Close forged-directness link-rebind DoS on DM routing (#1421)

* Gate connected-link trust on a secure session; deny forged direct announces the connected shortcut

Residual gap after the rotation-heal containment (#1401): "verified
direct" announces prove the signature but not directness — TTL is
unsigned — so a malicious connected peer can replay a victim's fresh
announce with its TTL restored. When the victim has no live link, the
replayer's link rebinds to the victim's ID and reads as "connected",
and MessageRouter's connected fast-path then trusts it outright: every
DM stalls on a Noise handshake the replayer can never complete and is
silently lost while showing "sent".

Router-level trust gate (no wire change):
- Transport gains canDeliverSecurely(to:) — BLE answers with an
  established Noise session; Nostr keeps its prompt-delivery predicate;
  the protocol default forwards to canDeliverPromptly for transports
  without a forgeable link layer.
- MessageRouter.sendPrivate only trusts a connected link outright when
  it can deliver securely; otherwise it still sends (kicking the
  handshake on a genuine link) but retains a copy and hands a sealed
  copy to couriers, like the reachable path. flushOutbox gets the same
  gate so a flush over an insecure link resends instead of dropping the
  retained copy.

Presence hardening (defense in depth): a "direct" announce arriving on
a link already bound to a different peer no longer shortcuts the
claimed peer into "connected" — only real link state does. Genuine
first-contact and direct announces are unaffected; only the ambiguous
heal path loses the forgeable shortcut.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Harden the insecure-link outbox bound; document the second-replay presence gap and the courier metadata tradeoff

Review follow-ups on the canDeliverSecurely gate:

- flushOutbox no longer counts connected-but-insecure flushes toward the
  maxSendAttempts drop: the message was actually transmitted over a live
  link, so a peer whose Noise handshake stalls across reconnect flapping
  must not burn through the cap and lose the store-and-forward copy the
  gate exists to preserve. Retention stays bounded by the 24h outbox TTL
  and the per-peer FIFO cap; acks still clear it. Attempt-counting stays
  for reachable-only (heuristic) sends. Regression test: >8 connected-
  insecure flushes keep the retained copy, drop callback never fires.

- Document the known second-replay presence gap: linkBoundToOtherPeer
  reads the binding before rebindLinkAfterVerifiedDirectAnnounce steals
  the link, so once a first replay has rebound a link to an absent
  victim's ID, a second replay marks the victim connected. Presence
  display only — DMs stay on the retain+courier path via the router
  gate. Not closed at the announce layer because the post-rebind state
  is indistinguishable from a legitimate rotation/reconnect heal (a
  supported, field-verified flow). Covered by a two-announce test.

- Note the accepted courier-spray metadata tradeoff at the connected-
  insecure send: nearby verified peers receive a sealed copy (they learn
  a DM exists, never its content), cleared on ack.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Promote a healed rotation to connected; normalize the secure-delivery probe; retain Codable properties in Periphery

Codex review follow-ups on 5017c232:

- P1: a legitimate rotation announce necessarily arrives on a link still
  bound to the OLD peer ID, so the linkBoundToOtherPeer denial stored the
  new identity as disconnected — and the rebind only fixed link state,
  never the registry. A healed rotation then read as disconnected until
  the peer happened to announce again. rebindLinkAfterVerifiedDirect-
  Announce now promotes the rebound identity to connected after the
  containment checks pass (registry markConnected + topology/snapshot/
  peer-list refresh; the .peerConnected UI event already fired from the
  announce path). This consciously moves the forged-presence residue
  from second-replay to first-successful-rebind — bounded by the rebind
  containment (never steals a live identity, one rebind per link per
  cooldown) and still display-only: DMs stay gated on canDeliverSecurely.
  Comments and the pinned tests updated; new regression test covers
  rotate-on-open-link -> rebind -> isPeerConnected(new) == true.

- P2: BLEService.canDeliverSecurely probed the Noise session with the
  peer ID as given, but sessions are keyed by the short wire ID — a send
  keyed by the full 64-hex Noise key (favorites resolution) misread an
  established session as insecure and needlessly retained + couriered
  every DM until ack. Normalize with toShort() like isPeerConnected.
  Test drives a real XX handshake and asserts both ID forms pass.

- Periphery: the PrekeyBundleStore.StoredBundle.noiseKey "assign-only"
  flake fired again and slipped past its baselined USR (read exists in
  loadFromDisk; the indexer intermittently misses it). Replace the
  baseline entry with retain_codable_properties: true — deterministic,
  and a truly-dead Codable field is a persisted-format change anyway.
  Local periphery scan --strict: no unused code detected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

bitchatTests/BLEServiceCoreTests.swift

@@ -253,6 +253,144 @@ struct BLEServiceCoreTests {
         #expect(ble.currentPeerSnapshots().map(\.peerID).contains(attackerPeerID))
     }
 
+    @Test
+    func replayedDirectAnnounceForAbsentPeerNeverYieldsSecureDelivery() async throws {
+        // Residual heal-path gap: the victim has NO live link, so the
+        // identity-owns-a-link containment cannot refuse the rebind. The
+        // replay steals the link binding, and because a successful rebind
+        // promotes its new owner to connected (a legitimate rotation heal
+        // requires that), the absent victim may read as connected. That
+        // forged presence is display-only and accepted — the invariant that
+        // holds is that the stolen link can never produce an established
+        // Noise session, so MessageRouter's canDeliverSecurely gate routes
+        // DMs through retain + courier instead of trusting it outright.
+        let ble = makeService()
+        let attackerPeerID = PeerID(str: "1122334455667788")
+        let attackerLink = "central-attacker-absent-victim"
+        ble._test_seedConnectedPeer(attackerPeerID, nickname: "attacker")
+        ble._test_bindCentral(attackerLink, to: attackerPeerID)
+
+        // The absent victim's fresh signed announce, replayed on the
+        // attacker's bound link with its direct TTL restored.
+        let victimSigner = NoiseEncryptionService(keychain: MockKeychain())
+        let announcement = AnnouncementPacket(
+            nickname: "victim",
+            noisePublicKey: victimSigner.getStaticPublicKeyData(),
+            signingPublicKey: victimSigner.getSigningPublicKeyData(),
+            directNeighbors: nil
+        )
+        let payload = try #require(announcement.encode(), "Failed to encode announcement")
+        let victimPeerID = PeerID(publicKey: announcement.noisePublicKey)
+        let unsigned = BitchatPacket(
+            type: MessageType.announce.rawValue,
+            senderID: Data(hexString: victimPeerID.id) ?? Data(),
+            recipientID: nil,
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
+            payload: payload,
+            signature: nil,
+            ttl: 7
+        )
+        let packet = try #require(victimSigner.signPacket(unsigned), "Failed to sign announce packet")
+
+        #expect(ble._test_recordIngressIfNew(packet: packet, linkID: attackerLink))
+        ble._test_handlePacket(packet, fromPeerID: victimPeerID, preseedPeer: false)
+
+        // The rebind steals the link (no live link owns the victim's
+        // identity, so containment cannot refuse) …
+        let rebound = await TestHelpers.waitUntil(
+            { ble._test_centralBinding(attackerLink) == victimPeerID },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(rebound)
+        // … and the promote marks the absent victim connected: the accepted,
+        // display-only forged-presence residue (documented at
+        // BLEAnnounceHandler's linkBoundToOtherPeer check) …
+        let forgedPresence = await TestHelpers.waitUntil(
+            { ble.isPeerConnected(victimPeerID) },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(forgedPresence)
+        // … but secure delivery stays impossible — the DM gate holds, and
+        // MessageRouter retains + couriers instead of trusting the link.
+        #expect(!ble.canDeliverSecurely(to: victimPeerID))
+    }
+
+    /// A legitimate rotation announce necessarily arrives on a link still
+    /// bound to the OLD ID, so its registry upsert stores the new peer
+    /// disconnected. The successful rebind must promote it: a healed
+    /// rotation with a live link has to read as connected again for routing
+    /// and outbox flushes.
+    @Test
+    func rotationHealPromotesRotatedPeerToConnected() async throws {
+        let ble = makeService()
+        let oldPeerID = PeerID(str: "1122334455667788")
+        let centralUUID = "central-rotation-promote"
+
+        ble._test_seedConnectedPeer(oldPeerID, nickname: "alice")
+        ble._test_bindCentral(centralUUID, to: oldPeerID)
+
+        let signer = NoiseEncryptionService(keychain: MockKeychain())
+        let announcement = AnnouncementPacket(
+            nickname: "alice",
+            noisePublicKey: signer.getStaticPublicKeyData(),
+            signingPublicKey: signer.getSigningPublicKeyData(),
+            directNeighbors: nil
+        )
+        let payload = try #require(announcement.encode(), "Failed to encode announcement")
+        let newPeerID = PeerID(publicKey: announcement.noisePublicKey)
+        let unsigned = BitchatPacket(
+            type: MessageType.announce.rawValue,
+            senderID: Data(hexString: newPeerID.id) ?? Data(),
+            recipientID: nil,
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
+            payload: payload,
+            signature: nil,
+            ttl: 7
+        )
+        let packet = try #require(signer.signPacket(unsigned), "Failed to sign announce packet")
+
+        #expect(ble._test_recordIngressIfNew(packet: packet, linkID: centralUUID))
+        ble._test_handlePacket(packet, fromPeerID: newPeerID, preseedPeer: false)
+
+        let rebound = await TestHelpers.waitUntil(
+            { ble._test_centralBinding(centralUUID) == newPeerID },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(rebound)
+
+        let connected = await TestHelpers.waitUntil(
+            { ble.isPeerConnected(newPeerID) },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(connected)
+    }
+
+    /// Noise sessions are keyed by the short wire ID, but routers may key
+    /// sends by the full 64-hex Noise key (favorites resolution does). The
+    /// secure-delivery gate must normalize like isPeerConnected, or an
+    /// established session is misread as insecure and every DM needlessly
+    /// retains + couriers until an ack.
+    @Test
+    func canDeliverSecurelyNormalizesFullNoiseKeyPeerIDs() async throws {
+        let ble = makeService()
+        let remote = NoiseEncryptionService(keychain: MockKeychain())
+        let remoteKey = remote.getStaticPublicKeyData()
+        let shortID = PeerID(publicKey: remoteKey)
+        let fullKeyID = PeerID(hexData: remoteKey)
+        #expect(fullKeyID.toShort() == shortID)
+        #expect(!ble.canDeliverSecurely(to: shortID))
+
+        // Full XX handshake; the local side keys the session by the short
+        // wire ID, exactly as packets present it in production.
+        let m1 = try ble._test_noiseInitiateHandshake(with: shortID)
+        let m2 = try #require(try remote.processHandshakeMessage(from: ble.myPeerID, message: m1))
+        let m3 = try #require(try ble._test_noiseProcessHandshakeMessage(from: shortID, message: m2))
+        _ = try remote.processHandshakeMessage(from: ble.myPeerID, message: m3)
+
+        #expect(ble.canDeliverSecurely(to: shortID))
+        #expect(ble.canDeliverSecurely(to: fullKeyID))
+    }
+
     @Test
     func ingressRejectsSelfLoopbackBeforeSpoofChecks() async throws {
         let ble = makeService()