Harden PTT audio and the 1.7.1 release (#1423)

Centralize PTT and voice audio-session ownership, harden courier/bridge/outbox delivery and recovery, correct location and delivery-state races, add privacy/release metadata, and ship reproducible universal Arti slices with Release CI coverage.

Validated by the full iOS suite, repeated audio/fragment/performance regressions, BitFoundation tests, strict lint and dead-code analysis, universal iOS Release builds, and iOS/macOS archives.

bitchat/App/AppRuntime.swift

@@ -313,21 +313,29 @@ private extension AppRuntime {
     }
 
     func checkForSharedContent() {
-        guard let userDefaults = UserDefaults(suiteName: BitchatApp.groupID),
-              let sharedContent = userDefaults.string(forKey: "sharedContent"),
+        guard let userDefaults = UserDefaults(suiteName: BitchatApp.groupID) else { return }
+        let clearSharedContent = {
+            userDefaults.removeObject(forKey: "sharedContent")
+            userDefaults.removeObject(forKey: "sharedContentType")
+            userDefaults.removeObject(forKey: "sharedContentDate")
+        }
+
+        guard let sharedContent = userDefaults.string(forKey: "sharedContent"),
               let sharedDate = userDefaults.object(forKey: "sharedContentDate") as? Date else {
+            // A partial or malformed handoff must not linger in the shared
+            // app-group container indefinitely.
+            clearSharedContent()
             return
         }
 
         guard Date().timeIntervalSince(sharedDate) < TransportConfig.uiShareAcceptWindowSeconds else {
+            clearSharedContent()
             return
         }
 
         let contentKind = SharedContentKind(rawValue: userDefaults.string(forKey: "sharedContentType") ?? "") ?? .text
 
-        userDefaults.removeObject(forKey: "sharedContent")
-        userDefaults.removeObject(forKey: "sharedContentType")
-        userDefaults.removeObject(forKey: "sharedContentDate")
+        clearSharedContent()
 
         switch contentKind {
         case .url:

bitchat/App/ConversationStore.swift

@@ -229,15 +229,17 @@ final class Conversation: ObservableObject, Identifiable {
         // sending < sent < carried < delivered < read. A late `.sent` write
         // (e.g. the optimistic stamp after routing) must not clobber the
         // `.carried` the router already set when it handed a copy to a
-        // courier/bridge, nor a `.delivered`/`.read` ack. Same for the
+        // courier/bridge, nor a `.delivered`/`.read` ack. A late asynchronous
+        // failure is weaker than a confirmed recipient receipt too, so it may
+        // not replace `.delivered`/`.read`. Same for the
         // `.sending` stamp a pre-handshake resend emits asynchronously: it
         // can land after the message already reached `.sent`, and "Sent" was
         // already truthful. (`.failed` → `.sending` stays allowed so a real
         // failure retry is visible.)
         switch (current, new) {
-        case (.read, .delivered), (.read, .carried), (.read, .sent), (.read, .sending):
+        case (.read, .delivered), (.read, .carried), (.read, .sent), (.read, .sending), (.read, .failed):
             return true
-        case (.delivered, .carried), (.delivered, .sent), (.delivered, .sending):
+        case (.delivered, .carried), (.delivered, .sent), (.delivered, .sending), (.delivered, .failed):
             return true
         case (.carried, .sent), (.carried, .sending):
             return true

bitchat/App/NearbyNotesCounter.swift

@@ -27,6 +27,7 @@ final class NearbyNotesCounter: ObservableObject {
     private var manager: LocationNotesManager?
     private var managerCancellable: AnyCancellable?
     private var channelsCancellable: AnyCancellable?
+    private var permissionCancellable: AnyCancellable?
     private var settingCancellable: AnyCancellable?
     private var activeHolders = 0
     private let locationManager: LocationChannelManager
@@ -73,6 +74,13 @@ final class NearbyNotesCounter: ObservableObject {
         channelsCancellable = locationManager.$availableChannels
             .receive(on: DispatchQueue.main)
             .sink { [weak self] _ in self?.retarget() }
+        // CoreLocation can revoke authorization while the view remains
+        // mounted. `availableChannels` deliberately retains its last value,
+        // so permission must be an independent invalidation signal or the
+        // building REQ survives on stale coordinates.
+        permissionCancellable = locationManager.$permissionState
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in self?.retarget() }
         // The app-info kill switch must take effect immediately, not on the
         // next location change or remount.
         settingCancellable = NotificationCenter.default
@@ -86,6 +94,7 @@ final class NearbyNotesCounter: ObservableObject {
         activeHolders = max(0, activeHolders - 1)
         guard activeHolders == 0 else { return }
         channelsCancellable = nil
+        permissionCancellable = nil
         settingCancellable = nil
         managerCancellable = nil
         releaseManager(manager)