Persist authenticated private-media delivery receipts (#1466)

Adds a durable receiver-side ledger (BLEPrivateMediaReceiptStore) mapping a deterministic private-media message ID — hash-bound to sender, recipient, and entropy-bearing filename — to the stored file before UI delivery and before the Noise-encrypted delivery ACK, so sender retries and relaunches cannot create duplicate bubbles or files. Receipts are unforgeable without the Noise session; capability bit 9 rides the existing announce bitfield (no wire-format change; rolling upgrade safe both directions).

Includes review fixes: corrupt receipt records are quarantined per-record (bytes preserved at <id>.json.corrupt, only that ID fail-closed — previously one bad record silently disabled ALL inbound private media forever); the panic reset now reaches BLEService's own store instance via completePanicReset with a production-wiring test; and both content.delivery.reason.* strings ship with full 30-locale coverage.

bitchatTests/ChatMediaTransferCoordinatorContextTests.swift

@@ -8,7 +8,7 @@
 // `ChatPrivateConversationCoordinatorContextTests` exemplars.
 //
 // Real file/codec work remains covered by `ChatMediaPreparationTests`. These
-// tests inject a paused voice-note preparer to exercise cancellation ownership
+// tests inject paused media preparers to exercise cancellation ownership
 // across the detached-preparation/MainActor boundary deterministically.
 //
 
@@ -89,7 +89,11 @@ private final class MockChatMediaTransferContext: ChatMediaTransferContext {
     }
 
     // Mesh file transfer
-    private(set) var privateFileSends: [(peerID: PeerID, transferId: String)] = []
+    private(set) var privateFileSends: [(
+        packet: BitchatFilePacket,
+        peerID: PeerID,
+        transferId: String
+    )] = []
     private(set) var privateFileLegacyAllowances: [Bool] = []
     private(set) var broadcastFileSends: [String] = []
     private(set) var cancelledTransfers: [String] = []
@@ -154,7 +158,7 @@ private final class MockChatMediaTransferContext: ChatMediaTransferContext {
         transferId: String,
         allowLegacyFallback: Bool
     ) {
-        privateFileSends.append((peerID, transferId))
+        privateFileSends.append((packet, peerID, transferId))
         privateFileLegacyAllowances.append(allowLegacyFallback)
     }
 
@@ -172,19 +176,8 @@ private final class PausedVoiceNotePreparer: @unchecked Sendable {
     private var started = false
     private var released = false
     private var finished = false
-    private let packet: BitchatFilePacket
 
-    init() {
-        let content = Data("voice".utf8)
-        packet = BitchatFilePacket(
-            fileName: "paused.m4a",
-            fileSize: UInt64(content.count),
-            mimeType: "audio/mp4",
-            content: content
-        )
-    }
-
-    func prepare(_: URL) throws -> BitchatFilePacket {
+    func prepare(_ url: URL) throws -> BitchatFilePacket {
         condition.lock()
         started = true
         condition.broadcast()
@@ -194,7 +187,13 @@ private final class PausedVoiceNotePreparer: @unchecked Sendable {
         finished = true
         condition.broadcast()
         condition.unlock()
-        return packet
+        let content = Data("voice".utf8)
+        return BitchatFilePacket(
+            fileName: url.lastPathComponent,
+            fileSize: UInt64(content.count),
+            mimeType: "audio/mp4",
+            content: content
+        )
     }
 
     var hasStarted: Bool {
@@ -452,6 +451,109 @@ struct ChatMediaTransferCoordinatorContextTests {
         #expect(coordinator.transferIdToMessageIDs.isEmpty)
     }
 
+    @Test @MainActor
+    func privateVoiceNoteUsesWireDerivableMessageID() async throws {
+        let context = MockChatMediaTransferContext()
+        let coordinator = ChatMediaTransferCoordinator(context: context)
+        let peerID = PeerID(str: "1122334455667788")
+        context.selectedPrivateChatPeer = peerID
+        let url = FileManager.default.temporaryDirectory
+            .appendingPathComponent("voice_receipt_\(UUID().uuidString).m4a")
+        try Data("voice".utf8).write(to: url)
+        defer { try? FileManager.default.removeItem(at: url) }
+
+        coordinator.sendVoiceNote(at: url)
+
+        #expect(await TestHelpers.waitUntil(
+            { context.privateFileSends.count == 1 },
+            timeout: TestConstants.longTimeout
+        ))
+        let message = try #require(context.privateChats[peerID]?.first)
+        let sentPacket = try #require(context.privateFileSends.first?.packet)
+        #expect(message.id == PrivateMediaMessageIdentity.stableID(
+            for: sentPacket,
+            senderPeerID: context.myPeerID,
+            recipientPeerID: peerID
+        ))
+    }
+
+    @Test @MainActor
+    func privateImageUsesWireDerivableMessageID() async throws {
+        let context = MockChatMediaTransferContext()
+        let coordinator = ChatMediaTransferCoordinator(context: context)
+        let peerID = PeerID(str: "99aabbccddeeff00")
+        context.selectedPrivateChatPeer = peerID
+        let sourceURL = try makeCoordinatorTestImageURL()
+        defer { try? FileManager.default.removeItem(at: sourceURL) }
+
+        coordinator.sendImage(from: sourceURL)
+
+        #expect(await TestHelpers.waitUntil(
+            { context.privateFileSends.count == 1 },
+            timeout: TestConstants.longTimeout
+        ))
+        let message = try #require(context.privateChats[peerID]?.first)
+        let sentPacket = try #require(context.privateFileSends.first?.packet)
+        #expect(message.id == PrivateMediaMessageIdentity.stableID(
+            for: sentPacket,
+            senderPeerID: context.myPeerID,
+            recipientPeerID: peerID
+        ))
+        coordinator.cleanupLocalFile(forMessage: message)
+    }
+
+    @Test @MainActor
+    func panicDuringImagePreparationDeletesStaleOutputWithoutSideEffects() async throws {
+        let context = MockChatMediaTransferContext()
+        let peerID = PeerID(str: "99aabbccddeeff00")
+        context.selectedPrivateChatPeer = peerID
+        let sourceURL = try makeCoordinatorTestImageURL()
+        let outputURL = FileManager.default.temporaryDirectory
+            .appendingPathComponent(
+                "panic-stale-image-\(UUID().uuidString).jpg"
+            )
+        let preparer = PausedImagePreparer(outputURL: outputURL)
+        let coordinator = ChatMediaTransferCoordinator(
+            context: context,
+            prepareImagePacket: { url in try preparer.prepare(url) }
+        )
+        defer {
+            preparer.release()
+            try? FileManager.default.removeItem(at: sourceURL)
+            try? FileManager.default.removeItem(at: outputURL)
+        }
+
+        coordinator.sendImage(from: sourceURL)
+        #expect(await TestHelpers.waitUntil(
+            { preparer.hasStarted },
+            timeout: TestConstants.longTimeout
+        ))
+
+        DispatchQueue.global(qos: .userInitiated).asyncAfter(
+            deadline: .now() + .milliseconds(100)
+        ) {
+            preparer.release()
+        }
+        coordinator.resetForPanic()
+
+        #expect(await TestHelpers.waitUntil(
+            { preparer.hasFinished },
+            timeout: TestConstants.longTimeout
+        ))
+        #expect(await TestHelpers.waitUntil(
+            { !FileManager.default.fileExists(atPath: outputURL.path) },
+            timeout: TestConstants.longTimeout
+        ))
+        #expect(context.privateChats[peerID]?.isEmpty != false)
+        #expect(context.appendedPublicMessages.isEmpty)
+        #expect(context.privateFileSends.isEmpty)
+        #expect(context.broadcastFileSends.isEmpty)
+        #expect(context.systemMessages.isEmpty)
+        #expect(context.deliveryStatusUpdates.isEmpty)
+        #expect(coordinator.transferIdToMessageIDs.isEmpty)
+        #expect(coordinator.messageIDToTransferId.isEmpty)
+    }
+
     @Test @MainActor
     func cancelVoiceNoteDuringDetachedPreparationCannotSendOrRestoreMapping() async throws {
         let context = MockChatMediaTransferContext()