPeerInfo]
+    /// Resolves a display name from a verified packet signature for peers missing from the registry.
+    let signedSenderDisplayName: (_ packet: BitchatPacket, _ peerID: PeerID) -> String?
+    /// Tracks the broadcast file packet for gossip sync.
+    let trackPacketSeen: (BitchatPacket) -> Void
+    /// Enforces the incoming-media storage quota before saving (BCH-01-002).
+    let enforceStorageQuota: (_ reservingBytes: Int) -> Void
+    /// Persists the validated file to the incoming-media store; returns the destination URL.
+    let saveIncomingFile: (
+        _ data: Data,
+        _ preferredName: String?,
+        _ subdirectory: String,
+        _ fallbackExtension: String?,
+        _ defaultPrefix: String
+    ) -> URL?
+    /// Updates the registry last-seen timestamp for the peer (async barrier write).
+    let updatePeerLastSeen: (PeerID) -> Void
+    /// Delivers `.messageReceived` to the UI as one main-actor hop.
+    let deliverMessage: (BitchatMessage) -> Void
+}
+
+/// Orchestrates inbound file transfers: self-echo policy, sender display-name
+/// resolution, delivery planning, payload validation, quota-checked storage,
+/// and UI delivery.
+final class BLEFileTransferHandler {
+    private let environment: BLEFileTransferHandlerEnvironment
+
+    init(environment: BLEFileTransferHandlerEnvironment) {
+        self.environment = environment
+    }
+
+    func handle(_ packet: BitchatPacket, from peerID: PeerID) {
+        let env = environment
+        if BLEFileTransferPolicy.isSelfEcho(packet: packet, from: peerID, localPeerID: env.localPeerID()) { return }
+
+        let peersSnapshot = env.peersSnapshot()
+        guard let senderNickname = BLEPeerSenderDisplayName.resolveKnownPeer(
+            peerID: peerID,
+            localPeerID: env.localPeerID(),
+            localNickname: env.localNickname(),
+            peers: peersSnapshot,
+            allowConnectedUnverified: true
+        ) ?? env.signedSenderDisplayName(packet, peerID) else {
+            SecureLogger.warning("🚫 Dropping file transfer from unverified or unknown peer \(peerID.id.prefix(8))…", category: .security)
+            return
+        }
+
+        guard let deliveryPlan = BLEFileTransferPolicy.deliveryPlan(packet: packet, localPeerID: env.localPeerID()) else {
+            return
+        }
+        if deliveryPlan.shouldTrackForSync {
+            env.trackPacketSeen(packet)
+        }
+
+        let filePacket: BitchatFilePacket
+        let mime: MimeType
+        switch BLEIncomingFileValidator.validate(payload: packet.payload) {
+        case .success(let acceptance):
+            filePacket = acceptance.filePacket
+            mime = acceptance.mime
+        case .failure(.malformedPayload):
+            SecureLogger.error("❌ Failed to decode file transfer payload", category: .session)
+            return
+        case .failure(.payloadTooLarge(let bytes)):
+            SecureLogger.warning("🚫 Dropping file transfer exceeding size cap (\(bytes) bytes)", category: .security)
+            return
+        case .failure(.unsupportedMime(let mimeType, let bytes)):
+            SecureLogger.warning("🚫 MIME REJECT: '\(mimeType ?? "<empty>")' not supported. Size=\(bytes)b from \(peerID.id.prefix(8))...", category: .security)
+            return
+        case .failure(.magicMismatch(let mime, let bytes, let prefixHex)):
+            SecureLogger.warning("🚫 MAGIC REJECT: MIME='\(mime)' size=\(bytes)b prefix=[\(prefixHex)] from \(peerID.id.prefix(8))...", category: .security)
+            return
+        }
+
+        // BCH-01-002: Enforce storage quota before saving
+        env.enforceStorageQuota(filePacket.content.count)
+
+        guard let destination = env.saveIncomingFile(
+            filePacket.content,
+            filePacket.fileName,
+            "\(mime.category.mediaDir)/incoming",
+            mime.defaultExtension,
+            mime.category.rawValue
+        ) else {
+            return
+        }
+
+        if deliveryPlan.isPrivateMessage {
+            env.updatePeerLastSeen(peerID)
+        }
+
+        let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
+        let message = BitchatMessage(
+            sender: senderNickname,
+            content: "\(mime.category.messagePrefix)\(destination.lastPathComponent)",
+            timestamp: ts,
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: deliveryPlan.isPrivateMessage,
+            recipientNickname: nil,
+            senderPeerID: peerID
+        )
+
+        SecureLogger.debug("📁 Stored incoming media from \(peerID.id.prefix(8))… -> \(destination.lastPathComponent)", category: .session)
+
+        env.deliverMessage(message)
+    }
+}

bitchat/Services/BLE/BLEFragmentHandler.swift

@@ -0,0 +1,94 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+/// Narrow environment for `BLEFragmentHandler`.
+///
+/// All queue hops (the message-queue entry hop and the collections barrier
+/// around the assembly buffer) live on the `BLEService` side — the entry hop
+/// in `BLEService.handleFragment`, the barrier inside the supplied closures —
+/// keeping the handler queue-agnostic and synchronously testable.
+struct BLEFragmentHandlerEnvironment {
+    /// Local peer identity at the time the fragment is handled.
+    let localPeerID: () -> PeerID
+    /// Tracks broadcast fragments for gossip sync.
+    let trackPacketSeen: (BitchatPacket) -> Void
+    /// Appends the fragment to the assembly buffer (collections barrier write).
+    let appendFragment: (BLEFragmentHeader) -> BLEFragmentAssemblyBuffer.AppendResult
+    /// Ingress acceptance check for the reassembled inner packet.
+    let isAcceptedIngressPayload: (_ packet: BitchatPacket, _ innerSender: PeerID) -> Bool
+    /// Re-enters the receive pipeline with the reassembled packet (TTL already zeroed).
+    let processReassembledPacket: (_ packet: BitchatPacket, _ from: PeerID) -> Void
+}
+
+/// Orchestrates inbound fragments: self-fragment suppression, gossip tracking,
+/// assembly-buffer appends, and reassembled-packet validation and re-injection
+/// into the receive pipeline.
+final class BLEFragmentHandler {
+    private let environment: BLEFragmentHandlerEnvironment
+
+    init(environment: BLEFragmentHandlerEnvironment) {
+        self.environment = environment
+    }
+
+    func handle(_ packet: BitchatPacket, from peerID: PeerID) {
+        let env = environment
+        // Don't process our own fragments
+        if peerID == env.localPeerID() {
+            return
+        }
+
+        guard let header = BLEFragmentHeader(packet: packet) else { return }
+
+        if header.isBroadcastFragment {
+            env.trackPacketSeen(packet)
+        }
+
+        let assemblyResult = env.appendFragment(header)
+
+        logFragmentAssemblyResult(assemblyResult)
+
+        guard case let .complete(completedHeader, reassembled, _) = assemblyResult else { return }
+
+        // Decode the original packet bytes we reassembled, so flags/compression are preserved
+        if var originalPacket = BinaryProtocol.decode(reassembled) {
+
+            // Reassembled packet validation
+            let innerSender = PeerID(hexData: originalPacket.senderID)
+            if !env.isAcceptedIngressPayload(originalPacket, innerSender) {
+                // Cleanup below
+            } else {
+                SecureLogger.debug("✅ Reassembled packet id=\(completedHeader.idLogString) type=\(originalPacket.type) bytes=\(reassembled.count)", category: .session)
+                originalPacket.ttl = 0
+                env.processReassembledPacket(originalPacket, peerID)
+            }
+        } else {
+            SecureLogger.error("❌ Failed to decode reassembled packet (type=\(completedHeader.originalType), total=\(completedHeader.total))", category: .session)
+        }
+    }
+
+    private func logFragmentAssemblyResult(_ result: BLEFragmentAssemblyBuffer.AppendResult) {
+        func logStartedIfNeeded(header: BLEFragmentHeader, started: Bool) {
+            if started {
+                SecureLogger.debug("📦 Started fragment assembly id=\(header.idLogString) total=\(header.total)", category: .session)
+            }
+        }
+
+        switch result {
+        case let .stored(header, started):
+            logStartedIfNeeded(header: header, started: started)
+            SecureLogger.debug("📦 Fragment \(header.index + 1)/\(header.total) (len=\(header.fragmentData.count)) for id=\(header.idLogString)", category: .session)
+
+        case let .complete(header, _, started):
+            logStartedIfNeeded(header: header, started: started)
+            SecureLogger.debug("📦 Fragment \(header.index + 1)/\(header.total) (len=\(header.fragmentData.count)) for id=\(header.idLogString)", category: .session)
+
+        case let .oversized(header, projectedSize, limit, started):
+            logStartedIfNeeded(header: header, started: started)
+            SecureLogger.warning(
+                "🚫 Fragment assembly exceeds size limit (\(projectedSize) bytes > \(limit)), evicting. Type=\(header.originalType) Index=\(header.index)/\(header.total)",
+                category: .security
+            )
+        }
+    }
+}

bitchat/Services/BLE/BLENoisePacketHandler.swift

@@ -0,0 +1,132 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+/// Narrow environment for `BLENoisePacketHandler`.
+///
+/// All queue hops (collections barrier writes, main-actor UI notification)
+/// and every `noiseService.*` crypto call live inside the closures supplied by
+/// `BLEService`, keeping the handler queue-agnostic and synchronously testable.
+struct BLENoisePacketHandlerEnvironment {
+    /// Local peer identity at the time the packet is handled.
+    let localPeerID: () -> PeerID
+    /// Local peer ID bytes used as the sender of handshake responses.
+    let localPeerIDData: () -> Data
+    /// TTL value used for direct (non-relayed) packets.
+    let messageTTL: UInt8
+    /// Current time source.
+    let now: () -> Date
+    /// Processes an inbound handshake message, returning an optional response payload (crypto).
+    let processHandshakeMessage: (_ peerID: PeerID, _ message: Data) throws -> Data?
+    /// Whether any Noise session (established or pending) exists for the peer (crypto).
+    let hasNoiseSession: (PeerID) -> Bool
+    /// Initiates a fresh Noise handshake with the peer (crypto + send).
+    let initiateHandshake: (PeerID) -> Void
+    /// Broadcasts a packet on the mesh (caller is already on the message queue).
+    let broadcastPacket: (BitchatPacket) -> Void
+    /// Updates the registry last-seen timestamp for the peer (async barrier write).
+    let updatePeerLastSeen: (PeerID) -> Void
+    /// Decrypts an encrypted payload from the peer (crypto).
+    let decrypt: (_ payload: Data, _ peerID: PeerID) throws -> Data
+    /// Clears the peer's Noise session after an unrecoverable decrypt failure (crypto).
+    let clearSession: (PeerID) -> Void
+    /// Delivers `.noisePayloadReceived` to the UI as one main-actor hop.
+    let deliverNoisePayload: (
+        _ peerID: PeerID,
+        _ type: NoisePayloadType,
+        _ payload: Data,
+        _ timestamp: Date
+    ) -> Void
+}
+
+/// Orchestrates the Noise session domain for inbound packets: handshake
+/// processing (with response), encrypted payload decryption and dispatch,
+/// and session recovery on decrypt failure.
+final class BLENoisePacketHandler {
+    private let environment: BLENoisePacketHandlerEnvironment
+
+    init(environment: BLENoisePacketHandlerEnvironment) {
+        self.environment = environment
+    }
+
+    func handleHandshake(_ packet: BitchatPacket, from peerID: PeerID) {
+        let env = environment
+        // Use NoiseEncryptionService for handshake processing
+        if PeerID(hexData: packet.recipientID) == env.localPeerID() {
+            // Handshake is for us
+            do {
+                if let response = try env.processHandshakeMessage(peerID, packet.payload) {
+                    // Send response
+                    let responsePacket = BitchatPacket(
+                        type: MessageType.noiseHandshake.rawValue,
+                        senderID: env.localPeerIDData(),
+                        recipientID: Data(hexString: peerID.id),
+                        timestamp: UInt64(env.now().timeIntervalSince1970 * 1000),
+                        payload: response,
+                        signature: nil,
+                        ttl: env.messageTTL
+                    )
+                    // We're on messageQueue from delegate callback
+                    env.broadcastPacket(responsePacket)
+                }
+
+                // Session establishment will trigger onPeerAuthenticated callback
+                // which will send any pending messages at the right time
+            } catch {
+                SecureLogger.error("Failed to process handshake: \(error)")
+                // Try initiating a new handshake
+                if !env.hasNoiseSession(peerID) {
+                    env.initiateHandshake(peerID)
+                }
+            }
+        }
+    }
+
+    func handleEncrypted(_ packet: BitchatPacket, from peerID: PeerID) {
+        let env = environment
+        guard let recipientID = PeerID(hexData: packet.recipientID) else {
+            SecureLogger.warning("⚠️ Encrypted message has no recipient ID", category: .session)
+            return
+        }
+
+        if recipientID != env.localPeerID() {
+            SecureLogger.debug("🔐 Encrypted message not for me (for \(recipientID.id.prefix(8))…, I am \(env.localPeerID().id.prefix(8))…)", category: .session)
+            return
+        }
+
+        // Update lastSeen for the peer we received from (important for private messages)
+        env.updatePeerLastSeen(peerID)
+
+        do {
+            let decrypted = try env.decrypt(packet.payload, peerID)
+            guard decrypted.count > 0 else { return }
+
+            // First byte indicates the payload type
+            let payloadType = decrypted[0]
+            let payloadData = decrypted.dropFirst()
+
+            guard let noisePayloadType = NoisePayloadType(rawValue: payloadType) else {
+                SecureLogger.warning("⚠️ Unknown noise payload type: \(payloadType)")
+                return
+            }
+
+            SecureLogger.debug("🔐 Decrypted noise payload type \(noisePayloadType.description) from \(peerID.id.prefix(8))…", category: .session)
+
+            let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
+            env.deliverNoisePayload(peerID, noisePayloadType, Data(payloadData), ts)
+        } catch NoiseEncryptionError.sessionNotEstablished {
+            // We received an encrypted message before establishing a session with this peer.
+            // Trigger a handshake so future messages can be decrypted.
+            SecureLogger.debug("🔑 Encrypted message from \(peerID.id.prefix(8))… without session; initiating handshake")
+            if !env.hasNoiseSession(peerID) {
+                env.initiateHandshake(peerID)
+            }
+        } catch {
+            // Decryption failed - clear the corrupted session and re-initiate handshake
+            // This handles cases where session state got out of sync (nonce mismatch, etc.)
+            SecureLogger.error("❌ Failed to decrypt message from \(peerID.id.prefix(8))…: \(error) - clearing session and re-initiating handshake")
+            env.clearSession(peerID)
+            env.initiateHandshake(peerID)
+        }
+    }
+}

bitchat/Services/BLE/BLEPublicMessageHandler.swift

@@ -0,0 +1,104 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+/// Narrow environment for `BLEPublicMessageHandler`.
+///
+/// All queue hops (collections registry reads, BLE-queue link-state reads,
+/// main-actor UI notification) live inside the closures supplied by
+/// `BLEService`, keeping the handler queue-agnostic and synchronously testable.
+struct BLEPublicMessageHandlerEnvironment {
+    /// Local peer identity at the time the message is handled.
+    let localPeerID: () -> PeerID
+    /// Local nickname used for sender resolution and collision checks.
+    let localNickname: () -> String
+    /// Current time source.
+    let now: () -> Date
+    /// Snapshot of known peers keyed by ID (registry read).
+    let peersSnapshot: () -> [PeerID: BLEPeerInfo]
+    /// Resolves a display name from a verified packet signature for peers missing from the registry.
+    let signedSenderDisplayName: (_ packet: BitchatPacket, _ peerID: PeerID) -> String?
+    /// Tracks the broadcast message packet for gossip sync.
+    let trackPacketSeen: (BitchatPacket) -> Void
+    /// Direct link state for the peer (BLE-queue read).
+    let linkState: (PeerID) -> (hasPeripheral: Bool, hasCentral: Bool)
+    /// Resolves and consumes the original message ID for our own re-broadcast.
+    let takeSelfBroadcastMessageID: (BitchatPacket) -> String?
+    /// Delivers `.publicMessageReceived` to the UI as one main-actor hop.
+    let deliverPublicMessage: (
+        _ peerID: PeerID,
+        _ nickname: String,
+        _ content: String,
+        _ timestamp: Date,
+        _ messageID: String?
+    ) -> Void
+}
+
+/// Orchestrates inbound public (broadcast) messages: freshness/self-echo
+/// policy, sender display-name resolution, gossip tracking, payload decoding,
+/// and UI delivery.
+final class BLEPublicMessageHandler {
+    private let environment: BLEPublicMessageHandlerEnvironment
+
+    init(environment: BLEPublicMessageHandlerEnvironment) {
+        self.environment = environment
+    }
+
+    func handle(_ packet: BitchatPacket, from peerID: PeerID) {
+        let env = environment
+        let now = env.now()
+        let messageDecision = BLEPublicMessagePolicy.evaluate(
+            packet: packet,
+            from: peerID,
+            localPeerID: env.localPeerID(),
+            now: now
+        )
+
+        let messagePolicy: BLEPublicMessageAcceptance
+        switch messageDecision {
+        case .accept(let acceptance):
+            messagePolicy = acceptance
+        case .reject(.selfEcho):
+            return
+        case .reject(.staleBroadcast(let ageSeconds)):
+            SecureLogger.debug("⏰ Ignoring stale broadcast message from \(peerID.id.prefix(8))… (age: \(ageSeconds)s)", category: .session)
+            return
+        }
+
+        // Snapshot peers to avoid concurrent mutation while iterating during nickname collision checks.
+        let peersSnapshot = env.peersSnapshot()
+
+        guard let senderNickname = BLEPeerSenderDisplayName.resolveKnownPeer(
+            peerID: peerID,
+            localPeerID: env.localPeerID(),
+            localNickname: env.localNickname(),
+            peers: peersSnapshot,
+            allowConnectedUnverified: false
+        ) ?? env.signedSenderDisplayName(packet, peerID) else {
+            SecureLogger.warning("🚫 Dropping public message from unverified or unknown peer \(peerID.id.prefix(8))…", category: .security)
+            return
+        }
+
+        if messagePolicy.shouldTrackForSync {
+            env.trackPacketSeen(packet)
+        }
+
+        guard let content = String(data: packet.payload, encoding: .utf8) else {
+            SecureLogger.error("❌ Failed to decode message payload as UTF-8", category: .session)
+            return
+        }
+        // Determine if we have a direct link to the sender
+        let directLink = env.linkState(peerID)
+        let hasDirectLink = directLink.hasPeripheral || directLink.hasCentral
+
+        let pathTag = hasDirectLink ? "direct" : "mesh"
+        SecureLogger.debug("💬 [\(senderNickname)] TTL:\(packet.ttl) (\(pathTag)) chars=\(content.count) bytes=\(packet.payload.count)", category: .session)
+
+        let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
+        var resolvedSelfMessageID: String? = nil
+        if peerID == env.localPeerID() {
+            resolvedSelfMessageID = env.takeSelfBroadcastMessageID(packet)
+        }
+        env.deliverPublicMessage(peerID, senderNickname, content, ts, resolvedSelfMessageID)
+    }
+}

bitchat/Services/BLE/BLEService.swift

@@ -110,6 +110,16 @@ final class BLEService: NSObject {
     private var pendingDirectedRelays = BLEDirectedRelaySpool()
     // Debounce for 'reconnected' logs
     private var reconnectLogDebouncer = BLEPeerEventDebouncer()
+    // Announce-packet orchestration (queue hops stay in the environment closures)
+    private lazy var announceHandler = BLEAnnounceHandler(environment: makeAnnounceHandlerEnvironment())
+    // Public-message orchestration (queue hops stay in the environment closures)
+    private lazy var publicMessageHandler = BLEPublicMessageHandler(environment: makePublicMessageHandlerEnvironment())
+    // Noise handshake/encrypted orchestration (queue hops and crypto stay in the environment closures)
+    private lazy var noisePacketHandler = BLENoisePacketHandler(environment: makeNoisePacketHandlerEnvironment())
+    // Fragment-assembly orchestration (queue hops stay in the environment closures)
+    private lazy var fragmentHandler = BLEFragmentHandler(environment: makeFragmentHandlerEnvironment())
+    // File-transfer orchestration (queue hops stay in the environment closures)
+    private lazy var fileTransferHandler = BLEFileTransferHandler(environment: makeFileTransferHandlerEnvironment())
 
     // MARK: - Gossip Sync
     private var gossipSyncManager: GossipSyncManager?
@@ -195,6 +205,9 @@ final class BLEService: NSObject {
         
         // Tag BLE queue for re-entrancy detection
         bleQueue.setSpecific(key: bleQueueKey, value: ())
+        // Link state is owned exclusively by bleQueue; debug builds trap
+        // any access from another queue (cross-queue reads use readLinkState).
+        linkStateStore.assumeOwnership(of: bleQueue)
 
         if initializeBluetoothManagers {
             // Initialize BLE on background queue to prevent main thread blocking.
@@ -1005,79 +1018,50 @@ final class BLEService: NSObject {
     }
 
     private func handleFileTransfer(_ packet: BitchatPacket, from peerID: PeerID) {
-        if BLEFileTransferPolicy.isSelfEcho(packet: packet, from: peerID, localPeerID: myPeerID) { return }
+        fileTransferHandler.handle(packet, from: peerID)
+    }
 
-        let peersSnapshot = collectionsQueue.sync { peerRegistry.snapshotByID }
-        guard let senderNickname = BLEPeerSenderDisplayName.resolveKnownPeer(
-            peerID: peerID,
-            localPeerID: myPeerID,
-            localNickname: myNickname,
-            peers: peersSnapshot,
-            allowConnectedUnverified: true
-        ) ?? signedSenderDisplayName(for: packet, from: peerID) else {
-            SecureLogger.warning("🚫 Dropping file transfer from unverified or unknown peer \(peerID.id.prefix(8))…", category: .security)
-            return
-        }
-
-        guard let deliveryPlan = BLEFileTransferPolicy.deliveryPlan(packet: packet, localPeerID: myPeerID) else {
-            return
-        }
-        if deliveryPlan.shouldTrackForSync {
-            gossipSyncManager?.onPublicPacketSeen(packet)
-        }
-
-        let filePacket: BitchatFilePacket
-        let mime: MimeType
-        switch BLEIncomingFileValidator.validate(payload: packet.payload) {
-        case .success(let acceptance):
-            filePacket = acceptance.filePacket
-            mime = acceptance.mime
-        case .failure(.malformedPayload):
-            SecureLogger.error("❌ Failed to decode file transfer payload", category: .session)
-            return
-        case .failure(.payloadTooLarge(let bytes)):
-            SecureLogger.warning("🚫 Dropping file transfer exceeding size cap (\(bytes) bytes)", category: .security)
-            return
-        case .failure(.unsupportedMime(let mimeType, let bytes)):
-            SecureLogger.warning("🚫 MIME REJECT: '\(mimeType ?? "<empty>")' not supported. Size=\(bytes)b from \(peerID.id.prefix(8))...", category: .security)
-            return
-        case .failure(.magicMismatch(let mime, let bytes, let prefixHex)):
-            SecureLogger.warning("🚫 MAGIC REJECT: MIME='\(mime)' size=\(bytes)b prefix=[\(prefixHex)] from \(peerID.id.prefix(8))...", category: .security)
-            return
-        }
-
-        // BCH-01-002: Enforce storage quota before saving
-        incomingFileStore.enforceQuota(reservingBytes: filePacket.content.count)
-
-        guard let destination = incomingFileStore.save(
-            data: filePacket.content,
-            preferredName: filePacket.fileName,
-            subdirectory: "\(mime.category.mediaDir)/incoming",
-            fallbackExtension: mime.defaultExtension,
-            defaultPrefix: mime.category.rawValue
-        ) else {
-            return
-        }
-
-        if deliveryPlan.isPrivateMessage {
-            updatePeerLastSeen(peerID)
-        }
-
-        let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
-        let message = BitchatMessage(
-            sender: senderNickname,
-            content: "\(mime.category.messagePrefix)\(destination.lastPathComponent)",
-            timestamp: ts,
-            isRelay: false,
-            originalSender: nil,
-            isPrivate: deliveryPlan.isPrivateMessage,
-            recipientNickname: nil,
-            senderPeerID: peerID
+    /// Builds the file-transfer handler environment. All queue hops stay here
+    /// so `BLEFileTransferHandler` remains queue-agnostic and synchronously
+    /// testable.
+    private func makeFileTransferHandlerEnvironment() -> BLEFileTransferHandlerEnvironment {
+        BLEFileTransferHandlerEnvironment(
+            localPeerID: { [weak self] in
+                self?.myPeerID ?? PeerID(str: "")
+            },
+            localNickname: { [weak self] in
+                self?.myNickname ?? ""
+            },
+            peersSnapshot: { [weak self] in
+                guard let self = self else { return [:] }
+                return self.collectionsQueue.sync { self.peerRegistry.snapshotByID }
+            },
+            signedSenderDisplayName: { [weak self] packet, peerID in
+                self?.signedSenderDisplayName(for: packet, from: peerID)
+            },
+            trackPacketSeen: { [weak self] packet in
+                self?.gossipSyncManager?.onPublicPacketSeen(packet)
+            },
+            enforceStorageQuota: { [weak self] reservingBytes in
+                self?.incomingFileStore.enforceQuota(reservingBytes: reservingBytes)
+            },
+            saveIncomingFile: { [weak self] data, preferredName, subdirectory, fallbackExtension, defaultPrefix in
+                self?.incomingFileStore.save(
+                    data: data,
+                    preferredName: preferredName,
+                    subdirectory: subdirectory,
+                    fallbackExtension: fallbackExtension,
+                    defaultPrefix: defaultPrefix
+                )
+            },
+            updatePeerLastSeen: { [weak self] peerID in
+                self?.updatePeerLastSeen(peerID)
+            },
+            deliverMessage: { [weak self] message in
+                // Single main-actor hop delivering `.messageReceived`.
+                self?.emitTransportEvent(.messageReceived(message))
+            }
         )
-
-        SecureLogger.debug("📁 Stored incoming media from \(peerID.id.prefix(8))… -> \(destination.lastPathComponent)", category: .session)
-
-        emitTransportEvent(.messageReceived(message))
     }
     
     func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool) {
@@ -2775,74 +2759,39 @@ extension BLEService {
     
     private func handleFragment(_ packet: BitchatPacket, from peerID: PeerID) {
         if DispatchQueue.getSpecific(key: messageQueueKey) != nil {
-            _handleFragment(packet, from: peerID)
+            fragmentHandler.handle(packet, from: peerID)
         } else {
             messageQueue.async(flags: .barrier) { [weak self] in
-                self?._handleFragment(packet, from: peerID)
+                self?.fragmentHandler.handle(packet, from: peerID)
             }
         }
     }
 
-    private func _handleFragment(_ packet: BitchatPacket, from peerID: PeerID) {
-        // Don't process our own fragments
-        if peerID == myPeerID {
-            return
-        }
-
-        guard let header = BLEFragmentHeader(packet: packet) else { return }
-
-        if header.isBroadcastFragment {
-            gossipSyncManager?.onPublicPacketSeen(packet)
-        }
-
-        let assemblyResult = collectionsQueue.sync(flags: .barrier) {
-            fragmentAssemblyBuffer.append(header, maxInFlightAssemblies: maxInFlightAssemblies)
-        }
-
-        logFragmentAssemblyResult(assemblyResult)
-
-        guard case let .complete(completedHeader, reassembled, _) = assemblyResult else { return }
-
-        // Decode the original packet bytes we reassembled, so flags/compression are preserved
-        if var originalPacket = BinaryProtocol.decode(reassembled) {
-            
-            // Reassembled packet validation
-            let innerSender = PeerID(hexData: originalPacket.senderID)
-            if !isAcceptedIngressPayload(originalPacket, from: innerSender) {
-                // Cleanup below
-            } else {
-                SecureLogger.debug("✅ Reassembled packet id=\(completedHeader.idLogString) type=\(originalPacket.type) bytes=\(reassembled.count)", category: .session)
-                originalPacket.ttl = 0
-                handleReceivedPacket(originalPacket, from: peerID)
+    /// Builds the fragment handler environment. All queue hops stay here so
+    /// `BLEFragmentHandler` remains queue-agnostic and synchronously testable.
+    private func makeFragmentHandlerEnvironment() -> BLEFragmentHandlerEnvironment {
+        BLEFragmentHandlerEnvironment(
+            localPeerID: { [weak self] in
+                self?.myPeerID ?? PeerID(str: "")
+            },
+            trackPacketSeen: { [weak self] packet in
+                self?.gossipSyncManager?.onPublicPacketSeen(packet)
+            },
+            appendFragment: { [weak self] header in
+                guard let self = self else {
+                    return .stored(header: header, started: false)
+                }
+                return self.collectionsQueue.sync(flags: .barrier) {
+                    self.fragmentAssemblyBuffer.append(header, maxInFlightAssemblies: self.maxInFlightAssemblies)
+                }
+            },
+            isAcceptedIngressPayload: { [weak self] packet, innerSender in
+                self?.isAcceptedIngressPayload(packet, from: innerSender) ?? false
+            },
+            processReassembledPacket: { [weak self] packet, peerID in
+                self?.handleReceivedPacket(packet, from: peerID)
             }
-        } else {
-            SecureLogger.error("❌ Failed to decode reassembled packet (type=\(completedHeader.originalType), total=\(completedHeader.total))", category: .session)
-        }
-    }
-
-    private func logFragmentAssemblyResult(_ result: BLEFragmentAssemblyBuffer.AppendResult) {
-        func logStartedIfNeeded(header: BLEFragmentHeader, started: Bool) {
-            if started {
-                SecureLogger.debug("📦 Started fragment assembly id=\(header.idLogString) total=\(header.total)", category: .session)
-            }
-        }
-
-        switch result {
-        case let .stored(header, started):
-            logStartedIfNeeded(header: header, started: started)
-            SecureLogger.debug("📦 Fragment \(header.index + 1)/\(header.total) (len=\(header.fragmentData.count)) for id=\(header.idLogString)", category: .session)
-
-        case let .complete(header, _, started):
-            logStartedIfNeeded(header: header, started: started)
-            SecureLogger.debug("📦 Fragment \(header.index + 1)/\(header.total) (len=\(header.fragmentData.count)) for id=\(header.idLogString)", category: .session)
-
-        case let .oversized(header, projectedSize, limit, started):
-            logStartedIfNeeded(header: header, started: started)
-            SecureLogger.warning(
-                "🚫 Fragment assembly exceeds size limit (\(projectedSize) bytes > \(limit)), evicting. Type=\(header.originalType) Index=\(header.index)/\(header.total)",
-                category: .security
-            )
-        }
+        )
     }
     
     // MARK: Packet Reception
@@ -2963,165 +2912,96 @@ extension BLEService {
     }
     
     private func handleAnnounce(_ packet: BitchatPacket, from peerID: PeerID) {
-        let now = Date()
-        let preflight = BLEAnnouncePreflightPolicy.evaluate(
-            packet: packet,
-            from: peerID,
-            localPeerID: myPeerID,
-            now: now
-        )
+        announceHandler.handle(packet, from: peerID)
+    }
 
-        let announcement: AnnouncementPacket
-        switch preflight {
-        case .accept(let acceptance):
-            announcement = acceptance.announcement
-        case .reject(.malformed):
-            SecureLogger.error("❌ Failed to decode announce packet from \(peerID.id.prefix(8))…", category: .session)
-            return
-        case .reject(.senderMismatch(let derivedFromKey)):
-            SecureLogger.warning("⚠️ Announce sender mismatch: derived \(derivedFromKey.id.prefix(8))… vs packet \(peerID.id.prefix(8))…", category: .security)
-            return
-        case .reject(.selfAnnounce):
-            return
-        case .reject(.stale(let ageSeconds)):
-            SecureLogger.debug("⏰ Ignoring stale announce from \(peerID.id.prefix(8))… (age: \(ageSeconds)s)", category: .session)
-            return
-        }
-
-        // Suppress announce logs to reduce noise
-
-        // Precompute signature verification outside barrier to reduce contention
-        let existingPeerForVerify = collectionsQueue.sync { peerRegistry.info(for: peerID) }
-        let hasSignature = packet.signature != nil
-        let signatureValid: Bool
-        if hasSignature {
-            signatureValid = noiseService.verifyPacketSignature(packet, publicKey: announcement.signingPublicKey)
-            if !signatureValid {
-                SecureLogger.warning("⚠️ Signature verification for announce failed \(peerID.id.prefix(8))", category: .security)
-            }
-        } else {
-            signatureValid = false
-        }
-        let trustDecision = BLEAnnounceTrustPolicy.evaluate(
-            hasSignature: hasSignature,
-            signatureValid: signatureValid,
-            existingNoisePublicKey: existingPeerForVerify?.noisePublicKey,
-            announcedNoisePublicKey: announcement.noisePublicKey
-        )
-        if case .reject(.keyMismatch) = trustDecision {
-            SecureLogger.warning("⚠️ Announce key mismatch for \(peerID.id.prefix(8))… — keeping unverified", category: .security)
-        }
-        let verifiedAnnounce = trustDecision.isVerified
-
-        var isNewPeer = false
-        var isReconnectedPeer = false
-        let directLinkState = linkState(for: peerID)
-        let isDirectAnnounce = packet.ttl == messageTTL
-        
-        collectionsQueue.sync(flags: .barrier) {
-            let hasPeripheralConnection = directLinkState.hasPeripheral
-            let hasCentralSubscription = directLinkState.hasCentral
-
-            // Require verified announce; ignore otherwise (no backward compatibility)
-            if !verifiedAnnounce {
-                SecureLogger.warning("❌ Ignoring unverified announce from \(peerID.id.prefix(8))…", category: .security)
-                // Reset flags to prevent post-barrier code from acting on unverified announces
-                isNewPeer = false
-                isReconnectedPeer = false
-                return
-            }
-
-            let update = peerRegistry.upsertVerifiedAnnounce(
-                peerID: peerID,
-                nickname: announcement.nickname,
-                noisePublicKey: announcement.noisePublicKey,
-                signingPublicKey: announcement.signingPublicKey,
-                isConnected: isDirectAnnounce || hasPeripheralConnection || hasCentralSubscription,
-                now: now
-            )
-            isNewPeer = update.isNewPeer
-            isReconnectedPeer = update.wasDisconnected
-            
-            // Log connection status only for direct connectivity changes; debounce to reduce spam
-            if isDirectAnnounce || hasPeripheralConnection || hasCentralSubscription {
-                let now = Date()
-                if update.isNewPeer {
-                    SecureLogger.debug("🆕 New peer: \(announcement.nickname)", category: .session)
-                } else if update.wasDisconnected {
-                    if reconnectLogDebouncer.shouldEmit(
-                        peerID: peerID,
-                        now: now,
-                        minimumInterval: TransportConfig.bleReconnectLogDebounceSeconds
-                    ) {
-                        SecureLogger.debug("🔄 Peer \(announcement.nickname) reconnected", category: .session)
+    /// Builds the announce handler environment. All queue hops stay here so
+    /// `BLEAnnounceHandler` remains queue-agnostic and synchronously testable.
+    private func makeAnnounceHandlerEnvironment() -> BLEAnnounceHandlerEnvironment {
+        BLEAnnounceHandlerEnvironment(
+            localPeerID: { [weak self] in
+                self?.myPeerID ?? PeerID(str: "")
+            },
+            messageTTL: messageTTL,
+            now: { Date() },
+            existingNoisePublicKey: { [weak self] peerID in
+                guard let self = self else { return nil }
+                return self.collectionsQueue.sync { self.peerRegistry.info(for: peerID)?.noisePublicKey }
+            },
+            verifySignature: { [weak self] packet, signingPublicKey in
+                self?.noiseService.verifyPacketSignature(packet, publicKey: signingPublicKey) ?? false
+            },
+            linkState: { [weak self] peerID in
+                self?.linkState(for: peerID) ?? (hasPeripheral: false, hasCentral: false)
+            },
+            withRegistryBarrier: { [weak self] body in
+                self?.collectionsQueue.sync(flags: .barrier) { body() }
+            },
+            upsertVerifiedAnnounce: { [weak self] peerID, announcement, isConnected, now in
+                // Called from inside withRegistryBarrier; access registry directly.
+                self?.peerRegistry.upsertVerifiedAnnounce(
+                    peerID: peerID,
+                    nickname: announcement.nickname,
+                    noisePublicKey: announcement.noisePublicKey,
+                    signingPublicKey: announcement.signingPublicKey,
+                    isConnected: isConnected,
+                    now: now
+                ) ?? BLEPeerAnnounceUpdate(isNewPeer: false, wasDisconnected: false, previousNickname: nil)
+            },
+            shouldEmitReconnectLog: { [weak self] peerID, now in
+                // Called from inside withRegistryBarrier; access debouncer directly.
+                self?.reconnectLogDebouncer.shouldEmit(
+                    peerID: peerID,
+                    now: now,
+                    minimumInterval: TransportConfig.bleReconnectLogDebounceSeconds
+                ) ?? false
+            },
+            updateTopology: { [weak self] peerID, neighbors in
+                self?.meshTopology.updateNeighbors(for: peerID.routingData, neighbors: neighbors)
+            },
+            persistIdentity: { [weak self] announcement in
+                self?.identityManager.upsertCryptographicIdentity(
+                    fingerprint: announcement.noisePublicKey.sha256Fingerprint(),
+                    noisePublicKey: announcement.noisePublicKey,
+                    signingPublicKey: announcement.signingPublicKey,
+                    claimedNickname: announcement.nickname
+                )
+            },
+            dedupContains: { [weak self] id in
+                self?.messageDeduplicator.contains(id) ?? true
+            },
+            dedupMarkProcessed: { [weak self] id in
+                self?.messageDeduplicator.markProcessed(id)
+            },
+            deliverAnnounceUIEvents: { [weak self] peerID, notifyPeerConnected, scheduleInitialSync in
+                // Single main-actor hop so event order is guaranteed:
+                // .peerConnected → initial sync scheduling → .peerListUpdated.
+                self?.notifyUI { [weak self] in
+                    guard let self = self else { return }
+                    if notifyPeerConnected {
+                        self.deliverTransportEvent(.peerConnected(peerID))
                     }
-                } else if let previousNickname = update.previousNickname, previousNickname != announcement.nickname {
-                    SecureLogger.debug("🔄 Peer \(peerID.id.prefix(8))… changed nickname: \(previousNickname) -> \(announcement.nickname)", category: .session)
+                    if scheduleInitialSync {
+                        self.gossipSyncManager?.scheduleInitialSyncToPeer(peerID, delaySeconds: 1.0)
+                    }
+                    // Get current peer list (after addition)
+                    let currentPeerIDs = self.collectionsQueue.sync { self.peerRegistry.peerIDs }
+                    self.requestPeerDataPublish()
+                    self.deliverTransportEvent(.peerListUpdated(currentPeerIDs))
                 }
-            }
-        }
-
-        // Update topology with verified neighbor claims (only for authenticated announces)
-        if verifiedAnnounce, let neighbors = announcement.directNeighbors {
-            meshTopology.updateNeighbors(for: peerID.routingData, neighbors: neighbors)
-        }
-
-        // Persist cryptographic identity and signing key for robust offline verification
-        identityManager.upsertCryptographicIdentity(
-            fingerprint: announcement.noisePublicKey.sha256Fingerprint(),
-            noisePublicKey: announcement.noisePublicKey,
-            signingPublicKey: announcement.signingPublicKey,
-            claimedNickname: announcement.nickname
-        )
-
-        let announceBackID = "announce-back-\(peerID)"
-        let shouldSendBack = !messageDeduplicator.contains(announceBackID)
-        if shouldSendBack {
-            messageDeduplicator.markProcessed(announceBackID)
-        }
-        let responsePlan = BLEAnnounceResponsePolicy.plan(
-            isDirectAnnounce: isDirectAnnounce,
-            isNewPeer: isNewPeer,
-            isReconnectedPeer: isReconnectedPeer,
-            shouldSendAnnounceBack: shouldSendBack
-        )
-
-        // Notify UI on main thread
-        notifyUI { [weak self] in
-            guard let self = self else { return }
-            
-            // Get current peer list (after addition)
-            let currentPeerIDs = self.collectionsQueue.sync { self.peerRegistry.peerIDs }
-            
-            // Only notify of connection for new or reconnected peers when it is a direct announce
-            if responsePlan.shouldNotifyPeerConnected {
-                self.deliverTransportEvent(.peerConnected(peerID))
-                // Schedule initial unicast sync to this peer
-                if responsePlan.shouldScheduleInitialSync {
-                    self.gossipSyncManager?.scheduleInitialSyncToPeer(peerID, delaySeconds: 1.0)
-                }
-            }
-            
-            self.requestPeerDataPublish()
-            self.deliverTransportEvent(.peerListUpdated(currentPeerIDs))
-        }
-        
-        // Track for sync (include our own and others' announces)
-        gossipSyncManager?.onPublicPacketSeen(packet)
-        
-        if responsePlan.shouldSendAnnounceBack {
-            // Reciprocate announce for bidirectional discovery
-            // Force send to ensure the peer receives our announce
-            sendAnnounce(forceSend: true)
-        }
-
-        // Afterglow: on first-seen peers, schedule a short re-announce to push presence one more hop
-        if responsePlan.shouldScheduleAfterglow {
-            let delay = Double.random(in: 0.3...0.6)
-            messageQueue.asyncAfter(deadline: .now() + delay) { [weak self] in
+            },
+            trackPacketSeen: { [weak self] packet in
+                self?.gossipSyncManager?.onPublicPacketSeen(packet)
+            },
+            sendAnnounceBack: { [weak self] in
                 self?.sendAnnounce(forceSend: true)
+            },
+            scheduleAfterglow: { [weak self] delay in
+                self?.messageQueue.asyncAfter(deadline: .now() + delay) { [weak self] in
+                    self?.sendAnnounce(forceSend: true)
+                }
             }
-        }
+        )
     }
 
     // Handle REQUEST_SYNC: decode payload and respond with missing packets via sync manager
@@ -3136,156 +3016,110 @@ extension BLEService {
     // Mention parsing moved to ChatViewModel
     
     private func handleMessage(_ packet: BitchatPacket, from peerID: PeerID) {
-        let now = Date()
-        let messageDecision = BLEPublicMessagePolicy.evaluate(
-            packet: packet,
-            from: peerID,
-            localPeerID: myPeerID,
-            now: now
-        )
-
-        let messagePolicy: BLEPublicMessageAcceptance
-        switch messageDecision {
-        case .accept(let acceptance):
-            messagePolicy = acceptance
-        case .reject(.selfEcho):
-            return
-        case .reject(.staleBroadcast(let ageSeconds)):
-            SecureLogger.debug("⏰ Ignoring stale broadcast message from \(peerID.id.prefix(8))… (age: \(ageSeconds)s)", category: .session)
-            return
-        }
-
-        // Snapshot peers to avoid concurrent mutation while iterating during nickname collision checks.
-        let peersSnapshot = collectionsQueue.sync { peerRegistry.snapshotByID }
-
-        guard let senderNickname = BLEPeerSenderDisplayName.resolveKnownPeer(
-            peerID: peerID,
-            localPeerID: myPeerID,
-            localNickname: myNickname,
-            peers: peersSnapshot,
-            allowConnectedUnverified: false
-        ) ?? signedSenderDisplayName(for: packet, from: peerID) else {
-            SecureLogger.warning("🚫 Dropping public message from unverified or unknown peer \(peerID.id.prefix(8))…", category: .security)
-            return
-        }
-
-        if messagePolicy.shouldTrackForSync {
-            gossipSyncManager?.onPublicPacketSeen(packet)
-        }
-
-        guard let content = String(data: packet.payload, encoding: .utf8) else {
-            SecureLogger.error("❌ Failed to decode message payload as UTF-8", category: .session)
-            return
-        }
-        // Determine if we have a direct link to the sender
-        let directLink = linkState(for: peerID)
-        let hasDirectLink = directLink.hasPeripheral || directLink.hasCentral
-
-        let pathTag = hasDirectLink ? "direct" : "mesh"
-        SecureLogger.debug("💬 [\(senderNickname)] TTL:\(packet.ttl) (\(pathTag)) chars=\(content.count) bytes=\(packet.payload.count)", category: .session)
-
-        let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
-        var resolvedSelfMessageID: String? = nil
-        if peerID == myPeerID {
-            resolvedSelfMessageID = selfBroadcastTracker.takeMessageID(for: packet)
-        }
-        notifyUI { [weak self] in
-            self?.deliverTransportEvent(
-                .publicMessageReceived(
-                    peerID: peerID,
-                    nickname: senderNickname,
-                    content: content,
-                    timestamp: ts,
-                    messageID: resolvedSelfMessageID
-                )
-            )
-        }
+        publicMessageHandler.handle(packet, from: peerID)
     }
-    
-    private func handleNoiseHandshake(_ packet: BitchatPacket, from peerID: PeerID) {
-        // Use NoiseEncryptionService for handshake processing
-        if PeerID(hexData: packet.recipientID) == myPeerID {
-            // Handshake is for us
-            do {
-                if let response = try noiseService.processHandshakeMessage(from: peerID, message: packet.payload) {
-                    // Send response
-                    let responsePacket = BitchatPacket(
-                        type: MessageType.noiseHandshake.rawValue,
-                        senderID: myPeerIDData,
-                        recipientID: Data(hexString: peerID.id),
-                        timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
-                        payload: response,
-                        signature: nil,
-                        ttl: messageTTL
+
+    /// Builds the public-message handler environment. All queue hops stay here
+    /// so `BLEPublicMessageHandler` remains queue-agnostic and synchronously
+    /// testable.
+    private func makePublicMessageHandlerEnvironment() -> BLEPublicMessageHandlerEnvironment {
+        BLEPublicMessageHandlerEnvironment(
+            localPeerID: { [weak self] in
+                self?.myPeerID ?? PeerID(str: "")
+            },
+            localNickname: { [weak self] in
+                self?.myNickname ?? ""
+            },
+            now: { Date() },
+            peersSnapshot: { [weak self] in
+                guard let self = self else { return [:] }
+                return self.collectionsQueue.sync { self.peerRegistry.snapshotByID }
+            },
+            signedSenderDisplayName: { [weak self] packet, peerID in
+                self?.signedSenderDisplayName(for: packet, from: peerID)
+            },
+            trackPacketSeen: { [weak self] packet in
+                self?.gossipSyncManager?.onPublicPacketSeen(packet)
+            },
+            linkState: { [weak self] peerID in
+                self?.linkState(for: peerID) ?? (hasPeripheral: false, hasCentral: false)
+            },
+            takeSelfBroadcastMessageID: { [weak self] packet in
+                // Caller is on messageQueue, where the tracker is owned.
+                self?.selfBroadcastTracker.takeMessageID(for: packet)
+            },
+            deliverPublicMessage: { [weak self] peerID, nickname, content, timestamp, messageID in
+                // Single main-actor hop delivering `.publicMessageReceived`.
+                self?.notifyUI { [weak self] in
+                    self?.deliverTransportEvent(
+                        .publicMessageReceived(
+                            peerID: peerID,
+                            nickname: nickname,
+                            content: content,
+                            timestamp: timestamp,
+                            messageID: messageID
+                        )
                     )
-                    // We're on messageQueue from delegate callback
-                    broadcastPacket(responsePacket)
-                }
-                
-                // Session establishment will trigger onPeerAuthenticated callback
-                // which will send any pending messages at the right time
-            } catch {
-                SecureLogger.error("Failed to process handshake: \(error)")
-                // Try initiating a new handshake
-                if !noiseService.hasSession(with: peerID) {
-                    initiateNoiseHandshake(with: peerID)
                 }
             }
-        }
+        )
     }
-    
+
+    private func handleNoiseHandshake(_ packet: BitchatPacket, from peerID: PeerID) {
+        noisePacketHandler.handleHandshake(packet, from: peerID)
+    }
+
     private func handleNoiseEncrypted(_ packet: BitchatPacket, from peerID: PeerID) {
-        guard let recipientID = PeerID(hexData: packet.recipientID) else {
-            SecureLogger.warning("⚠️ Encrypted message has no recipient ID", category: .session)
-            return
-        }
-        
-        if recipientID != myPeerID {
-            SecureLogger.debug("🔐 Encrypted message not for me (for \(recipientID.id.prefix(8))…, I am \(myPeerID.id.prefix(8))…)", category: .session)
-            return
-        }
-        
-        // Update lastSeen for the peer we received from (important for private messages)
-        updatePeerLastSeen(peerID)
-        
-        do {
-            let decrypted = try noiseService.decrypt(packet.payload, from: peerID)
-            guard decrypted.count > 0 else { return }
-            
-            // First byte indicates the payload type
-            let payloadType = decrypted[0]
-            let payloadData = decrypted.dropFirst()
+        noisePacketHandler.handleEncrypted(packet, from: peerID)
+    }
 
-            guard let noisePayloadType = NoisePayloadType(rawValue: payloadType) else {
-                SecureLogger.warning("⚠️ Unknown noise payload type: \(payloadType)")
-                return
+    /// Builds the Noise packet handler environment. All queue hops and
+    /// `noiseService` crypto calls stay here so `BLENoisePacketHandler`
+    /// remains queue-agnostic and synchronously testable.
+    private func makeNoisePacketHandlerEnvironment() -> BLENoisePacketHandlerEnvironment {
+        BLENoisePacketHandlerEnvironment(
+            localPeerID: { [weak self] in
+                self?.myPeerID ?? PeerID(str: "")
+            },
+            localPeerIDData: { [weak self] in
+                self?.myPeerIDData ?? Data()
+            },
+            messageTTL: messageTTL,
+            now: { Date() },
+            processHandshakeMessage: { [weak self] peerID, message in
+                try self?.noiseService.processHandshakeMessage(from: peerID, message: message)
+            },
+            hasNoiseSession: { [weak self] peerID in
+                self?.noiseService.hasSession(with: peerID) ?? false
+            },
+            initiateHandshake: { [weak self] peerID in
+                self?.initiateNoiseHandshake(with: peerID)
+            },
+            broadcastPacket: { [weak self] packet in
+                self?.broadcastPacket(packet)
+            },
+            updatePeerLastSeen: { [weak self] peerID in
+                self?.updatePeerLastSeen(peerID)
+            },
+            decrypt: { [weak self] payload, peerID in
+                guard let self = self else { throw NoiseEncryptionError.sessionNotEstablished }
+                return try self.noiseService.decrypt(payload, from: peerID)
+            },
+            clearSession: { [weak self] peerID in
+                self?.noiseService.clearSession(for: peerID)
+            },
+            deliverNoisePayload: { [weak self] peerID, type, payload, timestamp in
+                // Single main-actor hop delivering `.noisePayloadReceived`.
+                self?.notifyUI { [weak self] in
+                    self?.deliverTransportEvent(.noisePayloadReceived(
+                        peerID: peerID,
+                        type: type,
+                        payload: payload,
+                        timestamp: timestamp
+                    ))
+                }
             }
-
-            SecureLogger.debug("🔐 Decrypted noise payload type \(noisePayloadType.description) from \(peerID.id.prefix(8))…", category: .session)
-
-            let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
-            notifyUI { [weak self] in
-                self?.deliverTransportEvent(.noisePayloadReceived(
-                    peerID: peerID,
-                    type: noisePayloadType,
-                    payload: Data(payloadData),
-                    timestamp: ts
-                ))
-            }
-        } catch NoiseEncryptionError.sessionNotEstablished {
-            // We received an encrypted message before establishing a session with this peer.
-            // Trigger a handshake so future messages can be decrypted.
-            SecureLogger.debug("🔑 Encrypted message from \(peerID.id.prefix(8))… without session; initiating handshake")
-            if !noiseService.hasSession(with: peerID) {
-                initiateNoiseHandshake(with: peerID)
-            }
-        } catch {
-            // Decryption failed - clear the corrupted session and re-initiate handshake
-            // This handles cases where session state got out of sync (nonce mismatch, etc.)
-            SecureLogger.error("❌ Failed to decrypt message from \(peerID.id.prefix(8))…: \(error) - clearing session and re-initiating handshake")
-            noiseService.clearSession(for: peerID)
-            initiateNoiseHandshake(with: peerID)
-        }
+        )
     }
 
     // MARK: Helper Functions

bitchat/ViewModels/ChatDeliveryCoordinator.swift

@@ -2,29 +2,65 @@ import BitFoundation
 import BitLogger
 import Foundation
 
-final class ChatDeliveryCoordinator {
-    private unowned let viewModel: ChatViewModel
+/// The narrow surface `ChatDeliveryCoordinator` needs from its owner.
+///
+/// Coordinators should depend on the minimal context they actually use rather
+/// than holding an `unowned` back-reference to the whole `ChatViewModel`. This
+/// keeps the coordinator independently testable (see
+/// `ChatDeliveryCoordinatorContextTests`) and makes its true dependencies
+/// explicit. This protocol is the exemplar for migrating the other
+/// coordinators off their `unowned let viewModel: ChatViewModel` back-refs.
+@MainActor
+protocol ChatDeliveryContext: AnyObject {
+    var messages: [BitchatMessage] { get set }
+    var privateChats: [PeerID: [BitchatMessage]] { get set }
+    var sentReadReceipts: Set<String> { get set }
+    var isStartupPhase: Bool { get }
+    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
+    func notifyUIChanged()
+    /// Confirms receipt so the message router stops retaining the message for resend.
+    func markMessageDelivered(_ messageID: String)
+}
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+extension ChatViewModel: ChatDeliveryContext {
+    func notifyUIChanged() {
+        objectWillChange.send()
+    }
+
+    func markMessageDelivered(_ messageID: String) {
+        messageRouter.markDelivered(messageID)
+    }
+}
+
+final class ChatDeliveryCoordinator {
+    private unowned let context: any ChatDeliveryContext
+    private var messageLocationIndex: [String: Set<MessageLocation>] = [:]
+    private var indexedPublicMessageCount = 0
+    private var indexedPublicTailMessageID: String?
+    private var indexedPrivateMessageCounts: [PeerID: Int] = [:]
+    private var indexedPrivateTailMessageIDs: [PeerID: String] = [:]
+    private var hasBuiltMessageLocationIndex = false
+
+    init(context: any ChatDeliveryContext) {
+        self.context = context
     }
 
     @MainActor
     func cleanupOldReadReceipts() {
-        guard !viewModel.isStartupPhase, !viewModel.privateChats.isEmpty else {
+        guard !context.isStartupPhase, !context.privateChats.isEmpty else {
             return
         }
 
         let validMessageIDs = Set(
-            viewModel.privateChats.values.flatMap { messages in
+            context.privateChats.values.flatMap { messages in
                 messages.map(\.id)
             }
         )
 
-        let oldCount = viewModel.sentReadReceipts.count
-        viewModel.sentReadReceipts = viewModel.sentReadReceipts.intersection(validMessageIDs)
+        let oldCount = context.sentReadReceipts.count
+        context.sentReadReceipts = context.sentReadReceipts.intersection(validMessageIDs)
 
-        let removedCount = oldCount - viewModel.sentReadReceipts.count
+        let removedCount = oldCount - context.sentReadReceipts.count
         if removedCount > 0 {
             SecureLogger.debug("🧹 Cleaned up \(removedCount) old read receipts", category: .session)
         }
@@ -45,48 +81,65 @@ final class ChatDeliveryCoordinator {
 
     @MainActor
     func deliveryStatus(for messageID: String) -> DeliveryStatus? {
-        if let message = viewModel.messages.first(where: { $0.id == messageID }) {
-            return message.deliveryStatus
+        withValidLocations(for: messageID) { locations in
+            locations.lazy.compactMap { self.deliveryStatus(at: $0) }.first
         }
-
-        for messages in viewModel.privateChats.values {
-            if let message = messages.first(where: { $0.id == messageID }) {
-                return message.deliveryStatus
-            }
-        }
-
-        return nil
     }
 
     @MainActor
     @discardableResult
     func updateMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool {
-        var didUpdateStatus = false
+        switch status {
+        case .delivered, .read:
+            // Confirmed receipt — stop retaining the message for resend.
+            context.markMessageDelivered(messageID)
+        default:
+            break
+        }
 
-        if let index = viewModel.messages.firstIndex(where: { $0.id == messageID }) {
-            let currentStatus = viewModel.messages[index].deliveryStatus
+        var didUpdateStatus = false
+        var didUpdatePrivateStatus = false
+        let locations = withValidLocations(for: messageID) { $0 }
+        guard !locations.isEmpty else { return false }
+
+        for location in locations {
+            guard case .publicTimeline(let index) = location,
+                  index < context.messages.count,
+                  context.messages[index].id == messageID else {
+                continue
+            }
+
+            let currentStatus = context.messages[index].deliveryStatus
             if !shouldSkipUpdate(currentStatus: currentStatus, newStatus: status) {
-                viewModel.messages[index].deliveryStatus = status
+                context.messages[index].deliveryStatus = status
                 didUpdateStatus = true
             }
         }
 
-        var privateChats = viewModel.privateChats
-        for (peerID, chatMessages) in privateChats {
-            guard let index = chatMessages.firstIndex(where: { $0.id == messageID }) else { continue }
+        var privateChats = context.privateChats
+        for location in locations {
+            guard case .privateChat(let peerID, let index) = location,
+                  let chatMessages = privateChats[peerID],
+                  index < chatMessages.count,
+                  chatMessages[index].id == messageID else {
+                continue
+            }
 
             let currentStatus = chatMessages[index].deliveryStatus
             guard !shouldSkipUpdate(currentStatus: currentStatus, newStatus: status) else { continue }
 
-            let updatedMessages = chatMessages
-            updatedMessages[index].deliveryStatus = status
-            privateChats[peerID] = updatedMessages
+            chatMessages[index].deliveryStatus = status
+            privateChats[peerID] = chatMessages
             didUpdateStatus = true
+            didUpdatePrivateStatus = true
+        }
+
+        if didUpdatePrivateStatus {
+            context.privateChats = privateChats
         }
 
         if didUpdateStatus {
-            viewModel.privateChats = privateChats
-            viewModel.objectWillChange.send()
+            context.notifyUIChanged()
         }
 
         return didUpdateStatus
@@ -94,8 +147,14 @@ final class ChatDeliveryCoordinator {
 }
 
 private extension ChatDeliveryCoordinator {
+    enum MessageLocation: Hashable {
+        case publicTimeline(index: Int)
+        case privateChat(peerID: PeerID, index: Int)
+    }
+
     func shouldSkipUpdate(currentStatus: DeliveryStatus?, newStatus: DeliveryStatus) -> Bool {
         guard let currentStatus else { return false }
+        if currentStatus == newStatus { return true }
 
         switch (currentStatus, newStatus) {
         case (.read, .delivered), (.read, .sent):
@@ -104,4 +163,148 @@ private extension ChatDeliveryCoordinator {
             return false
         }
     }
+
+    @MainActor
+    func withValidLocations<T>(
+        for messageID: String,
+        _ body: (Set<MessageLocation>) -> T
+    ) -> T {
+        let didRebuildIndex = refreshMessageLocationIndexForGrowth()
+
+        if let locations = messageLocationIndex[messageID],
+           locations.allSatisfy({ isLocation($0, validFor: messageID) }) {
+            return body(locations)
+        }
+
+        guard !didRebuildIndex else {
+            return body(messageLocationIndex[messageID] ?? [])
+        }
+
+        if messageLocationIndex[messageID] == nil {
+            return body([])
+        }
+
+        rebuildMessageLocationIndex()
+        return body(messageLocationIndex[messageID] ?? [])
+    }
+
+    @MainActor
+    func deliveryStatus(at location: MessageLocation) -> DeliveryStatus? {
+        switch location {
+        case .publicTimeline(let index):
+            guard index < context.messages.count else { return nil }
+            return context.messages[index].deliveryStatus
+        case .privateChat(let peerID, let index):
+            guard let messages = context.privateChats[peerID],
+                  index < messages.count else {
+                return nil
+            }
+            return messages[index].deliveryStatus
+        }
+    }
+
+    @MainActor
+    func isLocation(_ location: MessageLocation, validFor messageID: String) -> Bool {
+        switch location {
+        case .publicTimeline(let index):
+            return index < context.messages.count
+                && context.messages[index].id == messageID
+        case .privateChat(let peerID, let index):
+            guard let messages = context.privateChats[peerID],
+                  index < messages.count else {
+                return false
+            }
+            return messages[index].id == messageID
+        }
+    }
+
+    @MainActor
+    @discardableResult
+    func refreshMessageLocationIndexForGrowth() -> Bool {
+        guard hasBuiltMessageLocationIndex else {
+            rebuildMessageLocationIndex()
+            return true
+        }
+
+        if context.messages.count < indexedPublicMessageCount {
+            rebuildMessageLocationIndex()
+            return true
+        }
+
+        if context.messages.count == indexedPublicMessageCount,
+           context.messages.last?.id != indexedPublicTailMessageID {
+            rebuildMessageLocationIndex()
+            return true
+        }
+
+        if context.messages.count > indexedPublicMessageCount {
+            for index in indexedPublicMessageCount..<context.messages.count {
+                add(.publicTimeline(index: index), for: context.messages[index].id)
+            }
+            indexedPublicMessageCount = context.messages.count
+            indexedPublicTailMessageID = context.messages.last?.id
+        }
+
+        let currentPeerIDs = Set(context.privateChats.keys)
+        if !Set(indexedPrivateMessageCounts.keys).isSubset(of: currentPeerIDs) {
+            rebuildMessageLocationIndex()
+            return true
+        }
+
+        for (peerID, messages) in context.privateChats {
+            let indexedCount = indexedPrivateMessageCounts[peerID] ?? 0
+            if messages.count < indexedCount {
+                rebuildMessageLocationIndex()
+                return true
+            }
+
+            if messages.count == indexedCount,
+               messages.last?.id != indexedPrivateTailMessageIDs[peerID] {
+                rebuildMessageLocationIndex()
+                return true
+            }
+
+            guard messages.count > indexedCount else { continue }
+            for index in indexedCount..<messages.count {
+                add(.privateChat(peerID: peerID, index: index), for: messages[index].id)
+            }
+            indexedPrivateMessageCounts[peerID] = messages.count
+            if let tailID = messages.last?.id {
+                indexedPrivateTailMessageIDs[peerID] = tailID
+            } else {
+                indexedPrivateTailMessageIDs.removeValue(forKey: peerID)
+            }
+        }
+
+        return false
+    }
+
+    @MainActor
+    func rebuildMessageLocationIndex() {
+        messageLocationIndex.removeAll(keepingCapacity: true)
+
+        for (index, message) in context.messages.enumerated() {
+            add(.publicTimeline(index: index), for: message.id)
+        }
+        indexedPublicMessageCount = context.messages.count
+        indexedPublicTailMessageID = context.messages.last?.id
+
+        indexedPrivateMessageCounts.removeAll(keepingCapacity: true)
+        indexedPrivateTailMessageIDs.removeAll(keepingCapacity: true)
+        for (peerID, messages) in context.privateChats {
+            for (index, message) in messages.enumerated() {
+                add(.privateChat(peerID: peerID, index: index), for: message.id)
+            }
+            indexedPrivateMessageCounts[peerID] = messages.count
+            if let tailID = messages.last?.id {
+                indexedPrivateTailMessageIDs[peerID] = tailID
+            }
+        }
+
+        hasBuiltMessageLocationIndex = true
+    }
+
+    func add(_ location: MessageLocation, for messageID: String) {
+        messageLocationIndex[messageID, default: []].insert(location)
+    }
 }

bitchat/ViewModels/ChatMediaTransferCoordinator.swift

@@ -34,11 +34,11 @@ final class ChatMediaTransferCoordinator {
         let transferId = makeTransferID(messageID: messageID)
 
         Task.detached(priority: .userInitiated) { [weak self] in
-            guard let self else { return }
             do {
                 let packet = try ChatMediaPreparation.prepareVoiceNotePacket(at: url)
 
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     self.registerTransfer(transferId: transferId, messageID: messageID)
                     if let peerID = targetPeer {
                         self.viewModel.meshService.sendFilePrivate(packet, to: peerID, transferId: transferId)
@@ -49,12 +49,14 @@ final class ChatMediaTransferCoordinator {
             } catch ChatMediaPreparationError.voiceNoteTooLarge(let size) {
                 SecureLogger.warning("Voice note exceeds size limit (\(size) bytes)", category: .session)
                 try? FileManager.default.removeItem(at: url)
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     self.handleMediaSendFailure(messageID: messageID, reason: "Voice note too large")
                 }
             } catch {
                 SecureLogger.error("Voice note send failed: \(error)", category: .session)
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     self.handleMediaSendFailure(messageID: messageID, reason: "Failed to send voice note")
                 }
             }
@@ -65,10 +67,10 @@ final class ChatMediaTransferCoordinator {
     func processThenSendImage(_ image: UIImage?) {
         guard let image else { return }
         Task.detached { [weak self] in
-            guard let self else { return }
             do {
                 let processedURL = try ImageUtils.processImage(image)
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     self.sendImage(from: processedURL)
                 }
             } catch {
@@ -80,10 +82,10 @@ final class ChatMediaTransferCoordinator {
     func processThenSendImage(from url: URL?) {
         guard let url else { return }
         Task.detached { [weak self] in
-            guard let self else { return }
             do {
                 let processedURL = try ImageUtils.processImage(at: url)
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     self.sendImage(from: processedURL)
                 }
             } catch {
@@ -112,11 +114,11 @@ final class ChatMediaTransferCoordinator {
         }
 
         Task.detached(priority: .userInitiated) { [weak self] in
-            guard let self else { return }
             do {
                 let prepared = try ChatMediaPreparation.prepareImagePacket(from: sourceURL)
 
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     let message = self.enqueueMediaMessage(
                         content: "\(MimeType.Category.image.messagePrefix)\(prepared.outputURL.lastPathComponent)",
                         targetPeer: targetPeer
@@ -132,12 +134,14 @@ final class ChatMediaTransferCoordinator {
                 }
             } catch ChatMediaPreparationError.imageTooLarge(let size) {
                 SecureLogger.warning("Processed image exceeds size limit (\(size) bytes)", category: .session)
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     self.viewModel.addSystemMessage("Image is too large to send.")
                 }
             } catch {
                 SecureLogger.error("Image send preparation failed: \(error)", category: .session)
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     self.viewModel.addSystemMessage("Failed to prepare image for sending.")
                 }
             }

bitchat/ViewModels/ChatNostrCoordinator.swift

@@ -4,22 +4,208 @@ import Foundation
 import SwiftUI
 import Tor
 
-final class ChatNostrCoordinator {
-    private unowned let viewModel: ChatViewModel
+/// The narrow surface `ChatNostrCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding a back-reference to the
+/// whole `ChatViewModel`. This keeps the coordinator independently testable
+/// (see `ChatNostrCoordinatorContextTests`) and makes its true dependencies
+/// explicit. The surface is intentionally large — it documents the
+/// coordinator's real coupling to channel/subscription state, the inbound
+/// Nostr event pipeline, geohash presence, and the ack transports.
+@MainActor
+protocol ChatNostrContext: AnyObject {
+    // MARK: Channel & subscription state
+    var activeChannel: ChannelID { get set }
+    var currentGeohash: String? { get set }
+    var geoSubscriptionID: String? { get set }
+    var geoDmSubscriptionID: String? { get set }
+    /// Geohash sampling subscriptions: subscription ID -> geohash.
+    var geoSamplingSubs: [String: String] { get set }
+    /// Per-geohash notification cooldown: geohash -> last notify time.
+    var lastGeoNotificationAt: [String: Date] { get set }
+    var nostrRelayManager: NostrRelayManager? { get }
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    // MARK: Public timeline & pipeline
+    var messages: [BitchatMessage] { get }
+    func resetPublicMessagePipeline()
+    func updatePublicMessagePipelineChannel(_ channel: ChannelID)
+    func refreshVisibleMessages(from channel: ChannelID?)
+    func addPublicSystemMessage(_ content: String)
+    func drainPendingGeohashSystemMessages() -> [String]
+    func appendGeohashMessageIfAbsent(_ message: BitchatMessage, toGeohash geohash: String) -> Bool
+    func synchronizePublicConversationStore(forGeohash geohash: String)
+
+    // MARK: Inbound public messages
+    func handlePublicMessage(_ message: BitchatMessage)
+    func checkForMentions(_ message: BitchatMessage)
+    func sendHapticFeedback(for message: BitchatMessage)
+    func parseMentions(from content: String) -> [String]
+
+    // MARK: Inbound private (geohash DM) payloads
+    var selectedPrivateChatPeer: PeerID? { get }
+    var nostrKeyMapping: [PeerID: String] { get set }
+    func handlePrivateMessage(
+        _ payload: NoisePayload,
+        senderPubkey: String,
+        convKey: PeerID,
+        id: NostrIdentity,
+        messageTimestamp: Date
+    )
+    func handleDelivered(_ payload: NoisePayload, senderPubkey: String, convKey: PeerID)
+    func handleReadReceipt(_ payload: NoisePayload, senderPubkey: String, convKey: PeerID)
+    func startPrivateChat(with peerID: PeerID)
+
+    // MARK: Nostr identity & blocking (shared with `ChatPrivateConversationContext`)
+    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
+    func currentNostrIdentity() -> NostrIdentity?
+    func isNostrBlocked(pubkeyHexLowercased: String) -> Bool
+    func displayNameForNostrPubkey(_ pubkeyHex: String) -> String
+
+    // MARK: Event dedup
+    func hasProcessedNostrEvent(_ eventID: String) -> Bool
+    func recordProcessedNostrEvent(_ eventID: String)
+    func clearProcessedNostrEvents()
+
+    // MARK: Geo participants & presence
+    var geoNicknames: [String: String] { get }
+    var teleportedGeoCount: Int { get }
+    func startGeoParticipantRefreshTimer()
+    func stopGeoParticipantRefreshTimer()
+    func setActiveParticipantGeohash(_ geohash: String?)
+    func recordGeoParticipant(pubkeyHex: String)
+    func recordGeoParticipant(pubkeyHex: String, geohash: String)
+    func geoParticipantCount(for geohash: String) -> Int
+    func setGeoNickname(_ nickname: String, forPubkey pubkeyHex: String)
+    func markGeoTeleported(_ pubkeyHexLowercased: String)
+    func clearGeoTeleported(_ pubkeyHexLowercased: String)
+    func clearTeleportedGeo()
+    func clearGeoNicknames()
+    func visibleGeohashPeople() -> [GeoPerson]
+
+    // MARK: Location channels
+    var isTeleported: Bool { get }
+    /// True when regional channels are known and the geohash is not one of them.
+    func isGeohashOutsideRegionalChannels(_ geohash: String) -> Bool
+
+    // MARK: Routing & acknowledgements (shared with `ChatPrivateConversationContext`)
+    func routeFavoriteNotification(to peerID: PeerID, isFavorite: Bool)
+    func sendGeohashDeliveryAck(for messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
+    func sendGeohashReadReceipt(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
+}
+
+extension ChatViewModel: ChatNostrContext {
+    // `activeChannel`, `selectedPrivateChatPeer`, `nostrKeyMapping`,
+    // `messages`, `geoNicknames`, the Nostr identity/blocking members, and the
+    // routing/ack members are shared requirements with `ChatDeliveryContext` /
+    // `ChatPrivateConversationContext`; their witnesses already exist. The
+    // members below flatten nested service accesses into intent-named calls.
+
+    func resetPublicMessagePipeline() {
+        publicMessagePipeline.reset()
+    }
+
+    func updatePublicMessagePipelineChannel(_ channel: ChannelID) {
+        publicMessagePipeline.updateActiveChannel(channel)
+    }
+
+    func drainPendingGeohashSystemMessages() -> [String] {
+        timelineStore.drainPendingGeohashSystemMessages()
+    }
+
+    func appendGeohashMessageIfAbsent(_ message: BitchatMessage, toGeohash geohash: String) -> Bool {
+        timelineStore.appendIfAbsent(message, toGeohash: geohash)
+    }
+
+    func hasProcessedNostrEvent(_ eventID: String) -> Bool {
+        deduplicationService.hasProcessedNostrEvent(eventID)
+    }
+
+    func recordProcessedNostrEvent(_ eventID: String) {
+        deduplicationService.recordNostrEvent(eventID)
+    }
+
+    func clearProcessedNostrEvents() {
+        deduplicationService.clearNostrCaches()
+    }
+
+    var teleportedGeoCount: Int {
+        locationPresenceStore.teleportedGeo.count
+    }
+
+    func startGeoParticipantRefreshTimer() {
+        participantTracker.startRefreshTimer()
+    }
+
+    func stopGeoParticipantRefreshTimer() {
+        participantTracker.stopRefreshTimer()
+    }
+
+    func setActiveParticipantGeohash(_ geohash: String?) {
+        participantTracker.setActiveGeohash(geohash)
+    }
+
+    func recordGeoParticipant(pubkeyHex: String) {
+        participantTracker.recordParticipant(pubkeyHex: pubkeyHex)
+    }
+
+    func recordGeoParticipant(pubkeyHex: String, geohash: String) {
+        participantTracker.recordParticipant(pubkeyHex: pubkeyHex, geohash: geohash)
+    }
+
+    func geoParticipantCount(for geohash: String) -> Int {
+        participantTracker.participantCount(for: geohash)
+    }
+
+    func setGeoNickname(_ nickname: String, forPubkey pubkeyHex: String) {
+        locationPresenceStore.setNickname(nickname, for: pubkeyHex)
+    }
+
+    func markGeoTeleported(_ pubkeyHexLowercased: String) {
+        locationPresenceStore.markTeleported(pubkeyHexLowercased)
+    }
+
+    func clearGeoTeleported(_ pubkeyHexLowercased: String) {
+        locationPresenceStore.clearTeleported(pubkeyHexLowercased)
+    }
+
+    func clearTeleportedGeo() {
+        locationPresenceStore.clearTeleportedGeo()
+    }
+
+    func clearGeoNicknames() {
+        locationPresenceStore.clearGeoNicknames()
+    }
+
+    var isTeleported: Bool {
+        locationManager.teleported
+    }
+
+    func isGeohashOutsideRegionalChannels(_ geohash: String) -> Bool {
+        let channels = locationManager.availableChannels
+        return !channels.isEmpty && !channels.contains { $0.geohash == geohash }
+    }
+}
+
+final class ChatNostrCoordinator {
+    private weak var context: (any ChatNostrContext)?
+    private var recentGeoSamplingEventIDs = Set<String>()
+    private var recentGeoSamplingEventIDOrder: [String] = []
+
+    init(context: any ChatNostrContext) {
+        self.context = context
     }
 
     @MainActor
     func resubscribeCurrentGeohash() {
-        guard case .location(let channel) = viewModel.activeChannel else { return }
-        guard let subID = viewModel.geoSubscriptionID else {
-            switchLocationChannel(to: viewModel.activeChannel)
+        guard let context else { return }
+        guard case .location(let channel) = context.activeChannel else { return }
+        guard let subID = context.geoSubscriptionID else {
+            switchLocationChannel(to: context.activeChannel)
             return
         }
 
-        viewModel.participantTracker.startRefreshTimer()
+        context.startGeoParticipantRefreshTimer()
         NostrRelayManager.shared.unsubscribe(id: subID)
         let filter = NostrFilter.geohashEphemeral(
             channel.geohash,
@@ -36,14 +222,14 @@ final class ChatNostrCoordinator {
             }
         }
 
-        if let dmSub = viewModel.geoDmSubscriptionID {
+        if let dmSub = context.geoDmSubscriptionID {
             NostrRelayManager.shared.unsubscribe(id: dmSub)
-            viewModel.geoDmSubscriptionID = nil
+            context.geoDmSubscriptionID = nil
         }
 
-        if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+        if let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
             let dmSub = "geo-dm-\(channel.geohash)"
-            viewModel.geoDmSubscriptionID = dmSub
+            context.geoDmSubscriptionID = dmSub
             let dmFilter = NostrFilter.giftWrapsFor(
                 pubkey: identity.publicKeyHex,
                 since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
@@ -58,18 +244,19 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func subscribeNostrEvent(_ event: NostrEvent) {
+        guard let context else { return }
         guard event.isValidSignature() else { return }
         guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
             || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue),
-              !viewModel.deduplicationService.hasProcessedNostrEvent(event.id)
+              !context.hasProcessedNostrEvent(event.id)
         else {
             return
         }
 
-        viewModel.deduplicationService.recordNostrEvent(event.id)
+        context.recordProcessedNostrEvent(event.id)
 
-        if let gh = viewModel.currentGeohash,
-           let myGeoIdentity = try? viewModel.idBridge.deriveIdentity(forGeohash: gh),
+        if let gh = context.currentGeohash,
+           let myGeoIdentity = try? context.deriveNostrIdentity(forGeohash: gh),
            myGeoIdentity.publicKeyHex.lowercased() == event.pubkey.lowercased() {
             let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
             if Date().timeIntervalSince(eventTime) < 15 {
@@ -79,12 +266,12 @@ final class ChatNostrCoordinator {
 
         if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
             let nick = nickTag[1].trimmed
-            viewModel.locationPresenceStore.setNickname(nick, for: event.pubkey)
+            context.setGeoNickname(nick, forPubkey: event.pubkey)
         }
 
-        viewModel.nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
-        viewModel.nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
-        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey)
+        context.nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
+        context.nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
+        context.recordGeoParticipant(pubkeyHex: event.pubkey)
 
         if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
             return
@@ -97,24 +284,24 @@ final class ChatNostrCoordinator {
         if hasTeleportTag {
             let key = event.pubkey.lowercased()
             let isSelf: Bool = {
-                if let gh = viewModel.currentGeohash,
-                   let myIdentity = try? viewModel.idBridge.deriveIdentity(forGeohash: gh) {
+                if let gh = context.currentGeohash,
+                   let myIdentity = try? context.deriveNostrIdentity(forGeohash: gh) {
                     return myIdentity.publicKeyHex.lowercased() == key
                 }
                 return false
             }()
             if !isSelf {
-                Task { @MainActor [weak viewModel] in
-                    viewModel?.locationPresenceStore.markTeleported(key)
+                Task { @MainActor [weak context] in
+                    context?.markGeoTeleported(key)
                 }
             }
         }
 
-        let senderName = viewModel.displayNameForNostrPubkey(event.pubkey)
+        let senderName = context.displayNameForNostrPubkey(event.pubkey)
         let content = event.content.trimmed
         let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
         let timestamp = min(rawTs, Date())
-        let mentions = viewModel.parseMentions(from: content)
+        let mentions = context.parseMentions(from: content)
         let message = BitchatMessage(
             id: event.id,
             sender: senderName,
@@ -125,22 +312,23 @@ final class ChatNostrCoordinator {
             mentions: mentions.isEmpty ? nil : mentions
         )
 
-        Task { @MainActor [weak viewModel] in
-            guard let viewModel else { return }
-            let isBlocked = viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased())
-            viewModel.handlePublicMessage(message)
+        Task { @MainActor [weak context] in
+            guard let context else { return }
+            let isBlocked = context.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased())
+            context.handlePublicMessage(message)
             if !isBlocked {
-                viewModel.checkForMentions(message)
-                viewModel.sendHapticFeedback(for: message)
+                context.checkForMentions(message)
+                context.sendHapticFeedback(for: message)
             }
         }
     }
 
     @MainActor
     func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
+        guard let context else { return }
         guard giftWrap.isValidSignature() else { return }
-        guard !viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) else { return }
-        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
+        guard !context.hasProcessedNostrEvent(giftWrap.id) else { return }
+        context.recordProcessedNostrEvent(giftWrap.id)
 
         guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
             giftWrap: giftWrap,
@@ -155,11 +343,11 @@ final class ChatNostrCoordinator {
 
         let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
         let convKey = PeerID(nostr_: senderPubkey)
-        viewModel.nostrKeyMapping[convKey] = senderPubkey
+        context.nostrKeyMapping[convKey] = senderPubkey
 
         switch noisePayload.type {
         case .privateMessage:
-            viewModel.handlePrivateMessage(
+            context.handlePrivateMessage(
                 noisePayload,
                 senderPubkey: senderPubkey,
                 convKey: convKey,
@@ -167,9 +355,9 @@ final class ChatNostrCoordinator {
                 messageTimestamp: messageTimestamp
             )
         case .delivered:
-            viewModel.handleDelivered(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
+            context.handleDelivered(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
         case .readReceipt:
-            viewModel.handleReadReceipt(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
+            context.handleReadReceipt(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
         case .verifyChallenge, .verifyResponse:
             break
         }
@@ -177,67 +365,66 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func switchLocationChannel(to channel: ChannelID) {
-        viewModel.publicMessagePipeline.reset()
-        viewModel.activeChannel = channel
-        viewModel.publicMessagePipeline.updateActiveChannel(channel)
+        guard let context else { return }
+        context.resetPublicMessagePipeline()
+        context.activeChannel = channel
+        context.updatePublicMessagePipelineChannel(channel)
 
-        viewModel.deduplicationService.clearNostrCaches()
+        context.clearProcessedNostrEvents()
         switch channel {
         case .mesh:
-            viewModel.refreshVisibleMessages(from: .mesh)
-            let emptyMesh = viewModel.messages.filter { $0.content.trimmed.isEmpty }.count
+            context.refreshVisibleMessages(from: .mesh)
+            let emptyMesh = context.messages.filter { $0.content.trimmed.isEmpty }.count
             if emptyMesh > 0 {
                 SecureLogger.debug("RenderGuard: mesh timeline contains \(emptyMesh) empty messages", category: .session)
             }
-            viewModel.participantTracker.stopRefreshTimer()
-            viewModel.participantTracker.setActiveGeohash(nil)
-            viewModel.locationPresenceStore.clearTeleportedGeo()
+            context.stopGeoParticipantRefreshTimer()
+            context.setActiveParticipantGeohash(nil)
+            context.clearTeleportedGeo()
 
         case .location:
-            viewModel.refreshVisibleMessages(from: channel)
+            context.refreshVisibleMessages(from: channel)
         }
 
         if case .location = channel {
-            for content in viewModel.timelineStore.drainPendingGeohashSystemMessages() {
-                viewModel.addPublicSystemMessage(content)
+            for content in context.drainPendingGeohashSystemMessages() {
+                context.addPublicSystemMessage(content)
             }
         }
 
-        if let sub = viewModel.geoSubscriptionID {
+        if let sub = context.geoSubscriptionID {
             NostrRelayManager.shared.unsubscribe(id: sub)
-            viewModel.geoSubscriptionID = nil
+            context.geoSubscriptionID = nil
         }
-        if let dmSub = viewModel.geoDmSubscriptionID {
+        if let dmSub = context.geoDmSubscriptionID {
             NostrRelayManager.shared.unsubscribe(id: dmSub)
-            viewModel.geoDmSubscriptionID = nil
+            context.geoDmSubscriptionID = nil
         }
-        viewModel.currentGeohash = nil
-        viewModel.participantTracker.setActiveGeohash(nil)
-        viewModel.locationPresenceStore.clearGeoNicknames()
+        context.currentGeohash = nil
+        context.setActiveParticipantGeohash(nil)
+        context.clearGeoNicknames()
 
         guard case .location(let channel) = channel else { return }
-        viewModel.currentGeohash = channel.geohash
-        viewModel.participantTracker.setActiveGeohash(channel.geohash)
+        context.currentGeohash = channel.geohash
+        context.setActiveParticipantGeohash(channel.geohash)
 
-        if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
-            viewModel.participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
-            let hasRegional = !viewModel.locationManager.availableChannels.isEmpty
-            let inRegional = viewModel.locationManager.availableChannels.contains { $0.geohash == channel.geohash }
+        if let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
+            context.recordGeoParticipant(pubkeyHex: identity.publicKeyHex)
             let key = identity.publicKeyHex.lowercased()
-            if viewModel.locationManager.teleported && hasRegional && !inRegional {
-                viewModel.locationPresenceStore.markTeleported(key)
+            if context.isTeleported && context.isGeohashOutsideRegionalChannels(channel.geohash) {
+                context.markGeoTeleported(key)
                 SecureLogger.info(
-                    "GeoTeleport: channel switch mark self teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
+                    "GeoTeleport: channel switch mark self teleported key=\(key.prefix(8))… total=\(context.teleportedGeoCount)",
                     category: .session
                 )
             } else {
-                viewModel.locationPresenceStore.clearTeleported(key)
+                context.clearGeoTeleported(key)
             }
         }
 
         let subID = "geo-\(channel.geohash)"
-        viewModel.geoSubscriptionID = subID
-        viewModel.participantTracker.startRefreshTimer()
+        context.geoSubscriptionID = subID
+        context.startGeoParticipantRefreshTimer()
         let ts = Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds)
         let filter = NostrFilter.geohashEphemeral(channel.geohash, since: ts, limit: TransportConfig.nostrGeohashInitialLimit)
         let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: channel.geohash, count: 5)
@@ -252,6 +439,7 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func handleNostrEvent(_ event: NostrEvent) {
+        guard let context else { return }
         guard event.isValidSignature() else { return }
         guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
             || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue)
@@ -259,13 +447,13 @@ final class ChatNostrCoordinator {
             return
         }
 
-        if viewModel.deduplicationService.hasProcessedNostrEvent(event.id) { return }
-        viewModel.deduplicationService.recordNostrEvent(event.id)
+        if context.hasProcessedNostrEvent(event.id) { return }
+        context.recordProcessedNostrEvent(event.id)
 
         let tagSummary = event.tags.map { "[" + $0.joined(separator: ",") + "]" }.joined(separator: ",")
         SecureLogger.debug("GeoTeleport: recv pub=\(event.pubkey.prefix(8))… tags=\(tagSummary)", category: .session)
 
-        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
+        if context.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
             return
         }
 
@@ -274,8 +462,8 @@ final class ChatNostrCoordinator {
         }
 
         let isSelf: Bool = {
-            if let gh = viewModel.currentGeohash,
-               let my = try? viewModel.idBridge.deriveIdentity(forGeohash: gh) {
+            if let gh = context.currentGeohash,
+               let my = try? context.deriveNostrIdentity(forGeohash: gh) {
                 return my.publicKeyHex.lowercased() == event.pubkey.lowercased()
             }
             return false
@@ -283,17 +471,17 @@ final class ChatNostrCoordinator {
 
         if hasTeleportTag, !isSelf {
             let key = event.pubkey.lowercased()
-            Task { @MainActor [weak viewModel] in
-                guard let viewModel else { return }
-                viewModel.locationPresenceStore.markTeleported(key)
+            Task { @MainActor [weak context] in
+                guard let context else { return }
+                context.markGeoTeleported(key)
                 SecureLogger.info(
-                    "GeoTeleport: mark peer teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
+                    "GeoTeleport: mark peer teleported key=\(key.prefix(8))… total=\(context.teleportedGeoCount)",
                     category: .session
                 )
             }
         }
 
-        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey)
+        context.recordGeoParticipant(pubkeyHex: event.pubkey)
 
         if isSelf {
             let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
@@ -303,17 +491,17 @@ final class ChatNostrCoordinator {
         }
 
         if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
-            viewModel.locationPresenceStore.setNickname(nickTag[1].trimmed, for: event.pubkey)
+            context.setGeoNickname(nickTag[1].trimmed, forPubkey: event.pubkey)
         }
 
-        viewModel.nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
-        viewModel.nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
+        context.nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
+        context.nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
 
         if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
             return
         }
 
-        let senderName = viewModel.displayNameForNostrPubkey(event.pubkey)
+        let senderName = context.displayNameForNostrPubkey(event.pubkey)
         let content = event.content
 
         if let teleTag = event.tags.first(where: { $0.first == "t" }),
@@ -324,7 +512,7 @@ final class ChatNostrCoordinator {
         }
 
         let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-        let mentions = viewModel.parseMentions(from: content)
+        let mentions = context.parseMentions(from: content)
         let message = BitchatMessage(
             id: event.id,
             sender: senderName,
@@ -335,20 +523,21 @@ final class ChatNostrCoordinator {
             mentions: mentions.isEmpty ? nil : mentions
         )
 
-        Task { @MainActor [weak viewModel] in
-            guard let viewModel else { return }
-            viewModel.handlePublicMessage(message)
-            viewModel.checkForMentions(message)
-            viewModel.sendHapticFeedback(for: message)
+        Task { @MainActor [weak context] in
+            guard let context else { return }
+            context.handlePublicMessage(message)
+            context.checkForMentions(message)
+            context.sendHapticFeedback(for: message)
         }
     }
 
     @MainActor
     func subscribeToGeoChat(_ channel: GeohashChannel) {
-        guard let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) else { return }
+        guard let context else { return }
+        guard let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) else { return }
 
         let dmSub = "geo-dm-\(channel.geohash)"
-        viewModel.geoDmSubscriptionID = dmSub
+        context.geoDmSubscriptionID = dmSub
         if TorManager.shared.isReady {
             SecureLogger.debug("GeoDM: subscribing DMs pub=\(identity.publicKeyHex.prefix(8))… sub=\(dmSub)", category: .session)
         }
@@ -365,11 +554,12 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func handleGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
+        guard let context else { return }
         guard giftWrap.isValidSignature() else { return }
-        if viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) {
+        if context.hasProcessedNostrEvent(giftWrap.id) {
             return
         }
-        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
+        context.recordProcessedNostrEvent(giftWrap.id)
 
         guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
             giftWrap: giftWrap,
@@ -392,12 +582,12 @@ final class ChatNostrCoordinator {
         }
 
         let convKey = PeerID(nostr_: senderPubkey)
-        viewModel.nostrKeyMapping[convKey] = senderPubkey
+        context.nostrKeyMapping[convKey] = senderPubkey
 
         switch payload.type {
         case .privateMessage:
             let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
-            viewModel.handlePrivateMessage(
+            context.handlePrivateMessage(
                 payload,
                 senderPubkey: senderPubkey,
                 convKey: convKey,
@@ -405,19 +595,20 @@ final class ChatNostrCoordinator {
                 messageTimestamp: messageTimestamp
             )
         case .delivered:
-            viewModel.handleDelivered(payload, senderPubkey: senderPubkey, convKey: convKey)
+            context.handleDelivered(payload, senderPubkey: senderPubkey, convKey: convKey)
         case .readReceipt:
-            viewModel.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: convKey)
+            context.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: convKey)
         case .verifyChallenge, .verifyResponse:
             break
         }
     }
 
     @MainActor
-    func sendGeohash(context: ChatViewModel.GeoOutgoingContext) {
-        let channel = context.channel
-        let event = context.event
-        let identity = context.identity
+    func sendGeohash(context geoContext: ChatViewModel.GeoOutgoingContext) {
+        guard let context else { return }
+        let channel = geoContext.channel
+        let event = geoContext.event
+        let identity = geoContext.identity
 
         let targetRelays = GeoRelayDirectory.shared.closestRelays(
             toGeohash: channel.geohash,
@@ -430,42 +621,41 @@ final class ChatNostrCoordinator {
             NostrRelayManager.shared.sendEvent(event, to: targetRelays)
         }
 
-        viewModel.participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
-        viewModel.nostrKeyMapping[PeerID(nostr: identity.publicKeyHex)] = identity.publicKeyHex
+        context.recordGeoParticipant(pubkeyHex: identity.publicKeyHex)
+        context.nostrKeyMapping[PeerID(nostr: identity.publicKeyHex)] = identity.publicKeyHex
         SecureLogger.debug(
-            "GeoTeleport: sent geo message pub=\(identity.publicKeyHex.prefix(8))… teleported=\(context.teleported)",
+            "GeoTeleport: sent geo message pub=\(identity.publicKeyHex.prefix(8))… teleported=\(geoContext.teleported)",
             category: .session
         )
 
-        let hasRegional = !viewModel.locationManager.availableChannels.isEmpty
-        let inRegional = viewModel.locationManager.availableChannels.contains { $0.geohash == channel.geohash }
-        if context.teleported && hasRegional && !inRegional {
+        if geoContext.teleported && context.isGeohashOutsideRegionalChannels(channel.geohash) {
             let key = identity.publicKeyHex.lowercased()
-            viewModel.locationPresenceStore.markTeleported(key)
+            context.markGeoTeleported(key)
             SecureLogger.info(
-                "GeoTeleport: mark self teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
+                "GeoTeleport: mark self teleported key=\(key.prefix(8))… total=\(context.teleportedGeoCount)",
                 category: .session
             )
         }
 
-        viewModel.deduplicationService.recordNostrEvent(event.id)
+        context.recordProcessedNostrEvent(event.id)
     }
 
     @MainActor
     func beginGeohashSampling(for geohashes: [String]) {
+        guard let context else { return }
         if !TorManager.shared.isForeground() {
             endGeohashSampling()
             return
         }
 
         let desired = Set(geohashes)
-        let current = Set(viewModel.geoSamplingSubs.values)
+        let current = Set(context.geoSamplingSubs.values)
         let toAdd = desired.subtracting(current)
         let toRemove = current.subtracting(desired)
 
-        for (subID, gh) in viewModel.geoSamplingSubs where toRemove.contains(gh) {
+        for (subID, gh) in context.geoSamplingSubs where toRemove.contains(gh) {
             NostrRelayManager.shared.unsubscribe(id: subID)
-            viewModel.geoSamplingSubs.removeValue(forKey: subID)
+            context.geoSamplingSubs.removeValue(forKey: subID)
         }
 
         for gh in toAdd {
@@ -475,8 +665,9 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func subscribe(_ gh: String) {
+        guard let context else { return }
         let subID = "geo-sample-\(gh)"
-        viewModel.geoSamplingSubs[subID] = gh
+        context.geoSamplingSubs[subID] = gh
         let filter = NostrFilter.geohashEphemeral(
             gh,
             since: Date().addingTimeInterval(-TransportConfig.nostrGeohashSampleLookbackSeconds),
@@ -492,19 +683,21 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func subscribeNostrEvent(_ event: NostrEvent, gh: String) {
-        guard event.isValidSignature() else { return }
+        guard let context else { return }
         guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
             || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue)
         else {
             return
         }
+        guard event.isValidSignature() else { return }
+        guard shouldProcessGeoSamplingEvent(event.id) else { return }
 
-        let existingCount = viewModel.participantTracker.participantCount(for: gh)
-        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey, geohash: gh)
+        let existingCount = context.geoParticipantCount(for: gh)
+        context.recordGeoParticipant(pubkeyHex: event.pubkey, geohash: gh)
 
         guard let content = event.content.trimmedOrNilIfEmpty else { return }
-        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased()) { return }
-        if let my = try? viewModel.idBridge.deriveIdentity(forGeohash: gh),
+        if context.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased()) { return }
+        if let my = try? context.deriveNostrIdentity(forGeohash: gh),
            my.publicKeyHex.lowercased() == event.pubkey.lowercased() {
             return
         }
@@ -515,10 +708,10 @@ final class ChatNostrCoordinator {
 
         #if os(iOS)
         guard UIApplication.shared.applicationState == .active else { return }
-        if case .location(let channel) = viewModel.activeChannel, channel.geohash == gh { return }
+        if case .location(let channel) = context.activeChannel, channel.geohash == gh { return }
         #elseif os(macOS)
         guard NSApplication.shared.isActive else { return }
-        if case .location(let channel) = viewModel.activeChannel, channel.geohash == gh { return }
+        if case .location(let channel) = context.activeChannel, channel.geohash == gh { return }
         #endif
 
         cooldownPerGeohash(gh, content: content, event: event)
@@ -526,8 +719,9 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func cooldownPerGeohash(_ gh: String, content: String, event: NostrEvent) {
+        guard let context else { return }
         let now = Date()
-        let last = viewModel.lastGeoNotificationAt[gh] ?? .distantPast
+        let last = context.lastGeoNotificationAt[gh] ?? .distantPast
         if now.timeIntervalSince(last) < TransportConfig.uiGeoNotifyCooldownSeconds { return }
 
         let preview: String = {
@@ -537,16 +731,16 @@ final class ChatNostrCoordinator {
             return String(content[..<idx]) + "…"
         }()
 
-        Task { @MainActor [weak viewModel] in
-            guard let viewModel else { return }
-            viewModel.lastGeoNotificationAt[gh] = now
+        Task { @MainActor [weak context] in
+            guard let context else { return }
+            context.lastGeoNotificationAt[gh] = now
             let senderSuffix = String(event.pubkey.suffix(4))
-            let nick = viewModel.geoNicknames[event.pubkey.lowercased()]
+            let nick = context.geoNicknames[event.pubkey.lowercased()]
             let senderName = (nick?.isEmpty == false ? nick! : "anon") + "#" + senderSuffix
 
             let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
             let ts = min(rawTs, Date())
-            let mentions = viewModel.parseMentions(from: content)
+            let mentions = context.parseMentions(from: content)
             let message = BitchatMessage(
                 id: event.id,
                 sender: senderName,
@@ -556,8 +750,8 @@ final class ChatNostrCoordinator {
                 senderPeerID: PeerID(nostr: event.pubkey),
                 mentions: mentions.isEmpty ? nil : mentions
             )
-            if viewModel.timelineStore.appendIfAbsent(message, toGeohash: gh) {
-                viewModel.synchronizePublicConversationStore(forGeohash: gh)
+            if context.appendGeohashMessageIfAbsent(message, toGeohash: gh) {
+                context.synchronizePublicConversationStore(forGeohash: gh)
                 NotificationService.shared.sendGeohashActivityNotification(geohash: gh, bodyPreview: preview)
             }
         }
@@ -565,15 +759,41 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func endGeohashSampling() {
-        for subID in viewModel.geoSamplingSubs.keys {
+        guard let context else { return }
+        for subID in context.geoSamplingSubs.keys {
             NostrRelayManager.shared.unsubscribe(id: subID)
         }
-        viewModel.geoSamplingSubs.removeAll()
+        context.geoSamplingSubs.removeAll()
+        clearGeoSamplingEventDedup()
+    }
+
+    private func shouldProcessGeoSamplingEvent(_ eventID: String) -> Bool {
+        guard !eventID.isEmpty else { return true }
+        guard recentGeoSamplingEventIDs.insert(eventID).inserted else {
+            return false
+        }
+        recentGeoSamplingEventIDOrder.append(eventID)
+
+        let cap = TransportConfig.geoSamplingEventLRUCap
+        if recentGeoSamplingEventIDOrder.count > cap {
+            let removeCount = recentGeoSamplingEventIDOrder.count - cap
+            for staleID in recentGeoSamplingEventIDOrder.prefix(removeCount) {
+                recentGeoSamplingEventIDs.remove(staleID)
+            }
+            recentGeoSamplingEventIDOrder.removeFirst(removeCount)
+        }
+        return true
+    }
+
+    private func clearGeoSamplingEventDedup() {
+        recentGeoSamplingEventIDs.removeAll()
+        recentGeoSamplingEventIDOrder.removeAll()
     }
 
     @MainActor
     func setupNostrMessageHandling() {
-        guard let currentIdentity = try? viewModel.idBridge.getCurrentNostrIdentity() else {
+        guard let context else { return }
+        guard let currentIdentity = context.currentNostrIdentity() else {
             SecureLogger.warning("⚠️ No Nostr identity available for message handling", category: .session)
             return
         }
@@ -588,7 +808,7 @@ final class ChatNostrCoordinator {
             since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
         )
 
-        viewModel.nostrRelayManager?.subscribe(filter: filter, id: "chat-messages") { [weak self] event in
+        context.nostrRelayManager?.subscribe(filter: filter, id: "chat-messages") { [weak self] event in
             Task { @MainActor [weak self] in
                 self?.handleNostrMessage(event)
             }
@@ -597,8 +817,10 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func handleNostrMessage(_ giftWrap: NostrEvent) {
-        if viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) { return }
-        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
+        guard let context else { return }
+        guard giftWrap.isValidSignature() else { return }
+        if context.hasProcessedNostrEvent(giftWrap.id) { return }
+        context.recordProcessedNostrEvent(giftWrap.id)
 
         Task.detached(priority: .userInitiated) { [weak self] in
             await self?.processNostrMessage(giftWrap)
@@ -607,8 +829,9 @@ final class ChatNostrCoordinator {
 
     func processNostrMessage(_ giftWrap: NostrEvent) async {
         guard giftWrap.isValidSignature() else { return }
+        guard let context else { return }
         let currentIdentity: NostrIdentity? = await MainActor.run {
-            try? viewModel.idBridge.getCurrentNostrIdentity()
+            context.currentNostrIdentity()
         }
         guard let currentIdentity else { return }
 
@@ -640,11 +863,11 @@ final class ChatNostrCoordinator {
                    let payload = NoisePayload.decode(packet.payload) {
                     let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTimestamp))
                     await MainActor.run {
-                        viewModel.nostrKeyMapping[targetPeerID] = senderPubkey
+                        context.nostrKeyMapping[targetPeerID] = senderPubkey
 
                         switch payload.type {
                         case .privateMessage:
-                            viewModel.handlePrivateMessage(
+                            context.handlePrivateMessage(
                                 payload,
                                 senderPubkey: senderPubkey,
                                 convKey: targetPeerID,
@@ -652,9 +875,9 @@ final class ChatNostrCoordinator {
                                 messageTimestamp: messageTimestamp
                             )
                         case .delivered:
-                            viewModel.handleDelivered(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
+                            context.handleDelivered(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
                         case .readReceipt:
-                            viewModel.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
+                            context.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
                         case .verifyChallenge, .verifyResponse:
                             break
                         }
@@ -711,33 +934,26 @@ final class ChatNostrCoordinator {
         senderPubkey: String,
         key: Data?
     ) {
+        guard let context else { return }
         if let _ = key {
-            if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
-                let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-                transport.senderPeerID = viewModel.meshService.myPeerID
-                transport.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: identity)
+            if let identity = context.currentNostrIdentity() {
+                context.sendGeohashDeliveryAck(for: message.id, toRecipientHex: senderPubkey, from: identity)
             }
-        } else if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
-            let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-            transport.senderPeerID = viewModel.meshService.myPeerID
-            transport.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: identity)
+        } else if let identity = context.currentNostrIdentity() {
+            context.sendGeohashDeliveryAck(for: message.id, toRecipientHex: senderPubkey, from: identity)
             SecureLogger.debug(
                 "Sent DELIVERED ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…",
                 category: .session
             )
         }
 
-        if !wasReadBefore && viewModel.selectedPrivateChatPeer == message.senderPeerID {
+        if !wasReadBefore && context.selectedPrivateChatPeer == message.senderPeerID {
             if let _ = key {
-                if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
-                    let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-                    transport.senderPeerID = viewModel.meshService.myPeerID
-                    transport.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: identity)
+                if let identity = context.currentNostrIdentity() {
+                    context.sendGeohashReadReceipt(message.id, toRecipientHex: senderPubkey, from: identity)
                 }
-            } else if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
-                let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-                transport.senderPeerID = viewModel.meshService.myPeerID
-                transport.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: identity)
+            } else if let identity = context.currentNostrIdentity() {
+                context.sendGeohashReadReceipt(message.id, toRecipientHex: senderPubkey, from: identity)
                 SecureLogger.debug(
                     "Viewing chat; sent READ ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…",
                     category: .session
@@ -798,6 +1014,7 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func sendFavoriteNotificationViaNostr(noisePublicKey: Data, isFavorite: Bool) {
+        guard let context else { return }
         guard let relationship = FavoritesPersistenceService.shared.getFavoriteStatus(for: noisePublicKey),
               relationship.peerNostrPublicKey != nil else {
             SecureLogger.warning("⚠️ Cannot send favorite notification - no Nostr key for peer", category: .session)
@@ -805,15 +1022,16 @@ final class ChatNostrCoordinator {
         }
 
         let peerID = PeerID(hexData: noisePublicKey)
-        viewModel.messageRouter.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
+        context.routeFavoriteNotification(to: peerID, isFavorite: isFavorite)
     }
 
     @MainActor
     func nostrPubkeyForDisplayName(_ name: String) -> String? {
-        for person in viewModel.visibleGeohashPeople() where person.displayName == name {
+        guard let context else { return nil }
+        for person in context.visibleGeohashPeople() where person.displayName == name {
             return person.id
         }
-        for (pub, nick) in viewModel.geoNicknames where nick == name {
+        for (pub, nick) in context.geoNicknames where nick == name {
             return pub
         }
         return nil
@@ -821,22 +1039,25 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func startGeohashDM(withPubkeyHex hex: String) {
+        guard let context else { return }
         let convKey = PeerID(nostr_: hex)
-        viewModel.nostrKeyMapping[convKey] = hex
-        viewModel.startPrivateChat(with: convKey)
+        context.nostrKeyMapping[convKey] = hex
+        context.startPrivateChat(with: convKey)
     }
 
     @MainActor
     func fullNostrHex(forSenderPeerID senderID: PeerID) -> String? {
-        viewModel.nostrKeyMapping[senderID]
+        guard let context else { return nil }
+        return context.nostrKeyMapping[senderID]
     }
 
     @MainActor
     func geohashDisplayName(for convKey: PeerID) -> String {
-        guard let full = viewModel.nostrKeyMapping[convKey] else {
+        guard let context else { return convKey.bare }
+        guard let full = context.nostrKeyMapping[convKey] else {
             return convKey.bare
         }
-        return viewModel.displayNameForNostrPubkey(full)
+        return context.displayNameForNostrPubkey(full)
     }
 }
 

bitchat/ViewModels/ChatPrivateConversationCoordinator.swift

@@ -2,20 +2,174 @@ import BitFoundation
 import BitLogger
 import Foundation
 
+/// The narrow surface `ChatPrivateConversationCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding an `unowned` back-ref
+/// to the whole `ChatViewModel`. This keeps the coordinator independently
+/// testable (see `ChatPrivateConversationCoordinatorContextTests`) and makes
+/// its true dependencies explicit. The surface is intentionally large — it
+/// documents the coordinator's real coupling to private-chat state, peer
+/// identity, and the routing/ack transports.
+@MainActor
+protocol ChatPrivateConversationContext: AnyObject {
+    // MARK: Conversation state
+    var privateChats: [PeerID: [BitchatMessage]] { get set }
+    var sentReadReceipts: Set<String> { get set }
+    var sentGeoDeliveryAcks: Set<String> { get set }
+    var unreadPrivateMessages: Set<PeerID> { get set }
+    var selectedPrivateChatPeer: PeerID? { get set }
+    var nickname: String { get }
+    var activeChannel: ChannelID { get }
+    var nostrKeyMapping: [PeerID: String] { get }
+    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
+    func notifyUIChanged()
+
+    // MARK: Peers & identity
+    var myPeerID: PeerID { get }
+    func peerNickname(for peerID: PeerID) -> String?
+    func isPeerConnected(_ peerID: PeerID) -> Bool
+    func isPeerReachable(_ peerID: PeerID) -> Bool
+    func isPeerBlocked(_ peerID: PeerID) -> Bool
+    func noisePublicKey(for peerID: PeerID) -> Data?
+    /// Resolves the ephemeral (short) peer ID for a known Noise public key, if connected.
+    func ephemeralPeerID(forNoiseKey noiseKey: Data) -> PeerID?
+    func getPeerIDForNickname(_ nickname: String) -> PeerID?
+    func getFingerprint(for peerID: PeerID) -> String?
+    func storedFingerprint(for peerID: PeerID) -> String?
+    func clearStoredFingerprint(for peerID: PeerID)
+
+    // MARK: Nostr identity
+    func isNostrBlocked(pubkeyHexLowercased: String) -> Bool
+    func displayNameForNostrPubkey(_ pubkeyHex: String) -> String
+    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
+    func currentNostrIdentity() -> NostrIdentity?
+
+    // MARK: Routing & acknowledgements
+    func routePrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String)
+    func routeReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID)
+    func routeFavoriteNotification(to peerID: PeerID, isFavorite: Bool)
+    func sendMeshReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID)
+    func sendGeohashPrivateMessage(_ content: String, toRecipientHex recipientHex: String, from identity: NostrIdentity, messageID: String)
+    func sendGeohashDeliveryAck(for messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
+    func sendGeohashReadReceipt(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
+    func sendDeliveryAckViaNostrEmbedded(_ message: BitchatMessage, wasReadBefore: Bool, senderPubkey: String, key: Data?)
+
+    // MARK: System messages & chat hygiene
+    func addSystemMessage(_ content: String)
+    func addMeshOnlySystemMessage(_ content: String)
+    func sanitizeChat(for peerID: PeerID)
+}
+
+extension ChatViewModel: ChatPrivateConversationContext {
+    // `privateChats`, `sentReadReceipts`, and `notifyUIChanged()` are shared
+    // requirements with `ChatDeliveryContext`; the remaining state members are
+    // satisfied by existing `ChatViewModel` properties and methods.
+
+    var myPeerID: PeerID { meshService.myPeerID }
+
+    func peerNickname(for peerID: PeerID) -> String? {
+        meshService.peerNickname(peerID: peerID)
+    }
+
+    func isPeerConnected(_ peerID: PeerID) -> Bool {
+        meshService.isPeerConnected(peerID)
+    }
+
+    func isPeerReachable(_ peerID: PeerID) -> Bool {
+        meshService.isPeerReachable(peerID)
+    }
+
+    func noisePublicKey(for peerID: PeerID) -> Data? {
+        unifiedPeerService.getPeer(by: peerID)?.noisePublicKey
+    }
+
+    func ephemeralPeerID(forNoiseKey noiseKey: Data) -> PeerID? {
+        unifiedPeerService.peers.first(where: { $0.noisePublicKey == noiseKey })?.peerID
+    }
+
+    func storedFingerprint(for peerID: PeerID) -> String? {
+        peerIDToPublicKeyFingerprint[peerID]
+    }
+
+    func clearStoredFingerprint(for peerID: PeerID) {
+        peerIdentityStore.setFingerprint(nil, for: peerID)
+    }
+
+    func isNostrBlocked(pubkeyHexLowercased: String) -> Bool {
+        identityManager.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
+    }
+
+    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity {
+        try idBridge.deriveIdentity(forGeohash: geohash)
+    }
+
+    func currentNostrIdentity() -> NostrIdentity? {
+        try? idBridge.getCurrentNostrIdentity()
+    }
+
+    func routePrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
+        messageRouter.sendPrivate(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
+    }
+
+    func routeReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
+        messageRouter.sendReadReceipt(receipt, to: peerID)
+    }
+
+    func routeFavoriteNotification(to peerID: PeerID, isFavorite: Bool) {
+        messageRouter.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
+    }
+
+    func sendMeshReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
+        meshService.sendReadReceipt(receipt, to: peerID)
+    }
+
+    func sendGeohashPrivateMessage(_ content: String, toRecipientHex recipientHex: String, from identity: NostrIdentity, messageID: String) {
+        makeGeohashNostrTransport().sendPrivateMessageGeohash(
+            content: content,
+            toRecipientHex: recipientHex,
+            from: identity,
+            messageID: messageID
+        )
+    }
+
+    func sendGeohashDeliveryAck(for messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity) {
+        makeGeohashNostrTransport().sendDeliveryAckGeohash(for: messageID, toRecipientHex: recipientHex, from: identity)
+    }
+
+    func sendGeohashReadReceipt(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity) {
+        makeGeohashNostrTransport().sendReadReceiptGeohash(messageID, toRecipientHex: recipientHex, from: identity)
+    }
+
+    func addSystemMessage(_ content: String) {
+        addSystemMessage(content, timestamp: Date())
+    }
+
+    func sanitizeChat(for peerID: PeerID) {
+        privateChatManager.sanitizeChat(for: peerID)
+    }
+
+    private func makeGeohashNostrTransport() -> NostrTransport {
+        let transport = NostrTransport(keychain: keychain, idBridge: idBridge)
+        transport.senderPeerID = meshService.myPeerID
+        return transport
+    }
+}
+
 @MainActor
 final class ChatPrivateConversationCoordinator {
-    private unowned let viewModel: ChatViewModel
+    private unowned let context: any ChatPrivateConversationContext
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    init(context: any ChatPrivateConversationContext) {
+        self.context = context
     }
 
     func sendPrivateMessage(_ content: String, to peerID: PeerID) {
         guard !content.isEmpty else { return }
 
-        if viewModel.unifiedPeerService.isBlocked(peerID) {
-            let nickname = viewModel.meshService.peerNickname(peerID: peerID) ?? "user"
-            viewModel.addSystemMessage(
+        if context.isPeerBlocked(peerID) {
+            let nickname = context.peerNickname(for: peerID) ?? "user"
+            context.addSystemMessage(
                 String(
                     format: String(localized: "system.dm.blocked_recipient", comment: "System message when attempting to message a blocked user"),
                     locale: .current,
@@ -31,13 +185,13 @@ final class ChatPrivateConversationCoordinator {
         }
 
         guard let noiseKey = Data(hexString: peerID.id) else { return }
-        let isConnected = viewModel.meshService.isPeerConnected(peerID)
-        let isReachable = viewModel.meshService.isPeerReachable(peerID)
+        let isConnected = context.isPeerConnected(peerID)
+        let isReachable = context.isPeerReachable(peerID)
         let favoriteStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey)
         let isMutualFavorite = favoriteStatus?.isMutual ?? false
         let hasNostrKey = favoriteStatus?.peerNostrPublicKey != nil
 
-        var recipientNickname = viewModel.meshService.peerNickname(peerID: peerID)
+        var recipientNickname = context.peerNickname(for: peerID)
         if recipientNickname == nil && favoriteStatus != nil {
             recipientNickname = favoriteStatus?.peerNickname
         }
@@ -46,42 +200,42 @@ final class ChatPrivateConversationCoordinator {
         let messageID = UUID().uuidString
         let message = BitchatMessage(
             id: messageID,
-            sender: viewModel.nickname,
+            sender: context.nickname,
             content: content,
             timestamp: Date(),
             isRelay: false,
             originalSender: nil,
             isPrivate: true,
             recipientNickname: recipientNickname,
-            senderPeerID: viewModel.meshService.myPeerID,
+            senderPeerID: context.myPeerID,
             mentions: nil,
             deliveryStatus: .sending
         )
 
-        if viewModel.privateChats[peerID] == nil {
-            viewModel.privateChats[peerID] = []
+        if context.privateChats[peerID] == nil {
+            context.privateChats[peerID] = []
         }
-        viewModel.privateChats[peerID]?.append(message)
-        viewModel.objectWillChange.send()
+        context.privateChats[peerID]?.append(message)
+        context.notifyUIChanged()
 
         if isConnected || isReachable || (isMutualFavorite && hasNostrKey) {
-            viewModel.messageRouter.sendPrivate(
+            context.routePrivateMessage(
                 content,
                 to: peerID,
                 recipientNickname: recipientNickname ?? "user",
                 messageID: messageID
             )
-            if let idx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
-                viewModel.privateChats[peerID]?[idx].deliveryStatus = .sent
+            if let idx = context.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                context.privateChats[peerID]?[idx].deliveryStatus = .sent
             }
         } else {
-            if let index = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
-                viewModel.privateChats[peerID]?[index].deliveryStatus = .failed(
+            if let index = context.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                context.privateChats[peerID]?[index].deliveryStatus = .failed(
                     reason: String(localized: "content.delivery.reason.unreachable", comment: "Failure reason when a peer is unreachable")
                 )
             }
             let name = recipientNickname ?? "user"
-            viewModel.addSystemMessage(
+            context.addSystemMessage(
                 String(
                     format: String(localized: "system.dm.unreachable", comment: "System message when a recipient is unreachable"),
                     locale: .current,
@@ -92,8 +246,8 @@ final class ChatPrivateConversationCoordinator {
     }
 
     func sendGeohashDM(_ content: String, to peerID: PeerID) {
-        guard case .location(let channel) = viewModel.activeChannel else {
-            viewModel.addSystemMessage(
+        guard case .location(let channel) = context.activeChannel else {
+            context.addSystemMessage(
                 String(localized: "system.location.not_in_channel", comment: "System message when attempting to send without being in a location channel")
             )
             return
@@ -102,49 +256,49 @@ final class ChatPrivateConversationCoordinator {
         let messageID = UUID().uuidString
         let message = BitchatMessage(
             id: messageID,
-            sender: viewModel.nickname,
+            sender: context.nickname,
             content: content,
             timestamp: Date(),
             isRelay: false,
             isPrivate: true,
-            recipientNickname: viewModel.nickname,
-            senderPeerID: viewModel.meshService.myPeerID,
+            recipientNickname: context.nickname,
+            senderPeerID: context.myPeerID,
             deliveryStatus: .sending
         )
 
-        if viewModel.privateChats[peerID] == nil {
-            viewModel.privateChats[peerID] = []
+        if context.privateChats[peerID] == nil {
+            context.privateChats[peerID] = []
         }
 
-        viewModel.privateChats[peerID]?.append(message)
-        viewModel.objectWillChange.send()
+        context.privateChats[peerID]?.append(message)
+        context.notifyUIChanged()
 
-        guard let recipientHex = viewModel.nostrKeyMapping[peerID] else {
-            if let msgIdx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
-                viewModel.privateChats[peerID]?[msgIdx].deliveryStatus = .failed(
+        guard let recipientHex = context.nostrKeyMapping[peerID] else {
+            if let msgIdx = context.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                context.privateChats[peerID]?[msgIdx].deliveryStatus = .failed(
                     reason: String(localized: "content.delivery.reason.unknown_recipient", comment: "Failure reason when the recipient is unknown")
                 )
             }
             return
         }
 
-        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: recipientHex) {
-            if let msgIdx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
-                viewModel.privateChats[peerID]?[msgIdx].deliveryStatus = .failed(
+        if context.isNostrBlocked(pubkeyHexLowercased: recipientHex) {
+            if let msgIdx = context.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                context.privateChats[peerID]?[msgIdx].deliveryStatus = .failed(
                     reason: String(localized: "content.delivery.reason.blocked", comment: "Failure reason when the user is blocked")
                 )
             }
-            viewModel.addSystemMessage(
+            context.addSystemMessage(
                 String(localized: "system.dm.blocked_generic", comment: "System message when sending fails because user is blocked")
             )
             return
         }
 
         do {
-            let identity = try viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash)
+            let identity = try context.deriveNostrIdentity(forGeohash: channel.geohash)
             if recipientHex.lowercased() == identity.publicKeyHex.lowercased() {
-                if let idx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
-                    viewModel.privateChats[peerID]?[idx].deliveryStatus = .failed(
+                if let idx = context.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                    context.privateChats[peerID]?[idx].deliveryStatus = .failed(
                         reason: String(localized: "content.delivery.reason.self", comment: "Failure reason when attempting to message yourself")
                     )
                 }
@@ -155,20 +309,18 @@ final class ChatPrivateConversationCoordinator {
                 "GeoDM: local send mid=\(messageID.prefix(8))… to=\(recipientHex.prefix(8))… conv=\(peerID)",
                 category: .session
             )
-            let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-            transport.senderPeerID = viewModel.meshService.myPeerID
-            transport.sendPrivateMessageGeohash(
-                content: content,
+            context.sendGeohashPrivateMessage(
+                content,
                 toRecipientHex: recipientHex,
                 from: identity,
                 messageID: messageID
             )
-            if let msgIdx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
-                viewModel.privateChats[peerID]?[msgIdx].deliveryStatus = .sent
+            if let msgIdx = context.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                context.privateChats[peerID]?[msgIdx].deliveryStatus = .sent
             }
         } catch {
-            if let idx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
-                viewModel.privateChats[peerID]?[idx].deliveryStatus = .failed(
+            if let idx = context.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                context.privateChats[peerID]?[idx].deliveryStatus = .failed(
                     reason: String(localized: "content.delivery.reason.send_error", comment: "Failure reason for a generic send error")
                 )
             }
@@ -189,16 +341,16 @@ final class ChatPrivateConversationCoordinator {
 
         sendDeliveryAckIfNeeded(to: messageId, senderPubKey: senderPubkey, from: id)
 
-        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: senderPubkey) {
+        if context.isNostrBlocked(pubkeyHexLowercased: senderPubkey) {
             return
         }
 
-        if viewModel.privateChats[convKey]?.contains(where: { $0.id == messageId }) == true { return }
-        for (_, arr) in viewModel.privateChats where arr.contains(where: { $0.id == messageId }) {
+        if context.privateChats[convKey]?.contains(where: { $0.id == messageId }) == true { return }
+        for (_, arr) in context.privateChats where arr.contains(where: { $0.id == messageId }) {
             return
         }
 
-        let senderName = viewModel.displayNameForNostrPubkey(senderPubkey)
+        let senderName = context.displayNameForNostrPubkey(senderPubkey)
         let message = BitchatMessage(
             id: messageId,
             sender: senderName,
@@ -206,22 +358,22 @@ final class ChatPrivateConversationCoordinator {
             timestamp: messageTimestamp,
             isRelay: false,
             isPrivate: true,
-            recipientNickname: viewModel.nickname,
+            recipientNickname: context.nickname,
             senderPeerID: convKey,
-            deliveryStatus: .delivered(to: viewModel.nickname, at: Date())
+            deliveryStatus: .delivered(to: context.nickname, at: Date())
         )
 
-        if viewModel.privateChats[convKey] == nil {
-            viewModel.privateChats[convKey] = []
+        if context.privateChats[convKey] == nil {
+            context.privateChats[convKey] = []
         }
-        viewModel.privateChats[convKey]?.append(message)
+        context.privateChats[convKey]?.append(message)
 
-        let isViewing = viewModel.selectedPrivateChatPeer == convKey
-        let wasReadBefore = viewModel.sentReadReceipts.contains(messageId)
+        let isViewing = context.selectedPrivateChatPeer == convKey
+        let wasReadBefore = context.sentReadReceipts.contains(messageId)
         let isRecentMessage = Date().timeIntervalSince(messageTimestamp) < 30
         let shouldMarkUnread = !wasReadBefore && !isViewing && isRecentMessage
         if shouldMarkUnread {
-            viewModel.unreadPrivateMessages.insert(convKey)
+            context.unreadPrivateMessages.insert(convKey)
         }
 
         if isViewing {
@@ -236,18 +388,18 @@ final class ChatPrivateConversationCoordinator {
             )
         }
 
-        viewModel.objectWillChange.send()
+        context.notifyUIChanged()
     }
 
     func handleDelivered(_ payload: NoisePayload, senderPubkey: String, convKey: PeerID) {
         guard let messageID = String(data: payload.data, encoding: .utf8) else { return }
 
-        if let idx = viewModel.privateChats[convKey]?.firstIndex(where: { $0.id == messageID }) {
-            viewModel.privateChats[convKey]?[idx].deliveryStatus = .delivered(
-                to: viewModel.displayNameForNostrPubkey(senderPubkey),
+        if let idx = context.privateChats[convKey]?.firstIndex(where: { $0.id == messageID }) {
+            context.privateChats[convKey]?[idx].deliveryStatus = .delivered(
+                to: context.displayNameForNostrPubkey(senderPubkey),
                 at: Date()
             )
-            viewModel.objectWillChange.send()
+            context.notifyUIChanged()
             SecureLogger.info(
                 "GeoDM: recv DELIVERED for mid=\(messageID.prefix(8))… from=\(senderPubkey.prefix(8))…",
                 category: .session
@@ -260,12 +412,12 @@ final class ChatPrivateConversationCoordinator {
     func handleReadReceipt(_ payload: NoisePayload, senderPubkey: String, convKey: PeerID) {
         guard let messageID = String(data: payload.data, encoding: .utf8) else { return }
 
-        if let idx = viewModel.privateChats[convKey]?.firstIndex(where: { $0.id == messageID }) {
-            viewModel.privateChats[convKey]?[idx].deliveryStatus = .read(
-                by: viewModel.displayNameForNostrPubkey(senderPubkey),
+        if let idx = context.privateChats[convKey]?.firstIndex(where: { $0.id == messageID }) {
+            context.privateChats[convKey]?[idx].deliveryStatus = .read(
+                by: context.displayNameForNostrPubkey(senderPubkey),
                 at: Date()
             )
-            viewModel.objectWillChange.send()
+            context.notifyUIChanged()
             SecureLogger.info("GeoDM: recv READ for mid=\(messageID.prefix(8))… from=\(senderPubkey.prefix(8))…", category: .session)
         } else {
             SecureLogger.warning("GeoDM: read ack for unknown mid=\(messageID.prefix(8))… conv=\(convKey)", category: .session)
@@ -273,19 +425,15 @@ final class ChatPrivateConversationCoordinator {
     }
 
     func sendDeliveryAckIfNeeded(to messageId: String, senderPubKey: String, from id: NostrIdentity) {
-        guard !viewModel.sentGeoDeliveryAcks.contains(messageId) else { return }
-        let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-        transport.senderPeerID = viewModel.meshService.myPeerID
-        transport.sendDeliveryAckGeohash(for: messageId, toRecipientHex: senderPubKey, from: id)
-        viewModel.sentGeoDeliveryAcks.insert(messageId)
+        guard !context.sentGeoDeliveryAcks.contains(messageId) else { return }
+        context.sendGeohashDeliveryAck(for: messageId, toRecipientHex: senderPubKey, from: id)
+        context.sentGeoDeliveryAcks.insert(messageId)
     }
 
     func sendReadReceiptIfNeeded(to messageId: String, senderPubKey: String, from id: NostrIdentity) {
-        guard !viewModel.sentReadReceipts.contains(messageId) else { return }
-        let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-        transport.senderPeerID = viewModel.meshService.myPeerID
-        transport.sendReadReceiptGeohash(messageId, toRecipientHex: senderPubKey, from: id)
-        viewModel.sentReadReceipts.insert(messageId)
+        guard !context.sentReadReceipts.contains(messageId) else { return }
+        context.sendGeohashReadReceipt(messageId, toRecipientHex: senderPubKey, from: id)
+        context.sentReadReceipts.insert(messageId)
     }
 
     func handlePrivateMessage(
@@ -315,15 +463,15 @@ final class ChatPrivateConversationCoordinator {
             return
         }
 
-        let wasReadBefore = viewModel.sentReadReceipts.contains(messageId)
+        let wasReadBefore = context.sentReadReceipts.contains(messageId)
 
         var isViewingThisChat = false
-        if viewModel.selectedPrivateChatPeer == targetPeerID {
+        if context.selectedPrivateChatPeer == targetPeerID {
             isViewingThisChat = true
-        } else if let selectedPeer = viewModel.selectedPrivateChatPeer,
-                  let selectedPeerData = viewModel.unifiedPeerService.getPeer(by: selectedPeer),
+        } else if let selectedPeer = context.selectedPrivateChatPeer,
+                  let selectedPeerNoiseKey = context.noisePublicKey(for: selectedPeer),
                   let key = actualSenderNoiseKey,
-                  selectedPeerData.noisePublicKey == key {
+                  selectedPeerNoiseKey == key {
             isViewingThisChat = true
         }
 
@@ -337,15 +485,15 @@ final class ChatPrivateConversationCoordinator {
             timestamp: messageTimestamp,
             isRelay: false,
             isPrivate: true,
-            recipientNickname: viewModel.nickname,
+            recipientNickname: context.nickname,
             senderPeerID: targetPeerID,
-            deliveryStatus: .delivered(to: viewModel.nickname, at: Date())
+            deliveryStatus: .delivered(to: context.nickname, at: Date())
         )
 
         addMessageToPrivateChatsIfNeeded(message, targetPeerID: targetPeerID)
         mirrorToEphemeralIfNeeded(message, targetPeerID: targetPeerID, key: actualSenderNoiseKey)
 
-        viewModel.sendDeliveryAckViaNostrEmbedded(
+        context.sendDeliveryAckViaNostrEmbedded(
             message,
             wasReadBefore: wasReadBefore,
             senderPubkey: senderPubkey,
@@ -372,12 +520,12 @@ final class ChatPrivateConversationCoordinator {
             )
         }
 
-        viewModel.objectWillChange.send()
+        context.notifyUIChanged()
     }
 
     func handlePrivateMessage(_ message: BitchatMessage) {
         SecureLogger.debug("📥 handlePrivateMessage called for message from \(message.sender)", category: .session)
-        let senderPeerID = message.senderPeerID ?? viewModel.getPeerIDForNickname(message.sender)
+        let senderPeerID = message.senderPeerID ?? context.getPeerIDForNickname(message.sender)
 
         guard let peerID = senderPeerID else {
             SecureLogger.warning("⚠️ Could not get peer ID for sender \(message.sender)", category: .session)
@@ -391,22 +539,22 @@ final class ChatPrivateConversationCoordinator {
 
         migratePrivateChatsIfNeeded(for: peerID, senderNickname: message.sender)
 
-        if peerID.id.count == 16, let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
-            let stableKeyHex = PeerID(hexData: peer.noisePublicKey)
+        if peerID.id.count == 16, let peerNoiseKey = context.noisePublicKey(for: peerID) {
+            let stableKeyHex = PeerID(hexData: peerNoiseKey)
             if stableKeyHex != peerID,
-               let nostrMessages = viewModel.privateChats[stableKeyHex],
+               let nostrMessages = context.privateChats[stableKeyHex],
                !nostrMessages.isEmpty {
-                if viewModel.privateChats[peerID] == nil {
-                    viewModel.privateChats[peerID] = []
+                if context.privateChats[peerID] == nil {
+                    context.privateChats[peerID] = []
                 }
 
-                let existingMessageIds = Set(viewModel.privateChats[peerID]?.map { $0.id } ?? [])
+                let existingMessageIds = Set(context.privateChats[peerID]?.map { $0.id } ?? [])
                 for nostrMessage in nostrMessages where !existingMessageIds.contains(nostrMessage.id) {
-                    viewModel.privateChats[peerID]?.append(nostrMessage)
+                    context.privateChats[peerID]?.append(nostrMessage)
                 }
 
-                viewModel.privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
-                viewModel.privateChats.removeValue(forKey: stableKeyHex)
+                context.privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
+                context.privateChats.removeValue(forKey: stableKeyHex)
 
                 SecureLogger.info(
                     "📥 Consolidated \(nostrMessages.count) Nostr messages from stable key to ephemeral peer \(peerID)",
@@ -420,20 +568,20 @@ final class ChatPrivateConversationCoordinator {
         }
 
         addMessageToPrivateChatsIfNeeded(message, targetPeerID: peerID)
-        let noiseKey = peerID.noiseKey ?? viewModel.unifiedPeerService.getPeer(by: peerID)?.noisePublicKey
+        let noiseKey = peerID.noiseKey ?? context.noisePublicKey(for: peerID)
         mirrorToEphemeralIfNeeded(message, targetPeerID: peerID, key: noiseKey)
 
-        let isViewing = viewModel.selectedPrivateChatPeer == peerID
+        let isViewing = context.selectedPrivateChatPeer == peerID
         if isViewing {
             let receipt = ReadReceipt(
                 originalMessageID: message.id,
-                readerID: viewModel.meshService.myPeerID,
-                readerNickname: viewModel.nickname
+                readerID: context.myPeerID,
+                readerNickname: context.nickname
             )
-            viewModel.meshService.sendReadReceipt(receipt, to: peerID)
-            viewModel.sentReadReceipts.insert(message.id)
+            context.sendMeshReadReceipt(receipt, to: peerID)
+            context.sentReadReceipts.insert(message.id)
         } else {
-            viewModel.unreadPrivateMessages.insert(peerID)
+            context.unreadPrivateMessages.insert(peerID)
             NotificationService.shared.sendPrivateMessageNotification(
                 from: message.sender,
                 message: message.content,
@@ -441,48 +589,48 @@ final class ChatPrivateConversationCoordinator {
             )
         }
 
-        viewModel.objectWillChange.send()
+        context.notifyUIChanged()
     }
 
     func isDuplicateMessage(_ messageId: String, targetPeerID: PeerID) -> Bool {
-        if viewModel.privateChats[targetPeerID]?.contains(where: { $0.id == messageId }) == true {
+        if context.privateChats[targetPeerID]?.contains(where: { $0.id == messageId }) == true {
             return true
         }
-        for (_, messages) in viewModel.privateChats where messages.contains(where: { $0.id == messageId }) {
+        for (_, messages) in context.privateChats where messages.contains(where: { $0.id == messageId }) {
             return true
         }
         return false
     }
 
     func addMessageToPrivateChatsIfNeeded(_ message: BitchatMessage, targetPeerID: PeerID) {
-        if viewModel.privateChats[targetPeerID] == nil {
-            viewModel.privateChats[targetPeerID] = []
+        if context.privateChats[targetPeerID] == nil {
+            context.privateChats[targetPeerID] = []
         }
-        if let idx = viewModel.privateChats[targetPeerID]?.firstIndex(where: { $0.id == message.id }) {
-            viewModel.privateChats[targetPeerID]?[idx] = message
+        if let idx = context.privateChats[targetPeerID]?.firstIndex(where: { $0.id == message.id }) {
+            context.privateChats[targetPeerID]?[idx] = message
         } else {
-            viewModel.privateChats[targetPeerID]?.append(message)
+            context.privateChats[targetPeerID]?.append(message)
         }
-        viewModel.privateChatManager.sanitizeChat(for: targetPeerID)
+        context.sanitizeChat(for: targetPeerID)
     }
 
     func mirrorToEphemeralIfNeeded(_ message: BitchatMessage, targetPeerID: PeerID, key: Data?) {
         guard let key,
-              let ephemeralPeerID = viewModel.unifiedPeerService.peers.first(where: { $0.noisePublicKey == key })?.peerID,
+              let ephemeralPeerID = context.ephemeralPeerID(forNoiseKey: key),
               ephemeralPeerID != targetPeerID
         else {
             return
         }
 
-        if viewModel.privateChats[ephemeralPeerID] == nil {
-            viewModel.privateChats[ephemeralPeerID] = []
+        if context.privateChats[ephemeralPeerID] == nil {
+            context.privateChats[ephemeralPeerID] = []
         }
-        if let idx = viewModel.privateChats[ephemeralPeerID]?.firstIndex(where: { $0.id == message.id }) {
-            viewModel.privateChats[ephemeralPeerID]?[idx] = message
+        if let idx = context.privateChats[ephemeralPeerID]?.firstIndex(where: { $0.id == message.id }) {
+            context.privateChats[ephemeralPeerID]?[idx] = message
         } else {
-            viewModel.privateChats[ephemeralPeerID]?.append(message)
+            context.privateChats[ephemeralPeerID]?.append(message)
         }
-        viewModel.privateChatManager.sanitizeChat(for: ephemeralPeerID)
+        context.sanitizeChat(for: ephemeralPeerID)
     }
 
     func handleViewingThisChat(
@@ -491,27 +639,25 @@ final class ChatPrivateConversationCoordinator {
         key: Data?,
         senderPubkey: String
     ) {
-        viewModel.unreadPrivateMessages.remove(targetPeerID)
+        context.unreadPrivateMessages.remove(targetPeerID)
         if let key,
-           let ephemeralPeerID = viewModel.unifiedPeerService.peers.first(where: { $0.noisePublicKey == key })?.peerID {
-            viewModel.unreadPrivateMessages.remove(ephemeralPeerID)
+           let ephemeralPeerID = context.ephemeralPeerID(forNoiseKey: key) {
+            context.unreadPrivateMessages.remove(ephemeralPeerID)
         }
-        guard !viewModel.sentReadReceipts.contains(message.id) else { return }
+        guard !context.sentReadReceipts.contains(message.id) else { return }
 
         if let key {
             let receipt = ReadReceipt(
                 originalMessageID: message.id,
-                readerID: viewModel.meshService.myPeerID,
-                readerNickname: viewModel.nickname
+                readerID: context.myPeerID,
+                readerNickname: context.nickname
             )
             SecureLogger.debug("Viewing chat; sending READ ack for \(message.id.prefix(8))… via router", category: .session)
-            viewModel.messageRouter.sendReadReceipt(receipt, to: PeerID(hexData: key))
-            viewModel.sentReadReceipts.insert(message.id)
-        } else if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
-            let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-            transport.senderPeerID = viewModel.meshService.myPeerID
-            transport.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: identity)
-            viewModel.sentReadReceipts.insert(message.id)
+            context.routeReadReceipt(receipt, to: PeerID(hexData: key))
+            context.sentReadReceipts.insert(message.id)
+        } else if let identity = context.currentNostrIdentity() {
+            context.sendGeohashReadReceipt(message.id, toRecipientHex: senderPubkey, from: identity)
+            context.sentReadReceipts.insert(message.id)
             SecureLogger.debug(
                 "Viewing chat; sent READ ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…",
                 category: .session
@@ -529,11 +675,11 @@ final class ChatPrivateConversationCoordinator {
     ) {
         guard shouldMarkAsUnread else { return }
 
-        viewModel.unreadPrivateMessages.insert(targetPeerID)
+        context.unreadPrivateMessages.insert(targetPeerID)
         if let key,
-           let ephemeralPeerID = viewModel.unifiedPeerService.peers.first(where: { $0.noisePublicKey == key })?.peerID,
+           let ephemeralPeerID = context.ephemeralPeerID(forNoiseKey: key),
            ephemeralPeerID != targetPeerID {
-            viewModel.unreadPrivateMessages.insert(ephemeralPeerID)
+            context.unreadPrivateMessages.insert(ephemeralPeerID)
         }
         if isRecentMessage {
             NotificationService.shared.sendPrivateMessageNotification(
@@ -554,7 +700,7 @@ final class ChatPrivateConversationCoordinator {
             SecureLogger.info("📝 Received Nostr npub in favorite notification: \(nostrPubkey ?? "none")", category: .session)
         }
 
-        let noiseKey = peerID.noiseKey ?? viewModel.unifiedPeerService.getPeer(by: peerID)?.noisePublicKey
+        let noiseKey = peerID.noiseKey ?? context.noisePublicKey(for: peerID)
         guard let finalNoiseKey = noiseKey else {
             SecureLogger.warning("⚠️ Cannot get Noise key for peer \(peerID)", category: .session)
             return
@@ -577,7 +723,7 @@ final class ChatPrivateConversationCoordinator {
 
         if prior != isFavorite {
             let action = isFavorite ? "favorited" : "unfavorited"
-            viewModel.addMeshOnlySystemMessage("\(senderNickname) \(action) you")
+            context.addMeshOnlySystemMessage("\(senderNickname) \(action) you")
         }
     }
 
@@ -606,15 +752,15 @@ final class ChatPrivateConversationCoordinator {
     }
 
     func migratePrivateChatsIfNeeded(for peerID: PeerID, senderNickname: String) {
-        let currentFingerprint = viewModel.getFingerprint(for: peerID)
+        let currentFingerprint = context.getFingerprint(for: peerID)
 
-        if viewModel.privateChats[peerID] == nil || viewModel.privateChats[peerID]?.isEmpty == true {
+        if context.privateChats[peerID] == nil || context.privateChats[peerID]?.isEmpty == true {
             var migratedMessages: [BitchatMessage] = []
             var oldPeerIDsToRemove: [PeerID] = []
             let cutoffTime = Date().addingTimeInterval(-TransportConfig.uiMigrationCutoffSeconds)
 
-            for (oldPeerID, messages) in viewModel.privateChats where oldPeerID != peerID {
-                let oldFingerprint = viewModel.peerIDToPublicKeyFingerprint[oldPeerID]
+            for (oldPeerID, messages) in context.privateChats where oldPeerID != peerID {
+                let oldFingerprint = context.storedFingerprint(for: oldPeerID)
                 let recentMessages = messages.filter { $0.timestamp > cutoffTime }
                 guard !recentMessages.isEmpty else { continue }
 
@@ -637,8 +783,8 @@ final class ChatPrivateConversationCoordinator {
                     )
                 } else if currentFingerprint == nil || oldFingerprint == nil {
                     let isRelevantChat = recentMessages.contains { msg in
-                        (msg.sender == senderNickname && msg.sender != viewModel.nickname)
-                            || (msg.sender == viewModel.nickname && msg.recipientNickname == senderNickname)
+                        (msg.sender == senderNickname && msg.sender != context.nickname)
+                            || (msg.sender == context.nickname && msg.recipientNickname == senderNickname)
                     }
 
                     if isRelevantChat {
@@ -656,27 +802,27 @@ final class ChatPrivateConversationCoordinator {
             }
 
             if !oldPeerIDsToRemove.isEmpty {
-                let needsSelectedUpdate = oldPeerIDsToRemove.contains { viewModel.selectedPrivateChatPeer == $0 }
+                let needsSelectedUpdate = oldPeerIDsToRemove.contains { context.selectedPrivateChatPeer == $0 }
 
                 for oldID in oldPeerIDsToRemove {
-                    viewModel.privateChats.removeValue(forKey: oldID)
-                    viewModel.unreadPrivateMessages.remove(oldID)
-                    viewModel.peerIdentityStore.setFingerprint(nil, for: oldID)
+                    context.privateChats.removeValue(forKey: oldID)
+                    context.unreadPrivateMessages.remove(oldID)
+                    context.clearStoredFingerprint(for: oldID)
                 }
 
                 if needsSelectedUpdate {
-                    viewModel.selectedPrivateChatPeer = peerID
+                    context.selectedPrivateChatPeer = peerID
                 }
             }
 
             if !migratedMessages.isEmpty {
-                if viewModel.privateChats[peerID] == nil {
-                    viewModel.privateChats[peerID] = []
+                if context.privateChats[peerID] == nil {
+                    context.privateChats[peerID] = []
                 }
-                viewModel.privateChats[peerID]?.append(contentsOf: migratedMessages)
-                viewModel.privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
-                viewModel.privateChatManager.sanitizeChat(for: peerID)
-                viewModel.objectWillChange.send()
+                context.privateChats[peerID]?.append(contentsOf: migratedMessages)
+                context.privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
+                context.sanitizeChat(for: peerID)
+                context.notifyUIChanged()
             }
         }
     }
@@ -686,26 +832,26 @@ final class ChatPrivateConversationCoordinator {
 
         if let hexKey = Data(hexString: peerID.id) {
             noiseKey = hexKey
-        } else if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
-            noiseKey = peer.noisePublicKey
+        } else if let peerNoiseKey = context.noisePublicKey(for: peerID) {
+            noiseKey = peerNoiseKey
         }
 
-        if viewModel.meshService.isPeerConnected(peerID) {
-            viewModel.messageRouter.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
+        if context.isPeerConnected(peerID) {
+            context.routeFavoriteNotification(to: peerID, isFavorite: isFavorite)
             SecureLogger.debug("📤 Sent favorite notification via BLE to \(peerID)", category: .session)
         } else if let key = noiseKey {
-            viewModel.messageRouter.sendFavoriteNotification(to: PeerID(hexData: key), isFavorite: isFavorite)
+            context.routeFavoriteNotification(to: PeerID(hexData: key), isFavorite: isFavorite)
         } else {
             SecureLogger.warning("⚠️ Cannot send favorite notification - peer not connected and no Nostr pubkey", category: .session)
         }
     }
 
     func isMessageBlocked(_ message: BitchatMessage) -> Bool {
-        if let peerID = message.senderPeerID ?? viewModel.getPeerIDForNickname(message.sender) {
-            if viewModel.isPeerBlocked(peerID) { return true }
+        if let peerID = message.senderPeerID ?? context.getPeerIDForNickname(message.sender) {
+            if context.isPeerBlocked(peerID) { return true }
             if peerID.isGeoChat || peerID.isGeoDM,
-               let full = viewModel.nostrKeyMapping[peerID]?.lowercased(),
-               viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: full) {
+               let full = context.nostrKeyMapping[peerID]?.lowercased(),
+               context.isNostrBlocked(pubkeyHexLowercased: full) {
                 return true
             }
         }

bitchat/ViewModels/ChatPublicConversationCoordinator.swift

@@ -7,16 +7,190 @@ import SwiftUI
 import UIKit
 #endif
 
+/// The narrow surface `ChatPublicConversationCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding an `unowned` back-ref
+/// to the whole `ChatViewModel`. This keeps the coordinator independently
+/// testable (see `ChatPublicConversationCoordinatorContextTests`) and makes
+/// its true dependencies explicit. The surface is intentionally large — it
+/// documents the coordinator's real coupling to the public timeline, the
+/// conversation stores, geohash participants, and the inbound public message
+/// pipeline.
+@MainActor
+protocol ChatPublicConversationContext: AnyObject {
+    // MARK: Channel & visible timeline state
+    var messages: [BitchatMessage] { get set }
+    var activeChannel: ChannelID { get }
+    var currentGeohash: String? { get }
+    var nickname: String { get }
+    var myPeerID: PeerID { get }
+    var isBatchingPublic: Bool { get set }
+    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
+    func notifyUIChanged()
+    func trimMessagesIfNeeded()
+
+    // MARK: Public timeline store
+    func timelineMessages(for channel: ChannelID) -> [BitchatMessage]
+    func appendTimelineMessage(_ message: BitchatMessage, to channel: ChannelID)
+    func appendGeohashMessageIfAbsent(_ message: BitchatMessage, toGeohash geohash: String) -> Bool
+    func removeTimelineMessage(withID id: String) -> BitchatMessage?
+    func removeGeohashTimelineMessages(in geohash: String, where predicate: (BitchatMessage) -> Bool)
+    func clearTimeline(for channel: ChannelID)
+    func timelineGeohashKeys() -> [String]
+    /// Queues a system message for the next geohash channel visit.
+    func queueGeohashSystemMessage(_ content: String)
+
+    // MARK: Conversation stores
+    func setConversationActiveChannel(_ channel: ChannelID)
+    func replaceConversationMessages(_ messages: [BitchatMessage], for channelID: ChannelID)
+    func replaceConversationMessages(_ messages: [BitchatMessage], for conversationID: ConversationID)
+    func synchronizePrivateConversationStore()
+    func synchronizeConversationSelectionStore()
+
+    // MARK: Private chats (block cleanup & message removal)
+    var privateChats: [PeerID: [BitchatMessage]] { get set }
+    var unreadPrivateMessages: Set<PeerID> { get set }
+    func cleanupLocalFile(forMessage message: BitchatMessage)
+
+    // MARK: Geohash participants & presence
+    var geoNicknames: [String: String] { get }
+    var isTeleported: Bool { get }
+    var nostrKeyMapping: [PeerID: String] { get set }
+    func visibleGeoPeople() -> [GeoPerson]
+    func geoParticipantCount(for geohash: String) -> Int
+    func removeGeoParticipant(pubkeyHex: String)
+
+    // MARK: Nostr identity & blocking (shared with the other contexts)
+    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
+    func isNostrBlocked(pubkeyHexLowercased: String) -> Bool
+    func setNostrBlocked(_ pubkeyHexLowercased: String, isBlocked: Bool)
+
+    // MARK: Mesh transport
+    func meshPeerNicknames() -> [PeerID: String]
+    func sendMeshMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date)
+
+    // MARK: Inbound public message processing
+    func processActionMessage(_ message: BitchatMessage) -> BitchatMessage
+    func isMessageBlocked(_ message: BitchatMessage) -> Bool
+    func allowPublicMessage(senderKey: String, contentKey: String) -> Bool
+    func enqueuePublicMessage(_ message: BitchatMessage)
+    func cachedStablePeerID(for shortPeerID: PeerID) -> PeerID?
+
+    // MARK: Content dedup & formatting
+    func normalizedContentKey(_ content: String) -> String
+    func contentTimestamp(forKey key: String) -> Date?
+    func recordContentKey(_ key: String, timestamp: Date)
+    /// Pre-renders the message so the formatting cache is warm before display.
+    func prewarmMessageFormatting(_ message: BitchatMessage)
+}
+
+extension ChatViewModel: ChatPublicConversationContext {
+    // `messages`, `privateChats`, `unreadPrivateMessages`, `nostrKeyMapping`,
+    // `nickname`, `activeChannel`, `currentGeohash`, `geoNicknames`,
+    // `myPeerID`, `isTeleported`, `isBatchingPublic`, `notifyUIChanged()`,
+    // `geoParticipantCount(for:)`, `isNostrBlocked(pubkeyHexLowercased:)`,
+    // `deriveNostrIdentity(forGeohash:)`, and
+    // `appendGeohashMessageIfAbsent(_:toGeohash:)` are shared requirements
+    // with `ChatDeliveryContext` / `ChatPrivateConversationContext` /
+    // `ChatNostrContext`; their witnesses already exist. The members below
+    // flatten nested service accesses into intent-named calls.
+
+    func timelineMessages(for channel: ChannelID) -> [BitchatMessage] {
+        timelineStore.messages(for: channel)
+    }
+
+    func appendTimelineMessage(_ message: BitchatMessage, to channel: ChannelID) {
+        timelineStore.append(message, to: channel)
+    }
+
+    func removeTimelineMessage(withID id: String) -> BitchatMessage? {
+        timelineStore.removeMessage(withID: id)
+    }
+
+    func removeGeohashTimelineMessages(in geohash: String, where predicate: (BitchatMessage) -> Bool) {
+        timelineStore.removeMessages(in: geohash, where: predicate)
+    }
+
+    func clearTimeline(for channel: ChannelID) {
+        timelineStore.clear(channel: channel)
+    }
+
+    func timelineGeohashKeys() -> [String] {
+        timelineStore.geohashKeys()
+    }
+
+    func queueGeohashSystemMessage(_ content: String) {
+        timelineStore.queueGeohashSystemMessage(content)
+    }
+
+    func setConversationActiveChannel(_ channel: ChannelID) {
+        conversationStore.setActiveChannel(channel)
+    }
+
+    func replaceConversationMessages(_ messages: [BitchatMessage], for channelID: ChannelID) {
+        conversationStore.replaceMessages(messages, for: channelID)
+    }
+
+    func replaceConversationMessages(_ messages: [BitchatMessage], for conversationID: ConversationID) {
+        conversationStore.replaceMessages(messages, for: conversationID)
+    }
+
+    func visibleGeoPeople() -> [GeoPerson] {
+        participantTracker.getVisiblePeople()
+    }
+
+    func removeGeoParticipant(pubkeyHex: String) {
+        participantTracker.removeParticipant(pubkeyHex: pubkeyHex)
+    }
+
+    func setNostrBlocked(_ pubkeyHexLowercased: String, isBlocked: Bool) {
+        identityManager.setNostrBlocked(pubkeyHexLowercased, isBlocked: isBlocked)
+    }
+
+    func meshPeerNicknames() -> [PeerID: String] {
+        meshService.getPeerNicknames()
+    }
+
+    func sendMeshMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date) {
+        meshService.sendMessage(content, mentions: mentions, messageID: messageID, timestamp: timestamp)
+    }
+
+    func allowPublicMessage(senderKey: String, contentKey: String) -> Bool {
+        publicRateLimiter.allow(senderKey: senderKey, contentKey: contentKey)
+    }
+
+    func enqueuePublicMessage(_ message: BitchatMessage) {
+        publicMessagePipeline.enqueue(message)
+    }
+
+    func normalizedContentKey(_ content: String) -> String {
+        deduplicationService.normalizedContentKey(content)
+    }
+
+    func contentTimestamp(forKey key: String) -> Date? {
+        deduplicationService.contentTimestamp(forKey: key)
+    }
+
+    func recordContentKey(_ key: String, timestamp: Date) {
+        deduplicationService.recordContentKey(key, timestamp: timestamp)
+    }
+
+    func prewarmMessageFormatting(_ message: BitchatMessage) {
+        _ = formatMessageAsText(message, colorScheme: currentColorScheme)
+    }
+}
+
 @MainActor
 final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
-    private unowned let viewModel: ChatViewModel
+    private unowned let context: any ChatPublicConversationContext
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    init(context: any ChatPublicConversationContext) {
+        self.context = context
     }
 
     func visibleGeohashPeople() -> [GeoPerson] {
-        viewModel.participantTracker.getVisiblePeople()
+        context.visibleGeoPeople()
     }
 
     func getVisibleGeoParticipants() -> [CommandGeoParticipant] {
@@ -24,7 +198,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func geohashParticipantCount(for geohash: String) -> Int {
-        viewModel.participantTracker.participantCount(for: geohash)
+        context.geoParticipantCount(for: geohash)
     }
 
     func displayNameForPubkey(_ pubkeyHex: String) -> String {
@@ -32,49 +206,49 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func isBlocked(_ pubkeyHexLowercased: String) -> Bool {
-        viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
+        context.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
     }
 
     func isGeohashUserBlocked(pubkeyHexLowercased: String) -> Bool {
-        viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
+        context.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
     }
 
     func blockGeohashUser(pubkeyHexLowercased: String, displayName: String) {
         let hex = pubkeyHexLowercased.lowercased()
-        viewModel.identityManager.setNostrBlocked(hex, isBlocked: true)
-        viewModel.participantTracker.removeParticipant(pubkeyHex: hex)
+        context.setNostrBlocked(hex, isBlocked: true)
+        context.removeGeoParticipant(pubkeyHex: hex)
 
-        if let gh = viewModel.currentGeohash {
-            let predicate: (BitchatMessage) -> Bool = { [unowned viewModel] message in
+        if let gh = context.currentGeohash {
+            let predicate: (BitchatMessage) -> Bool = { [unowned context] message in
                 guard let senderPeerID = message.senderPeerID,
                       senderPeerID.isGeoDM || senderPeerID.isGeoChat else {
                     return false
                 }
-                if let full = viewModel.nostrKeyMapping[senderPeerID]?.lowercased() {
+                if let full = context.nostrKeyMapping[senderPeerID]?.lowercased() {
                     return full == hex
                 }
                 return false
             }
-            viewModel.timelineStore.removeMessages(in: gh, where: predicate)
+            context.removeGeohashTimelineMessages(in: gh, where: predicate)
             synchronizePublicConversationStore(forGeohash: gh)
-            if case .location = viewModel.activeChannel {
-                viewModel.messages.removeAll(where: predicate)
+            if case .location = context.activeChannel {
+                context.messages.removeAll(where: predicate)
             }
         }
 
         let conversationPeerID = PeerID(nostr_: hex)
-        if viewModel.privateChats[conversationPeerID] != nil {
-            var privateChats = viewModel.privateChats
+        if context.privateChats[conversationPeerID] != nil {
+            var privateChats = context.privateChats
             privateChats.removeValue(forKey: conversationPeerID)
-            viewModel.privateChats = privateChats
+            context.privateChats = privateChats
 
-            var unread = viewModel.unreadPrivateMessages
+            var unread = context.unreadPrivateMessages
             unread.remove(conversationPeerID)
-            viewModel.unreadPrivateMessages = unread
+            context.unreadPrivateMessages = unread
         }
 
-        for (key, value) in viewModel.nostrKeyMapping where value.lowercased() == hex {
-            viewModel.nostrKeyMapping.removeValue(forKey: key)
+        for (key, value) in context.nostrKeyMapping where value.lowercased() == hex {
+            context.nostrKeyMapping.removeValue(forKey: key)
         }
 
         addSystemMessage(
@@ -90,7 +264,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func unblockGeohashUser(pubkeyHexLowercased: String, displayName: String) {
-        viewModel.identityManager.setNostrBlocked(pubkeyHexLowercased, isBlocked: false)
+        context.setNostrBlocked(pubkeyHexLowercased, isBlocked: false)
         addSystemMessage(
             String(
                 format: String(
@@ -105,24 +279,24 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
 
     func displayNameForNostrPubkey(_ pubkeyHex: String) -> String {
         let suffix = String(pubkeyHex.suffix(4))
-        if let geohash = viewModel.currentGeohash,
-           let myGeoIdentity = try? viewModel.idBridge.deriveIdentity(forGeohash: geohash),
+        if let geohash = context.currentGeohash,
+           let myGeoIdentity = try? context.deriveNostrIdentity(forGeohash: geohash),
            myGeoIdentity.publicKeyHex.lowercased() == pubkeyHex.lowercased() {
-            return viewModel.nickname + "#" + suffix
+            return context.nickname + "#" + suffix
         }
-        if let nick = viewModel.geoNicknames[pubkeyHex.lowercased()], !nick.isEmpty {
+        if let nick = context.geoNicknames[pubkeyHex.lowercased()], !nick.isEmpty {
             return nick + "#" + suffix
         }
         return "anon#\(suffix)"
     }
 
     func currentPublicSender() -> (name: String, peerID: PeerID) {
-        var displaySender = viewModel.nickname
-        var senderPeerID = viewModel.meshService.myPeerID
-        if case .location(let channel) = viewModel.activeChannel,
-           let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+        var displaySender = context.nickname
+        var senderPeerID = context.myPeerID
+        if case .location(let channel) = context.activeChannel,
+           let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
             let suffix = String(identity.publicKeyHex.suffix(4))
-            displaySender = viewModel.nickname + "#" + suffix
+            displaySender = context.nickname + "#" + suffix
             senderPeerID = PeerID(nostr: identity.publicKeyHex)
         }
         return (displaySender, senderPeerID)
@@ -131,16 +305,16 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     func removeMessage(withID messageID: String, cleanupFile: Bool = false) {
         var removedMessage: BitchatMessage?
 
-        if let index = viewModel.messages.firstIndex(where: { $0.id == messageID }) {
-            removedMessage = viewModel.messages.remove(at: index)
+        if let index = context.messages.firstIndex(where: { $0.id == messageID }) {
+            removedMessage = context.messages.remove(at: index)
         }
 
-        if let storeRemoved = viewModel.timelineStore.removeMessage(withID: messageID) {
+        if let storeRemoved = context.removeTimelineMessage(withID: messageID) {
             removedMessage = removedMessage ?? storeRemoved
             synchronizeAllPublicConversationStores()
         }
 
-        var chats = viewModel.privateChats
+        var chats = context.privateChats
         for (peerID, items) in chats {
             let filtered = items.filter { $0.id != messageID }
             if filtered.count != items.count {
@@ -154,55 +328,55 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
                 }
             }
         }
-        viewModel.privateChats = chats
+        context.privateChats = chats
 
         if cleanupFile, let removedMessage {
-            viewModel.cleanupLocalFile(forMessage: removedMessage)
+            context.cleanupLocalFile(forMessage: removedMessage)
         }
 
-        viewModel.objectWillChange.send()
+        context.notifyUIChanged()
     }
 
     func initializeConversationStore() {
-        viewModel.conversationStore.setActiveChannel(viewModel.activeChannel)
-        synchronizePublicConversationStore(for: viewModel.activeChannel)
-        viewModel.synchronizePrivateConversationStore()
-        viewModel.synchronizeConversationSelectionStore()
+        context.setConversationActiveChannel(context.activeChannel)
+        synchronizePublicConversationStore(for: context.activeChannel)
+        context.synchronizePrivateConversationStore()
+        context.synchronizeConversationSelectionStore()
     }
 
     func synchronizePublicConversationStore(for channel: ChannelID) {
-        let publicMessages = viewModel.timelineStore.messages(for: channel)
-        viewModel.conversationStore.replaceMessages(publicMessages, for: channel)
-        if channel == viewModel.activeChannel {
-            viewModel.conversationStore.setActiveChannel(viewModel.activeChannel)
+        let publicMessages = context.timelineMessages(for: channel)
+        context.replaceConversationMessages(publicMessages, for: channel)
+        if channel == context.activeChannel {
+            context.setConversationActiveChannel(context.activeChannel)
         }
     }
 
     func synchronizePublicConversationStore(forGeohash geohash: String) {
         let channel = ChannelID.location(GeohashChannel(level: .city, geohash: geohash))
-        let publicMessages = viewModel.timelineStore.messages(for: channel)
-        viewModel.conversationStore.replaceMessages(publicMessages, for: .geohash(geohash.lowercased()))
+        let publicMessages = context.timelineMessages(for: channel)
+        context.replaceConversationMessages(publicMessages, for: .geohash(geohash.lowercased()))
     }
 
     func synchronizeAllPublicConversationStores() {
         synchronizePublicConversationStore(for: .mesh)
-        for geohash in viewModel.timelineStore.geohashKeys() {
+        for geohash in context.timelineGeohashKeys() {
             synchronizePublicConversationStore(forGeohash: geohash)
         }
     }
 
     func refreshVisibleMessages(from channel: ChannelID? = nil) {
-        let target = channel ?? viewModel.activeChannel
-        viewModel.messages = viewModel.timelineStore.messages(for: target)
-        viewModel.conversationStore.replaceMessages(viewModel.messages, for: target)
-        if target == viewModel.activeChannel {
-            viewModel.conversationStore.setActiveChannel(viewModel.activeChannel)
+        let target = channel ?? context.activeChannel
+        context.messages = context.timelineMessages(for: target)
+        context.replaceConversationMessages(context.messages, for: target)
+        if target == context.activeChannel {
+            context.setConversationActiveChannel(context.activeChannel)
         }
     }
 
     func clearCurrentPublicTimeline() {
-        viewModel.messages.removeAll()
-        viewModel.timelineStore.clear(channel: viewModel.activeChannel)
+        context.messages.removeAll()
+        context.clearTimeline(for: context.activeChannel)
 
         Task.detached(priority: .utility) {
             do {
@@ -242,7 +416,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             timestamp: timestamp,
             isRelay: false
         )
-        viewModel.messages.append(systemMessage)
+        context.messages.append(systemMessage)
     }
 
     func addMeshOnlySystemMessage(_ content: String) {
@@ -252,11 +426,11 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             timestamp: Date(),
             isRelay: false
         )
-        viewModel.timelineStore.append(systemMessage, to: .mesh)
+        context.appendTimelineMessage(systemMessage, to: .mesh)
         synchronizePublicConversationStore(for: .mesh)
         refreshVisibleMessages()
-        viewModel.trimMessagesIfNeeded()
-        viewModel.objectWillChange.send()
+        context.trimMessagesIfNeeded()
+        context.notifyUIChanged()
     }
 
     func addPublicSystemMessage(_ content: String) {
@@ -266,34 +440,34 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             timestamp: Date(),
             isRelay: false
         )
-        viewModel.timelineStore.append(systemMessage, to: viewModel.activeChannel)
-        refreshVisibleMessages(from: viewModel.activeChannel)
-        let contentKey = viewModel.deduplicationService.normalizedContentKey(systemMessage.content)
-        viewModel.deduplicationService.recordContentKey(contentKey, timestamp: systemMessage.timestamp)
-        viewModel.trimMessagesIfNeeded()
-        viewModel.objectWillChange.send()
+        context.appendTimelineMessage(systemMessage, to: context.activeChannel)
+        refreshVisibleMessages(from: context.activeChannel)
+        let contentKey = context.normalizedContentKey(systemMessage.content)
+        context.recordContentKey(contentKey, timestamp: systemMessage.timestamp)
+        context.trimMessagesIfNeeded()
+        context.notifyUIChanged()
     }
 
     func addGeohashOnlySystemMessage(_ content: String) {
-        if case .location = viewModel.activeChannel {
+        if case .location = context.activeChannel {
             addPublicSystemMessage(content)
         } else {
-            viewModel.timelineStore.queueGeohashSystemMessage(content)
+            context.queueGeohashSystemMessage(content)
         }
     }
 
     func sendPublicRaw(_ content: String) {
-        if case .location(let channel) = viewModel.activeChannel {
-            Task { @MainActor [weak viewModel] in
-                guard let viewModel else { return }
+        if case .location(let channel) = context.activeChannel {
+            Task { @MainActor [weak context] in
+                guard let context else { return }
                 do {
-                    let identity = try viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash)
+                    let identity = try context.deriveNostrIdentity(forGeohash: channel.geohash)
                     let event = try NostrProtocol.createEphemeralGeohashEvent(
                         content: content,
                         geohash: channel.geohash,
                         senderIdentity: identity,
-                        nickname: viewModel.nickname,
-                        teleported: viewModel.locationManager.teleported
+                        nickname: context.nickname,
+                        teleported: context.isTeleported
                     )
                     let targetRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: channel.geohash, count: 5)
                     if targetRelays.isEmpty {
@@ -308,7 +482,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             return
         }
 
-        viewModel.meshService.sendMessage(
+        context.sendMeshMessage(
             content,
             mentions: [],
             messageID: UUID().uuidString,
@@ -317,15 +491,15 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func handlePublicMessage(_ message: BitchatMessage) {
-        let finalMessage = viewModel.processActionMessage(message)
-        if viewModel.isMessageBlocked(finalMessage) { return }
+        let finalMessage = context.processActionMessage(message)
+        if context.isMessageBlocked(finalMessage) { return }
 
         let isGeo = finalMessage.senderPeerID?.isGeoChat == true
         let shouldRateLimit = finalMessage.sender != "system" || finalMessage.senderPeerID != nil
         if shouldRateLimit {
             let senderKey = normalizedSenderKey(for: finalMessage)
-            let contentKey = viewModel.deduplicationService.normalizedContentKey(finalMessage.content)
-            if !viewModel.publicRateLimiter.allow(senderKey: senderKey, contentKey: contentKey) {
+            let contentKey = context.normalizedContentKey(finalMessage.content)
+            if !context.allowPublicMessage(senderKey: senderKey, contentKey: contentKey) {
                 return
             }
         }
@@ -333,19 +507,19 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
         if finalMessage.sender != "system" && finalMessage.content.count > 16000 { return }
 
         if !isGeo && finalMessage.sender != "system" {
-            viewModel.timelineStore.append(finalMessage, to: .mesh)
+            context.appendTimelineMessage(finalMessage, to: .mesh)
             synchronizePublicConversationStore(for: .mesh)
         }
 
         if isGeo && finalMessage.sender != "system",
-           let geohash = viewModel.currentGeohash,
-           viewModel.timelineStore.appendIfAbsent(finalMessage, toGeohash: geohash) {
+           let geohash = context.currentGeohash,
+           context.appendGeohashMessageIfAbsent(finalMessage, toGeohash: geohash) {
             synchronizePublicConversationStore(forGeohash: geohash)
         }
 
         let isSystem = finalMessage.sender == "system"
         let channelMatches: Bool = {
-            switch viewModel.activeChannel {
+            switch context.activeChannel {
             case .mesh: return !isGeo || isSystem
             case .location: return isGeo || isSystem
             }
@@ -354,22 +528,22 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
         guard channelMatches else { return }
 
         if !finalMessage.content.trimmed.isEmpty,
-           !viewModel.messages.contains(where: { $0.id == finalMessage.id }) {
-            viewModel.publicMessagePipeline.enqueue(finalMessage)
+           !context.messages.contains(where: { $0.id == finalMessage.id }) {
+            context.enqueuePublicMessage(finalMessage)
         }
     }
 
     func checkForMentions(_ message: BitchatMessage) {
-        var myTokens: Set<String> = [viewModel.nickname]
-        let meshPeers = viewModel.meshService.getPeerNicknames()
-        let collisions = meshPeers.values.filter { $0.hasPrefix(viewModel.nickname + "#") }
+        var myTokens: Set<String> = [context.nickname]
+        let meshPeers = context.meshPeerNicknames()
+        let collisions = meshPeers.values.filter { $0.hasPrefix(context.nickname + "#") }
         if !collisions.isEmpty {
-            let suffix = "#" + String(viewModel.meshService.myPeerID.id.prefix(4))
-            myTokens = [viewModel.nickname + suffix]
+            let suffix = "#" + String(context.myPeerID.id.prefix(4))
+            myTokens = [context.nickname + suffix]
         }
         let isMentioned = message.mentions?.contains(where: myTokens.contains) ?? false
 
-        if isMentioned && message.sender != viewModel.nickname {
+        if isMentioned && message.sender != context.nickname {
             SecureLogger.info("🔔 Mention from \(message.sender)", category: .session)
             NotificationService.shared.sendMentionNotification(from: message.sender, message: message.content)
         }
@@ -379,11 +553,11 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
         #if os(iOS)
         guard UIApplication.shared.applicationState == .active else { return }
 
-        var tokens: [String] = [viewModel.nickname]
-        switch viewModel.activeChannel {
+        var tokens: [String] = [context.nickname]
+        switch context.activeChannel {
         case .location(let channel):
-            if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
-                tokens.append(viewModel.nickname + "#" + String(identity.publicKeyHex.suffix(4)))
+            if let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
+                tokens.append(context.nickname + "#" + String(identity.publicKeyHex.suffix(4)))
             }
         case .mesh:
             break
@@ -394,7 +568,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
         let isHugForMe = message.content.contains("🫂") && hugsMe
         let isSlapForMe = message.content.contains("🐟") && slapsMe
 
-        if isHugForMe && message.sender != viewModel.nickname {
+        if isHugForMe && message.sender != context.nickname {
             let impactFeedback = UIImpactFeedbackGenerator(style: .medium)
             impactFeedback.prepare()
 
@@ -405,7 +579,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
                     impactFeedback.impactOccurred()
                 }
             }
-        } else if isSlapForMe && message.sender != viewModel.nickname {
+        } else if isSlapForMe && message.sender != context.nickname {
             let impactFeedback = UIImpactFeedbackGenerator(style: .heavy)
             impactFeedback.prepare()
             impactFeedback.impactOccurred()
@@ -414,35 +588,35 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func pipelineCurrentMessages(_ pipeline: PublicMessagePipeline) -> [BitchatMessage] {
-        viewModel.messages
+        context.messages
     }
 
     func pipeline(_ pipeline: PublicMessagePipeline, setMessages messages: [BitchatMessage]) {
-        viewModel.messages = messages
+        context.messages = messages
     }
 
     func pipeline(_ pipeline: PublicMessagePipeline, normalizeContent content: String) -> String {
-        viewModel.deduplicationService.normalizedContentKey(content)
+        context.normalizedContentKey(content)
     }
 
     func pipeline(_ pipeline: PublicMessagePipeline, contentTimestampForKey key: String) -> Date? {
-        viewModel.deduplicationService.contentTimestamp(forKey: key)
+        context.contentTimestamp(forKey: key)
     }
 
     func pipeline(_ pipeline: PublicMessagePipeline, recordContentKey key: String, timestamp: Date) {
-        viewModel.deduplicationService.recordContentKey(key, timestamp: timestamp)
+        context.recordContentKey(key, timestamp: timestamp)
     }
 
     func pipelineTrimMessages(_ pipeline: PublicMessagePipeline) {
-        viewModel.trimMessagesIfNeeded()
+        context.trimMessagesIfNeeded()
     }
 
     func pipelinePrewarmMessage(_ pipeline: PublicMessagePipeline, message: BitchatMessage) {
-        _ = viewModel.formatMessageAsText(message, colorScheme: viewModel.currentColorScheme)
+        context.prewarmMessageFormatting(message)
     }
 
     func pipelineSetBatchingState(_ pipeline: PublicMessagePipeline, isBatching: Bool) {
-        viewModel.isBatchingPublic = isBatching
+        context.isBatchingPublic = isBatching
     }
 }
 
@@ -450,10 +624,10 @@ private extension ChatPublicConversationCoordinator {
     func normalizedSenderKey(for message: BitchatMessage) -> String {
         if let senderPeerID = message.senderPeerID {
             if senderPeerID.isGeoChat || senderPeerID.isGeoDM {
-                let full = (viewModel.nostrKeyMapping[senderPeerID] ?? senderPeerID.bare).lowercased()
+                let full = (context.nostrKeyMapping[senderPeerID] ?? senderPeerID.bare).lowercased()
                 return "nostr:" + full
             } else if senderPeerID.id.count == 16,
-                      let full = viewModel.cachedStablePeerID(for: senderPeerID)?.id.lowercased() {
+                      let full = context.cachedStablePeerID(for: senderPeerID)?.id.lowercased() {
                 return "noise:" + full
             } else {
                 return "mesh:" + senderPeerID.id.lowercased()

bitchat/ViewModels/ChatVerificationCoordinator.swift

@@ -66,7 +66,7 @@ final class ChatVerificationCoordinator {
         let noiseService = viewModel.meshService.getNoiseService()
 
         noiseService.onPeerAuthenticated = { [weak self] peerID, fingerprint in
-            DispatchQueue.main.async {
+            DispatchQueue.main.async { [weak self] in
                 guard let self else { return }
 
                 SecureLogger.debug("🔐 Authenticated: \(peerID)", category: .security)
@@ -103,7 +103,7 @@ final class ChatVerificationCoordinator {
         }
 
         noiseService.onHandshakeRequired = { [weak self] peerID in
-            DispatchQueue.main.async {
+            DispatchQueue.main.async { [weak self] in
                 guard let self else { return }
                 self.viewModel.peerIdentityStore.setEncryptionStatus(.noiseHandshaking, for: peerID)
                 self.viewModel.invalidateEncryptionCache(for: peerID)

bitchat/ViewModels/ChatViewModel.swift

@@ -152,11 +152,11 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     private lazy var peerListCoordinator = ChatPeerListCoordinator(viewModel: self)
     private lazy var messageFormatter = ChatMessageFormatter(viewModel: self)
     lazy var peerIdentityCoordinator = ChatPeerIdentityCoordinator(viewModel: self)
-    lazy var deliveryCoordinator = ChatDeliveryCoordinator(viewModel: self)
+    lazy var deliveryCoordinator = ChatDeliveryCoordinator(context: self)
     lazy var composerCoordinator = ChatComposerCoordinator(viewModel: self)
-    lazy var publicConversationCoordinator = ChatPublicConversationCoordinator(viewModel: self)
-    lazy var privateConversationCoordinator = ChatPrivateConversationCoordinator(viewModel: self)
-    lazy var nostrCoordinator = ChatNostrCoordinator(viewModel: self)
+    lazy var publicConversationCoordinator = ChatPublicConversationCoordinator(context: self)
+    lazy var privateConversationCoordinator = ChatPrivateConversationCoordinator(context: self)
+    lazy var nostrCoordinator = ChatNostrCoordinator(context: self)
     lazy var mediaTransferCoordinator = ChatMediaTransferCoordinator(viewModel: self)
     lazy var verificationCoordinator = ChatVerificationCoordinator(viewModel: self)
 
@@ -168,7 +168,7 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         get { privateChatManager.privateChats }
         set {
             privateChatManager.privateChats = newValue
-            synchronizePrivateConversationStore()
+            schedulePrivateConversationStoreSynchronization()
         }
     }
     var selectedPrivateChatPeer: PeerID? {
@@ -187,7 +187,7 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         get { privateChatManager.unreadMessages }
         set {
             privateChatManager.unreadMessages = newValue
-            synchronizePrivateConversationStore()
+            schedulePrivateConversationStoreSynchronization()
         }
     }
 
@@ -372,6 +372,7 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     // MARK: - Message Delivery Tracking
 
     var cancellables = Set<AnyCancellable>()
+    private var pendingPrivateConversationStoreSyncTask: Task<Void, Never>?
 
     var transferIdToMessageIDs: [String: [String]] {
         mediaTransferCoordinator.transferIdToMessageIDs
@@ -967,6 +968,17 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         publicConversationCoordinator.synchronizeAllPublicConversationStores()
     }
 
+    @MainActor
+    func schedulePrivateConversationStoreSynchronization() {
+        guard pendingPrivateConversationStoreSyncTask == nil else { return }
+        pendingPrivateConversationStoreSyncTask = Task { @MainActor [weak self] in
+            await Task.yield()
+            guard let self else { return }
+            self.pendingPrivateConversationStoreSyncTask = nil
+            self.synchronizePrivateConversationStore()
+        }
+    }
+
     @MainActor
     func synchronizePrivateConversationStore() {
         conversationStore.synchronizePrivateChats(

bitchat/ViewModels/ChatViewModelBootstrapper.swift

@@ -93,7 +93,7 @@ private extension ChatViewModelBootstrapper {
             .receive(on: DispatchQueue.main)
             .sink { [weak viewModel] _ in
                 Task { @MainActor [weak viewModel] in
-                    viewModel?.synchronizePrivateConversationStore()
+                    viewModel?.schedulePrivateConversationStoreSynchronization()
                 }
             }
             .store(in: &viewModel.cancellables)
@@ -102,7 +102,7 @@ private extension ChatViewModelBootstrapper {
             .receive(on: DispatchQueue.main)
             .sink { [weak viewModel] _ in
                 Task { @MainActor [weak viewModel] in
-                    viewModel?.synchronizePrivateConversationStore()
+                    viewModel?.schedulePrivateConversationStoreSynchronization()
                 }
             }
             .store(in: &viewModel.cancellables)

bitchat/ViewModels/PublicTimelineStore.swift

@@ -10,7 +10,9 @@ import Foundation
 
 struct PublicTimelineStore {
     private var meshTimeline: [BitchatMessage] = []
+    private var meshMessageIDs: Set<String> = []
     private var geohashTimelines: [String: [BitchatMessage]] = [:]
+    private var geohashMessageIDs: [String: Set<String>] = [:]
     private var pendingGeohashSystemMessages: [String] = []
 
     private let meshCap: Int
@@ -24,8 +26,9 @@ struct PublicTimelineStore {
     mutating func append(_ message: BitchatMessage, to channel: ChannelID) {
         switch channel {
         case .mesh:
-            guard !meshTimeline.contains(where: { $0.id == message.id }) else { return }
+            guard !meshMessageIDs.contains(message.id) else { return }
             meshTimeline.append(message)
+            meshMessageIDs.insert(message.id)
             trimMeshTimelineIfNeeded()
         case .location(let channel):
             append(message, toGeohash: channel.geohash)
@@ -33,21 +36,12 @@ struct PublicTimelineStore {
     }
 
     mutating func append(_ message: BitchatMessage, toGeohash geohash: String) {
-        var timeline = geohashTimelines[geohash] ?? []
-        guard !timeline.contains(where: { $0.id == message.id }) else { return }
-        timeline.append(message)
-        trimGeohashTimelineIfNeeded(&timeline)
-        geohashTimelines[geohash] = timeline
+        _ = appendGeohashMessageIfAbsent(message, geohash: geohash)
     }
 
     /// Append message if absent, returning true when stored.
     mutating func appendIfAbsent(_ message: BitchatMessage, toGeohash geohash: String) -> Bool {
-        var timeline = geohashTimelines[geohash] ?? []
-        guard !timeline.contains(where: { $0.id == message.id }) else { return false }
-        timeline.append(message)
-        trimGeohashTimelineIfNeeded(&timeline)
-        geohashTimelines[geohash] = timeline
-        return true
+        appendGeohashMessageIfAbsent(message, geohash: geohash)
     }
 
     mutating func messages(for channel: ChannelID) -> [BitchatMessage] {
@@ -56,7 +50,7 @@ struct PublicTimelineStore {
             return meshTimeline
         case .location(let channel):
             let cleaned = geohashTimelines[channel.geohash]?.cleanedAndDeduped() ?? []
-            geohashTimelines[channel.geohash] = cleaned
+            replaceGeohashTimeline(cleaned, for: channel.geohash, keepEmpty: true)
             return cleaned
         }
     }
@@ -65,22 +59,26 @@ struct PublicTimelineStore {
         switch channel {
         case .mesh:
             meshTimeline.removeAll()
+            meshMessageIDs.removeAll()
         case .location(let channel):
             geohashTimelines[channel.geohash] = []
+            geohashMessageIDs[channel.geohash] = []
         }
     }
 
     @discardableResult
     mutating func removeMessage(withID id: String) -> BitchatMessage? {
         if let index = meshTimeline.firstIndex(where: { $0.id == id }) {
-            return meshTimeline.remove(at: index)
+            let removed = meshTimeline.remove(at: index)
+            meshMessageIDs.remove(id)
+            return removed
         }
 
         for key in Array(geohashTimelines.keys) {
             var timeline = geohashTimelines[key] ?? []
             if let index = timeline.firstIndex(where: { $0.id == id }) {
                 let removed = timeline.remove(at: index)
-                geohashTimelines[key] = timeline.isEmpty ? nil : timeline
+                replaceGeohashTimeline(timeline, for: key, keepEmpty: false)
                 return removed
             }
         }
@@ -91,13 +89,13 @@ struct PublicTimelineStore {
     mutating func removeMessages(in geohash: String, where predicate: (BitchatMessage) -> Bool) {
         var timeline = geohashTimelines[geohash] ?? []
         timeline.removeAll(where: predicate)
-        geohashTimelines[geohash] = timeline.isEmpty ? nil : timeline
+        replaceGeohashTimeline(timeline, for: geohash, keepEmpty: false)
     }
 
     mutating func mutateGeohash(_ geohash: String, _ transform: (inout [BitchatMessage]) -> Void) {
         var timeline = geohashTimelines[geohash] ?? []
         transform(&timeline)
-        geohashTimelines[geohash] = timeline.isEmpty ? nil : timeline
+        replaceGeohashTimeline(timeline, for: geohash, keepEmpty: false)
     }
 
     mutating func queueGeohashSystemMessage(_ content: String) {
@@ -116,10 +114,35 @@ struct PublicTimelineStore {
     private mutating func trimMeshTimelineIfNeeded() {
         guard meshTimeline.count > meshCap else { return }
         meshTimeline = Array(meshTimeline.suffix(meshCap))
+        meshMessageIDs = Set(meshTimeline.map(\.id))
     }
 
-    private func trimGeohashTimelineIfNeeded(_ timeline: inout [BitchatMessage]) {
+    private mutating func appendGeohashMessageIfAbsent(_ message: BitchatMessage, geohash: String) -> Bool {
+        var timeline = geohashTimelines[geohash] ?? []
+        var messageIDs = geohashMessageIDs[geohash] ?? Set(timeline.map(\.id))
+        guard messageIDs.insert(message.id).inserted else { return false }
+
+        timeline.append(message)
+        trimGeohashTimelineIfNeeded(&timeline, messageIDs: &messageIDs)
+        geohashTimelines[geohash] = timeline
+        geohashMessageIDs[geohash] = messageIDs
+        return true
+    }
+
+    private func trimGeohashTimelineIfNeeded(_ timeline: inout [BitchatMessage], messageIDs: inout Set<String>) {
         guard timeline.count > geohashCap else { return }
         timeline = Array(timeline.suffix(geohashCap))
+        messageIDs = Set(timeline.map(\.id))
+    }
+
+    private mutating func replaceGeohashTimeline(_ timeline: [BitchatMessage], for geohash: String, keepEmpty: Bool) {
+        if timeline.isEmpty && !keepEmpty {
+            geohashTimelines[geohash] = nil
+            geohashMessageIDs[geohash] = nil
+            return
+        }
+
+        geohashTimelines[geohash] = timeline
+        geohashMessageIDs[geohash] = Set(timeline.map(\.id))
     }
 }

bitchat/Views/MessageListView.swift

@@ -305,10 +305,10 @@ private extension MessageListView {
 
     var targetPeerID: String? {
         if let peer = privatePeer,
-           let last = privateInboxModel.messages(for: peer).suffix(300).last?.id {
+           let last = privateInboxModel.messages(for: peer).last?.id {
             return "dm:\(peer)|\(last)"
         }
-        if let last = publicChatModel.messages.suffix(300).last?.id {
+        if let last = publicChatModel.messages.last?.id {
             return "\(locationChannelsModel.selectedChannel.contextKey)|\(last)"
         }
         return nil
@@ -329,7 +329,7 @@ private extension MessageListView {
         func scrollIfNeeded(date: Date) {
             lastScrollTime = date
             let contextKey = locationChannelsModel.selectedChannel.contextKey
-            if let target = messages.suffix(windowCountPublic).last.map({ "\(contextKey)|\($0.id)" }) {
+            if let target = messages.last.map({ "\(contextKey)|\($0.id)" }) {
                 proxy.scrollTo(target, anchor: .bottom)
             }
         }
@@ -368,8 +368,7 @@ private extension MessageListView {
         func scrollIfNeeded(date: Date) {
             lastScrollTime = date
             let contextKey = "dm:\(peerID)"
-            let count = windowCountPrivate[peerID] ?? 300
-            if let target = messages.suffix(count).last.map({ "\(contextKey)|\($0.id)" }){
+            if let target = messages.last.map({ "\(contextKey)|\($0.id)" }) {
                 proxy.scrollTo(target, anchor: .bottom)
             }
         }
@@ -399,7 +398,7 @@ private extension MessageListView {
             isAtBottom = true
             windowCountPublic = TransportConfig.uiWindowInitialCountPublic
             let contextKey = "geo:\(ch.geohash)"
-            if let target = publicChatModel.messages.suffix(windowCountPublic).last?.id.map({ "\(contextKey)|\($0)" }) {
+            if let target = publicChatModel.messages.last?.id.map({ "\(contextKey)|\($0)" }) {
                 proxy.scrollTo(target, anchor: .bottom)
             }
         }