Unified notices: one pin, one sheet for board pins + location notes (#1392)

* Unified notices: merge board pins and location notes into one sheet One pin icon in the header now opens a single Notices sheet with a geo/mesh scope toggle, replacing the separate board, location-notes, and mesh-only note buttons: - geo tab: current geohash's notices — mesh-synced board posts merged and deduped with Nostr kind-1 location notes, with per-item mesh/net source badges. Scope follows the selected location channel, or the device's building geohash when chatting on mesh. - mesh tab: mesh-local board only (fully offline). - One composer: geo posts go to the board and bridge to Nostr (existing bridge), so mesh and internet see the same notice. - Merged delete: tombstoning an own board post now also retracts the bridged Nostr copy via NIP-09 (new createDeleteEvent, bridged event ids tracked in BoardManager); own Nostr-only notes are deletable too. - LocationNotesManager accepts any channel-precision geohash (1-12 chars), not just building-level. BoardView and LocationNotesView are superseded by NoticesView. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Notices round 2: honest composer, friendlier copy, new-pin chat alerts - Urgent + expiry controls now appear on the mesh tab only: the bridged Nostr copy of a geo post carries neither, so relay-side readers would never see them. Geo posts default to non-urgent with 7-day expiry, and the bridged note now gets a NIP-40 expiration tag so honoring relays drop it in step with the board copy. - Geo tab explainer reuses the original location-notes description (keeps its 29 existing translations); mesh tab gets a new plain- language description. - New-pin chat alerts, fully local (no wire traffic): BoardStore fires postArrivals for posts newly accepted from the wire; BoardAlertsModel filters own posts, dedups by postID, and for urgent pins created within the last 30 minutes emits one system line into the matching timeline (geo pin -> that geohash's chat, mesh pin -> mesh chat), collapsing simultaneous arrivals into a count line. - Routine pins light up the header: the pin icon tints orange whenever the current scope has notices at all, and fills (pin.fill) while unseen new pins are waiting; opening the sheet clears them. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * i18n: translate the unified-notices strings into all 28 non-English locales Adds the 13 new notices keys (sheet title, geo/mesh tabs, mesh description, source badges, urgent alert lines, button tooltip and accessibility strings) to the string catalog with translations for every locale the app ships. The geo tab already reuses the fully translated location_notes.description; this covers the rest. Insertion preserves the catalog's case-insensitive key order, so the diff is purely additive. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Address Codex review: panic-wipe reset, scoped badge clear, geohash-aware dedupe - BoardStore.wipe() now emits didWipe; BoardAlertsModel subscribes and resets, so a panic wipe drops pending urgent lines (which could otherwise re-append pre-wipe content into chat after the collapse flush), unseen badge scopes, and handled-post history. - Opening the notices sheet clears unseen badges only for the scopes it actually shows (mesh + current geo scope); pins for other geohash channels keep their badge until visited. - LocationNotesManager.Note now retains the matched g tag, and the bridged-copy dedupe requires the note's geohash to equal the board post's — a same-text note from a neighboring cell is no longer swallowed as a duplicate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: jack <jackjackbits@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-27 12:45:20 +00:00 · 2026-07-07 17:40:12 +02:00
parent a0c517c018
commit 8415c52913
19 changed files with 6210 additions and 3139 deletions
@@ -0,0 +1,160 @@
+//
+// BoardAlertsModel.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import Combine
+import Foundation
+
+/// Turns newly arriving board posts into local, scope-matched chat alerts.
+/// Everything here is derived from posts the mesh already synced — no extra
+/// wire traffic, nothing another peer can't already see.
+///
+/// - Urgent, recent pins get one system line in the matching chat (geo pin →
+///   that geohash's timeline, mesh pin → mesh chat), collapsed when several
+///   arrive together.
+/// - Every other new pin just marks the header's pin icon until the notices
+///   sheet is opened.
+@MainActor
+final class BoardAlertsModel: ObservableObject {
+    struct Dependencies {
+        /// Own posts never alert; the author already knows.
+        var isOwnPost: @MainActor (BoardPostPacket) -> Bool
+        /// Appends a local system line to a scope's chat timeline
+        /// (geohash, or "" for mesh chat).
+        var emitSystemLine: @MainActor (_ content: String, _ geohash: String) -> Void
+        var now: () -> Date = Date.init
+        /// Schedules the collapsed flush of pending urgent alerts; tests
+        /// inject a synchronous hook.
+        var scheduleFlush: (_ flush: @escaping @MainActor () -> Void) -> Void = { flush in
+            Task { @MainActor in
+                try? await Task.sleep(nanoseconds: UInt64(BoardAlertsModel.collapseDelaySeconds * 1_000_000_000))
+                flush()
+            }
+        }
+    }
+
+    /// Posts older than this at arrival are backfilled history carried in by
+    /// a peer, not something happening now; they badge but never line the chat.
+    static let inlineRecencyWindow: TimeInterval = 30 * 60
+    /// Urgent arrivals within this window collapse into one line.
+    static let collapseDelaySeconds: TimeInterval = 4
+    private static let alertContentMaxChars = 120
+
+    /// Unseen new pins by postID (hex) → geohash scope, cleared when the
+    /// notices sheet opens.
+    @Published private(set) var unseenPostScopes: [String: String] = [:]
+
+    /// PostIDs already handled this session, so store eviction/re-sync churn
+    /// can't re-alert. Bounded by session wire volume (32-byte strings).
+    private var handledPostIDs = Set<String>()
+    private var pendingUrgent: [String: [BoardPostPacket]] = [:]
+    private var flushScheduled = false
+    private let dependencies: Dependencies
+    private var cancellable: AnyCancellable?
+    private var wipeCancellable: AnyCancellable?
+
+    private enum Strings {
+        static func urgentSingle(author: String, content: String) -> String {
+            String(
+                format: String(localized: "notices.alert.urgent_single", defaultValue: "📌 urgent notice from @%@: %@", comment: "Local chat line when one urgent notice is pinned nearby"),
+                locale: .current,
+                author, content
+            )
+        }
+
+        static func urgentCollapsed(_ count: Int) -> String {
+            String(
+                format: String(localized: "notices.alert.urgent_collapsed", defaultValue: "📌 %lld new urgent notices — tap the pin to view", comment: "Local chat line when several urgent notices arrive together"),
+                locale: .current,
+                count
+            )
+        }
+    }
+
+    init(
+        arrivals: AnyPublisher<BoardPostPacket, Never>,
+        wipes: AnyPublisher<Void, Never> = Empty(completeImmediately: false).eraseToAnyPublisher(),
+        dependencies: Dependencies
+    ) {
+        self.dependencies = dependencies
+        cancellable = arrivals
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] post in
+                self?.handleArrival(post)
+            }
+        wipeCancellable = wipes
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] in
+                self?.reset()
+            }
+    }
+
+    func unseenCount(forGeohash geohash: String) -> Int {
+        unseenPostScopes.values.reduce(0) { $0 + ($1 == geohash ? 1 : 0) }
+    }
+
+    /// Marks pins in the given scopes as seen — only the scopes the notices
+    /// sheet actually shows, so unseen pins for other geohash channels keep
+    /// their badge until visited.
+    func markSeen(forScopes scopes: Set<String>) {
+        guard unseenPostScopes.contains(where: { scopes.contains($0.value) }) else { return }
+        unseenPostScopes = unseenPostScopes.filter { !scopes.contains($0.value) }
+    }
+
+    /// Panic wipe: drop everything derived from pre-wipe posts, including
+    /// urgent lines still waiting on the collapse flush.
+    func reset() {
+        pendingUrgent.removeAll()
+        handledPostIDs.removeAll()
+        guard !unseenPostScopes.isEmpty else { return }
+        unseenPostScopes.removeAll()
+    }
+
+    func handleArrival(_ post: BoardPostPacket) {
+        let postID = post.postID.hexEncodedString()
+        guard !handledPostIDs.contains(postID) else { return }
+        handledPostIDs.insert(postID)
+        guard !dependencies.isOwnPost(post) else { return }
+
+        unseenPostScopes[postID] = post.geohash
+
+        let createdAt = Date(timeIntervalSince1970: TimeInterval(post.createdAt) / 1000)
+        guard post.isUrgent,
+              dependencies.now().timeIntervalSince(createdAt) <= Self.inlineRecencyWindow else {
+            return
+        }
+        pendingUrgent[post.geohash, default: []].append(post)
+        if !flushScheduled {
+            flushScheduled = true
+            dependencies.scheduleFlush { [weak self] in
+                self?.flushPendingUrgent()
+            }
+        }
+    }
+
+    private func flushPendingUrgent() {
+        flushScheduled = false
+        let pending = pendingUrgent
+        pendingUrgent.removeAll()
+        for (geohash, posts) in pending {
+            guard let first = posts.first else { continue }
+            let line: String
+            if posts.count == 1 {
+                let author = first.authorNickname.trimmedOrNilIfEmpty ?? "anon"
+                line = Strings.urgentSingle(author: author, content: Self.truncated(first.content))
+            } else {
+                line = Strings.urgentCollapsed(posts.count)
+            }
+            dependencies.emitSystemLine(line, geohash)
+        }
+    }
+
+    private static func truncated(_ content: String) -> String {
+        guard content.count > alertContentMaxChars else { return content }
+        return content.prefix(alertContentMaxChars) + "…"
+    }
+}
@@ -20,17 +20,28 @@ final class BoardManager: ObservableObject {

    private let transport: Transport
    private let store: BoardStore
-    private let publishToNostr: (_ content: String, _ geohash: String, _ nickname: String) -> Void
+    /// Publishes a bridged kind-1 note (expiring with the board post via
+    /// NIP-40) and returns its Nostr event id, or nil when bridging failed or
+    /// was skipped.
+    private let publishToNostr: (_ content: String, _ geohash: String, _ nickname: String, _ expiresAtMs: UInt64) -> String?
+    /// Requests NIP-09 deletion of a previously bridged note.
+    private let deleteFromNostr: (_ eventID: String, _ geohash: String) -> Void
+    /// Bridged Nostr event ids by postID, for merged deletes. In-memory only:
+    /// after a relaunch a delete still tombstones the board copy, but the
+    /// Nostr copy is left to expire with relay retention.
+    private var bridgedEventIDs: [Data: String] = [:]
    private var cancellable: AnyCancellable?

    init(
        transport: Transport,
        store: BoardStore = .shared,
-        publishToNostr: ((String, String, String) -> Void)? = nil
+        publishToNostr: ((String, String, String, UInt64) -> String?)? = nil,
+        deleteFromNostr: ((String, String) -> Void)? = nil
    ) {
        self.transport = transport
        self.store = store
        self.publishToNostr = publishToNostr ?? Self.livePublishToNostr
+        self.deleteFromNostr = deleteFromNostr ?? Self.liveDeleteFromNostr
        cancellable = store.$postsSnapshot
            .receive(on: DispatchQueue.main)
            .sink { [weak self] snapshot in
@@ -115,10 +126,10 @@ final class BoardManager: ObservableObject {
        )
        transport.sendBoardPayload(BoardWire.post(post).encode())

-        // One-way Nostr bridge (v1): geohash posts also go out as kind-1
-        // location notes so online users see them. No inbound merge yet.
-        if !geohash.isEmpty {
-            publishToNostr(trimmed, geohash, cleanNickname)
+        // Nostr bridge: geohash posts also go out as kind-1 location notes so
+        // online users see them. Remember the event id for merged deletes.
+        if !geohash.isEmpty, let eventID = publishToNostr(trimmed, geohash, cleanNickname, expiresAt) {
+            bridgedEventIDs[postID] = eventID
        }
        return true
    }
@@ -140,14 +151,20 @@ final class BoardManager: ObservableObject {
            signature: signature
        )
        transport.sendBoardPayload(BoardWire.tombstone(tombstone).encode())
+
+        // Merged delete: also retract the bridged Nostr copy when we still
+        // know its event id.
+        if !post.geohash.isEmpty, let eventID = bridgedEventIDs.removeValue(forKey: post.postID) {
+            deleteFromNostr(eventID, post.geohash)
+        }
        return true
    }

-    private static func livePublishToNostr(content: String, geohash: String, nickname: String) {
+    private static func livePublishToNostr(content: String, geohash: String, nickname: String, expiresAtMs: UInt64) -> String? {
        let relays = GeoRelayDirectory.shared.closestRelays(toGeohash: geohash, count: TransportConfig.nostrGeoRelayCount)
        guard !relays.isEmpty else {
            SecureLogger.debug("Board: no geo relays for \(geohash); skipping Nostr bridge", category: .session)
-            return
+            return nil
        }
        do {
            let identity = try NostrIdentityBridge().deriveIdentity(forGeohash: geohash)
@@ -155,11 +172,26 @@ final class BoardManager: ObservableObject {
                content: content,
                geohash: geohash,
                senderIdentity: identity,
-                nickname: nickname
+                nickname: nickname,
+                expiresAt: Date(timeIntervalSince1970: TimeInterval(expiresAtMs) / 1000)
            )
            NostrRelayManager.shared.sendEvent(event, to: relays)
+            return event.id
        } catch {
            SecureLogger.error("Board: failed to bridge post to Nostr: \(error)", category: .session)
+            return nil
+        }
+    }
+
+    private static func liveDeleteFromNostr(eventID: String, geohash: String) {
+        let relays = GeoRelayDirectory.shared.closestRelays(toGeohash: geohash, count: TransportConfig.nostrGeoRelayCount)
+        guard !relays.isEmpty else { return }
+        do {
+            let identity = try NostrIdentityBridge().deriveIdentity(forGeohash: geohash)
+            let deletion = try NostrProtocol.createDeleteEvent(ofEventID: eventID, senderIdentity: identity)
+            NostrRelayManager.shared.sendEvent(deletion, to: relays)
+        } catch {
+            SecureLogger.error("Board: failed to delete bridged Nostr note: \(error)", category: .session)
        }
    }
 }
@@ -78,6 +78,16 @@ final class BoardStore {
    /// Live posts, published on the main thread for the board UI.
    @Published private(set) var postsSnapshot: [BoardPostPacket] = []

+    /// Fires on the main thread for each post newly accepted from the wire
+    /// (radio, sync, or local echo) — not for disk restores. Drives the
+    /// local new-pin chat alerts; duplicates never fire twice because the
+    /// store rejects them.
+    let postArrivals = PassthroughSubject<BoardPostPacket, Never>()
+
+    /// Fires on the main thread after a panic wipe so derived state (pending
+    /// alerts, unseen badges) is dropped along with the posts themselves.
+    let didWipe = PassthroughSubject<Void, Never>()
+
    private var posts: [StoredPost] = []
    private var tombstones: [StoredTombstone] = []
    private let queue = DispatchQueue(label: "chat.bitchat.board.store")
@@ -104,6 +114,11 @@ final class BoardStore {
            let result = ingestLocked(wire, packet: packet, rawPacket: rawPacket, nowMs: nowMs)
            if result == .accepted {
                persistLocked()
+                if case .post(let post) = wire {
+                    DispatchQueue.main.async { [weak self] in
+                        self?.postArrivals.send(post)
+                    }
+                }
            }
            return result
        }
@@ -149,6 +164,9 @@ final class BoardStore {
            }
            publishSnapshotLocked()
        }
+        DispatchQueue.main.async { [weak self] in
+            self?.didWipe.send()
+        }
    }

    // MARK: - Internals (call only on `queue`)
@@ -0,0 +1,88 @@
+//
+// UnifiedNotices.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import Foundation
+
+/// One row in the unified notices sheet: a mesh board post or a Nostr
+/// location note, normalized for display.
+struct NoticeItem: Identifiable, Equatable {
+    enum Source: Equatable {
+        /// Signed board post carried by the mesh.
+        case board(BoardPostPacket)
+        /// Kind-1 location note seen on geo relays.
+        case nostr(LocationNotesManager.Note)
+    }
+
+    let id: String
+    let author: String
+    let content: String
+    let createdAt: Date
+    let isUrgent: Bool
+    let source: Source
+
+    var isBoardPost: Bool {
+        if case .board = source { return true }
+        return false
+    }
+
+    init(post: BoardPostPacket) {
+        id = post.postID.hexEncodedString()
+        author = post.authorNickname.trimmedOrNilIfEmpty ?? "anon"
+        content = post.content
+        createdAt = Date(timeIntervalSince1970: TimeInterval(post.createdAt) / 1000)
+        isUrgent = post.isUrgent
+        source = .board(post)
+    }
+
+    init(note: LocationNotesManager.Note) {
+        id = note.id
+        let display = note.displayName
+        author = display.split(separator: "#", maxSplits: 1, omittingEmptySubsequences: false)
+            .first.map(String.init) ?? display
+        content = note.content
+        createdAt = note.createdAt
+        isUrgent = false
+        source = .nostr(note)
+    }
+}
+
+/// Merges mesh board posts and Nostr location notes into one deduplicated
+/// list for the notices sheet's geo tab.
+enum UnifiedNotices {
+    /// Board posts on geohash channels are bridged to Nostr as kind-1 notes at
+    /// post time, so the same notice arrives twice. The copies share content
+    /// and nickname but are signed by unlinkable keys; match them
+    /// heuristically by content + author within a time window.
+    static let bridgeDedupeWindow: TimeInterval = 15 * 60
+
+    /// Returns board posts and notes as one list, urgent posts first, then
+    /// newest first. Notes that look like bridged copies of a board post are
+    /// dropped — the board copy wins because it carries urgency and supports
+    /// merged deletion. The geohash must match exactly: the notes
+    /// subscription also surfaces neighboring cells, and a same-text note
+    /// from a neighbor is not the bridged copy.
+    static func merge(posts: [BoardPostPacket], notes: [LocationNotesManager.Note]) -> [NoticeItem] {
+        var items = posts.map(NoticeItem.init(post:))
+        for note in notes {
+            let noteNickname = note.nickname?.trimmedOrNilIfEmpty ?? "anon"
+            let isBridgedCopy = posts.contains { post in
+                post.geohash == note.geohash
+                    && post.content == note.content
+                    && (post.authorNickname.trimmedOrNilIfEmpty ?? "anon") == noteNickname
+                    && abs(Date(timeIntervalSince1970: TimeInterval(post.createdAt) / 1000).timeIntervalSince(note.createdAt)) <= bridgeDedupeWindow
+            }
+            if !isBridgedCopy {
+                items.append(NoticeItem(note: note))
+            }
+        }
+        return items.sorted {
+            if $0.isUrgent != $1.isUrgent { return $0.isUrgent }
+            return $0.createdAt > $1.createdAt
+        }
+    }
+}
@@ -67,6 +67,9 @@ final class LocationNotesManager: ObservableObject {
        let content: String
        let createdAt: Date
        let nickname: String?
+        /// The matched `g` tag: the cell the note was posted to, which can be
+        /// a neighbor of the subscribed geohash.
+        let geohash: String

        var displayName: String {
            let suffix = String(pubkey.suffix(4))
@@ -82,6 +85,8 @@ final class LocationNotesManager: ObservableObject {
    @Published private(set) var initialLoadComplete: Bool = false
    @Published private(set) var state: State = .loading
    @Published private(set) var errorMessage: String?
+    /// Public key of our per-geohash Nostr identity; identifies our own notes.
+    private var ownPubkey: String?
    private var subscriptionID: String?
    private var noteIDs = Set<String>() // O(1) duplicate detection
    private var directoryUpdateCancellable: AnyCancellable?
@@ -104,10 +109,10 @@ final class LocationNotesManager: ObservableObject {
        let norm = geohash.lowercased()
        self.geohash = norm
        self.dependencies = dependencies
-        // Validate geohash (building-level precision: 8 chars)
-        if !Geohash.isValidBuildingGeohash(norm) {
-            SecureLogger.warning("LocationNotesManager: invalid geohash '\(norm)' (expected 8 valid base32 chars)", category: .session)
+        if !Geohash.isValidGeohash(norm) {
+            SecureLogger.warning("LocationNotesManager: invalid geohash '\(norm)' (expected 1-12 valid base32 chars)", category: .session)
        }
+        ownPubkey = (try? dependencies.deriveIdentity(norm))?.publicKeyHex
        subscribe()
        // The relay directory may load after init (remote fetch over Tor);
        // retry automatically instead of staying stuck on "no relays".
@@ -123,9 +128,8 @@ final class LocationNotesManager: ObservableObject {
    func setGeohash(_ newGeohash: String) {
        let norm = newGeohash.lowercased()
        guard norm != geohash else { return }
-        // Validate geohash (building-level precision: 8 chars)
-        guard Geohash.isValidBuildingGeohash(norm) else {
-            SecureLogger.warning("LocationNotesManager: rejecting invalid geohash '\(norm)' (expected 8 valid base32 chars)", category: .session)
+        guard Geohash.isValidGeohash(norm) else {
+            SecureLogger.warning("LocationNotesManager: rejecting invalid geohash '\(norm)' (expected 1-12 valid base32 chars)", category: .session)
            return
        }
        if let sub = subscriptionID {
@@ -137,6 +141,7 @@ final class LocationNotesManager: ObservableObject {
        initialLoadComplete = false
        errorMessage = nil
        geohash = norm
+        ownPubkey = (try? dependencies.deriveIdentity(norm))?.publicKeyHex
        notes.removeAll()
        noteIDs.removeAll()
        subscribe()
@@ -193,14 +198,14 @@ final class LocationNotesManager: ObservableObject {
            guard let self = self else { return }
            guard event.kind == NostrProtocol.EventKind.textNote.rawValue else { return }
            // Ensure matching tag - accept any of our 9 geohashes
-            guard event.tags.contains(where: { tag in
+            guard let matchedGeohash = event.tags.first(where: { tag in
                tag.count >= 2 && tag[0].lowercased() == "g" && validGeohashes.contains(tag[1].lowercased())
-            }) else { return }
+            })?[1].lowercased() else { return }
            guard !self.noteIDs.contains(event.id) else { return }
            self.noteIDs.insert(event.id)
            let nick = event.tags.first(where: { $0.first?.lowercased() == "n" && $0.count >= 2 })?.dropFirst().first
            let ts = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-            let note = Note(id: event.id, pubkey: event.pubkey, content: event.content, createdAt: ts, nickname: nick)
+            let note = Note(id: event.id, pubkey: event.pubkey, content: event.content, createdAt: ts, nickname: nick, geohash: matchedGeohash)
            self.notes.append(note)
            self.notes.sort { $0.createdAt > $1.createdAt }
            self.enforceMemoryCap()
@@ -239,7 +244,8 @@ final class LocationNotesManager: ObservableObject {
                pubkey: id.publicKeyHex,
                content: trimmed,
                createdAt: Date(timeIntervalSince1970: TimeInterval(event.created_at)),
-                nickname: nickname
+                nickname: nickname,
+                geohash: geohash
            )
            self.noteIDs.insert(event.id)
            self.notes.insert(echo, at: 0)
@@ -252,6 +258,36 @@ final class LocationNotesManager: ObservableObject {
        }
    }

+    /// Whether the note was published by this device's identity for the
+    /// current geohash (and can therefore be deleted with NIP-09).
+    func isOwnNote(_ note: Note) -> Bool {
+        guard let ownPubkey else { return false }
+        return note.pubkey == ownPubkey
+    }
+
+    /// Requests NIP-09 deletion of one of our own notes and removes it locally.
+    @discardableResult
+    func delete(note: Note) -> Bool {
+        guard isOwnNote(note) else { return false }
+        let relays = dependencies.relayLookup(geohash, TransportConfig.nostrGeoRelayCount)
+        guard !relays.isEmpty else {
+            state = .noRelays
+            errorMessage = Strings.noRelays
+            return false
+        }
+        do {
+            let identity = try dependencies.deriveIdentity(geohash)
+            let deletion = try NostrProtocol.createDeleteEvent(ofEventID: note.id, senderIdentity: identity)
+            dependencies.sendEvent(deletion, relays)
+            // Keep the id in noteIDs so a relay replay can't resurrect it.
+            notes.removeAll { $0.id == note.id }
+            return true
+        } catch {
+            SecureLogger.error("LocationNotesManager: failed to delete note: \(error)", category: .session)
+            return false
+        }
+    }
+
    /// Enforces defensive memory cap on notes array (keeps newest).
    private func enforceMemoryCap() {
        if notes.count > maxNotesInMemory {