Harden the insecure-link outbox bound; document the second-replay presence gap and the courier metadata tradeoff

Review follow-ups on the canDeliverSecurely gate:

- flushOutbox no longer counts connected-but-insecure flushes toward the
  maxSendAttempts drop: the message was actually transmitted over a live
  link, so a peer whose Noise handshake stalls across reconnect flapping
  must not burn through the cap and lose the store-and-forward copy the
  gate exists to preserve. Retention stays bounded by the 24h outbox TTL
  and the per-peer FIFO cap; acks still clear it. Attempt-counting stays
  for reachable-only (heuristic) sends. Regression test: >8 connected-
  insecure flushes keep the retained copy, drop callback never fires.

- Document the known second-replay presence gap: linkBoundToOtherPeer
  reads the binding before rebindLinkAfterVerifiedDirectAnnounce steals
  the link, so once a first replay has rebound a link to an absent
  victim's ID, a second replay marks the victim connected. Presence
  display only — DMs stay on the retain+courier path via the router
  gate. Not closed at the announce layer because the post-rebind state
  is indistinguishable from a legitimate rotation/reconnect heal (a
  supported, field-verified flow). Covered by a two-announce test.

- Note the accepted courier-spray metadata tradeoff at the connected-
  insecure send: nearby verified peers receive a sealed copy (they learn
  a DM exists, never its content), cleared on ack.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bitchatTests/Services/BLEAnnounceHandlerTests.swift

@@ -390,6 +390,51 @@ struct BLEAnnounceHandlerTests {
         #expect(recorder.upsertCalls.first?.isConnected == true)
     }
 
+    /// Documents a known, accepted limitation: the linkBoundToOtherPeer read
+    /// happens before the rebind steals the link, so while the FIRST replayed
+    /// "direct" announce is denied the connected shortcut, the SECOND finds
+    /// the link already rebound to the (absent) victim and the live-link
+    /// terms mark it connected. This is presence display only — DMs remain
+    /// gated on canDeliverSecurely, so without a Noise session they take the
+    /// retain + courier path (see MessageRouterTests
+    /// .sendPrivate_connectedWithoutSecureSessionRetainsAndDepositsWithCourier).
+    /// Not closed at the announce layer because the post-rebind state is
+    /// indistinguishable from a legitimate rotation/reconnect heal.
+    @Test
+    func secondReplayedDirectAnnounceAfterRebindMarksAbsentPeerConnected() throws {
+        let now = Date(timeIntervalSince1970: 1_000)
+        let noiseKey = Data(repeating: 0xA1, count: 32)
+        let victim = PeerID(publicKey: noiseKey)
+        let packet = try makeAnnouncePacket(
+            noisePublicKey: noiseKey,
+            peerID: victim,
+            timestamp: timestamp(now),
+            signature: Data(repeating: 0xEE, count: 64)
+        )
+
+        let recorder = Recorder()
+        let handler = makeHandler(recorder: recorder, now: now)
+
+        // First replay: the link still belongs to the replayer and the victim
+        // has no live link of its own — the connected shortcut is denied.
+        recorder.linkBoundToOtherPeer = true
+        recorder.linkState = (hasPeripheral: false, hasCentral: false)
+        handler.handle(packet, from: victim)
+        #expect(recorder.upsertCalls.count == 1)
+        #expect(recorder.upsertCalls.first?.isConnected == false)
+
+        // The rebind then binds the replayer's link to the victim's ID (the
+        // rotation-heal path, containment-checked in BLEService). A second
+        // replay now finds the link owned by the claimed peer …
+        recorder.linkBoundToOtherPeer = false
+        recorder.linkState = (hasPeripheral: false, hasCentral: true)
+        handler.handle(packet, from: victim)
+
+        // … and the absent victim reads as connected: the residual gap.
+        #expect(recorder.upsertCalls.count == 2)
+        #expect(recorder.upsertCalls.last?.isConnected == true)
+    }
+
     @Test
     func announceBackIsSkippedWhenAlreadyMarked() throws {
         let now = Date(timeIntervalSince1970: 1_000)

bitchatTests/Services/MessageRouterTests.swift

@@ -360,6 +360,38 @@ struct MessageRouterTests {
         #expect(transport.sentPrivateMessages.count == 3)
     }
 
+    /// Flushes over a connected-but-insecure link never count toward the
+    /// attempt-cap drop: the message was actually transmitted over a live
+    /// link, so a peer whose Noise handshake stalls across reconnect flapping
+    /// must not burn through the cap and lose the store-and-forward copy the
+    /// secure-session gate exists to preserve. Retention stays bounded by
+    /// the 24h outbox TTL and the per-peer FIFO cap; an ack clears it.
+    @Test @MainActor
+    func flushOutbox_connectedInsecureFlushesNeverDropTheRetainedCopy() async {
+        let peerID = PeerID(str: "00000000000000ac")
+        let transport = MockTransport()
+        transport.connectedPeers.insert(peerID)
+        transport.securePeers = [] // handshake never completes
+
+        let router = MessageRouter(transports: [transport])
+        var dropped: [String] = []
+        router.onMessageDropped = { messageID, _ in dropped.append(messageID) }
+
+        router.sendPrivate("Hello", to: peerID, recipientNickname: "Peer", messageID: "ci1")
+
+        // Well past maxSendAttempts (8): every flush resends, none drops.
+        for _ in 0..<10 {
+            router.flushOutbox(for: peerID)
+        }
+        #expect(dropped.isEmpty)
+        #expect(transport.sentPrivateMessages.count == 11)
+
+        // The copy is still retained and an ack still clears it.
+        router.markDelivered("ci1")
+        router.flushOutbox(for: peerID)
+        #expect(transport.sentPrivateMessages.count == 11)
+    }
+
     /// With an established secure session the connected fast-path stays
     /// exactly as before: trusted outright, no retained copy, no courier.
     @Test @MainActor