Discard deferred Noise ciphertext during panic

bitchat/Noise/NoiseSecurityConstants.swift

@@ -36,6 +36,30 @@ enum NoiseSecurityConstants {
 
     // Noise XX message 1 contains only the initiator's 32-byte ephemeral key.
     static let xxInitialMessageSize = 32
+
+    // Bounds an ordinary initiator whose message 1 or 2 is lost.
+    static let ordinaryHandshakeTimeout: TimeInterval = 10
+
+    // Bounds the receive-only rollback quarantine created by an unauthenticated
+    // inbound message 1. A lost message 3 must not strand outbound traffic.
+    static let ordinaryResponderHandshakeTimeout: TimeInterval = 20
+
+    // A released client may immediately retry after both crossed initiators
+    // yielded. Give that unilateral retry a brief head start before the
+    // patched side spends its one bounded recovery.
+    static let handshakeCollisionRecoveryDelay: TimeInterval = 0.2
+
+    // Rate-limited recovery remains actionable without spinning.
+    static let handshakeRateLimitRecoveryDelay: TimeInterval = 60
+
+    // Covers only reordering between a winning message 3 and the losing
+    // crossed message 1.
+    static let recentInitiatorCompletionGracePeriod: TimeInterval = 1
+
+    // After unauthenticated responder rollback, reject another attempt long
+    // enough that paced message 1 traffic cannot keep outbound paused. A
+    // legitimate peer converges through the one manager-owned local retry.
+    static let ordinaryReconnectRollbackCooldown: TimeInterval = 60
     
     // Session timeout - sessions older than this should be renegotiated
     static let sessionTimeout: TimeInterval = 86400 // 24 hours

bitchat/Noise/NoiseSessionError.swift

@@ -13,3 +13,9 @@ enum NoiseSessionError: Error, Equatable {
     case alreadyEstablished
     case peerIdentityMismatch
 }
+
+/// The manager owns the exact attempt's one bounded recovery. Packet handling
+/// must not launch its historical second, immediate restart for this failure.
+struct NoiseManagedHandshakeFailure: Error {
+    let underlying: Error
+}

bitchat/Services/BLE/BLENoisePacketHandler.swift

@@ -1,5 +1,6 @@
 import BitFoundation
 import BitLogger
+import CryptoKit
 import Foundation
 
 struct BLENoiseHandshakeHandlingResult {
@@ -33,6 +34,8 @@ struct BLENoisePacketHandlerEnvironment {
             -> NoiseHandshakeProcessingResult
     /// Whether any Noise session (established or pending) exists for the peer (crypto).
     let hasNoiseSession: (PeerID) -> Bool
+    /// Whether an inbound ordinary XX responder is waiting for message 3.
+    let isAwaitingResponderHandshakeCompletion: (PeerID) -> Bool
     /// Initiates a fresh Noise handshake with the peer (crypto + send).
     let initiateHandshake: (PeerID) -> Void
     /// Broadcasts a packet on the mesh (caller is already on the message queue).
@@ -63,15 +66,36 @@ struct BLENoisePacketHandlerEnvironment {
 /// processing (with response), encrypted payload decryption and dispatch,
 /// and session recovery on decrypt failure.
 final class BLENoisePacketHandler {
+    private struct DeferredCiphertext {
+        let packet: BitchatPacket
+        let receivedAt: Date
+    }
+
+    /// Early post-handshake packets are normally tiny control messages or
+    /// queued DMs. Keep the recovery surface deliberately small so an
+    /// unauthenticated half-handshake cannot create an unbounded memory queue.
+    private static let maxDeferredPacketsPerPeer = 4
+    private static let maxDeferredPacketsGlobal = 32
+    /// One legacy sender can immediately follow message 3 with the largest
+    /// valid private-file ciphertext and has no application-level retry. Keep
+    /// room for that packet plus a small control-message budget.
+    private static let maxDeferredBytes =
+        NoiseSecurityConstants.maxPrivateFileCiphertextSize + 256 * 1024
+    private static let deferredLifetime =
+        NoiseSecurityConstants.ordinaryResponderHandshakeTimeout
+
     private let environment: BLENoisePacketHandlerEnvironment
+    private let deferredLock = NSLock()
+    private var deferredCiphertexts: [PeerID: [DeferredCiphertext]] = [:]
+    private var deferredCiphertextBytes = 0
 
     init(environment: BLENoisePacketHandlerEnvironment) {
         self.environment = environment
     }
 
     /// Returns true when the handshake message was processed successfully.
-    /// Callers use this to distinguish an authenticated replacement completion
-    /// from a rejected candidate while an older session remains established.
+    /// Callers use this to distinguish an authenticated reconnect completion
+    /// from a rejected ordinary responder while rollback state is restored.
     @discardableResult
     func handleHandshake(_ packet: BitchatPacket, from peerID: PeerID) -> Bool {
         handleHandshakeWithResult(packet, from: peerID).processed
@@ -105,15 +129,23 @@ final class BLENoisePacketHandler {
                     env.broadcastPacket(responsePacket)
                 }
 
-                // Session establishment will trigger onPeerAuthenticated callback
-                // which will send any pending messages at the right time
+                // The serialized authentication callback installs transport
+                // state before it drains any bounded early ciphertext.
                 return BLENoiseHandshakeHandlingResult(
                     processed: true,
                     didEstablishAuthenticatedSession:
                         result.didEstablishAuthenticatedSession
                 )
+            } catch let managedFailure as NoiseManagedHandshakeFailure {
+                SecureLogger.error(
+                    "Failed to process handshake; manager owns recovery: \(managedFailure.underlying)"
+                )
+                return BLENoiseHandshakeHandlingResult(
+                    processed: false,
+                    didEstablishAuthenticatedSession: false
+                )
             } catch NoiseSessionError.peerIdentityMismatch {
-                // The candidate was already discarded by the session manager.
+                // The responder was already discarded by the session manager.
                 // Do not let a spoofed claimed ID trigger a fresh outbound
                 // handshake or recreate state for the attacker-selected ID.
                 SecureLogger.warning(
@@ -143,6 +175,30 @@ final class BLENoisePacketHandler {
     }
 
     func handleEncrypted(_ packet: BitchatPacket, from peerID: PeerID) {
+        handleEncrypted(packet, from: peerID, isDeferredRetry: false)
+    }
+
+    /// Called by the transport's serialized authentication callback after it
+    /// has installed state for the promoted or restored session generation.
+    func handleSessionAuthenticated(_ peerID: PeerID) {
+        drainDeferredCiphertextsIfReady(for: peerID)
+    }
+
+    /// Synchronously discards ciphertext retained for a pre-panic Noise
+    /// generation. The handler survives the service's identity replacement,
+    /// so keeping this queue would replay old bytes after post-panic auth.
+    func resetForPanic() {
+        deferredLock.lock()
+        deferredCiphertexts.removeAll(keepingCapacity: false)
+        deferredCiphertextBytes = 0
+        deferredLock.unlock()
+    }
+
+    private func handleEncrypted(
+        _ packet: BitchatPacket,
+        from peerID: PeerID,
+        isDeferredRetry: Bool
+    ) {
         let env = environment
         guard let recipientID = PeerID(hexData: packet.recipientID) else {
             SecureLogger.warning("⚠️ Encrypted message has no recipient ID", category: .session)
@@ -184,19 +240,205 @@ final class BLENoisePacketHandler {
 
             let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
             env.deliverNoisePayload(peerID, noisePayloadType, Data(payloadData), ts)
+        } catch NoiseEncryptionError.transportGenerationNotReady {
+            if isDeferredRetry {
+                SecureLogger.warning(
+                    "Dropping deferred Noise ciphertext from \(peerID.id.prefix(8))… because its authenticated transport generation changed again",
+                    category: .session
+                )
+                return
+            }
+            // The manager promoted or restored keys before BLE's serialized
+            // callback installed generation-bound transport state. The
+            // manager rejected this before decrypting, so replay is safe.
+            deferCiphertext(packet, from: peerID)
         } catch NoiseEncryptionError.sessionNotEstablished {
+            if isDeferredRetry {
+                SecureLogger.warning(
+                    "Dropping deferred Noise ciphertext from \(peerID.id.prefix(8))… because the authenticated session is unavailable",
+                    category: .session
+                )
+                return
+            }
             // We received an encrypted message before establishing a session with this peer.
-            // Trigger a handshake so future messages can be decrypted.
+            // An initiator may already have sent message 3 followed by this
+            // ciphertext, with BLE delivering the ciphertext first.
+            if env.isAwaitingResponderHandshakeCompletion(peerID) {
+                deferCiphertext(packet, from: peerID)
+                return
+            }
+            // Otherwise trigger a handshake so future messages can decrypt.
             SecureLogger.debug("🔑 Encrypted message from \(peerID.id.prefix(8))… without session; initiating handshake")
             if !env.hasNoiseSession(peerID) {
                 env.initiateHandshake(peerID)
             }
         } catch {
+            if isDeferredRetry {
+                // An early packet cannot tear down the authenticated session
+                // merely because its single bounded retry still fails.
+                SecureLogger.warning(
+                    "Dropping deferred Noise ciphertext from \(peerID.id.prefix(8))… after retry failed: \(error)",
+                    category: .session
+                )
+                return
+            }
+            // A responder may retain an older transport as receive-only
+            // rollback state while ordinary XX waits for message 3. New-key
+            // ciphertext can fail against those retained receive keys first.
+            if env.isAwaitingResponderHandshakeCompletion(peerID) {
+                if isDeferrableEarlyHandshakeFailure(error) {
+                    deferCiphertext(packet, from: peerID)
+                } else {
+                    SecureLogger.warning(
+                        "Dropping invalid Noise ciphertext from \(peerID.id.prefix(8))… while responder handshake is completing: \(error)",
+                        category: .session
+                    )
+                }
+                return
+            }
+            if isDropOnlyCiphertextFailure(error) {
+                // The packet is attacker-controlled and did not prove a
+                // transport-state failure. Never let malformed, replayed,
+                // forged, oversized, or rate-limited bytes evict working keys.
+                SecureLogger.warning(
+                    "Dropping rejected Noise ciphertext from \(peerID.id.prefix(8))… without clearing its session: \(error)",
+                    category: .security
+                )
+                return
+            }
             // Decryption failed - clear the corrupted session and re-initiate handshake
-            // This handles cases where session state got out of sync (nonce mismatch, etc.)
+            // Only local/session lifecycle failures reach this path.
             SecureLogger.error("❌ Failed to decrypt message from \(peerID.id.prefix(8))…: \(error) - clearing session and re-initiating handshake")
             env.clearSession(peerID)
             env.initiateHandshake(peerID)
         }
     }
+
+    private func isDeferrableEarlyHandshakeFailure(_ error: Error) -> Bool {
+        if let noiseError = error as? NoiseError {
+            switch noiseError {
+            case .authenticationFailure, .replayDetected:
+                return true
+            default:
+                return false
+            }
+        }
+        if let cryptoError = error as? CryptoKitError,
+           case .authenticationFailure = cryptoError {
+            return true
+        }
+        return false
+    }
+
+    private func isDropOnlyCiphertextFailure(_ error: Error) -> Bool {
+        if let securityError = error as? NoiseSecurityError {
+            switch securityError {
+            case .messageTooLarge, .rateLimitExceeded, .invalidPeerID:
+                return true
+            case .sessionExpired, .sessionExhausted:
+                return false
+            }
+        }
+        if let noiseError = error as? NoiseError {
+            switch noiseError {
+            case .invalidCiphertext, .authenticationFailure, .replayDetected:
+                return true
+            case .uninitializedCipher, .handshakeComplete,
+                    .handshakeNotComplete, .missingLocalStaticKey,
+                    .missingKeys, .invalidMessage, .invalidPublicKey,
+                    .nonceExceeded:
+                return false
+            }
+        }
+        return error is CryptoKitError
+    }
+
+    private func deferCiphertext(_ packet: BitchatPacket, from peerID: PeerID) {
+        guard NoiseSecurityValidator.validatePrivateFileCiphertextSize(
+            packet.payload
+        ) else {
+            SecureLogger.warning(
+                "Dropping oversized early Noise ciphertext from \(peerID.id.prefix(8))…",
+                category: .security
+            )
+            return
+        }
+
+        let now = environment.now()
+        deferredLock.lock()
+        defer { deferredLock.unlock() }
+        purgeExpiredCiphertextsLocked(now: now)
+
+        let peerCount = deferredCiphertexts[peerID]?.count ?? 0
+        let globalCount = deferredCiphertexts.values.reduce(0) {
+            $0 + $1.count
+        }
+        guard peerCount < Self.maxDeferredPacketsPerPeer,
+              globalCount < Self.maxDeferredPacketsGlobal,
+              deferredCiphertextBytes + packet.payload.count
+                <= Self.maxDeferredBytes else {
+            SecureLogger.warning(
+                "Dropping early Noise ciphertext from \(peerID.id.prefix(8))… because the handshake buffer is full",
+                category: .security
+            )
+            return
+        }
+
+        deferredCiphertexts[peerID, default: []].append(
+            DeferredCiphertext(packet: packet, receivedAt: now)
+        )
+        deferredCiphertextBytes += packet.payload.count
+        SecureLogger.debug(
+            "Deferring early Noise ciphertext from \(peerID.id.prefix(8))… until responder handshake completion",
+            category: .session
+        )
+    }
+
+    private func drainDeferredCiphertextsIfReady(for peerID: PeerID) {
+        let env = environment
+        guard !env.isAwaitingResponderHandshakeCompletion(peerID),
+              env.hasNoiseSession(peerID) else {
+            return
+        }
+
+        let now = env.now()
+        deferredLock.lock()
+        purgeExpiredCiphertextsLocked(now: now)
+        let deferred = deferredCiphertexts.removeValue(forKey: peerID) ?? []
+        deferredCiphertextBytes -= deferred.reduce(0) {
+            $0 + $1.packet.payload.count
+        }
+        deferredLock.unlock()
+
+        guard !deferred.isEmpty else { return }
+        SecureLogger.debug(
+            "Retrying \(deferred.count) early Noise ciphertext packet(s) from \(peerID.id.prefix(8))… after handshake completion",
+            category: .session
+        )
+        for item in deferred {
+            handleEncrypted(item.packet, from: peerID, isDeferredRetry: true)
+        }
+    }
+
+    private func purgeExpiredCiphertextsLocked(now: Date) {
+        for peerID in Array(deferredCiphertexts.keys) {
+            guard let items = deferredCiphertexts[peerID] else { continue }
+            let retained = items.filter {
+                now.timeIntervalSince($0.receivedAt) <= Self.deferredLifetime
+            }
+            guard retained.count != items.count else { continue }
+
+            deferredCiphertextBytes -= items.reduce(0) {
+                $0 + $1.packet.payload.count
+            }
+            deferredCiphertextBytes += retained.reduce(0) {
+                $0 + $1.packet.payload.count
+            }
+            if retained.isEmpty {
+                deferredCiphertexts.removeValue(forKey: peerID)
+            } else {
+                deferredCiphertexts[peerID] = retained
+            }
+        }
+    }
 }

bitchat/Services/BLE/BLENoiseReconnectPolicy.swift

@@ -0,0 +1,40 @@
+import Foundation
+
+/// Bounds ordinary Noise revalidation to one attempt per physical-link epoch.
+/// A live epoch may retry after the cooldown so a lost handshake cannot leave
+/// the link permanently unauthenticated.
+struct BLENoiseReconnectPolicy {
+    static let minimumRetryInterval: TimeInterval = 60
+
+    private var lastAttemptAt: [BLEIngressLinkID: Date] = [:]
+
+    mutating func shouldRevalidate(
+        on link: BLEIngressLinkID,
+        hasEstablishedSession: Bool,
+        isNoiseAuthenticatedLink: Bool,
+        hasAuthenticatedPeerLink: Bool,
+        now: Date
+    ) -> Bool {
+        guard hasEstablishedSession,
+              !isNoiseAuthenticatedLink,
+              !hasAuthenticatedPeerLink else {
+            return false
+        }
+        if let previous = lastAttemptAt[link],
+           now.timeIntervalSince(previous) < Self.minimumRetryInterval {
+            return false
+        }
+        lastAttemptAt[link] = now
+        return true
+    }
+
+    /// Link identifiers can be stable across CoreBluetooth reconnects, so a
+    /// disconnect explicitly starts a new epoch and permits one fresh attempt.
+    mutating func endLinkEpoch(_ link: BLEIngressLinkID) {
+        lastAttemptAt.removeValue(forKey: link)
+    }
+
+    mutating func removeAll() {
+        lastAttemptAt.removeAll()
+    }
+}

bitchat/Services/BLE/BLEService.swift

@@ -241,6 +241,7 @@ final class BLEService: NSObject {
     // that the session was established *on this current ingress link*, not
     // merely that some session exists for the claimed ID. bleQueue-owned.
     private var noiseAuthenticatedLinkOwners: [BLEIngressLinkID: PeerID] = [:]
+    private var noiseReconnectPolicy = BLENoiseReconnectPolicy()
 
     // Rotation-rebind cooldown per link UUID (bleQueue-owned, like the link
     // store): entries older than the cooldown are pruned on insert.
@@ -311,6 +312,9 @@ final class BLEService: NSObject {
     /// May block in tests to hold the serial message queue immediately before
     /// the deferred private-media admission check.
     var _test_beforePrivateMediaDeferredSend: ((String) -> Void)?
+    /// May block announce handling after verified-link rebind work is queued.
+    /// Tests use this boundary to prove rebind and reconnect are serialized.
+    var _test_afterVerifiedDirectRebindEnqueued: (() -> Void)?
     #endif
     private var selfBroadcastTracker = BLESelfBroadcastTracker()
     private let meshTopology = MeshTopologyTracker()
@@ -703,6 +707,7 @@ final class BLEService: NSObject {
     /// or advertising while the full panic transaction is incomplete.
     func suspendForPanicReset() {
         setPanicSuspended(true)
+        noisePacketHandler.resetForPanic()
         gossipSyncManager?.stop()
         gossipSyncManager = nil
         // Stop the radio and drain CoreBluetooth's delegate queue first. A
@@ -713,7 +718,11 @@ final class BLEService: NSObject {
         // Drain every receive/send submitted by callbacks that finished ahead
         // of the radio stop. Later callbacks observe the closed lifecycle, and
         // generation-bound handoffs that raced this barrier reject themselves.
-        messageQueue.sync(flags: .barrier) {}
+        // Clear the old identity's bounded early-ciphertext queue again after
+        // those callbacks drain so none can repopulate it after the first wipe.
+        messageQueue.sync(flags: .barrier) {
+            noisePacketHandler.resetForPanic()
+        }
         clearEmergencySessionState()
     }
 
@@ -732,6 +741,7 @@ final class BLEService: NSObject {
         gossipSyncManager?.stop()
         gossipSyncManager = nil
         messageQueue.sync(flags: .barrier) {
+            noisePacketHandler.resetForPanic()
             pendingNoiseSessionQueues.removeAll()
         }
 
@@ -764,6 +774,8 @@ final class BLEService: NSObject {
 
         bleQueue.sync {
             pendingWriteBuffers.removeAll()
+            noiseAuthenticatedLinkOwners.removeAll()
+            noiseReconnectPolicy.removeAll()
             connectionScheduler.reset()
         }
         disconnectNotifyDebouncer.removeAll()
@@ -1061,6 +1073,7 @@ final class BLEService: NSObject {
         bleQueue.sync {
             linkStateStore.clearAll()
             noiseAuthenticatedLinkOwners.removeAll()
+            noiseReconnectPolicy.removeAll()
             connectionScheduler.reset()
             subscriptionAnnounceLimiter.removeAll()
         }
@@ -2617,6 +2630,7 @@ final class BLEService: NSObject {
             }
             for link in departedLinks {
                 noiseAuthenticatedLinkOwners.removeValue(forKey: link)
+                noiseReconnectPolicy.endLinkEpoch(link)
             }
         }
         _ = collectionsQueue.sync(flags: .barrier) {
@@ -2929,14 +2943,21 @@ extension BLEService: CBCentralManagerDelegate {
             startScanning()
 
         case .poweredOff:
-            // Bluetooth was turned off - stop scanning and clean up connection state
+            // CoreBluetooth has already transitioned out of poweredOn. Do
+            // not issue stop/cancel commands now; they are rejected as API
+            // misuse. Retire our link state locally instead.
             SecureLogger.info("📴 Bluetooth powered off - cleaning up central state", category: .session)
-            central.stopScan()
-            // Mark all peripheral connections as disconnected (they are now invalid)
             let peripheralStates = linkStateStore.peripheralStates
             let peerIDs: [PeerID] = peripheralStates.compactMap(\.peerID)
             for state in peripheralStates {
-                central.cancelPeripheralConnection(state.peripheral)
+                let peripheralID = state.peripheral.identifier.uuidString
+                collectionsQueue.sync(flags: .barrier) {
+                    pendingPeripheralWrites.discardAll(for: peripheralID)
+                }
+                noiseAuthenticatedLinkOwners.removeValue(
+                    forKey: .peripheral(peripheralID)
+                )
+                noiseReconnectPolicy.endLinkEpoch(.peripheral(peripheralID))
             }
             _ = linkStateStore.clearPeripherals()
             // Notify UI of disconnections
@@ -2949,7 +2970,6 @@ extension BLEService: CBCentralManagerDelegate {
         case .unauthorized:
             // User denied Bluetooth permission
             SecureLogger.warning("🚫 Bluetooth unauthorized - user denied permission", category: .session)
-            central.stopScan()
             _ = linkStateStore.clearPeripherals()
 
         case .unsupported:
@@ -3097,6 +3117,7 @@ extension BLEService: CBCentralManagerDelegate {
             pendingPeripheralWrites.discardAll(for: peripheralID)
         }
         noiseAuthenticatedLinkOwners.removeValue(forKey: .peripheral(peripheralID))
+        noiseReconnectPolicy.endLinkEpoch(.peripheral(peripheralID))
         _ = linkStateStore.removePeripheral(peripheralID)
         // A duplicate link can drop while the peer stays live on another
         // (the dual-role central link, or a second bound link after a
@@ -3151,6 +3172,7 @@ extension BLEService: CBCentralManagerDelegate {
             pendingPeripheralWrites.discardAll(for: peripheralID)
         }
         noiseAuthenticatedLinkOwners.removeValue(forKey: .peripheral(peripheralID))
+        noiseReconnectPolicy.endLinkEpoch(.peripheral(peripheralID))
         _ = linkStateStore.removePeripheral(peripheralID)
         
         SecureLogger.error("❌ Failed to connect to peripheral: \(peripheral.name ?? "Unknown") [\(peripheralID)] - Error: \(error?.localizedDescription ?? "Unknown")", category: .session)
@@ -3258,6 +3280,7 @@ extension BLEService {
                 self.pendingPeripheralWrites.discardAll(for: peripheralID)
             }
             self.noiseAuthenticatedLinkOwners.removeValue(forKey: .peripheral(peripheralID))
+            self.noiseReconnectPolicy.endLinkEpoch(.peripheral(peripheralID))
             _ = self.linkStateStore.removePeripheral(peripheralID)
             self.connectionScheduler.recordConnectionTimeout(peripheralID: peripheralID, at: Date())
             self.tryConnectFromQueue()
@@ -3539,6 +3562,28 @@ extension BLEService {
         }
     }
 
+    /// Replays the current generation's ready callback. Restore tests use
+    /// this to prove same-generation reconciliation is idempotent.
+    func _test_reconcileCurrentNoiseSession(for peerID: PeerID) {
+        let normalizedPeerID = peerID.toShort()
+        messageQueue.async(flags: .barrier) { [weak self] in
+            guard let self,
+                  let generation = self.noiseService.sessionGeneration(
+                    for: normalizedPeerID
+                  ),
+                  let fingerprint = self.noiseService.getPeerFingerprint(
+                    normalizedPeerID
+                  ) else {
+                return
+            }
+            self.handleNoisePeerAuthenticated(
+                peerID: normalizedPeerID,
+                fingerprint: fingerprint,
+                sessionGeneration: generation
+            )
+        }
+    }
+
     /// Builds an authenticated-session packet from an exact typed plaintext.
     /// Compatibility tests use this to model Android's deployed 0x20 file
     /// payload and the short-lived 0x09 prerelease payload without exposing a
@@ -3838,8 +3883,19 @@ extension BLEService: CBPeripheralManagerDelegate {
         case .poweredOff:
             // Bluetooth was turned off - clean up peripheral state
             SecureLogger.info("📴 Bluetooth powered off - cleaning up peripheral state", category: .session)
-            peripheral.stopAdvertising()
             // Clear subscribed centrals (they are now invalid)
+            let centralSnapshot = linkStateStore.subscribedCentralSnapshot
+            for central in centralSnapshot.centrals {
+                let centralID = central.identifier.uuidString
+                noiseAuthenticatedLinkOwners.removeValue(
+                    forKey: .central(centralID)
+                )
+                noiseReconnectPolicy.endLinkEpoch(.central(centralID))
+            }
+            collectionsQueue.sync(flags: .barrier) {
+                pendingNotifications.removeAll()
+                pendingWriteBuffers.removeAll()
+            }
             let centralPeerIDs = linkStateStore.clearCentrals()
             subscriptionAnnounceLimiter.removeAll()
             characteristic = nil
@@ -3853,7 +3909,6 @@ extension BLEService: CBPeripheralManagerDelegate {
         case .unauthorized:
             // User denied Bluetooth permission
             SecureLogger.warning("🚫 Bluetooth unauthorized for peripheral role", category: .session)
-            peripheral.stopAdvertising()
             _ = linkStateStore.clearCentrals()
             subscriptionAnnounceLimiter.removeAll()
             characteristic = nil
@@ -3966,6 +4021,7 @@ extension BLEService: CBPeripheralManagerDelegate {
             pendingNotifications.removeTarget { $0.identifier.uuidString == centralID }
         }
         noiseAuthenticatedLinkOwners.removeValue(forKey: .central(centralID))
+        noiseReconnectPolicy.endLinkEpoch(.central(centralID))
         let removedPeerID = linkStateStore.removeSubscribedCentral(central)
         
         // Ensure we're still advertising for other devices to find us
@@ -4583,11 +4639,48 @@ extension BLEService {
             })
         }
     }
+
+    /// A peer-level session can outlive the physical link that established it.
+    /// Revalidate a fresh direct link with an ordinary XX exchange, retiring
+    /// cached sending keys atomically before message 1 can leave.
+    private func refreshNoiseSessionForVerifiedDirectLink(
+        _ packet: BitchatPacket,
+        peerID: PeerID
+    ) {
+        guard let link = collectionsQueue.sync(execute: { ingressLinks.link(for: packet) }) else {
+            return
+        }
+
+        let hasEstablishedSession = noiseService.hasEstablishedSession(with: peerID)
+        let authenticatedPeerLinks = currentNoiseAuthenticatedLinks(to: peerID)
+        let shouldRevalidate = readLinkState { store in
+            guard boundPeerID(for: link, in: store) == peerID else {
+                return false
+            }
+            return noiseReconnectPolicy.shouldRevalidate(
+                on: link,
+                hasEstablishedSession: hasEstablishedSession,
+                isNoiseAuthenticatedLink: noiseAuthenticatedLinkOwners[link] == peerID,
+                hasAuthenticatedPeerLink: !authenticatedPeerLinks.isEmpty,
+                now: Date()
+            )
+        }
+        guard shouldRevalidate else { return }
+
+        SecureLogger.info(
+            "🔄 Revalidating cached Noise session on fresh direct link to \(peerID.id.prefix(8))…",
+            category: .session
+        )
+        initiateNoiseReconnectHandshake(with: peerID)
+    }
     
     private func configureNoiseServiceCallbacks(for service: NoiseEncryptionService) {
         service.onPeerAuthenticatedWithGeneration = { [weak self] peerID, fingerprint, generation in
             SecureLogger.debug("🔐 Noise session authenticated with \(peerID.id.prefix(8))…, fingerprint: \(fingerprint.prefix(16))…")
-            self?.messageQueue.async { [weak self] in
+            // Authentication can be reported while an initiator is still
+            // returning XX message 3. Serialize generation-bound state and
+            // every post-handshake drain behind the handshake packet handler.
+            self?.messageQueue.async(flags: .barrier) { [weak self] in
                 self?.handleNoisePeerAuthenticated(
                     peerID: peerID,
                     fingerprint: fingerprint,
@@ -4595,13 +4688,96 @@ extension BLEService {
                 )
             }
         }
-        service.onRekeyHandshakeReady = { [weak self] peerID, message in
-            self?.messageQueue.async { [weak self] in
-                guard let self else { return }
+        service.onRekeyHandshakeReady = {
+            [weak self, weak service] peerID, initiation in
+            self?.messageQueue.async(flags: .barrier) {
+                [weak self, weak service] in
+                guard let self,
+                      let service,
+                      self.noiseService === service else {
+                    return
+                }
                 self.noteNoiseSessionCleared(for: peerID)
+                guard let message = service.claimHandshakeInitiation(
+                    initiation,
+                    for: peerID
+                ) else {
+                    return
+                }
                 self.broadcastNoiseHandshake(message, to: peerID)
             }
         }
+        service.onHandshakeRecoveryRequired = {
+            [weak self, weak service] request in
+            guard let self, let service else { return }
+            self.messageQueue.async(flags: .barrier) {
+                [weak self, weak service] in
+                guard let self,
+                      let service,
+                      self.noiseService === service else {
+                    return
+                }
+                let peerID = request.peerID
+                guard self.isPeerReachable(peerID) else {
+                    service.cancelHandshakeRecovery(request)
+                    return
+                }
+
+                do {
+                    guard let preparation =
+                        try service.prepareHandshakeRecovery(request) else {
+                        return
+                    }
+                    switch preparation {
+                    case .ordinary(let initiation):
+                        self.noteNoiseSessionCleared(for: peerID)
+                        guard let handshakeData =
+                            service.claimHandshakeInitiation(
+                                initiation,
+                                for: peerID
+                            ) else {
+                            return
+                        }
+                        self.broadcastNoiseHandshake(
+                            handshakeData,
+                            to: peerID
+                        )
+                    case .transferred:
+                        return
+                    }
+                } catch {
+                    SecureLogger.error(
+                        "Failed to prepare handshake recovery with \(peerID.id.prefix(8))…: \(error)",
+                        category: .session
+                    )
+                }
+            }
+        }
+        service.onSessionRestoredWithGeneration = { [weak self, weak service] peerID, generation in
+            guard let self, let service else { return }
+            // The manager makes restored keys visible atomically. Reconcile
+            // transport state and queued sends as the next serialized phase.
+            self.messageQueue.async(flags: .barrier) { [weak self, weak service] in
+                guard let self,
+                      let service,
+                      self.noiseService === service,
+                      let fingerprint = service.getPeerFingerprint(peerID) else {
+                    return
+                }
+                SecureLogger.debug(
+                    "🔐 Restored quarantined Noise session with \(peerID.id.prefix(8))…",
+                    category: .session
+                )
+                // Re-enter the same generation-bound transition used after a
+                // successful handshake. This restores authenticated protocol
+                // state and drains both PM and typed-payload queues.
+                self.handleNoisePeerAuthenticated(
+                    peerID: peerID,
+                    fingerprint: fingerprint,
+                    sessionGeneration: generation
+                )
+            }
+        }
     }
 
     private func handleNoisePeerAuthenticated(
@@ -4649,7 +4825,16 @@ extension BLEService {
             }
         ) else { return }
 
-        guard let watchdog = transition.watchdog else { return }
+        guard let watchdog = transition.watchdog else {
+            // A quarantined transport restored the same cryptographic
+            // generation. Its capability proof and announce state never
+            // became stale; only work queued while outbound keys were paused
+            // needs one idempotent ready transition.
+            noisePacketHandler.handleSessionAuthenticated(normalizedPeerID)
+            sendPendingMessagesAfterHandshake(for: normalizedPeerID)
+            sendPendingNoisePayloadsAfterHandshake(for: normalizedPeerID)
+            return
+        }
 
         completePrivateMediaPolicyResolution(transition.rejected, with: .blockedDowngrade)
         schedulePrivateMediaProofTimeout(
@@ -4658,6 +4843,10 @@ extension BLEService {
             sessionGeneration: generation,
             nonce: watchdog.nonce
         )
+        // Cross-link delivery can put ciphertext sent immediately after
+        // message 3 ahead of message 3 itself. Retry the bounded queue only
+        // after this generation's transport state has been fully installed.
+        noisePacketHandler.handleSessionAuthenticated(normalizedPeerID)
 
         // `onPeerAuthenticated` can fire while the initiator is returning XX
         // message 3. This callback is queued behind the handshake handler, so
@@ -4855,8 +5044,9 @@ extension BLEService {
             }
             return
         }
-        guard noiseService.hasSession(with: peerID) else {
-            // No session yet - queue the payload SYNCHRONOUSLY before initiating handshake
+        guard noiseService.hasEstablishedSession(with: peerID) else {
+            // No established session yet - queue the payload synchronously
+            // before initiating a handshake
             // to prevent race where fast handshake completion drains empty queue
             collectionsQueue.sync(flags: .barrier) {
                 self.pendingNoiseSessionQueues.appendTypedPayload(typedPayload, for: peerID)
@@ -5786,6 +5976,7 @@ extension BLEService {
                     self.pendingPeripheralWrites.discardAll(for: peripheralID)
                 }
                 self.noiseAuthenticatedLinkOwners.removeValue(forKey: .peripheral(peripheralID))
+                self.noiseReconnectPolicy.endLinkEpoch(.peripheral(peripheralID))
                 _ = self.linkStateStore.removePeripheral(peripheralID)
                 cancelled += 1
             }
@@ -5851,12 +6042,27 @@ extension BLEService {
     }
     
     private func initiateNoiseHandshake(with peerID: PeerID) {
-        // Use NoiseEncryptionService for handshake
-        guard !noiseService.hasSession(with: peerID) else { return }
-        
+        let service = noiseService
         do {
-            let handshakeData = try noiseService.initiateHandshake(with: peerID)
-            broadcastNoiseHandshake(handshakeData, to: peerID)
+            guard let initiation = try service.initiateHandshakeIfNeeded(
+                with: peerID,
+                retryOnTimeout: true
+            ) else {
+                return
+            }
+            messageQueue.async(flags: .barrier) {
+                [weak self, weak service] in
+                guard let self,
+                      let service,
+                      self.noiseService === service,
+                      let handshakeData = service.claimHandshakeInitiation(
+                        initiation,
+                        for: peerID
+                      ) else {
+                    return
+                }
+                self.broadcastNoiseHandshake(handshakeData, to: peerID)
+            }
         } catch {
             SecureLogger.error("Failed to initiate handshake: \(error)")
         }
@@ -5874,6 +6080,42 @@ extension BLEService {
         )
         broadcastPacket(packet)
     }
+
+    /// Starts a wire-compatible ordinary XX reconnect. The manager prepares
+    /// the initiator before atomically retiring the cached transport; the
+    /// one-shot claim prevents a crossed inbound message from making a stale
+    /// message 1 leave after this peer has already become responder.
+    private func initiateNoiseReconnectHandshake(with peerID: PeerID) {
+        let service = noiseService
+        do {
+            let initiation = try service.initiateReconnectHandshake(
+                with: peerID,
+                retryOnTimeout: true
+            )
+            messageQueue.async(flags: .barrier) { [weak self, weak service] in
+                guard let self,
+                      let service,
+                      self.noiseService === service else {
+                    return
+                }
+                self.noteNoiseSessionCleared(for: peerID)
+                guard let handshakeData = service.claimHandshakeInitiation(
+                          initiation,
+                          for: peerID
+                      ) else {
+                    return
+                }
+                self.broadcastNoiseHandshake(handshakeData, to: peerID)
+            }
+        } catch NoiseSessionError.notEstablished {
+            initiateNoiseHandshake(with: peerID)
+        } catch {
+            SecureLogger.error(
+                "Failed to initiate ordinary reconnect: \(error)",
+                category: .session
+            )
+        }
+    }
     
     private func sendPendingMessagesAfterHandshake(for peerID: PeerID) {
         // Atomically take all pending messages to process (prevents concurrent modification)
@@ -6219,7 +6461,12 @@ extension BLEService {
     // MARK: Packet Reception
     
     private func handleReceivedPacket(_ packet: BitchatPacket, from peerID: PeerID) {
-        // Call directly if already on messageQueue, otherwise dispatch
+        let isNoisePacket = packet.type == MessageType.noiseHandshake.rawValue
+            || packet.type == MessageType.noiseEncrypted.rawValue
+
+        // Capture the panic lifecycle at the first off-messageQueue handoff.
+        // Noise packets still enter through a barrier so handshake promotion,
+        // quarantine, and encrypted delivery share one ordered session.
         if DispatchQueue.getSpecific(key: messageQueueKey) == nil {
             guard let lifecycleGeneration =
                     capturePanicLifecycleGeneration() else {
@@ -6228,7 +6475,8 @@ extension BLEService {
             #if DEBUG
             _test_beforeReceivePacketHandoff?()
             #endif
-            messageQueue.async { [weak self] in
+            let flags: DispatchWorkItemFlags = isNoisePacket ? .barrier : []
+            messageQueue.async(flags: flags) { [weak self] in
                 guard let self,
                       self.isCurrentPanicLifecycleGeneration(
                           lifecycleGeneration
@@ -6238,11 +6486,34 @@ extension BLEService {
                 #if DEBUG
                 self._test_onReceivePacketHandoff?()
                 #endif
-                self.handleReceivedPacket(packet, from: peerID)
+                self.handleReceivedPacketOnQueue(packet, from: peerID)
             }
             return
         }
 
+        if isNoisePacket {
+            guard let lifecycleGeneration =
+                    capturePanicLifecycleGeneration() else {
+                return
+            }
+            messageQueue.async(flags: .barrier) { [weak self] in
+                guard let self,
+                      self.isCurrentPanicLifecycleGeneration(
+                          lifecycleGeneration
+                      ) else {
+                    return
+                }
+                self.handleReceivedPacketOnQueue(packet, from: peerID)
+            }
+        } else {
+            handleReceivedPacketOnQueue(packet, from: peerID)
+        }
+    }
+
+    private func handleReceivedPacketOnQueue(
+        _ packet: BitchatPacket,
+        from peerID: PeerID
+    ) {
         let context = BLEReceivePipeline.context(for: packet, localPeerID: myPeerID)
         let senderID = context.senderID
         let messageID = context.messageID
@@ -6429,6 +6700,9 @@ extension BLEService {
         // consolidate duplicate same-role connections onto that link.
         if let result, result.isVerified, result.isDirectAnnounce {
             rebindLinkAfterVerifiedDirectAnnounce(packet, to: result.peerID)
+            #if DEBUG
+            _test_afterVerifiedDirectRebindEnqueued?()
+            #endif
             retireRedundantPeripheralLinks(packet, to: result.peerID)
         }
 
@@ -6462,11 +6736,9 @@ extension BLEService {
             deliverCourierMailRemotely(to: result.peerID, noiseKey: noiseKey)
             if result.isDirectAnnounce,
                !hasCurrentNoiseAuthenticatedLink(to: result.peerID) {
-                if noiseService.hasEstablishedSession(with: result.peerID) {
-                    // A session with no surviving authenticated link is stale;
-                    // force the current link to prove possession again.
-                    clearNoiseSession(for: result.peerID)
-                }
+                // A cached session may predate this physical link.
+                // rebindLinkAfterVerifiedDirectAnnounce performs its atomic
+                // ordinary reconnect after the binding is published.
                 if !noiseService.hasSession(with: result.peerID) {
                     initiateNoiseHandshake(with: result.peerID)
                 }
@@ -6495,7 +6767,14 @@ extension BLEService {
                 linkUUID = centralUUID
                 previousPeerID = self.linkStateStore.peerID(forCentralUUID: centralUUID)
             }
-            guard let previousPeerID, previousPeerID != peerID else { return }
+            guard let previousPeerID else { return }
+            guard previousPeerID != peerID else {
+                self.refreshNoiseSessionForVerifiedDirectLink(
+                    packet,
+                    peerID: peerID
+                )
+                return
+            }
 
             // The signature does not authenticate directness (TTL is excluded
             // from signing because relays mutate it), so a "verified direct"
@@ -6522,12 +6801,20 @@ extension BLEService {
             // it across an announce-driven rebind, whose direct TTL is
             // replayable; the new owner must complete a fresh handshake.
             self.noiseAuthenticatedLinkOwners.removeValue(forKey: link)
+            self.noiseReconnectPolicy.endLinkEpoch(link)
             switch link {
             case .peripheral(let peripheralUUID):
                 self.linkStateStore.bindPeripheral(peripheralUUID, to: peerID)
             case .central(let centralUUID):
                 self.linkStateStore.bindCentral(centralUUID, to: peerID)
             }
+            // Keep the rebind and reconnect decision in one bleQueue critical
+            // section. No observer may see the new binding while a cached
+            // peer-level sender is still considered established.
+            self.refreshNoiseSessionForVerifiedDirectLink(
+                packet,
+                peerID: peerID
+            )
             SecureLogger.debug("🔄 Rebinding link after peer-ID rotation: \(previousPeerID.id.prefix(8))… → \(peerID.id.prefix(8))…", category: .session)
             self.refreshLocalTopology()
             // The announce that triggered this rebind was upserted as
@@ -6619,6 +6906,7 @@ extension BLEService {
                 pendingPeripheralWrites.discardAll(for: uuid)
             }
             noiseAuthenticatedLinkOwners.removeValue(forKey: .peripheral(uuid))
+            noiseReconnectPolicy.endLinkEpoch(.peripheral(uuid))
             _ = linkStateStore.removePeripheral(uuid)
             SecureLogger.info(
                 "🔗 Retiring redundant link \(uuid.prefix(8))… bound to \(peerID.id.prefix(8))…\(keptUUID.map { " (keeping \($0.prefix(8))…)" } ?? "")",
@@ -7005,6 +7293,12 @@ extension BLEService {
             packet,
             from: peerID
         )
+        // An inbound message 1 quarantines the old transport receive-only.
+        // Keep its generation-bound BLE state intact: the manager's new
+        // handshaking generation already gates every outbound policy, while
+        // a rollback can become ready again without repeating capability
+        // proof or announce side effects. Only the exact handshake candidate's
+        // authenticated completion may promote the physical ingress link.
         if result.didEstablishAuthenticatedSession {
             markNoiseAuthenticatedIngressLink(for: packet, peerID: peerID)
         }
@@ -7042,6 +7336,11 @@ extension BLEService {
             hasNoiseSession: { [weak self] peerID in
                 self?.noiseService.hasSession(with: peerID) ?? false
             },
+            isAwaitingResponderHandshakeCompletion: { [weak self] peerID in
+                self?.noiseService.isAwaitingResponderHandshakeCompletion(
+                    with: peerID
+                ) ?? false
+            },
             initiateHandshake: { [weak self] peerID in
                 self?.initiateNoiseHandshake(with: peerID)
             },
@@ -7055,7 +7354,14 @@ extension BLEService {
                 guard let self = self else { throw NoiseEncryptionError.sessionNotEstablished }
                 let result = try self.noiseService.decryptWithSessionGeneration(
                     payload,
-                    from: peerID
+                    from: peerID,
+                    establishedGenerationIsReady: { generation in
+                        self.collectionsQueue.sync {
+                            self.privateMediaSessionGenerations[
+                                peerID.toShort()
+                            ] == generation
+                        }
+                    }
                 )
                 return BLENoiseDecryptionResult(
                     plaintext: result.plaintext,

bitchat/Services/NoiseEncryptionService.swift

@@ -184,11 +184,17 @@ final class NoiseEncryptionService {
     private var onPeerAuthenticatedHandlers: [((PeerID, String) -> Void)] = [] // Array of handlers for peer authentication
     private var onPeerAuthenticatedWithGenerationHandlers: [((PeerID, String, UUID) -> Void)] = []
     var onHandshakeRequired: ((PeerID) -> Void)? // peerID needs handshake
-    /// Automatic rekey removed the old session and produced XX message 1.
-    /// The transport must clear session-scoped state and put these exact bytes
-    /// on the wire; merely reporting "handshake required" strands the partial
-    /// initiator session because a second initiate call sees it already exists.
-    var onRekeyHandshakeReady: ((_ peerID: PeerID, _ message: Data) -> Void)?
+    /// Automatic rekey prepared XX message 1. The transport must claim the
+    /// exact attempt at its actual BLE handoff; a crossed inbound initiation
+    /// can invalidate the token before that point.
+    var onRekeyHandshakeReady:
+        ((_ peerID: PeerID, _ initiation: NoiseHandshakeInitiation) -> Void)?
+    var onHandshakeRecoveryRequired:
+        ((_ request: NoiseHandshakeRecoveryRequest) -> Void)?
+    /// An unauthenticated reconnect attempt failed or timed out and the
+    /// receive-only rollback session became the active transport again.
+    /// Transport queues must be drained for this exact restored generation.
+    var onSessionRestoredWithGeneration: ((_ peerID: PeerID, _ generation: UUID) -> Void)?
     
     // Add a handler for peer authentication
     func addOnPeerAuthenticatedHandler(_ handler: @escaping (PeerID, String) -> Void) {
@@ -219,7 +225,17 @@ final class NoiseEncryptionService {
         }
     }
     
-    init(keychain: KeychainManagerProtocol) {
+    init(
+        keychain: KeychainManagerProtocol,
+        ordinaryHandshakeTimeout: TimeInterval =
+            NoiseSecurityConstants.ordinaryHandshakeTimeout,
+        ordinaryResponderHandshakeTimeout: TimeInterval =
+            NoiseSecurityConstants.ordinaryResponderHandshakeTimeout,
+        recentInitiatorCompletionGracePeriod: TimeInterval =
+            NoiseSecurityConstants.recentInitiatorCompletionGracePeriod,
+        ordinaryReconnectRollbackCooldown: TimeInterval =
+            NoiseSecurityConstants.ordinaryReconnectRollbackCooldown
+    ) {
         self.keychain = keychain
         self.localPrekeys = LocalPrekeyStore(keychain: keychain)
 
@@ -309,7 +325,17 @@ final class NoiseEncryptionService {
         self.signingPublicKey = signingKey.publicKey
 
         // Initialize session manager
-        self.sessionManager = NoiseSessionManager(localStaticKey: staticIdentityKey, keychain: keychain)
+        self.sessionManager = NoiseSessionManager(
+            localStaticKey: staticIdentityKey,
+            keychain: keychain,
+            ordinaryHandshakeTimeout: ordinaryHandshakeTimeout,
+            ordinaryResponderHandshakeTimeout:
+                ordinaryResponderHandshakeTimeout,
+            recentInitiatorCompletionGracePeriod:
+                recentInitiatorCompletionGracePeriod,
+            ordinaryReconnectRollbackCooldown:
+                ordinaryReconnectRollbackCooldown
+        )
 
         // Set up session callbacks
         sessionManager.onSessionEstablished = { [weak self] peerID, remoteStaticKey, generation in
@@ -319,6 +345,12 @@ final class NoiseEncryptionService {
                 sessionGeneration: generation
             )
         }
+        sessionManager.onSessionRestored = { [weak self] peerID, generation in
+            self?.onSessionRestoredWithGeneration?(peerID, generation)
+        }
+        sessionManager.onHandshakeRecoveryRequired = { [weak self] request in
+            self?.onHandshakeRecoveryRequired?(request)
+        }
 
         // Start session maintenance timer
         startRekeyTimer()
@@ -682,6 +714,90 @@ final class NoiseEncryptionService {
         let handshakeData = try sessionManager.initiateHandshake(with: peerID)
         return handshakeData
     }
+
+    /// Atomically admits and prepares one initial ordinary handshake. Returns
+    /// nil when another discovery callback already created a session.
+    func initiateHandshakeIfNeeded(
+        with peerID: PeerID,
+        retryOnTimeout: Bool = false
+    ) throws -> NoiseHandshakeInitiation? {
+        guard peerID.isValid else {
+            SecureLogger.warning(.authenticationFailed(peerID: peerID.id))
+            throw NoiseSecurityError.invalidPeerID
+        }
+
+        guard let initiation = try sessionManager.initiateHandshakeIfAbsent(
+            with: peerID,
+            notifyOnTimeout: retryOnTimeout,
+            authorize: { [rateLimiter] in
+                guard rateLimiter.allowHandshake(from: peerID) else {
+                    SecureLogger.warning(
+                        .authenticationFailed(peerID: "Rate limited: \(peerID)")
+                    )
+                    throw NoiseSecurityError.rateLimitExceeded
+                }
+            }
+        ) else {
+            return nil
+        }
+        SecureLogger.info(.handshakeStarted(peerID: peerID.id))
+        return initiation
+    }
+
+    /// Atomically prepares an ordinary reconnect for a peer whose cached
+    /// transport belongs to an earlier physical link. Failed authorization or
+    /// handshake setup preserves the established session.
+    func initiateReconnectHandshake(
+        with peerID: PeerID,
+        retryOnTimeout: Bool = false
+    ) throws -> NoiseHandshakeInitiation {
+        guard peerID.isValid else {
+            SecureLogger.warning(.authenticationFailed(peerID: peerID.id))
+            throw NoiseSecurityError.invalidPeerID
+        }
+
+        return try sessionManager.initiateReconnectHandshake(
+            with: peerID,
+            notifyOnTimeout: retryOnTimeout,
+            authorize: { [rateLimiter] in
+                guard rateLimiter.allowHandshake(from: peerID) else {
+                    SecureLogger.warning(
+                        .authenticationFailed(peerID: "Rate limited: \(peerID)")
+                    )
+                    throw NoiseSecurityError.rateLimitExceeded
+                }
+            }
+        )
+    }
+
+    func prepareHandshakeRecovery(
+        _ request: NoiseHandshakeRecoveryRequest
+    ) throws -> NoiseHandshakeRecoveryPreparation? {
+        try sessionManager.prepareHandshakeRecovery(
+            request,
+            authorizeAttempt: { [rateLimiter] in
+                guard rateLimiter.allowHandshake(from: request.peerID) else {
+                    SecureLogger.warning(
+                        .authenticationFailed(
+                            peerID: "Rate limited: \(request.peerID)"
+                        )
+                    )
+                    throw NoiseSecurityError.rateLimitExceeded
+                }
+            }
+        )
+    }
+
+    func cancelHandshakeRecovery(_ request: NoiseHandshakeRecoveryRequest) {
+        sessionManager.cancelHandshakeRecovery(request)
+    }
+
+    func claimHandshakeInitiation(
+        _ initiation: NoiseHandshakeInitiation,
+        for peerID: PeerID
+    ) -> Data? {
+        sessionManager.claimHandshakeInitiation(initiation, for: peerID)
+    }
     
     /// Process an incoming handshake message
     func processHandshakeMessage(from peerID: PeerID, message: Data) throws -> Data? {
@@ -737,6 +853,13 @@ final class NoiseEncryptionService {
     func hasSession(with peerID: PeerID) -> Bool {
         return sessionManager.getSession(for: peerID) != nil
     }
+
+    /// True while an inbound ordinary XX responder is waiting for message 3.
+    /// A small amount of immediately-following ciphertext may arrive first
+    /// over BLE and must be retried only after responder promotion.
+    func isAwaitingResponderHandshakeCompletion(with peerID: PeerID) -> Bool {
+        sessionManager.isAwaitingResponderHandshakeCompletion(for: peerID)
+    }
     
     // MARK: - Encryption/Decryption
     
@@ -804,27 +927,37 @@ final class NoiseEncryptionService {
 
     func decryptWithSessionGeneration(
         _ data: Data,
-        from peerID: PeerID
+        from peerID: PeerID,
+        establishedGenerationIsReady: (UUID) -> Bool = { _ in true }
     ) throws -> (plaintext: Data, sessionGeneration: UUID) {
         // Standard transport ciphertext has 20 bytes of nonce/tag overhead.
-        // A larger candidate is admitted only up to the framed-file ceiling;
+        // A larger ciphertext is admitted only up to the framed-file ceiling;
         // after authenticated decryption it must prove it is `.privateFile`.
         let isStandardCiphertext = NoiseSecurityValidator.validateCiphertextSize(data)
-        guard isStandardCiphertext || NoiseSecurityValidator.validatePrivateFileCiphertextSize(data) else {
-            throw NoiseSecurityError.messageTooLarge
-        }
+        let isAdmittedCiphertext = isStandardCiphertext
+            || NoiseSecurityValidator.validatePrivateFileCiphertextSize(data)
         
-        // Check rate limit
-        guard rateLimiter.allowMessage(from: peerID) else {
-            throw NoiseSecurityError.rateLimitExceeded
-        }
-        
-        // Check if we have an established session
-        guard hasEstablishedSession(with: peerID) else {
+        // A quarantined transport is deliberately unavailable for outbound
+        // state, but remains receive-only until the responder proves identity
+        // or the bounded rollback restores it.
+        guard sessionManager.hasReceiveSession(for: peerID) else {
             throw NoiseEncryptionError.sessionNotEstablished
         }
         
-        let result = try sessionManager.decryptWithSessionGeneration(data, from: peerID)
+        let result = try sessionManager.decryptWithSessionGeneration(
+            data,
+            from: peerID,
+            establishedGenerationIsReady:
+                establishedGenerationIsReady,
+            authorizeDecrypt: { [rateLimiter] in
+                guard isAdmittedCiphertext else {
+                    throw NoiseSecurityError.messageTooLarge
+                }
+                guard rateLimiter.allowMessage(from: peerID) else {
+                    throw NoiseSecurityError.rateLimitExceeded
+                }
+            }
+        )
         if !isStandardCiphertext {
             guard NoisePayloadType.isPrivateFile(rawValue: result.plaintext.first),
                   NoiseSecurityValidator.validatePrivateFileMessageSize(result.plaintext) else {
@@ -943,9 +1076,9 @@ final class NoiseEncryptionService {
     }
 
     private func initiateAutomaticRekey(for peerID: PeerID) throws {
-        let handshakeMessage = try sessionManager.initiateRekey(for: peerID)
+        let initiation = try sessionManager.initiateRekey(for: peerID)
         SecureLogger.debug("Key rotation initiated for peer: \(peerID)", category: .security)
-        onRekeyHandshakeReady?(peerID, handshakeMessage)
+        onRekeyHandshakeReady?(peerID, initiation)
         onHandshakeRequired?(peerID)
     }
 
@@ -1041,6 +1174,9 @@ struct NoiseMessage: Codable {
 enum NoiseEncryptionError: Error {
     case handshakeRequired
     case sessionNotEstablished
+    /// Manager keys are established or restored, but BLE has not installed
+    /// generation-bound transport state. No receive nonce was consumed.
+    case transportGenerationNotReady
     /// Envelope references a prekey ID we don't hold (never ours, already
     /// deleted after its grace window, or wiped in a panic).
     case unknownPrekey

bitchatTests/BLEServiceCoreTests.swift

@@ -502,14 +502,26 @@ struct BLEServiceCoreTests {
         )
         let replay = try #require(victim.signPacket(unsigned), "Failed to sign replayed announce")
         #expect(ble._test_recordIngressIfNew(packet: replay, linkID: attackerLink))
+        let rebindGate = VerifiedDirectRebindGate()
+        ble._test_afterVerifiedDirectRebindEnqueued = rebindGate.pause
+        defer {
+            rebindGate.release()
+            ble._test_afterVerifiedDirectRebindEnqueued = nil
+        }
         ble._test_handlePacket(replay, fromPeerID: victimPeerID, preseedPeer: false)
 
-        let rebound = await TestHelpers.waitUntil(
-            { ble._test_centralBinding(attackerLink) == victimPeerID },
+        let announcePaused = await TestHelpers.waitUntil(
+            { rebindGate.hasPaused },
             timeout: TestConstants.longTimeout
         )
-        #expect(rebound)
-        #expect(ble.canDeliverSecurely(to: victimPeerID))
+        try #require(announcePaused)
+
+        // Rebind and ordinary reconnect preparation are one bleQueue
+        // critical section. Once the binding is visible, stale sending keys
+        // must already be unavailable.
+        #expect(ble._test_centralBinding(attackerLink) == victimPeerID)
+        #expect(!ble.canDeliverSecurely(to: victimPeerID))
+        rebindGate.release()
 
         let outbound = OutboundPacketTap()
         ble._test_onOutboundPacket = { outbound.record($0) }
@@ -537,20 +549,26 @@ struct BLEServiceCoreTests {
 
         // Preserve a working victim session while an unauthenticated
         // replacement candidate arrives on a newly bound physical link.
-        let message1 = try ble._test_noiseInitiateHandshake(with: victimPeerID)
+        // Establish BLE as responder so the replacement candidate below is
+        // not coalesced by the initiator-completion grace path.
+        let message1 = try victim.initiateHandshake(with: ble.myPeerID)
         let message2 = try #require(
-            try victim.processHandshakeMessage(from: ble.myPeerID, message: message1)
-        )
-        let message3 = try #require(
             try ble._test_noiseProcessHandshakeMessage(
                 from: victimPeerID,
+                message: message1
+            )
+        )
+        let message3 = try #require(
+            try victim.processHandshakeMessage(
+                from: ble.myPeerID,
                 message: message2
             )
         )
-        _ = try victim.processHandshakeMessage(
-            from: ble.myPeerID,
+        _ = try ble._test_noiseProcessHandshakeMessage(
+            from: victimPeerID,
             message: message3
         )
+        await ble._test_drainNoiseMessagePipeline()
         #expect(ble.canDeliverSecurely(to: victimPeerID))
 
         let centralUUID = "central-replacement-xx-message-one"
@@ -614,7 +632,168 @@ struct BLEServiceCoreTests {
                 for: victimPeerID
             )
         )
-        #expect(ble.canDeliverSecurely(to: victimPeerID))
+        // Ordinary reconnect hardening quarantines the cached transport while
+        // this candidate proves the claimed identity. It must be unavailable
+        // for sending as well as unable to authenticate this ingress link.
+        #expect(!ble.canDeliverSecurely(to: victimPeerID))
+    }
+
+    @Test
+    func failedInboundReconnectRestoresAndDrainsWaitingWorkOnce() async throws {
+        let ble = makeService()
+        let alice = NoiseEncryptionService(keychain: MockKeychain())
+        let mallory = NoiseEncryptionService(keychain: MockKeychain())
+        let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
+
+        // Establish BLE as responder so the following inbound reconnect is
+        // not intentionally coalesced by the initiator-completion grace path.
+        let message1 = try alice.initiateHandshake(with: ble.myPeerID)
+        let message2 = try #require(
+            try ble._test_noiseProcessHandshakeMessage(
+                from: alicePeerID,
+                message: message1
+            )
+        )
+        let message3 = try #require(
+            try alice.processHandshakeMessage(
+                from: ble.myPeerID,
+                message: message2
+            )
+        )
+        _ = try ble._test_noiseProcessHandshakeMessage(
+            from: alicePeerID,
+            message: message3
+        )
+        await ble._test_drainNoiseMessagePipeline()
+        #expect(ble.canDeliverSecurely(to: alicePeerID))
+
+        let outbound = OutboundPacketTap()
+        ble._test_onOutboundPacket = outbound.record
+        let forgedMessage1 = try mallory.initiateHandshake(with: ble.myPeerID)
+        let firstPacket = BitchatPacket(
+            type: MessageType.noiseHandshake.rawValue,
+            senderID: Data(hexString: alicePeerID.id) ?? Data(),
+            recipientID: Data(hexString: ble.myPeerID.id),
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1_000),
+            payload: forgedMessage1,
+            signature: nil,
+            ttl: 7
+        )
+        ble._test_handlePacket(firstPacket, fromPeerID: alicePeerID)
+
+        let responseReady = await TestHelpers.waitUntil(
+            {
+                outbound.snapshot().contains {
+                    $0.type == MessageType.noiseHandshake.rawValue
+                        && PeerID(hexData: $0.senderID) == ble.myPeerID
+                        && $0.payload.count
+                            != NoiseSecurityConstants.xxInitialMessageSize
+                }
+            },
+            timeout: TestConstants.longTimeout
+        )
+        try #require(responseReady)
+        let forgedMessage2 = try #require(
+            outbound.snapshot().first {
+                $0.type == MessageType.noiseHandshake.rawValue
+                    && PeerID(hexData: $0.senderID) == ble.myPeerID
+                    && $0.payload.count
+                        != NoiseSecurityConstants.xxInitialMessageSize
+            }?.payload
+        )
+        #expect(!ble.canDeliverSecurely(to: alicePeerID))
+
+        // Typed control traffic must queue behind the ordinary responder,
+        // rather than attempting encryption and disappearing.
+        let privateMessageID = "quarantine-pm-\(UUID().uuidString)"
+        ble.sendPrivateMessage(
+            "queued private message",
+            to: alicePeerID,
+            recipientNickname: "Alice",
+            messageID: privateMessageID
+        )
+        ble.sendGroupInvite(Data("queued-during-quarantine".utf8), to: alicePeerID)
+        await ble._test_drainNoiseMessagePipeline()
+        #expect(outbound.count(ofType: .noiseEncrypted) == 0)
+
+        let forgedMessage3 = try #require(
+            try mallory.processHandshakeMessage(
+                from: ble.myPeerID,
+                message: forgedMessage2
+            )
+        )
+        let forgedEarlyPayload = try #require(
+            BLENoisePayloadFactory.privateMessage(
+                content: "forged early message",
+                messageID: "forged-early"
+            )
+        )
+        try #require(
+            mallory.hasEstablishedSession(with: ble.myPeerID),
+            "forged initiator did not establish after producing message three"
+        )
+        let forgedEarlyCiphertext = try mallory.encrypt(
+            forgedEarlyPayload,
+            for: ble.myPeerID
+        )
+        let earlyPacket = BitchatPacket(
+            type: MessageType.noiseEncrypted.rawValue,
+            senderID: Data(hexString: alicePeerID.id) ?? Data(),
+            recipientID: Data(hexString: ble.myPeerID.id),
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1_000) + 1,
+            payload: forgedEarlyCiphertext,
+            signature: nil,
+            ttl: 7
+        )
+        ble._test_handlePacket(earlyPacket, fromPeerID: alicePeerID)
+        await ble._test_drainNoiseMessagePipeline()
+
+        let thirdPacket = BitchatPacket(
+            type: MessageType.noiseHandshake.rawValue,
+            senderID: Data(hexString: alicePeerID.id) ?? Data(),
+            recipientID: Data(hexString: ble.myPeerID.id),
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1_000) + 2,
+            payload: forgedMessage3,
+            signature: nil,
+            ttl: 7
+        )
+        ble._test_handlePacket(thirdPacket, fromPeerID: alicePeerID)
+
+        // Rollback restores the same generation. It retries the bounded early
+        // ciphertext and drains both outbound queues, but must not repeat a
+        // new-generation capability proof or forced announce.
+        let drained = await TestHelpers.waitUntil(
+            { outbound.count(ofType: .noiseEncrypted) >= 2 },
+            timeout: TestConstants.longTimeout
+        )
+        try #require(drained)
+        await ble._test_drainNoiseMessagePipeline()
+        let plaintexts = try outbound.snapshot()
+            .filter { $0.type == MessageType.noiseEncrypted.rawValue }
+            .map { try alice.decrypt($0.payload, from: ble.myPeerID) }
+        #expect(plaintexts.count == 2)
+        #expect(
+            plaintexts.filter {
+                $0.first == NoisePayloadType.authenticatedPeerState.rawValue
+            }.isEmpty
+        )
+        #expect(
+            plaintexts.filter {
+                $0.first == NoisePayloadType.privateMessage.rawValue
+            }.count == 1
+        )
+        #expect(
+            plaintexts.filter {
+                $0.first == NoisePayloadType.groupInvite.rawValue
+            }.count == 1
+        )
+        #expect(outbound.count(ofType: .announce) == 0)
+
+        // A duplicate ready callback cannot replay either buffer.
+        ble._test_reconcileCurrentNoiseSession(for: alicePeerID)
+        await ble._test_drainNoiseMessagePipeline()
+        #expect(outbound.count(ofType: .noiseEncrypted) == 2)
+        #expect(outbound.count(ofType: .announce) == 0)
     }
 
     /// A legitimate rotation announce necessarily arrives on a link still
@@ -943,6 +1122,40 @@ private final class OutboundPacketTap {
         lock.lock(); defer { lock.unlock() }
         return packets.filter { $0.type == type.rawValue }.count
     }
+
+    func snapshot() -> [BitchatPacket] {
+        lock.lock(); defer { lock.unlock() }
+        return packets
+    }
+}
+
+private final class VerifiedDirectRebindGate: @unchecked Sendable {
+    private let condition = NSCondition()
+    private var paused = false
+    private var released = false
+
+    var hasPaused: Bool {
+        condition.lock()
+        defer { condition.unlock() }
+        return paused
+    }
+
+    func pause() {
+        condition.lock()
+        paused = true
+        condition.broadcast()
+        while !released {
+            condition.wait()
+        }
+        condition.unlock()
+    }
+
+    func release() {
+        condition.lock()
+        released = true
+        condition.broadcast()
+        condition.unlock()
+    }
 }
 
 private final class ReceivePacketHandoffGate: @unchecked Sendable {
@@ -1076,6 +1289,7 @@ private final class PublicCaptureDelegate: BitchatDelegate {
         defer { lock.unlock() }
         return publicMessages
     }
+
 }
 
 @MainActor

bitchatTests/Integration/IntegrationTests.swift

@@ -12,6 +12,7 @@ import Testing
 @testable import BitFoundation // to avoid unnecessary public's
 @testable import bitchat
 
+@Suite("Integration Tests", .serialized)
 struct IntegrationTests {
     
     private var helper = TestNetworkHelper()
@@ -272,8 +273,18 @@ struct IntegrationTests {
         // Re-establish Noise handshake explicitly via managers
         do {
             let m1 = try helper.noiseManagers["Bob"]!.initiateHandshake(with: helper.nodes["Alice"]!.peerID)
-            let m2 = try helper.noiseManagers["Alice"]!.handleIncomingHandshake(from: helper.nodes["Bob"]!.peerID, message: m1)!
-            let m3 = try helper.noiseManagers["Bob"]!.handleIncomingHandshake(from: helper.nodes["Alice"]!.peerID, message: m2)!
+            let m2 = try #require(
+                try helper.noiseManagers["Alice"]!.handleIncomingHandshake(
+                    from: helper.nodes["Bob"]!.peerID,
+                    message: m1
+                )
+            )
+            let m3 = try #require(
+                try helper.noiseManagers["Bob"]!.handleIncomingHandshake(
+                    from: helper.nodes["Alice"]!.peerID,
+                    message: m2
+                )
+            )
             _ = try helper.noiseManagers["Alice"]!.handleIncomingHandshake(from: helper.nodes["Bob"]!.peerID, message: m3)
         } catch {
             Issue.record("Failed to re-establish Noise session after restart: \(error)")

bitchatTests/Integration/TestNetworkHelper.swift

@@ -8,6 +8,7 @@
 
 import Foundation
 import CryptoKit
+import Testing
 @testable import BitFoundation // to avoid unnecessary public's
 @testable import bitchat
 
@@ -27,9 +28,14 @@ final class TestNetworkHelper {
         node.mockNickname = name
         nodes[name] = node
         
-        // Create/replace Noise manager for this node
+        // This synchronous helper directly drives all three XX messages and
+        // has no transport callback loop for delayed collision recovery.
         let key = Curve25519.KeyAgreement.PrivateKey()
-        noiseManagers[name] = NoiseSessionManager(localStaticKey: key, keychain: mockKeychain)
+        noiseManagers[name] = NoiseSessionManager(
+            localStaticKey: key,
+            keychain: mockKeychain,
+            recentInitiatorCompletionGracePeriod: 0
+        )
         return node
     }
     
@@ -108,8 +114,18 @@ final class TestNetworkHelper {
               let peer2ID = nodes[node2]?.peerID else { return }
         
         let msg1 = try manager1.initiateHandshake(with: peer2ID)
-        let msg2 = try manager2.handleIncomingHandshake(from: peer1ID, message: msg1)!
-        let msg3 = try manager1.handleIncomingHandshake(from: peer2ID, message: msg2)!
+        let msg2 = try #require(
+            try manager2.handleIncomingHandshake(
+                from: peer1ID,
+                message: msg1
+            )
+        )
+        let msg3 = try #require(
+            try manager1.handleIncomingHandshake(
+                from: peer2ID,
+                message: msg2
+            )
+        )
         _ = try manager2.handleIncomingHandshake(from: peer1ID, message: msg3)
     }
 }

bitchatTests/Noise/NoiseCoverageTests.swift

@@ -5,7 +5,7 @@ import BitFoundation
 
 @testable import bitchat
 
-@Suite("Noise Coverage Tests")
+@Suite("Noise Coverage Tests", .serialized)
 struct NoiseCoverageTests {
     private let keychain = MockKeychain()
     private let aliceStaticKey = Curve25519.KeyAgreement.PrivateKey()
@@ -633,8 +633,16 @@ struct NoiseCoverageTests {
         )
         let replacementSession = try #require(manager.getSession(for: alicePeerID))
 
-        #expect(replacementResponse != nil)
-        #expect(replacementSession !== restartedSession)
+        let localPeerID = PeerID(
+            publicKey: aliceStaticKey.publicKey.rawRepresentation
+        )
+        if localPeerID < alicePeerID {
+            #expect(replacementResponse == nil)
+            #expect(replacementSession === restartedSession)
+        } else {
+            #expect(replacementResponse != nil)
+            #expect(replacementSession !== restartedSession)
+        }
 
         let aliceManager = NoiseSessionManager(localStaticKey: aliceStaticKey, keychain: keychain)
         let bobManager = NoiseSessionManager(localStaticKey: bobStaticKey, keychain: keychain)
@@ -654,7 +662,13 @@ struct NoiseCoverageTests {
             try aliceManager.initiateHandshake(with: alicePeerID)
         }
 
-        let rekeyHandshake = try aliceManager.initiateRekey(for: alicePeerID)
+        let rekeyInitiation = try aliceManager.initiateRekey(for: alicePeerID)
+        let rekeyHandshake = try #require(
+            aliceManager.claimHandshakeInitiation(
+                rekeyInitiation,
+                for: alicePeerID
+            )
+        )
         #expect(!rekeyHandshake.isEmpty)
         let rekeyedSession = try #require(aliceManager.getSession(for: alicePeerID))
 
@@ -667,6 +681,7 @@ struct NoiseCoverageTests {
         let aliceManager = NoiseSessionManager(
             localStaticKey: aliceStaticKey,
             keychain: keychain,
+            recentInitiatorCompletionGracePeriod: 0,
             sessionFactory: { peerID, role in
                 BlockingDecryptNoiseSession(
                     peerID: peerID,

bitchatTests/Noise/NoiseProtocolTests.swift

@@ -357,8 +357,18 @@ struct NoiseProtocolTests {
     
     @Test func peerRestartDetection() throws {
         // Establish initial sessions
-        let aliceManager = NoiseSessionManager(localStaticKey: aliceKey, keychain: mockKeychain)
-        let bobManager = NoiseSessionManager(localStaticKey: bobKey, keychain: mockKeychain)
+        // This test explicitly drives the three synchronous XX messages and
+        // does not exercise the transport's delayed collision recovery.
+        let aliceManager = NoiseSessionManager(
+            localStaticKey: aliceKey,
+            keychain: mockKeychain,
+            recentInitiatorCompletionGracePeriod: 0
+        )
+        let bobManager = NoiseSessionManager(
+            localStaticKey: bobKey,
+            keychain: mockKeychain,
+            recentInitiatorCompletionGracePeriod: 0
+        )
         
         try establishManagerSessions(aliceManager: aliceManager, bobManager: bobManager)
         
@@ -377,15 +387,24 @@ struct NoiseProtocolTests {
         let newHandshake1 = try bobManagerRestarted.initiateHandshake(with: bobPeerID)
         
         // Alice should accept the new handshake (clearing old session)
-        let newHandshake2 = try aliceManager.handleIncomingHandshake(
-            from: alicePeerID, message: newHandshake1)
-        #expect(newHandshake2 != nil)
+        let newHandshake2 = try #require(
+            try aliceManager.handleIncomingHandshake(
+                from: alicePeerID,
+                message: newHandshake1
+            )
+        )
         
         // Complete the new handshake
-        let newHandshake3 = try bobManagerRestarted.handleIncomingHandshake(
-            from: bobPeerID, message: newHandshake2!)
-        #expect(newHandshake3 != nil)
-        _ = try aliceManager.handleIncomingHandshake(from: alicePeerID, message: newHandshake3!)
+        let newHandshake3 = try #require(
+            try bobManagerRestarted.handleIncomingHandshake(
+                from: bobPeerID,
+                message: newHandshake2
+            )
+        )
+        _ = try aliceManager.handleIncomingHandshake(
+            from: alicePeerID,
+            message: newHandshake3
+        )
         
         // Should be able to exchange messages with new sessions
         let testMessage = Data("After restart".utf8)
@@ -543,8 +562,18 @@ struct NoiseProtocolTests {
     
     @Test func nonceDesynchronizationCausesRehandshake() throws {
         // Test that nonce desynchronization leads to proper re-handshake
-        let aliceManager = NoiseSessionManager(localStaticKey: aliceKey, keychain: mockKeychain)
-        let bobManager = NoiseSessionManager(localStaticKey: bobKey, keychain: mockKeychain)
+        // This test explicitly drives the three synchronous XX messages and
+        // does not exercise the transport's delayed collision recovery.
+        let aliceManager = NoiseSessionManager(
+            localStaticKey: aliceKey,
+            keychain: mockKeychain,
+            recentInitiatorCompletionGracePeriod: 0
+        )
+        let bobManager = NoiseSessionManager(
+            localStaticKey: bobKey,
+            keychain: mockKeychain,
+            recentInitiatorCompletionGracePeriod: 0
+        )
         
         // Establish sessions
         try establishManagerSessions(aliceManager: aliceManager, bobManager: bobManager)
@@ -572,15 +601,25 @@ struct NoiseProtocolTests {
         let rehandshake1 = try bobManager.initiateHandshake(with: bobPeerID)
         
         // Alice should accept despite having a "valid" (but desynced) session
-        let rehandshake2 = try aliceManager.handleIncomingHandshake(
-            from: alicePeerID, message: rehandshake1)
-        #expect(rehandshake2 != nil, "Alice should accept handshake to fix desync")
+        let rehandshake2 = try #require(
+            try aliceManager.handleIncomingHandshake(
+                from: alicePeerID,
+                message: rehandshake1
+            ),
+            "Alice should accept handshake to fix desync"
+        )
         
         // Complete handshake
-        let rehandshake3 = try bobManager.handleIncomingHandshake(
-            from: bobPeerID, message: rehandshake2!)
-        #expect(rehandshake3 != nil)
-        _ = try aliceManager.handleIncomingHandshake(from: alicePeerID, message: rehandshake3!)
+        let rehandshake3 = try #require(
+            try bobManager.handleIncomingHandshake(
+                from: bobPeerID,
+                message: rehandshake2
+            )
+        )
+        _ = try aliceManager.handleIncomingHandshake(
+            from: alicePeerID,
+            message: rehandshake3
+        )
         
         // Verify communication works again
         let testResynced = Data("Resynced".utf8)

bitchatTests/Services/BLENoisePacketHandlerTests.swift

@@ -1,4 +1,5 @@
 import BitFoundation
+import CryptoKit
 import Foundation
 import Testing
 @testable import bitchat
@@ -11,7 +12,11 @@ struct BLENoisePacketHandlerTests {
         var handshakeAuthenticated = false
         var hasSession = false
         let sessionGeneration = UUID()
+        var awaitingResponderHandshake = false
         var decryptResult: Result<Data, Error> = .success(Data())
+        var currentDate = Date(timeIntervalSince1970: 1_000)
+        var transportGenerationReady = false
+        var forcedServiceDecryptError: Error?
 
         var processedHandshakes: [(peerID: PeerID, message: Data)] = []
         var hasSessionQueries: [PeerID] = []
@@ -34,11 +39,12 @@ struct BLENoisePacketHandlerTests {
         recorder: Recorder,
         now: Date = Date(timeIntervalSince1970: 1_000)
     ) -> BLENoisePacketHandler {
+        recorder.currentDate = now
         let environment = BLENoisePacketHandlerEnvironment(
             localPeerID: { [localPeerID] in localPeerID },
             localPeerIDData: { [localPeerIDData] in localPeerIDData },
             messageTTL: TransportConfig.messageTTLDefault,
-            now: { now },
+            now: { recorder.currentDate },
             processHandshakeMessage: { peerID, message in
                 recorder.processedHandshakes.append((peerID, message))
                 return NoiseHandshakeProcessingResult(
@@ -51,6 +57,9 @@ struct BLENoisePacketHandlerTests {
                 recorder.hasSessionQueries.append(peerID)
                 return recorder.hasSession
             },
+            isAwaitingResponderHandshakeCompletion: { _ in
+                recorder.awaitingResponderHandshake
+            },
             initiateHandshake: { peerID in
                 recorder.initiatedHandshakes.append(peerID)
                 recorder.events.append("initiateHandshake")
@@ -82,6 +91,120 @@ struct BLENoisePacketHandlerTests {
         return BLENoisePacketHandler(environment: environment)
     }
 
+    private func makeServiceBackedHandler(
+        service: NoiseEncryptionService,
+        localPeerID: PeerID,
+        recorder: Recorder,
+        transportGenerationIsReady:
+            @escaping (UUID) -> Bool
+    ) -> BLENoisePacketHandler {
+        BLENoisePacketHandler(
+            environment: BLENoisePacketHandlerEnvironment(
+                localPeerID: { localPeerID },
+                localPeerIDData: {
+                    Data(hexString: localPeerID.id) ?? Data()
+                },
+                messageTTL: TransportConfig.messageTTLDefault,
+                now: { recorder.currentDate },
+                processHandshakeMessage: { peerID, message in
+                    try service.processHandshakeMessageWithResult(
+                        from: peerID,
+                        message: message
+                    )
+                },
+                hasNoiseSession: { peerID in
+                    service.hasSession(with: peerID)
+                },
+                isAwaitingResponderHandshakeCompletion: { peerID in
+                    service.isAwaitingResponderHandshakeCompletion(
+                        with: peerID
+                    )
+                },
+                initiateHandshake: { peerID in
+                    recorder.initiatedHandshakes.append(peerID)
+                },
+                broadcastPacket: { packet in
+                    recorder.broadcastPackets.append(packet)
+                },
+                updatePeerLastSeen: { peerID in
+                    recorder.lastSeenUpdates.append(peerID)
+                },
+                decrypt: { payload, peerID in
+                    recorder.decryptCalls.append((payload, peerID))
+                    if let error = recorder.forcedServiceDecryptError {
+                        throw error
+                    }
+                    let result =
+                        try service.decryptWithSessionGeneration(
+                            payload,
+                            from: peerID,
+                            establishedGenerationIsReady:
+                                transportGenerationIsReady
+                        )
+                    return BLENoiseDecryptionResult(
+                        plaintext: result.plaintext,
+                        sessionGeneration: result.sessionGeneration
+                    )
+                },
+                clearSession: { peerID in
+                    recorder.clearedSessions.append(peerID)
+                    service.clearSession(for: peerID)
+                },
+                handleAuthenticatedPeerState: {
+                    peerID, payload, generation in
+                    recorder.authenticatedPeerStates.append(
+                        (peerID, payload, generation)
+                    )
+                },
+                deliverNoisePayload: {
+                    peerID, type, payload, timestamp in
+                    recorder.deliveries.append(
+                        (peerID, type, payload, timestamp)
+                    )
+                }
+            )
+        )
+    }
+
+    private func establishedServices() throws -> (
+        sender: NoiseEncryptionService,
+        receiver: NoiseEncryptionService,
+        senderPeerID: PeerID,
+        receiverPeerID: PeerID
+    ) {
+        let sender = NoiseEncryptionService(keychain: MockKeychain())
+        let receiver = NoiseEncryptionService(keychain: MockKeychain())
+        let senderPeerID = PeerID(
+            publicKey: sender.getStaticPublicKeyData()
+        )
+        let receiverPeerID = PeerID(
+            publicKey: receiver.getStaticPublicKeyData()
+        )
+        let message1 = try sender.initiateHandshake(with: receiverPeerID)
+        let message2 = try #require(
+            try receiver.processHandshakeMessage(
+                from: senderPeerID,
+                message: message1
+            )
+        )
+        let message3 = try #require(
+            try sender.processHandshakeMessage(
+                from: receiverPeerID,
+                message: message2
+            )
+        )
+        _ = try receiver.processHandshakeMessage(
+            from: senderPeerID,
+            message: message3
+        )
+        return (
+            sender,
+            receiver,
+            senderPeerID,
+            receiverPeerID
+        )
+    }
+
     // MARK: Handshake
 
     @Test
@@ -198,6 +321,24 @@ struct BLENoisePacketHandlerTests {
         #expect(recorder.broadcastPackets.isEmpty)
     }
 
+    @Test
+    func managedHandshakeFailureDoesNotStartASecondRecovery() {
+        let recorder = Recorder()
+        recorder.handshakeResult = .failure(
+            NoiseManagedHandshakeFailure(underlying: TestError())
+        )
+        recorder.hasSession = false
+        let handler = makeHandler(recorder: recorder)
+        let packet = makeHandshakePacket(
+            recipientID: Data(hexString: localPeerID.id)
+        )
+
+        #expect(!handler.handleHandshake(packet, from: remotePeerID))
+        #expect(recorder.hasSessionQueries.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+        #expect(recorder.broadcastPackets.isEmpty)
+    }
+
     // MARK: Encrypted
 
     @Test
@@ -346,6 +487,799 @@ struct BLENoisePacketHandlerTests {
         #expect(recorder.deliveries.isEmpty)
     }
 
+    @Test
+    func earlyCiphertextIsRetriedAfterResponderHandshakeCompletes() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(
+            CryptoKitError.authenticationFailure
+        )
+        let handler = makeHandler(recorder: recorder)
+        let encrypted = makeEncryptedPacket(
+            recipientID: Data(hexString: localPeerID.id)
+        )
+
+        handler.handleEncrypted(encrypted, from: remotePeerID)
+
+        #expect(recorder.decryptCalls.count == 1)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.privateMessage.rawValue, 0xCA, 0xFE])
+        )
+        handler.handleSessionAuthenticated(remotePeerID)
+        handler.handleSessionAuthenticated(remotePeerID)
+
+        #expect(recorder.decryptCalls.count == 2)
+        #expect(recorder.deliveries.count == 1)
+        #expect(recorder.deliveries.first?.type == .privateMessage)
+        #expect(recorder.deliveries.first?.payload == Data([0xCA, 0xFE]))
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func panicResetDiscardsDeferredCiphertextBeforeFutureAuthentication() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(
+            CryptoKitError.authenticationFailure
+        )
+        let handler = makeHandler(recorder: recorder)
+        let prePanicCiphertext = makeEncryptedPacket(
+            recipientID: Data(hexString: localPeerID.id),
+            payload: Data(
+                count: NoiseSecurityConstants.maxMessageSize
+                    + NoiseSecurityConstants.transportCiphertextOverhead
+            )
+        )
+
+        handler.handleEncrypted(prePanicCiphertext, from: remotePeerID)
+        #expect(recorder.decryptCalls.count == 1)
+
+        handler.resetForPanic()
+
+        // Three maximum-sized packets fit only when reset also zeroed the
+        // global byte accounting. They model ciphertext received under the
+        // replacement identity before that responder handshake completes.
+        for index in 0..<3 {
+            handler.handleEncrypted(
+                makeEncryptedPacket(
+                    recipientID: Data(hexString: localPeerID.id),
+                    timestamp: UInt64(901_000 + index),
+                    payload: Data(
+                        count: NoiseSecurityConstants.maxMessageSize
+                            + NoiseSecurityConstants.transportCiphertextOverhead
+                    )
+                ),
+                from: remotePeerID
+            )
+        }
+        #expect(recorder.decryptCalls.count == 4)
+
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.privateMessage.rawValue, 0xCA, 0xFE])
+        )
+        handler.handleSessionAuthenticated(remotePeerID)
+
+        // Only the three post-reset packets replay; the pre-panic packet does
+        // not survive into the replacement session.
+        #expect(recorder.decryptCalls.count == 7)
+        #expect(recorder.deliveries.count == 3)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func ciphertextQueuedAheadOfEstablishmentCallbackDoesNotConsumeNonce()
+        throws {
+        let alice = NoiseEncryptionService(keychain: MockKeychain())
+        let bob = NoiseEncryptionService(keychain: MockKeychain())
+        let alicePeerID = PeerID(
+            publicKey: alice.getStaticPublicKeyData()
+        )
+        let bobPeerID = PeerID(publicKey: bob.getStaticPublicKeyData())
+
+        let message1 = try alice.initiateHandshake(with: bobPeerID)
+        let message2 = try #require(
+            try bob.processHandshakeMessage(
+                from: alicePeerID,
+                message: message1
+            )
+        )
+        let message3 = try #require(
+            try alice.processHandshakeMessage(
+                from: bobPeerID,
+                message: message2
+            )
+        )
+        let typedPayload = Data([
+            NoisePayloadType.privateMessage.rawValue,
+            0xCA, 0xFE
+        ])
+        let ciphertext = try alice.encrypt(
+            typedPayload,
+            for: bobPeerID
+        )
+
+        // Manager promotion has completed, but the serialized BLE callback is
+        // deliberately still behind this ciphertext.
+        _ = try bob.processHandshakeMessage(
+            from: alicePeerID,
+            message: message3
+        )
+        let recorder = Recorder()
+        recorder.transportGenerationReady = false
+        let handler = makeServiceBackedHandler(
+            service: bob,
+            localPeerID: bobPeerID,
+            recorder: recorder,
+            transportGenerationIsReady: { _ in
+                recorder.transportGenerationReady
+            }
+        )
+        let packet = makeEncryptedPacket(
+            recipientID: Data(hexString: bobPeerID.id),
+            payload: ciphertext
+        )
+
+        handler.handleEncrypted(packet, from: alicePeerID)
+        #expect(recorder.deliveries.isEmpty)
+        #expect(recorder.clearedSessions.isEmpty)
+
+        // The exact ciphertext must still authenticate, proving the readiness
+        // rejection happened before the receive nonce was consumed.
+        recorder.transportGenerationReady = true
+        handler.handleSessionAuthenticated(alicePeerID)
+
+        #expect(recorder.decryptCalls.count == 2)
+        #expect(recorder.deliveries.count == 1)
+        #expect(recorder.deliveries.first?.type == .privateMessage)
+        #expect(recorder.deliveries.first?.payload == Data([0xCA, 0xFE]))
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func ciphertextQueuedAheadOfRestoreCallbackDoesNotConsumeNonce()
+        throws {
+        let alice = NoiseEncryptionService(keychain: MockKeychain())
+        let bob = NoiseEncryptionService(keychain: MockKeychain())
+        let mallory = NoiseEncryptionService(keychain: MockKeychain())
+        let alicePeerID = PeerID(
+            publicKey: alice.getStaticPublicKeyData()
+        )
+        let bobPeerID = PeerID(publicKey: bob.getStaticPublicKeyData())
+
+        let initial1 = try alice.initiateHandshake(with: bobPeerID)
+        let initial2 = try #require(
+            try bob.processHandshakeMessage(
+                from: alicePeerID,
+                message: initial1
+            )
+        )
+        let initial3 = try #require(
+            try alice.processHandshakeMessage(
+                from: bobPeerID,
+                message: initial2
+            )
+        )
+        _ = try bob.processHandshakeMessage(
+            from: alicePeerID,
+            message: initial3
+        )
+        let typedPayload = Data([
+            NoisePayloadType.privateMessage.rawValue,
+            0xBE, 0xEF
+        ])
+        let delayedCiphertext = try alice.encrypt(
+            typedPayload,
+            for: bobPeerID
+        )
+
+        let forged1 = try mallory.initiateHandshake(with: bobPeerID)
+        let forged2 = try #require(
+            try bob.processHandshakeMessage(
+                from: alicePeerID,
+                message: forged1
+            )
+        )
+        let forged3 = try #require(
+            try mallory.processHandshakeMessage(
+                from: bobPeerID,
+                message: forged2
+            )
+        )
+        #expect(throws: NoiseSessionError.peerIdentityMismatch) {
+            try bob.processHandshakeMessage(
+                from: alicePeerID,
+                message: forged3
+            )
+        }
+        #expect(bob.hasEstablishedSession(with: alicePeerID))
+
+        let recorder = Recorder()
+        recorder.transportGenerationReady = false
+        let handler = makeServiceBackedHandler(
+            service: bob,
+            localPeerID: bobPeerID,
+            recorder: recorder,
+            transportGenerationIsReady: { _ in
+                recorder.transportGenerationReady
+            }
+        )
+        let packet = makeEncryptedPacket(
+            recipientID: Data(hexString: bobPeerID.id),
+            payload: delayedCiphertext
+        )
+
+        // Manager rollback is visible, while the BLE restore callback is
+        // deliberately still queued behind this ciphertext.
+        handler.handleEncrypted(packet, from: alicePeerID)
+        #expect(recorder.deliveries.isEmpty)
+        #expect(recorder.clearedSessions.isEmpty)
+
+        recorder.transportGenerationReady = true
+        handler.handleSessionAuthenticated(alicePeerID)
+
+        #expect(recorder.decryptCalls.count == 2)
+        #expect(recorder.deliveries.count == 1)
+        #expect(recorder.deliveries.first?.type == .privateMessage)
+        #expect(recorder.deliveries.first?.payload == Data([0xBE, 0xEF]))
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func oversizedCiphertextCannotEvictEstablishedTransport() throws {
+        let pair = try establishedServices()
+        let recorder = Recorder()
+        recorder.transportGenerationReady = true
+        let handler = makeServiceBackedHandler(
+            service: pair.receiver,
+            localPeerID: pair.receiverPeerID,
+            recorder: recorder,
+            transportGenerationIsReady: { _ in
+                recorder.transportGenerationReady
+            }
+        )
+
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: pair.receiverPeerID.id),
+                payload: Data(
+                    count:
+                        NoiseSecurityConstants
+                            .maxPrivateFileCiphertextSize + 1
+                )
+            ),
+            from: pair.senderPeerID
+        )
+        #expect(
+            pair.receiver.hasEstablishedSession(with: pair.senderPeerID)
+        )
+        #expect(recorder.clearedSessions.isEmpty)
+
+        let valid = try pair.sender.encrypt(
+            Data([NoisePayloadType.privateMessage.rawValue, 0x01]),
+            for: pair.receiverPeerID
+        )
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: pair.receiverPeerID.id),
+                payload: valid
+            ),
+            from: pair.senderPeerID
+        )
+
+        #expect(recorder.deliveries.count == 1)
+        #expect(recorder.deliveries.first?.payload == Data([0x01]))
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func forgedAuthenticationFailureCannotEvictEstablishedTransport()
+        throws {
+        let pair = try establishedServices()
+        let recorder = Recorder()
+        recorder.transportGenerationReady = true
+        let handler = makeServiceBackedHandler(
+            service: pair.receiver,
+            localPeerID: pair.receiverPeerID,
+            recorder: recorder,
+            transportGenerationIsReady: { _ in
+                recorder.transportGenerationReady
+            }
+        )
+        let valid = try pair.sender.encrypt(
+            Data([NoisePayloadType.privateMessage.rawValue, 0x02]),
+            for: pair.receiverPeerID
+        )
+        var forged = valid
+        forged[forged.index(before: forged.endIndex)] ^= 0xFF
+
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: pair.receiverPeerID.id),
+                payload: forged
+            ),
+            from: pair.senderPeerID
+        )
+        #expect(
+            pair.receiver.hasEstablishedSession(with: pair.senderPeerID)
+        )
+        #expect(recorder.clearedSessions.isEmpty)
+
+        // Authentication failure leaves nonce state untouched, so the exact
+        // original ciphertext remains valid.
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: pair.receiverPeerID.id),
+                payload: valid
+            ),
+            from: pair.senderPeerID
+        )
+
+        #expect(recorder.deliveries.count == 1)
+        #expect(recorder.deliveries.first?.payload == Data([0x02]))
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func replayCannotEvictEstablishedTransportOrBlockNextNonce() throws {
+        let pair = try establishedServices()
+        let recorder = Recorder()
+        recorder.transportGenerationReady = true
+        let handler = makeServiceBackedHandler(
+            service: pair.receiver,
+            localPeerID: pair.receiverPeerID,
+            recorder: recorder,
+            transportGenerationIsReady: { _ in
+                recorder.transportGenerationReady
+            }
+        )
+        let first = try pair.sender.encrypt(
+            Data([NoisePayloadType.privateMessage.rawValue, 0x03]),
+            for: pair.receiverPeerID
+        )
+        let firstPacket = makeEncryptedPacket(
+            recipientID: Data(hexString: pair.receiverPeerID.id),
+            payload: first
+        )
+
+        handler.handleEncrypted(firstPacket, from: pair.senderPeerID)
+        handler.handleEncrypted(firstPacket, from: pair.senderPeerID)
+        #expect(
+            pair.receiver.hasEstablishedSession(with: pair.senderPeerID)
+        )
+        #expect(recorder.clearedSessions.isEmpty)
+
+        let next = try pair.sender.encrypt(
+            Data([NoisePayloadType.privateMessage.rawValue, 0x04]),
+            for: pair.receiverPeerID
+        )
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: pair.receiverPeerID.id),
+                payload: next
+            ),
+            from: pair.senderPeerID
+        )
+
+        #expect(recorder.deliveries.count == 2)
+        #expect(recorder.deliveries.map { $0.payload } == [
+            Data([0x03]), Data([0x04])
+        ])
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func rateLimitFailureCannotEvictEstablishedTransportOrConsumeNonce()
+        throws {
+        let pair = try establishedServices()
+        let recorder = Recorder()
+        recorder.transportGenerationReady = true
+        recorder.forcedServiceDecryptError =
+            NoiseSecurityError.rateLimitExceeded
+        let handler = makeServiceBackedHandler(
+            service: pair.receiver,
+            localPeerID: pair.receiverPeerID,
+            recorder: recorder,
+            transportGenerationIsReady: { _ in
+                recorder.transportGenerationReady
+            }
+        )
+        let valid = try pair.sender.encrypt(
+            Data([NoisePayloadType.privateMessage.rawValue, 0x05]),
+            for: pair.receiverPeerID
+        )
+
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: pair.receiverPeerID.id),
+                payload: Data(repeating: 0xA5, count: 20)
+            ),
+            from: pair.senderPeerID
+        )
+        #expect(
+            pair.receiver.hasEstablishedSession(with: pair.senderPeerID)
+        )
+        #expect(recorder.clearedSessions.isEmpty)
+
+        recorder.forcedServiceDecryptError = nil
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: pair.receiverPeerID.id),
+                payload: valid
+            ),
+            from: pair.senderPeerID
+        )
+
+        #expect(recorder.deliveries.count == 1)
+        #expect(recorder.deliveries.first?.payload == Data([0x05]))
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func maximumPrivateFileCiphertextIsEligibleForDeferredRetry() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(
+            CryptoKitError.authenticationFailure
+        )
+        let handler = makeHandler(recorder: recorder)
+        let encrypted = makeEncryptedPacket(
+            recipientID: Data(hexString: localPeerID.id),
+            payload: Data(
+                count: NoiseSecurityConstants.maxPrivateFileCiphertextSize
+            )
+        )
+
+        handler.handleEncrypted(encrypted, from: remotePeerID)
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.privateFile.rawValue, 0x01])
+        )
+        handler.handleSessionAuthenticated(remotePeerID)
+
+        #expect(recorder.decryptCalls.count == 2)
+        #expect(recorder.deliveries.count == 1)
+        #expect(recorder.deliveries.first?.type == .privateFile)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func oversizedEarlyCiphertextIsNotDeferred() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(
+            CryptoKitError.authenticationFailure
+        )
+        let handler = makeHandler(recorder: recorder)
+        let encrypted = makeEncryptedPacket(
+            recipientID: Data(hexString: localPeerID.id),
+            payload: Data(
+                count:
+                    NoiseSecurityConstants.maxPrivateFileCiphertextSize + 1
+            )
+        )
+
+        handler.handleEncrypted(encrypted, from: remotePeerID)
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.delivered.rawValue, 0x01])
+        )
+        handler.handleSessionAuthenticated(remotePeerID)
+
+        #expect(recorder.decryptCalls.count == 1)
+        #expect(recorder.deliveries.isEmpty)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func missingSessionCiphertextIsRetriedAfterResponderHandshakeCompletes() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(
+            NoiseEncryptionError.sessionNotEstablished
+        )
+        let handler = makeHandler(recorder: recorder)
+        let encrypted = makeEncryptedPacket(
+            recipientID: Data(hexString: localPeerID.id)
+        )
+
+        handler.handleEncrypted(encrypted, from: remotePeerID)
+        #expect(recorder.decryptCalls.count == 1)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.delivered.rawValue, 0x01])
+        )
+        handler.handleSessionAuthenticated(remotePeerID)
+
+        #expect(recorder.decryptCalls.count == 2)
+        #expect(recorder.deliveries.count == 1)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func lowNonceCiphertextIsRetriedAfterResponderHandshakeCompletes() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(NoiseError.replayDetected)
+        let handler = makeHandler(recorder: recorder)
+        let encrypted = makeEncryptedPacket(
+            recipientID: Data(hexString: localPeerID.id)
+        )
+
+        handler.handleEncrypted(encrypted, from: remotePeerID)
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.readReceipt.rawValue, 0x02])
+        )
+        handler.handleSessionAuthenticated(remotePeerID)
+
+        #expect(recorder.decryptCalls.count == 2)
+        #expect(recorder.deliveries.count == 1)
+        #expect(recorder.deliveries.first?.type == .readReceipt)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func invalidDeferredCiphertextDoesNotClearAuthenticatedSession() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(
+            CryptoKitError.authenticationFailure
+        )
+        let handler = makeHandler(recorder: recorder)
+        let encrypted = makeEncryptedPacket(
+            recipientID: Data(hexString: localPeerID.id)
+        )
+
+        handler.handleEncrypted(encrypted, from: remotePeerID)
+        recorder.awaitingResponderHandshake = false
+        handler.handleSessionAuthenticated(remotePeerID)
+
+        #expect(recorder.decryptCalls.count == 2)
+        #expect(recorder.deliveries.isEmpty)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func nonCipherFailureDuringResponderHandshakeIsDroppedNotDeferred() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(TestError())
+        let handler = makeHandler(recorder: recorder)
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: localPeerID.id)
+            ),
+            from: remotePeerID
+        )
+
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.delivered.rawValue, 0x01])
+        )
+        handler.handleSessionAuthenticated(remotePeerID)
+
+        #expect(recorder.decryptCalls.count == 1)
+        #expect(recorder.deliveries.isEmpty)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func earlyCiphertextBufferIsBoundedPerPeer() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(
+            CryptoKitError.authenticationFailure
+        )
+        let handler = makeHandler(recorder: recorder)
+
+        for index in 0..<5 {
+            handler.handleEncrypted(
+                makeEncryptedPacket(
+                    recipientID: Data(hexString: localPeerID.id),
+                    timestamp: UInt64(900_000 + index)
+                ),
+                from: remotePeerID
+            )
+        }
+        #expect(recorder.decryptCalls.count == 5)
+
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.delivered.rawValue, 0x01])
+        )
+        handler.handleSessionAuthenticated(remotePeerID)
+
+        #expect(recorder.decryptCalls.count == 9)
+        #expect(recorder.deliveries.count == 4)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func earlyCiphertextBufferIsBoundedGlobally() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(
+            CryptoKitError.authenticationFailure
+        )
+        let handler = makeHandler(recorder: recorder)
+        let peers = (1...33).map {
+            PeerID(str: String(format: "%016llx", UInt64($0)))
+        }
+        let packet = makeEncryptedPacket(
+            recipientID: Data(hexString: localPeerID.id)
+        )
+
+        for peerID in peers {
+            handler.handleEncrypted(packet, from: peerID)
+        }
+        #expect(recorder.decryptCalls.count == 33)
+
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.delivered.rawValue, 0x01])
+        )
+        for peerID in peers {
+            handler.handleSessionAuthenticated(peerID)
+        }
+
+        #expect(recorder.decryptCalls.count == 65)
+        #expect(recorder.deliveries.count == 32)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func earlyCiphertextBufferKeepsPrivateFileRoomAndByteBound() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(
+            CryptoKitError.authenticationFailure
+        )
+        let handler = makeHandler(recorder: recorder)
+        let peers = [
+            PeerID(str: "0000000000000001"),
+            PeerID(str: "0000000000000002"),
+            PeerID(str: "0000000000000003")
+        ]
+
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: localPeerID.id),
+                payload: Data(
+                    count:
+                        NoiseSecurityConstants.maxPrivateFileCiphertextSize
+                )
+            ),
+            from: peers[0]
+        )
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: localPeerID.id),
+                payload: Data(count: 256 * 1024)
+            ),
+            from: peers[1]
+        )
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: localPeerID.id),
+                payload: Data([0x01])
+            ),
+            from: peers[2]
+        )
+
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.delivered.rawValue, 0x01])
+        )
+        for peerID in peers {
+            handler.handleSessionAuthenticated(peerID)
+        }
+
+        #expect(recorder.decryptCalls.count == 5)
+        #expect(recorder.deliveries.count == 2)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func expiredEarlyCiphertextIsNotRetried() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(
+            CryptoKitError.authenticationFailure
+        )
+        let handler = makeHandler(recorder: recorder)
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: localPeerID.id)
+            ),
+            from: remotePeerID
+        )
+
+        recorder.currentDate =
+            recorder.currentDate.addingTimeInterval(
+                NoiseSecurityConstants.ordinaryResponderHandshakeTimeout
+                    + 0.001
+            )
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.delivered.rawValue, 0x01])
+        )
+        handler.handleSessionAuthenticated(remotePeerID)
+
+        #expect(recorder.decryptCalls.count == 1)
+        #expect(recorder.deliveries.isEmpty)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
+    @Test
+    func earlyCiphertextSurvivesResponderHandshakeWindow() {
+        let recorder = Recorder()
+        recorder.hasSession = true
+        recorder.awaitingResponderHandshake = true
+        recorder.decryptResult = .failure(
+            CryptoKitError.authenticationFailure
+        )
+        let handler = makeHandler(recorder: recorder)
+        handler.handleEncrypted(
+            makeEncryptedPacket(
+                recipientID: Data(hexString: localPeerID.id)
+            ),
+            from: remotePeerID
+        )
+
+        recorder.currentDate =
+            recorder.currentDate.addingTimeInterval(
+                NoiseSecurityConstants.ordinaryResponderHandshakeTimeout
+                    - 0.001
+            )
+        recorder.awaitingResponderHandshake = false
+        recorder.decryptResult = .success(
+            Data([NoisePayloadType.delivered.rawValue, 0x01])
+        )
+        handler.handleSessionAuthenticated(remotePeerID)
+
+        #expect(recorder.decryptCalls.count == 2)
+        #expect(recorder.deliveries.count == 1)
+        #expect(recorder.clearedSessions.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+    }
+
     private func makeHandshakePacket(recipientID: Data?) -> BitchatPacket {
         BitchatPacket(
             type: MessageType.noiseHandshake.rawValue,
@@ -360,14 +1294,15 @@ struct BLENoisePacketHandlerTests {
 
     private func makeEncryptedPacket(
         recipientID: Data?,
-        timestamp: UInt64 = 900_000
+        timestamp: UInt64 = 900_000,
+        payload: Data = Data([0xC0, 0xFF, 0xEE])
     ) -> BitchatPacket {
         BitchatPacket(
             type: MessageType.noiseEncrypted.rawValue,
             senderID: Data(hexString: remotePeerID.id) ?? Data(),
             recipientID: recipientID,
             timestamp: timestamp,
-            payload: Data([0xC0, 0xFF, 0xEE]),
+            payload: payload,
             signature: nil,
             ttl: TransportConfig.messageTTLDefault
         )

bitchatTests/Services/BLENoiseReconnectPolicyTests.swift

@@ -0,0 +1,115 @@
+import BitFoundation
+import Foundation
+import Testing
+@testable import bitchat
+
+@Suite("BLE Noise reconnect policy")
+struct BLENoiseReconnectPolicyTests {
+    @Test("Revalidation requires a cached session and no authenticated link")
+    func revalidationPreconditions() {
+        var policy = BLENoiseReconnectPolicy()
+        let link = BLEIngressLinkID.peripheral("peripheral-a")
+        let now = Date(timeIntervalSince1970: 1_000)
+
+        let withoutSession = policy.shouldRevalidate(
+            on: link,
+            hasEstablishedSession: false,
+            isNoiseAuthenticatedLink: false,
+            hasAuthenticatedPeerLink: false,
+            now: now
+        )
+        #expect(!withoutSession)
+        let authenticated = policy.shouldRevalidate(
+            on: link,
+            hasEstablishedSession: true,
+            isNoiseAuthenticatedLink: true,
+            hasAuthenticatedPeerLink: true,
+            now: now
+        )
+        #expect(!authenticated)
+        let eligible = policy.shouldRevalidate(
+            on: link,
+            hasEstablishedSession: true,
+            isNoiseAuthenticatedLink: false,
+            hasAuthenticatedPeerLink: false,
+            now: now
+        )
+        #expect(eligible)
+    }
+
+    @Test("Revalidation is once per link epoch or after sixty seconds")
+    func revalidationIsBoundPerLinkEpoch() {
+        var policy = BLENoiseReconnectPolicy()
+        let link = BLEIngressLinkID.central("central-a")
+        let start = Date(timeIntervalSince1970: 2_000)
+
+        let initial = policy.shouldRevalidate(
+            on: link,
+            hasEstablishedSession: true,
+            isNoiseAuthenticatedLink: false,
+            hasAuthenticatedPeerLink: false,
+            now: start
+        )
+        #expect(initial)
+        let duringCooldown = policy.shouldRevalidate(
+            on: link,
+            hasEstablishedSession: true,
+            isNoiseAuthenticatedLink: false,
+            hasAuthenticatedPeerLink: false,
+            now: start.addingTimeInterval(59.999)
+        )
+        #expect(!duringCooldown)
+        let afterCooldown = policy.shouldRevalidate(
+            on: link,
+            hasEstablishedSession: true,
+            isNoiseAuthenticatedLink: false,
+            hasAuthenticatedPeerLink: false,
+            now: start.addingTimeInterval(60)
+        )
+        #expect(afterCooldown)
+
+        policy.endLinkEpoch(link)
+        let nextEpoch = policy.shouldRevalidate(
+            on: link,
+            hasEstablishedSession: true,
+            isNoiseAuthenticatedLink: false,
+            hasAuthenticatedPeerLink: false,
+            now: start.addingTimeInterval(60.001)
+        )
+        #expect(nextEpoch)
+    }
+
+    @Test("An authenticated sibling suppresses redundant reconnect")
+    func authenticatedSiblingSuppressesReconnect() {
+        var policy = BLENoiseReconnectPolicy()
+        let link = BLEIngressLinkID.peripheral("unproven-sibling")
+        let start = Date(timeIntervalSince1970: 3_000)
+
+        let suppressed = policy.shouldRevalidate(
+            on: link,
+            hasEstablishedSession: true,
+            isNoiseAuthenticatedLink: false,
+            hasAuthenticatedPeerLink: true,
+            now: start
+        )
+        #expect(!suppressed)
+        let eligible = policy.shouldRevalidate(
+            on: link,
+            hasEstablishedSession: true,
+            isNoiseAuthenticatedLink: false,
+            hasAuthenticatedPeerLink: false,
+            now: start
+        )
+        #expect(eligible)
+    }
+
+    @Test("Reserved replacement bit is not advertised")
+    func reservedReplacementBitIsNotAdvertised() {
+        #expect(
+            !PeerCapabilities.localSupported.contains(
+                .nonDestructiveNoiseReplacement
+            )
+        )
+        #expect(PeerCapabilities.localSupported.contains(.privateMedia))
+    }
+}

localPackages/BitFoundation/Sources/BitFoundation/PeerCapabilities.swift

@@ -28,6 +28,11 @@ public struct PeerCapabilities: OptionSet, Equatable, Hashable, Sendable {
     /// before outer BLE fragmentation. Peers that omit this bit require the
     /// signed directed raw-file migration fallback.
     public static let privateMedia = PeerCapabilities(rawValue: 1 << 8)
+    /// Reserved for test builds that briefly advertised non-destructive Noise
+    /// replacement. Current clients intentionally do not advertise or act on
+    /// this bit; keep it decodable so the wire assignment is never reused.
+    public static let nonDestructiveNoiseReplacement =
+        PeerCapabilities(rawValue: 1 << 10)
 
     /// Minimal little-endian byte encoding; always at least one byte so an
     /// empty set is distinguishable from an absent TLV.

localPackages/BitFoundation/Tests/BitFoundationTests/PeerCapabilitiesTests.swift

@@ -20,6 +20,10 @@ struct PeerCapabilitiesTests {
 
         let high = PeerCapabilities(rawValue: 1 << 9)
         #expect(high.encoded() == Data([0x00, 0x02]))
+        #expect(
+            PeerCapabilities.nonDestructiveNoiseReplacement.encoded()
+                == Data([0x00, 0x04])
+        )
 
         let all: PeerCapabilities = [.prekeys, .wifiBulk, .gateway, .groups, .board, .vouch, .meshDiagnostics, .privateMedia]
         #expect(PeerCapabilities(encoded: all.encoded()) == all)