Retry unacknowledged DMs after Noise replacement (#1462)

DMs sent through an established Noise session are retained in the durable MessageRouter outbox until an authenticated delivery/read ack, and retried under the same message ID when the peer's replacement handshake authenticates — fixing DMs silently lost into stale local sessions after a remote app restart. Mesh ack handling is peer-scoped end-to-end (alias-scoped delivery status, peer-bound markDelivered, PeerMessageKey retry state), so a colliding message ID from another conversation can no longer clear or promote foreign state; bridge-drop dedup keys are recipient-scoped with hashed persistence. Includes review fix: acks arriving after a relaunch (durable outbox restored, conversation not) now clear the peer-scoped router entry unconditionally — only the UI status transition is gated on conversation presence — so a delivered message can no longer re-send to the attempt cap and be marked failed despite delivery. Regression test simulates the relaunch through real store persistence; the dead allowedPeerIDs parameter (unscoped-tombstone trap) is removed.
2026-07-27 06:05:21 +00:00 · 2026-07-26 15:37:50 +02:00
parent a4d294015a
commit a1711bd399
17 changed files with 1519 additions and 126 deletions
@@ -1179,6 +1179,71 @@ struct ConversationStoreTests {
        #expect(statusChangedIDs.isEmpty)
    }

+    @Test("peer-scoped receipt updates only authenticated direct aliases")
+    @MainActor
+    func peerScopedReceiptUpdatesOnlyAuthenticatedDirectAliases() {
+        let store = ConversationStore()
+        let ephemeralPeer = PeerID(str: "0102030405060708")
+        let stablePeer = PeerID(hexData: Data(repeating: 0x08, count: 32))
+        let otherPeer = PeerID(str: "1112131415161718")
+        let ephemeral = ConversationID.directPeer(ephemeralPeer)
+        let stable = ConversationID.directPeer(stablePeer)
+        let other = ConversationID.directPeer(otherPeer)
+        let messageID = "scoped-receipt"
+        let mirrored = makeMessage(
+            id: messageID,
+            timestamp: 1,
+            isPrivate: true,
+            deliveryStatus: .sent
+        )
+        store.upsertByID(mirrored, in: ephemeral)
+        store.upsertByID(mirrored, in: stable)
+        store.upsertByID(
+            makeMessage(
+                id: messageID,
+                timestamp: 1,
+                isPrivate: true,
+                deliveryStatus: .sent
+            ),
+            in: other
+        )
+        store.upsertByID(
+            makeMessage(id: messageID, timestamp: 1, deliveryStatus: .sent),
+            in: .mesh
+        )
+
+        var cancellables = Set<AnyCancellable>()
+        var publishedIDs: [ConversationID] = []
+        for id in [ephemeral, stable, other, .mesh] {
+            store.conversation(for: id).objectWillChange
+                .sink { publishedIDs.append(id) }
+                .store(in: &cancellables)
+        }
+        var statusChangedIDs: [ConversationID] = []
+        store.changes
+            .sink { change in
+                if case .statusChanged(let id, messageID, _) = change,
+                   messageID == "scoped-receipt" {
+                    statusChangedIDs.append(id)
+                }
+            }
+            .store(in: &cancellables)
+
+        let delivered = DeliveryStatus.delivered(to: "bob", at: Date())
+        #expect(store.setDeliveryStatus(
+            delivered,
+            forMessageID: messageID,
+            inDirectPeerAliases: [ephemeralPeer, stablePeer]
+        ))
+
+        #expect(Set(publishedIDs) == Set([ephemeral, stable]))
+        #expect(Set(statusChangedIDs) == Set([ephemeral, stable]))
+        #expect(store.conversation(for: ephemeral).message(withID: messageID)?.deliveryStatus == delivered)
+        #expect(store.conversation(for: stable).message(withID: messageID)?.deliveryStatus == delivered)
+        #expect(store.conversation(for: other).message(withID: messageID)?.deliveryStatus == .sent)
+        #expect(store.conversation(for: .mesh).message(withID: messageID)?.deliveryStatus == .sent)
+    }
+
    // MARK: - Invariant audit (field observability)

    /// A store exercised through every intent family: public + geohash +