Improve mesh relaying, presence, and DM robustness; signed public msgs; reachability UI; quicker announces; store-and-forward (#527)

* Sign public broadcasts; verify relayed messages via persisted signing keys; keep scheduled relays in sparse graphs and speed their jitter; persist announce signing key for offline auth; add short backoff after disconnect errors to reduce reconnect thrash

* Add connected vs reachable model: retain peers after link drop, expire after reachability window; expose all peers in snapshots; compute isReachable in UI; add meshReachable state and sorting; avoid removing peers on link events; notify UI on stale removals

* ContentView: handle new .meshReachable connection state in header icon switch (exhaustive switch fix)

* Logs: tag relayed announces as 'Reachable via mesh' and annotate public message logs with (direct|mesh) path for easier field analysis

* Fix syntax error: remove stray else/log inserted into writeOrEnqueue; keep logs clean

* UI: use 'point.3.connected.trianglepath.dotted' for mesh-reachable; change people count to include connected+reachable (exclude Nostr-only)

* UI: switch to 'point.3.filled.connected.trianglepath.dotted' for mesh-reachable icons in list and header

* Reachability: reduce retention to 21s for all peers (verified and unverified) to minimize stale presence

* mesh DMs/acks: route to reachable peers; queue READ/DELIVERED until handshake; add Transport.isPeerReachable; UI: hide offline non-mutuals; DM header: better name fallback + show transport + encryption icons; fix NostrTransport conformance

* Verification sheet: compute encryption status and fingerprint using short mesh ID mapping (fix 'not encrypted/handshake' for DMs with stable key)

* Announce cadence: faster discovery (4s), sparse 15±4s, dense 30±8s; initial 0.6s; post-subscribe 50ms; min-force 150ms; maintenance 5s; proactive announces on handshake + recent-traffic nudge

* Relay: increase broadcast TTL cap in sparse graphs to 6; tighten jitter for handshake (10–35ms) and directed (20–60ms) relays

* Range/robustness: store-and-forward for directed packets (15s) with flush on new links + periodic; announces: no subset + afterglow re-announce on first-seen; adaptive scanning: force ON when <=2 neighbors or recent traffic

* Fix warnings: remove unused msgID and unused mutable var in directed spool flush

* Announces: TTL 7 (sparse only) via RelayController; no fanout subset for announces; neighbor-change rebroadcast of last 2–3 announces. Fragments: faster pacing (5ms global, 4ms directed).

* Peer list: real-time icon updates by publishing snapshots on connectivity checks; add unread message indicator (envelope) next to peers with unread DMs

* UI: unread envelope uses orange; hasUnreadMessages checks Nostr conv key for peers with known Nostr pubkeys (geohash DM consistency)

* Logs/robustness: debounce disconnect notifications (1.5s), debounce 'reconnected' logs (2s), add weak-link cooldown after timeouts on very weak RSSI (<= -90)

* Peer icons: faster, accurate reachability\n\n- Run connectivity checks every maintenance tick (5s)\n- Publish peer snapshots on central unsubscribe for instant UI refresh\n- Lower inactivity timeout to 8s and disconnect debounce to 0.9s\n- Gate reachability on mesh-attached (>=1 direct link); no links => no reachable peers\n- Keep 21s retention for verified/unverified, but only when attached to mesh\n\nImproves list responsiveness when walking out of range and prevents stale 'reachable' states when isolated.

---------

Co-authored-by: jack <jackjackbits@users.noreply.github.com>

bitchat/Identity/IdentityModels.swift

@@ -106,6 +106,8 @@ enum HandshakeState {
 struct CryptographicIdentity: Codable {
     let fingerprint: String     // SHA256 of public key
     let publicKey: Data         // Noise static public key
+    // Optional Ed25519 signing public key (used to authenticate public messages)
+    var signingPublicKey: Data? = nil
     let firstSeen: Date
     let lastHandshake: Date?
 }

bitchat/Identity/SecureIdentityStateManager.swift

@@ -229,6 +229,91 @@ class SecureIdentityStateManager {
             return cache.socialIdentities[fingerprint]
         }
     }
+
+    // MARK: - Cryptographic Identities
+
+    /// Insert or update a cryptographic identity and optionally persist its signing key and claimed nickname.
+    /// - Parameters:
+    ///   - fingerprint: SHA-256 hex of the Noise static public key
+    ///   - noisePublicKey: Noise static public key data
+    ///   - signingPublicKey: Optional Ed25519 signing public key for authenticating public messages
+    ///   - claimedNickname: Optional latest claimed nickname to persist into social identity
+    func upsertCryptographicIdentity(fingerprint: String, noisePublicKey: Data, signingPublicKey: Data?, claimedNickname: String? = nil) {
+        queue.async(flags: .barrier) {
+            let now = Date()
+            if var existing = self.cryptographicIdentities[fingerprint] {
+                // Update keys if changed
+                if existing.publicKey != noisePublicKey {
+                    existing = CryptographicIdentity(
+                        fingerprint: fingerprint,
+                        publicKey: noisePublicKey,
+                        signingPublicKey: signingPublicKey ?? existing.signingPublicKey,
+                        firstSeen: existing.firstSeen,
+                        lastHandshake: now
+                    )
+                    self.cryptographicIdentities[fingerprint] = existing
+                } else {
+                    // Update signing key and lastHandshake
+                    existing.signingPublicKey = signingPublicKey ?? existing.signingPublicKey
+                    let updated = CryptographicIdentity(
+                        fingerprint: existing.fingerprint,
+                        publicKey: existing.publicKey,
+                        signingPublicKey: existing.signingPublicKey,
+                        firstSeen: existing.firstSeen,
+                        lastHandshake: now
+                    )
+                    self.cryptographicIdentities[fingerprint] = updated
+                }
+                // Persist updated state (already assigned in branches above)
+            } else {
+                // New entry
+                let entry = CryptographicIdentity(
+                    fingerprint: fingerprint,
+                    publicKey: noisePublicKey,
+                    signingPublicKey: signingPublicKey,
+                    firstSeen: now,
+                    lastHandshake: now
+                )
+                self.cryptographicIdentities[fingerprint] = entry
+            }
+
+            // Optionally persist claimed nickname into social identity
+            if let claimed = claimedNickname {
+                var identity = self.cache.socialIdentities[fingerprint] ?? SocialIdentity(
+                    fingerprint: fingerprint,
+                    localPetname: nil,
+                    claimedNickname: claimed,
+                    trustLevel: .unknown,
+                    isFavorite: false,
+                    isBlocked: false,
+                    notes: nil
+                )
+                // Update claimed nickname if changed
+                if identity.claimedNickname != claimed {
+                    identity.claimedNickname = claimed
+                    self.cache.socialIdentities[fingerprint] = identity
+                } else if self.cache.socialIdentities[fingerprint] == nil {
+                    self.cache.socialIdentities[fingerprint] = identity
+                }
+            }
+
+            self.saveIdentityCache()
+        }
+    }
+
+    /// Retrieve cryptographic identity by fingerprint
+    func getCryptographicIdentity(for fingerprint: String) -> CryptographicIdentity? {
+        queue.sync { cryptographicIdentities[fingerprint] }
+    }
+
+    /// Find cryptographic identities whose fingerprint prefix matches a peerID (16-hex) short ID
+    func getCryptoIdentitiesByPeerIDPrefix(_ peerID: String) -> [CryptographicIdentity] {
+        queue.sync {
+            // Defensive: ensure hex and correct length
+            guard peerID.count == 16, peerID.allSatisfy({ $0.isHexDigit }) else { return [] }
+            return cryptographicIdentities.values.filter { $0.fingerprint.hasPrefix(peerID) }
+        }
+    }
     
     func getAllSocialIdentities() -> [SocialIdentity] {
         queue.sync {