Courier: deposit in parallel when the only route is a send queue (#1368)

* Deposit with couriers in parallel when the only route is a send queue

The courier path was nearly unreachable: NostrTransport claims any
favorite with a known npub as "reachable" regardless of connectivity,
and the mesh favorite exchange shares npubs, so for essentially every
courier-eligible recipient the router picked Nostr's reachable branch.
With no internet the message just sat in the relay send queue — in the
flagship scenario (internet shutdown, mutual friend standing right
there) the courier walked away carrying nothing.

Add Transport.canDeliverPromptly(to:), defaulting to reachability for
radio-backed transports; NostrTransport answers honestly by mirroring
the relay manager's connection state (fail-closed behind Tor). When the
chosen transport can't hand the message off promptly, the router now
also deposits a sealed copy with connected couriers. Double delivery is
harmless: receivers dedup by message ID, and delivered/read acks never
downgrade the carried status. When relays are up, sends are trusted and
no courier quota is spent.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Track DM-relay connectivity, not any-relay, for prompt delivery

Codex review: NostrRelayManager.isConnected is true when any relay is
up, including geohash/custom relays — but private messages target the
default (gift-wrap-capable) relay set and queue when none of those are
connected. A lone geohash relay would have suppressed the parallel
courier deposit while the DM sat in the queue. Publish a DM-scoped
connectivity flag and drive canDeliverPromptly from it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

bitchatTests/EndToEnd/CourierEndToEndTests.swift

@@ -544,7 +544,16 @@ private final class CourierCaptureTransport: Transport {
     func isPeerConnected(_ peerID: PeerID) -> Bool {
         snapshots.contains { $0.peerID == peerID && $0.isConnected }
     }
-    func isPeerReachable(_ peerID: PeerID) -> Bool { isPeerConnected(peerID) }
+    // Nostr-style reachability: claimed for peers with no live link (known
+    // npub), where prompt delivery additionally needs a relay connection.
+    var reachablePeers: Set<PeerID> = []
+    var promptDelivery = true
+    func isPeerReachable(_ peerID: PeerID) -> Bool {
+        isPeerConnected(peerID) || reachablePeers.contains(peerID)
+    }
+    func canDeliverPromptly(to peerID: PeerID) -> Bool {
+        isPeerReachable(peerID) && promptDelivery
+    }
     func peerNickname(peerID: PeerID) -> String? { nil }
     func getPeerNicknames() -> [PeerID: String] { [:] }
 
@@ -652,4 +661,70 @@ struct MessageRouterCourierTests {
         #expect(transport.directSends == ["m3"])
         #expect(transport.courierSends.isEmpty)
     }
+
+    /// A peer can be "reachable" through a transport that cannot deliver
+    /// promptly (Nostr claims any favorite with a known npub, even with no
+    /// relay connection). The queued send must not shadow the courier: a
+    /// sealed copy goes to connected couriers in parallel, and receivers
+    /// dedup by message ID if both arrive.
+    @Test @MainActor
+    func queuedReachableSendAlsoDepositsWithCourier() {
+        let bobKey = Data(repeating: 0xB0, count: 32)
+        let bobID = PeerID(publicKey: bobKey)
+        let carolKey = Data(repeating: 0xC0, count: 32)
+        let carolID = PeerID(publicKey: carolKey)
+
+        let transport = CourierCaptureTransport()
+        transport.snapshots = [
+            TransportPeerSnapshot(peerID: carolID, nickname: "carol", isConnected: true, noisePublicKey: carolKey, lastSeen: Date())
+        ]
+        transport.reachablePeers = [bobID]
+        transport.promptDelivery = false
+
+        let directory = CourierDirectory(
+            noiseKey: { peerID in peerID == bobID ? bobKey : nil },
+            isTrustedCourier: { $0 == carolKey }
+        )
+        let router = MessageRouter(transports: [transport], courierDirectory: directory)
+        var carried: [String] = []
+        router.onMessageCarried = { messageID, _ in carried.append(messageID) }
+
+        router.sendPrivate("hi bob", to: bobID, recipientNickname: "bob", messageID: "m4")
+
+        #expect(transport.directSends == ["m4"])
+        #expect(transport.courierSends.count == 1)
+        #expect(transport.courierSends.first?.messageID == "m4")
+        #expect(transport.courierSends.first?.couriers == [carolID])
+        #expect(carried == ["m4"])
+    }
+
+    /// When the reachable transport can deliver promptly (relays up), the
+    /// send is trusted and no courier quota is spent.
+    @Test @MainActor
+    func promptlyDeliverableReachablePeerSkipsCourier() {
+        let bobKey = Data(repeating: 0xB0, count: 32)
+        let bobID = PeerID(publicKey: bobKey)
+        let carolKey = Data(repeating: 0xC0, count: 32)
+        let carolID = PeerID(publicKey: carolKey)
+
+        let transport = CourierCaptureTransport()
+        transport.snapshots = [
+            TransportPeerSnapshot(peerID: carolID, nickname: "carol", isConnected: true, noisePublicKey: carolKey, lastSeen: Date())
+        ]
+        transport.reachablePeers = [bobID]
+
+        let directory = CourierDirectory(
+            noiseKey: { peerID in peerID == bobID ? bobKey : nil },
+            isTrustedCourier: { $0 == carolKey }
+        )
+        let router = MessageRouter(transports: [transport], courierDirectory: directory)
+        var carried: [String] = []
+        router.onMessageCarried = { messageID, _ in carried.append(messageID) }
+
+        router.sendPrivate("hi bob", to: bobID, recipientNickname: "bob", messageID: "m5")
+
+        #expect(transport.directSends == ["m5"])
+        #expect(transport.courierSends.isEmpty)
+        #expect(carried.isEmpty)
+    }
 }