Scope authenticated delivery cleanup

* Add Persian (fa) localization and an in-app language picker

Persian was the one notable gap in the 29-language catalog. Translate all
381 strings (plus the share extension) with proper plural substitutions,
and register fa in knownRegions.

Settings gains a LANGUAGE section: a picker over every language the bundle
ships (native names via Locale), backed by an AppleLanguages override so
users can run bitchat in a language different from the device's. Localization
resolves at process start, so the picker surfaces a restart note.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Remove unused AppLanguageSettings.currentOverride (Periphery)

AppInfoView reads the override via @AppStorage, so the accessor was dead
code and failed the Periphery CI scan.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: jack <212554440+jackjackbits@users.noreply.github.com>

PRIVACY_POLICY.md

@@ -17,12 +17,12 @@ bitchat is designed for private, account-free communication. This policy describ
 
 1. **Identity and cryptographic keys**
    - Noise, signing, group, prekey, and optional Nostr identity material is generated locally.
-   - Secret keys are stored in the system keychain. Public keys are shared when required for messaging, verification, groups, or Nostr events.
-   - Keys remain until they are rotated, removed by the relevant feature, erased with panic wipe, or removed with the app.
+   - Secret keys are stored in the system keychain as device-only items. Public keys are shared when required for messaging, verification, groups, or Nostr events.
+   - Keys remain until they are rotated, removed by the relevant feature, or erased with panic wipe. Because operating-system keychains can outlive an uninstall, bitchat records a non-secret install marker and deletes surviving app keys before use after a later reinstall.
 
 2. **Nickname, preferences, and relationships**
    - Your nickname, settings, favorites, petnames, read-receipt identifiers, and bounded operational metadata are stored locally.
-   - The share extension can retain one item you choose to share in the app-group preferences for up to 24 hours. The app shows the destination and a preview for review; it does not send the item automatically. The item is cleared when you add it to the composer, cancel, panic-wipe, or it expires.
+   - The share extension briefly places content you choose to share in the app-group preferences so the main app can import it.
 
 3. **Private group state**
    - Group names, rosters, creator identity, and key epoch are stored as protected files in Application Support.
@@ -73,7 +73,7 @@ Private group members receive the group's name, roster, key epoch, and encrypted
 
 Internet-backed features are optional. When enabled or used:
 
-- Private fallback messages use encrypted NIP-17 gift wraps. Relays can observe event and network metadata but not the message plaintext.
+- Private fallback messages use BitChat's app-specific encrypted envelopes. This format is not NIP-17, NIP-44, or NIP-59 compatible. Relays can observe the recipient public-key tag, event timing and size, and network metadata, but not the message plaintext or stable sender identity.
 - Public location-channel messages, notes, notices, and presence include a geohash tag, event kind, timestamp, and a public key. A geohash reveals an approximate area; finer precision reveals a smaller area.
 - The optional mesh bridge publishes bridge-enabled public mesh messages and presence to a neighborhood rendezvous cell. Those messages are public to participants and relays for that cell. A per-message “nearby only” choice prevents that message from crossing the bridge.
 - Bridge courier drops contain opaque end-to-end encrypted envelopes and a rotating recipient tag. Relays still observe timing and network metadata.
@@ -103,7 +103,7 @@ Private and public features use different protections:
 
 - Mesh private sessions use Noise XX with X25519, ChaCha20-Poly1305, and SHA-256.
 - Private group messages use ChaCha20-Poly1305; group state and relevant mesh packets use Ed25519 signatures.
-- Nostr events use secp256k1 Schnorr signatures. NIP-44 v2 private payloads use secp256k1 key agreement, HKDF-SHA256, and XChaCha20-Poly1305.
+- Nostr events use secp256k1 Schnorr signatures. BitChat private envelopes use secp256k1 key agreement, HKDF-SHA256 with a BitChat-specific domain separator, and XChaCha20-Poly1305. The envelope format is proprietary, only interoperates with BitChat clients, and does not provide forward secrecy against later compromise of the recipient's static Nostr private key.
 - The persistent private-message outbox uses ChaCha20-Poly1305 with a key held in the keychain. Some other protected local identity state uses AES-GCM.
 - Public mesh, bridge, geohash, and board content is signed or authenticated as appropriate but is intentionally not confidential.
 
@@ -121,7 +121,7 @@ No cryptographic system can protect content after a recipient reads, copies, scr
 
 ## Your Controls
 
-- **Panic wipe:** Triple-tap the logo to clear local keys, sessions, preferences, groups, queues, carried mail, public archives, board data, and media managed by the app.
+- **Panic wipe:** Triple-tap the logo to synchronously cancel in-flight media work and clear local keys, sessions, preferences, groups, queues, carried mail, public archives, board data, and media managed by the app.
 - **Feature controls:** Location channels, mesh bridge, internet gateway, and related internet behaviors can be disabled in the app. Some already-published relay data cannot be recalled.
 - **System permissions:** Bluetooth, location, microphone, camera, and photo-library access can be revoked in system settings.
 - **No account:** The project operates no account record for you to request or export.

Package.swift

@@ -63,7 +63,11 @@ let package = Package(
                 // Only the vector fixture: declaring the whole "Noise"
                 // directory would claim its .swift test files as resources
                 // and silently drop them from compilation.
-                .process("Noise/NoiseTestVectors.json")
+                .process("Noise/NoiseTestVectors.json"),
+                // Frozen output produced by the released 733098bb private-DM
+                // implementation; proves receive compatibility independently
+                // of the refactored legacy generator.
+                .process("Nostr/Fixtures")
             ]
         )
     ]

README.md

@@ -19,7 +19,7 @@ This project is released into the public domain. See the [LICENSE](LICENSE) file
 - **Intelligent Message Routing**: Automatically chooses best transport (Bluetooth → Nostr fallback)
 - **Decentralized Mesh Network**: Automatic peer discovery and multi-hop message relay over Bluetooth LE
 - **Privacy First**: No accounts, no phone numbers, no persistent identifiers
-- **Private Message End-to-End Encryption**: [Noise Protocol](https://noiseprotocol.org) for mesh, NIP-17 for Nostr
+- **Private Message End-to-End Encryption**: [Noise Protocol](https://noiseprotocol.org) for mesh, BitChat private envelopes for Nostr fallback
 - **IRC-Style Commands**: Familiar `/slap`, `/msg`, `/who` style interface
 - **Universal App**: Native support for iOS and macOS
 - **Emergency Wipe**: Triple-tap to instantly clear all data
@@ -44,9 +44,50 @@ BitChat uses a **hybrid messaging architecture** with two complementary transpor
 - **Global Reach**: Connect with users worldwide via internet relays
 - **Location Channels**: Geographic chat rooms using geohash coordinates
 - **290+ Relay Network**: Distributed across the globe for reliability
-- **NIP-17 Encryption**: Gift-wrapped private messages for internet privacy
+- **BitChat Private Envelopes**: App-specific encrypted private messages over Nostr relays
 - **Ephemeral Keys**: Fresh cryptographic identity per geohash area
 
+BitChat's private-envelope format is proprietary and is **not** NIP-17,
+NIP-44, or NIP-59 compatible. It uses Nostr as a relay transport but only
+interoperates with BitChat clients. New envelopes use provisional,
+BitChat-specific public kind 1402 (not a formally reserved Nostr kind),
+encrypted inner kinds 1403/1404, and the `bitchat-pm-v1:` content prefix.
+For mixed-version delivery, clients publish both the primary kind-1402
+envelope and a compatibility kind-1059 copy. There is no date-based cutoff:
+kind 1059 must remain enabled until a coordinated iOS/Android release confirms
+that supported older clients have migrated. Receivers subscribe to both kinds
+and deduplicate the authenticated embedded BitChat payload.
+
+Private-envelope migration compatibility:
+
+| Sender | Receiver | Delivery path |
+| --- | --- | --- |
+| New iOS | New iOS | Kind 1402 is primary; the kind-1059 twin is deduplicated |
+| New iOS | Released iOS | Compatibility kind 1059 |
+| New iOS | Current Android | Compatibility kind 1059 |
+| Released iOS | New iOS | Kind 1059 with the released empty inner-tag shape |
+| Current Android | New iOS | Kind 1059 with exactly the authenticated recipient `p` tag |
+
+New kind-1402 envelopes require an empty inner tag list. The Android recipient
+tag exception is intentionally confined to legacy kind 1059 and accepts only
+the exact addressed recipient. Mailbox subscriptions cover the 24-hour
+delivery window plus Android's full 48-hour timestamp randomization and 15
+minutes of clock skew. Recovery uses
+one independent 500-event relay filter per wire kind so either format cannot
+consume the other's result budget.
+
+The two outbound migration copies are admitted to the relay queue as one
+protected batch. Queue pressure evicts ephemeral traffic first, never one copy
+of a private pair; if protected capacity is exhausted, the entire new pair is
+rejected as a whole. User-message rejection becomes a visible failed delivery;
+acknowledgements and favorite notifications retain the exact pair in a
+process-wide 256-entry bounded retry queue. A sustained outage beyond that
+bound evicts the oldest whole control pair with an explicit warning, never half
+a pair.
+If either socket write fails, the same queued pair remains pending and both
+copies are replayed on the replacement connection. A terminal relay target is
+pruned after bounded retries so one dead relay cannot wedge healthy delivery.
+
 ### Channel Types
 
 #### `mesh #bluetooth`
@@ -80,7 +121,7 @@ Private messages use **intelligent transport selection**:
 2. **Nostr Fallback** (when Bluetooth unavailable)
 
    - Uses recipient's Nostr public key
-   - NIP-17 gift-wrapping for privacy
+   - BitChat's app-specific private-envelope encryption
    - Routes through global relay network
 
 3. **Smart Queuing** (when neither available)

WHITEPAPER.md

@@ -25,7 +25,7 @@ bitchat is a decentralized, peer-to-peer messaging application for secure, priva
 Two transports implement a common `Transport` interface and are coordinated by a `MessageRouter`:
 
 * **BLE mesh** — every device is simultaneously a GATT central and peripheral, relaying packets in a controlled flood. No infrastructure, pairing, or accounts.
-* **Nostr** — private messages to mutual favorites travel as NIP-17 gift-wrapped events over public relays (over Tor where enabled), bridging separate meshes through the internet.
+* **Nostr** — private messages to mutual favorites travel in BitChat's app-specific encrypted envelopes over public relays (over Tor where enabled), bridging separate meshes through the internet.
 
 The router prefers a live mesh link, falls back to Nostr, and engages the courier system when neither can deliver promptly.
 
@@ -78,7 +78,9 @@ Courier envelopes are sealed to the recipient's *static* key with the one-way No
 
 ### 5.3 Nostr Path
 
-Private messages to mutual favorites are wrapped per NIP-17/NIP-59: a rumor (kind 14) sealed (kind 13) and gift-wrapped (kind 1059) under a throwaway ephemeral key, so relays learn neither sender nor content.
+Private messages to mutual favorites use BitChat's proprietary private-envelope protocol. An unsigned inner message (kind 1404) is encrypted and placed in a sender-signed seal (kind 1403); that seal is encrypted again inside a public envelope (kind 1402) signed by a one-time key. Kind 1402 is a provisional BitChat-specific assignment, not a formally reserved Nostr kind. Each encrypted content field is `bitchat-pm-v1:` followed by base64url of a 24-byte nonce, XChaCha20-Poly1305 ciphertext, and its 16-byte tag. Keys come from secp256k1 ECDH and HKDF-SHA256 with a BitChat-specific domain separator.
+
+This format is **not NIP-17, NIP-44, or NIP-59 compatible** and interoperates only with BitChat clients. The outer `p` tag exposes the recipient's Nostr public key to relays; the stable sender identity and plaintext remain inside authenticated ciphertext. New-format seal and envelope timestamps are randomized up to 15 minutes into the past, while the actual message timestamp is encrypted. Legacy Android envelopes can carry public-layer timestamps randomized across the preceding 48 hours. The protocol does not provide forward secrecy: compromise of the recipient's static Nostr private key can expose stored envelopes.
 
 ## 6. Store and Forward
 
@@ -105,7 +107,11 @@ Public broadcast messages are cached (1000 packets) and reconciled between peers
 
 ### 6.4 Nostr Mailboxes
 
-Gift-wrapped messages rest on Nostr relays; clients re-subscribe with a 24-hour lookback on reconnect, covering the both-devices-offline case for mutual favorites whenever either side touches the internet.
+BitChat private envelopes rest on Nostr relays; clients re-subscribe across the 24-hour delivery window plus the full 48-hour timestamp randomization used by deployed Android clients and 15 minutes of clock skew (72 hours 15 minutes total). During the rolling format migration, clients subscribe to both the provisional BitChat-specific kind 1402 and historical kind 1059. Recovery places the kinds in separate filters within one REQ, each with an independent 500-event limit, so traffic in one format cannot starve the other. Each logical payload is published first in the primary kind-1402 format and then as a compatibility legacy copy for older iOS and current Android clients. There is no calendar cutoff: legacy publication and reception remain until a coordinated cross-platform release confirms supported clients have migrated. Bounded dedup of the authenticated embedded payload collapses the migration pair at receivers.
+
+The relay send queue treats those two events as one protected batch. Capacity pressure removes ephemeral events before regular traffic and never evicts only one private-envelope copy. A queue containing only protected batches rejects a new pair as a whole: user messages surface a failed delivery, while acknowledgements and favorite notifications retain the exact pair in one process-wide 256-entry bounded-backoff retry queue shared by account and short-lived geohash transports. Sustained control-payload overflow evicts the oldest whole pair with an explicit warning rather than growing memory or splitting formats. After either socket write fails, the same pair remains pending and both copies are replayed on the replacement connection. Terminal relay targets are pruned after bounded connection retries; a batch that succeeded elsewhere retires normally, while an all-target failure returns to the transport's failure/retry policy. Receive-side dedup suppresses the replay if one copy had already reached the relay.
+
+Released iOS legacy envelopes use an empty inner tag list. Current Android legacy envelopes use exactly one inner `p` tag naming the recipient. The kind-1059 decoder accepts only those two shapes after authenticating the outer recipient and sender-signed seal; alternate recipients, duplicate tags, and extra tags are rejected. Kind 1402 remains strict and permits no inner tags.
 
 ### 6.5 Delivery Metrics
 
@@ -127,7 +133,7 @@ Bare local counters (deposits, handovers, sprays, opens, outbox flushes and drop
 * **Flooding abuse** is bounded by TTL clamps, deduplication, per-depositor quotas, connect-rate limits, and announce-rate limiting.
 * **Replay** of public broadcasts is bounded by the 6-hour acceptance window plus deduplication; private payloads are protected by Noise nonces.
 * **Metadata.** BLE proximity is inherently observable; ephemeral IDs and daily-rotating courier tags limit long-term correlation. Nostr traffic can ride Tor.
-* **No forward secrecy for sealed mail** (§5.2) is the main cryptographic trade-off of the offline path.
+* **No forward secrecy for sealed mail or Nostr envelopes** (§5.2–5.3) means compromise of a recipient's static key can expose retained ciphertext addressed to that key.
 
 ## 9. Future Work
 

bitchat.xcodeproj/project.pbxproj

@@ -70,7 +70,6 @@
 		A6E32D1B2E762EA70032EA8A /* Exceptions for "bitchat" folder in "bitchatShareExtension" target */ = {
 			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
 			membershipExceptions = (
-				Services/SharedContentHandoff.swift,
 				Services/TransportConfig.swift,
 			);
 			target = 57CA17A36A2532A6CFF367BB /* bitchatShareExtension */;
@@ -338,6 +337,7 @@
 				es,
 				ar,
 				de,
+				fa,
 				fr,
 				he,
 				id,

bitchat/App/AppArchitecture.swift

@@ -2,6 +2,11 @@ import BitFoundation
 import Combine
 import Foundation
 
+enum SharedContentKind: String, Sendable, Equatable {
+    case text
+    case url
+}
+
 enum RuntimeScenePhase: String, Sendable, Equatable {
     case active
     case inactive
@@ -20,7 +25,7 @@ enum AppEvent: Sendable, Equatable {
     case startupCompleted
     case scenePhaseChanged(RuntimeScenePhase)
     case openedURL(String)
-    case sharedContentReadyForReview(SharedContentKind)
+    case sharedContentAccepted(SharedContentKind)
     case notificationOpened(peerID: PeerID?)
     case deepLinkOpened(String)
     case torLifecycleChanged(TorLifecycleEvent)

bitchat/App/AppChromeModel.swift

@@ -20,19 +20,16 @@ final class AppChromeModel: ObservableObject {
     @Published var showScreenshotPrivacyWarning = false
 
     private let chatViewModel: ChatViewModel
-    private let onPanicWipe: () -> Void
     private var cancellables = Set<AnyCancellable>()
+    /// The composer owns capture state above ChatViewModel. ContentView
+    /// installs this hook so both panic entry points synchronously stop it.
+    private var prepareForPanic: (@MainActor () -> Void)?
 
     /// Bulletin-board coordinator, created on first use of the board sheet.
     private(set) lazy var boardManager = BoardManager(transport: chatViewModel.meshService)
 
-    init(
-        chatViewModel: ChatViewModel,
-        privateInboxModel: PrivateInboxModel,
-        onPanicWipe: @escaping () -> Void = {}
-    ) {
+    init(chatViewModel: ChatViewModel, privateInboxModel: PrivateInboxModel) {
         self.chatViewModel = chatViewModel
-        self.onPanicWipe = onPanicWipe
         self.nickname = chatViewModel.nickname
 
         bind(privateInboxModel: privateInboxModel)
@@ -103,8 +100,12 @@ final class AppChromeModel: ObservableObject {
         showScreenshotPrivacyWarning = true
     }
 
+    func setPanicPreparation(_ preparation: (@MainActor () -> Void)?) {
+        prepareForPanic = preparation
+    }
+
     func panicClearAllData() {
-        onPanicWipe()
+        prepareForPanic?()
         chatViewModel.panicClearAllData()
     }
 

bitchat/App/AppRuntime.swift

@@ -27,7 +27,6 @@ final class AppRuntime: ObservableObject {
     let peerListModel: PeerListModel
     let appChromeModel: AppChromeModel
     let boardAlertsModel: BoardAlertsModel
-    let sharedContentImportModel: SharedContentImportModel
 
     private let idBridge: NostrIdentityBridge
     private var cancellables = Set<AnyCancellable>()
@@ -42,8 +41,7 @@ final class AppRuntime: ObservableObject {
 
     init(
         keychain: KeychainManagerProtocol = KeychainManager.makeDefault(),
-        idBridge: NostrIdentityBridge = NostrIdentityBridge(),
-        sharedContentStore: SharedContentStore? = nil
+        idBridge: NostrIdentityBridge = NostrIdentityBridge()
     ) {
         self.idBridge = idBridge
         let conversations = ConversationStore()
@@ -86,20 +84,9 @@ final class AppRuntime: ObservableObject {
             peerIdentityStore: peerIdentityStore,
             locationPresenceStore: locationPresenceStore
         )
-        let resolvedSharedContentStore: SharedContentStore?
-        if let sharedContentStore {
-            resolvedSharedContentStore = sharedContentStore
-        } else if let sharedDefaults = UserDefaults(suiteName: BitchatApp.groupID) {
-            resolvedSharedContentStore = SharedContentStore(defaults: sharedDefaults)
-        } else {
-            resolvedSharedContentStore = nil
-        }
-        let sharedContentImportModel = SharedContentImportModel(store: resolvedSharedContentStore)
-        self.sharedContentImportModel = sharedContentImportModel
         self.appChromeModel = AppChromeModel(
             chatViewModel: self.chatViewModel,
-            privateInboxModel: self.privateInboxModel,
-            onPanicWipe: { sharedContentImportModel.discardAll() }
+            privateInboxModel: self.privateInboxModel
         )
         let chatViewModel = self.chatViewModel
         self.boardAlertsModel = BoardAlertsModel(
@@ -119,12 +106,16 @@ final class AppRuntime: ObservableObject {
                 }
             )
         )
-        GeoRelayDirectory.shared.prefetchIfNeeded()
+
+        if chatViewModel.networkActivationAllowed {
+            GeoRelayDirectory.shared.prefetchIfNeeded()
+        }
         bindRuntimeObservers()
         NotificationDelegate.shared.runtime = self
     }
 
     func start() {
+        guard chatViewModel.networkActivationAllowed else { return }
         guard !started else {
             checkForSharedContent()
             return
@@ -163,12 +154,14 @@ final class AppRuntime: ObservableObject {
     }
 
     func handleDidBecomeActiveNotification() {
+        guard chatViewModel.networkActivationAllowed else { return }
         chatViewModel.handleDidBecomeActive()
         checkForSharedContent()
     }
 
     #if os(macOS)
     func handleMacDidBecomeActiveNotification() {
+        guard chatViewModel.networkActivationAllowed else { return }
         record(.scenePhaseChanged(.active))
         chatViewModel.handleDidBecomeActive()
         checkForSharedContent()
@@ -187,6 +180,7 @@ final class AppRuntime: ObservableObject {
             didEnterBackground = true
 
         case .active:
+            guard chatViewModel.networkActivationAllowed else { return }
             record(.scenePhaseChanged(.active))
             chatViewModel.meshService.startServices()
             TorManager.shared.setAppForeground(true)
@@ -234,6 +228,7 @@ final class AppRuntime: ObservableObject {
         actionIdentifier: String = UNNotificationDefaultActionIdentifier,
         userInfo: [AnyHashable: Any]
     ) {
+        guard chatViewModel.networkActivationAllowed else { return }
         if actionIdentifier == NotificationService.waveActionID {
             chatViewModel.sendMeshWave()
             return
@@ -285,6 +280,8 @@ private extension AppRuntime {
         NotificationCenter.default.publisher(for: .TorWillRestart)
             .receive(on: DispatchQueue.main)
             .sink { [weak self] _ in
+                guard self?.chatViewModel.networkActivationAllowed == true
+                else { return }
                 self?.record(.torLifecycleChanged(.willRestart))
                 self?.chatViewModel.handleTorWillRestart()
             }
@@ -293,6 +290,8 @@ private extension AppRuntime {
         NotificationCenter.default.publisher(for: .TorDidBecomeReady)
             .receive(on: DispatchQueue.main)
             .sink { [weak self] _ in
+                guard self?.chatViewModel.networkActivationAllowed == true
+                else { return }
                 self?.record(.torLifecycleChanged(.didBecomeReady))
                 self?.chatViewModel.handleTorDidBecomeReady()
             }
@@ -301,6 +300,8 @@ private extension AppRuntime {
         NotificationCenter.default.publisher(for: .TorWillStart)
             .receive(on: DispatchQueue.main)
             .sink { [weak self] _ in
+                guard self?.chatViewModel.networkActivationAllowed == true
+                else { return }
                 self?.record(.torLifecycleChanged(.willStart))
                 self?.chatViewModel.handleTorWillStart()
             }
@@ -309,6 +310,8 @@ private extension AppRuntime {
         NotificationCenter.default.publisher(for: .TorUserPreferenceChanged)
             .receive(on: DispatchQueue.main)
             .sink { [weak self] notification in
+                guard self?.chatViewModel.networkActivationAllowed == true
+                else { return }
                 self?.record(.torLifecycleChanged(.preferenceChanged))
                 self?.chatViewModel.handleTorPreferenceChanged(notification)
             }
@@ -325,22 +328,45 @@ private extension AppRuntime {
     }
 
     func checkForSharedContent() {
-        let previousID = sharedContentImportModel.offer?.id
-        guard let payload = sharedContentImportModel.refresh(
-            destination: currentSharedContentDestination
-        ) else { return }
-
-        if previousID != payload.id {
-            record(.sharedContentReadyForReview(payload.kind))
+        guard chatViewModel.networkActivationAllowed else { return }
+        guard let userDefaults = UserDefaults(suiteName: BitchatApp.groupID) else { return }
+        let clearSharedContent = {
+            userDefaults.removeObject(forKey: "sharedContent")
+            userDefaults.removeObject(forKey: "sharedContentType")
+            userDefaults.removeObject(forKey: "sharedContentDate")
         }
-    }
 
-    var currentSharedContentDestination: SharedContentDestination {
-        SharedContentDestination.resolve(
-            selectedPrivatePeerID: privateConversationModel.selectedPeerID,
-            privateDisplayName: privateConversationModel.selectedHeaderState?.displayName,
-            activeChannel: locationChannelsModel.selectedChannel
-        )
+        guard let sharedContent = userDefaults.string(forKey: "sharedContent"),
+              let sharedDate = userDefaults.object(forKey: "sharedContentDate") as? Date else {
+            // A partial or malformed handoff must not linger in the shared
+            // app-group container indefinitely.
+            clearSharedContent()
+            return
+        }
+
+        guard Date().timeIntervalSince(sharedDate) < TransportConfig.uiShareAcceptWindowSeconds else {
+            clearSharedContent()
+            return
+        }
+
+        let contentKind = SharedContentKind(rawValue: userDefaults.string(forKey: "sharedContentType") ?? "") ?? .text
+
+        clearSharedContent()
+
+        switch contentKind {
+        case .url:
+            if let data = sharedContent.data(using: .utf8),
+               let urlData = try? JSONSerialization.jsonObject(with: data) as? [String: String],
+               let url = urlData["url"] {
+                chatViewModel.sendMessage(url)
+            } else {
+                chatViewModel.sendMessage(sharedContent)
+            }
+        case .text:
+            chatViewModel.sendMessage(sharedContent)
+        }
+
+        record(.sharedContentAccepted(contentKind))
     }
 
     func handleNostrRelayConnectionChanged(_ isConnected: Bool) {
@@ -349,7 +375,9 @@ private extension AppRuntime {
         let becameConnected = isConnected && !lastNostrRelayConnectedState
         lastNostrRelayConnectedState = isConnected
 
-        guard started, becameConnected else { return }
+        guard chatViewModel.networkActivationAllowed,
+              started,
+              becameConnected else { return }
 
         let isInitialConnection = !didHandleInitialNostrConnection
         didHandleInitialNostrConnection = true

bitchat/App/ConversationStore.swift

@@ -426,6 +426,40 @@ final class ConversationStore: ObservableObject {
     @discardableResult
     func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool {
         guard let ids = conversationIDsByMessageID[messageID] else { return false }
+        return applyDeliveryStatus(status, forMessageID: messageID, among: ids)
+    }
+
+    /// Applies an authenticated delivery/read receipt only to the supplied
+    /// direct-conversation aliases. A colliding message ID in another peer's
+    /// conversation (or a public timeline) must not inherit the receipt.
+    ///
+    /// Stable and ephemeral aliases can temporarily hold the same message
+    /// instance during handoff. The shared helper republishes every targeted
+    /// alias even when the first mutation already changed that instance.
+    @discardableResult
+    func setDeliveryStatus(
+        _ status: DeliveryStatus,
+        forMessageID messageID: String,
+        inDirectPeerAliases peerIDs: Set<PeerID>
+    ) -> Bool {
+        guard !peerIDs.isEmpty,
+              let indexedIDs = conversationIDsByMessageID[messageID] else {
+            return false
+        }
+        let allowedIDs = Set(peerIDs.map { ConversationID.directPeer($0) })
+        return applyDeliveryStatus(
+            status,
+            forMessageID: messageID,
+            among: indexedIDs.intersection(allowedIDs)
+        )
+    }
+
+    private func applyDeliveryStatus(
+        _ status: DeliveryStatus,
+        forMessageID messageID: String,
+        among ids: Set<ConversationID>
+    ) -> Bool {
+        guard !ids.isEmpty else { return false }
         var applied = false
         var skipped: [ConversationID] = []
         for id in ids {

bitchat/App/ConversationUIModel.swift

@@ -12,6 +12,7 @@ final class ConversationUIModel: ObservableObject {
     @Published private(set) var currentNickname: String
     @Published private(set) var isBatchingPublic = false
     @Published private(set) var canSendMediaInCurrentContext = true
+    @Published private(set) var legacyPrivateMediaConsentRequest: LegacyPrivateMediaConsentRequest?
     /// Who is talking live in the public mesh channel right now (floor
     /// courtesy: the composer mic tints "busy" while someone holds the floor).
     @Published private(set) var activeLiveVoiceTalker: String?
@@ -153,6 +154,13 @@ final class ConversationUIModel: ObservableObject {
         chatViewModel.sendVoiceNote(at: url)
     }
 
+    func resolveLegacyPrivateMediaConsent(requestID: UUID, approved: Bool) {
+        chatViewModel.resolveLegacyPrivateMediaConsent(
+            requestID: requestID,
+            approved: approved
+        )
+    }
+
     /// Capture backend for the mic gesture: live PTT when the current DM
     /// peer can hear it now, classic voice note otherwise.
     func makeVoiceCaptureSession() -> VoiceCaptureSession {
@@ -193,6 +201,10 @@ final class ConversationUIModel: ObservableObject {
             .receive(on: DispatchQueue.main)
             .assign(to: &$activeLiveVoiceTalker)
 
+        chatViewModel.$legacyPrivateMediaConsentRequest
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$legacyPrivateMediaConsentRequest)
+
         conversations.$activeChannel
             .receive(on: DispatchQueue.main)
             .sink { [weak self] channel in

bitchat/App/LocationPresenceStore.swift

@@ -7,45 +7,146 @@ final class LocationPresenceStore: ObservableObject {
     @Published private(set) var geoNicknames: [String: String] = [:]
     @Published private(set) var teleportedGeo: Set<String> = []
 
+    private let teleportedGeoCapacity: Int
+    private var teleportedGeoOrder: [String] = []
+    private let geoNicknameCapacity: Int
+    private var geoNicknameOrder: [String] = []
+
+    init(
+        teleportedGeoCapacity: Int = TransportConfig.geoTeleportedParticipantsCap,
+        geoNicknameCapacity: Int = TransportConfig.geoNicknameParticipantsCap
+    ) {
+        self.teleportedGeoCapacity = max(0, teleportedGeoCapacity)
+        self.geoNicknameCapacity = max(0, geoNicknameCapacity)
+    }
+
     func setCurrentGeohash(_ geohash: String?) {
-        currentGeohash = geohash?.lowercased()
+        let normalized = geohash?.lowercased()
+        if currentGeohash != normalized {
+            // Presence markers are scoped to the active geohash channel.
+            clearTeleportedGeo()
+            clearGeoNicknames()
+        }
+        currentGeohash = normalized
     }
 
     func setNickname(_ nickname: String, for pubkeyHex: String) {
-        geoNicknames[pubkeyHex.lowercased()] = nickname
+        guard geoNicknameCapacity > 0 else {
+            clearGeoNicknames()
+            return
+        }
+
+        let key = pubkeyHex.lowercased()
+        if geoNicknames[key] != nil {
+            geoNicknames[key] = nickname
+            return
+        }
+
+        while geoNicknameOrder.count >= geoNicknameCapacity, let oldest = geoNicknameOrder.first {
+            geoNicknameOrder.removeFirst()
+            geoNicknames.removeValue(forKey: oldest)
+        }
+
+        geoNicknames[key] = nickname
+        geoNicknameOrder.append(key)
     }
 
     func replaceGeoNicknames(_ nicknames: [String: String]) {
-        geoNicknames = Dictionary(
-            uniqueKeysWithValues: nicknames.map { key, value in
-                (key.lowercased(), value)
-            }
-        )
+        guard geoNicknameCapacity > 0 else {
+            clearGeoNicknames()
+            return
+        }
+
+        var seen: Set<String> = []
+        var ordered: [String] = []
+        var normalized: [String: String] = [:]
+        for (key, value) in nicknames {
+            let lower = key.lowercased()
+            guard seen.insert(lower).inserted else { continue }
+            ordered.append(lower)
+            normalized[lower] = value
+        }
+        if ordered.count > geoNicknameCapacity {
+            let kept = Array(ordered.suffix(geoNicknameCapacity))
+            ordered = kept
+            normalized = Dictionary(uniqueKeysWithValues: kept.compactMap { key in
+                normalized[key].map { (key, $0) }
+            })
+        }
+        geoNicknameOrder = ordered
+        geoNicknames = normalized
     }
 
     func clearGeoNicknames() {
         geoNicknames.removeAll()
+        geoNicknameOrder.removeAll()
+    }
+
+    func retainGeoNicknames(keeping pubkeys: Set<String>) {
+        let allowed = Set(pubkeys.map { $0.lowercased() })
+        geoNicknameOrder = geoNicknameOrder.filter { allowed.contains($0) }
+        geoNicknames = geoNicknames.filter { allowed.contains($0.key) }
     }
 
     func markTeleported(_ pubkeyHex: String) {
-        teleportedGeo.insert(pubkeyHex.lowercased())
+        guard teleportedGeoCapacity > 0 else {
+            clearTeleportedGeo()
+            return
+        }
+
+        let key = pubkeyHex.lowercased()
+        guard !teleportedGeo.contains(key) else { return }
+
+        while teleportedGeoOrder.count >= teleportedGeoCapacity, let oldest = teleportedGeoOrder.first {
+            teleportedGeoOrder.removeFirst()
+            teleportedGeo.remove(oldest)
+        }
+
+        teleportedGeo.insert(key)
+        teleportedGeoOrder.append(key)
     }
 
     func clearTeleported(_ pubkeyHex: String) {
-        teleportedGeo.remove(pubkeyHex.lowercased())
+        let key = pubkeyHex.lowercased()
+        teleportedGeo.remove(key)
+        teleportedGeoOrder.removeAll { $0 == key }
     }
 
     func replaceTeleportedGeo(_ pubkeys: Set<String>) {
-        teleportedGeo = Set(pubkeys.map { $0.lowercased() })
+        guard teleportedGeoCapacity > 0 else {
+            clearTeleportedGeo()
+            return
+        }
+
+        var seen: Set<String> = []
+        var ordered: [String] = []
+        for key in pubkeys.map({ $0.lowercased() }) where !seen.contains(key) {
+            seen.insert(key)
+            ordered.append(key)
+        }
+        if ordered.count > teleportedGeoCapacity {
+            ordered = Array(ordered.suffix(teleportedGeoCapacity))
+        }
+        teleportedGeoOrder = ordered
+        teleportedGeo = Set(ordered)
+    }
+
+    func retainTeleportedGeo(keeping pubkeys: Set<String>) {
+        let allowed = Set(pubkeys.map { $0.lowercased() })
+        teleportedGeoOrder = teleportedGeoOrder.filter { allowed.contains($0) }
+        teleportedGeo = teleportedGeo.intersection(allowed)
     }
 
     func clearTeleportedGeo() {
         teleportedGeo.removeAll()
+        teleportedGeoOrder.removeAll()
     }
 
     func reset() {
         currentGeohash = nil
         geoNicknames.removeAll()
+        geoNicknameOrder.removeAll()
         teleportedGeo.removeAll()
+        teleportedGeoOrder.removeAll()
     }
 }

bitchat/App/PrivateConversationModels.swift

@@ -265,10 +265,10 @@ final class PrivateConversationModel: ObservableObject {
         let headerPeerID = chatViewModel.getShortIDForNoiseKey(conversationPeerID)
         let peer = chatViewModel.getPeer(byID: headerPeerID)
         let displayName = resolveDisplayName(for: conversationPeerID, headerPeerID: headerPeerID, peer: peer)
-        // Geo DMs are always routed over Nostr (NIP-17); their nostr_ keys
-        // never resolve to a reachable mesh peer, so resolveAvailability would
-        // report .offline. Report .nostrAvailable so the header shows the
-        // globe instead of a misleading "offline" tag.
+        // Geo DMs are always routed through BitChat private envelopes over
+        // Nostr; their nostr_ keys never resolve to a reachable mesh peer, so
+        // resolveAvailability would report .offline. Report .nostrAvailable
+        // so the header shows the globe instead of a misleading "offline" tag.
         let availability = conversationPeerID.isGeoDM
             ? .nostrAvailable
             : resolveAvailability(for: headerPeerID, peer: peer)

bitchat/App/SharedContentImportModel.swift

@@ -1,119 +0,0 @@
-import BitFoundation
-import Combine
-import Foundation
-
-enum SharedContentDestination: Sendable, Equatable {
-    case mesh
-    case geohash(String)
-    case privateConversation(peerID: PeerID, displayName: String)
-
-    static func resolve(
-        selectedPrivatePeerID: PeerID?,
-        privateDisplayName: String?,
-        activeChannel: ChannelID
-    ) -> SharedContentDestination {
-        if let selectedPrivatePeerID {
-            let fallback = String(selectedPrivatePeerID.id.prefix(12))
-            return .privateConversation(
-                peerID: selectedPrivatePeerID,
-                displayName: privateDisplayName?.trimmedOrNilIfEmpty ?? fallback
-            )
-        }
-
-        switch activeChannel {
-        case .mesh:
-            return .mesh
-        case .location(let channel):
-            return .geohash(channel.geohash.lowercased())
-        }
-    }
-
-    var displayName: String {
-        switch self {
-        case .mesh:
-            return "#mesh"
-        case .geohash(let geohash):
-            return "#\(geohash)"
-        case .privateConversation(_, let displayName):
-            return displayName
-        }
-    }
-}
-
-struct SharedContentOffer: Identifiable, Sendable, Equatable {
-    let payload: SharedContentPayload
-    let destination: SharedContentDestination
-
-    var id: UUID { payload.id }
-}
-
-/// Holds a pending extension handoff until the user chooses a destination and
-/// explicitly adds it to the composer. This type has no send dependency by
-/// design: confirming an import can never transmit a message.
-@MainActor
-final class SharedContentImportModel: ObservableObject {
-    @Published private(set) var offer: SharedContentOffer?
-
-    private let store: SharedContentStore?
-
-    init(store: SharedContentStore?) {
-        self.store = store
-    }
-
-    @discardableResult
-    func refresh(
-        destination: SharedContentDestination,
-        now: Date = Date()
-    ) -> SharedContentPayload? {
-        guard let payload = store?.pending(now: now) else {
-            offer = nil
-            return nil
-        }
-
-        let nextOffer = SharedContentOffer(payload: payload, destination: destination)
-        if offer != nextOffer {
-            offer = nextOffer
-        }
-        return payload
-    }
-
-    func updateDestination(_ destination: SharedContentDestination) {
-        guard let offer, offer.destination != destination else { return }
-        self.offer = SharedContentOffer(payload: offer.payload, destination: destination)
-    }
-
-    /// Returns composer text only when the currently displayed destination is
-    /// still current and the reviewed envelope is still the stored envelope.
-    /// A destination change updates the prompt and requires another tap.
-    func confirm(
-        destination: SharedContentDestination,
-        now: Date = Date()
-    ) -> String? {
-        guard let offer else { return nil }
-        guard offer.destination == destination else {
-            updateDestination(destination)
-            return nil
-        }
-        guard let payload = store?.consume(id: offer.id, now: now) else {
-            _ = refresh(destination: destination, now: now)
-            return nil
-        }
-
-        self.offer = nil
-        return payload.composerText
-    }
-
-    func cancel(destination: SharedContentDestination, now: Date = Date()) {
-        guard let offer else { return }
-        store?.discard(id: offer.id)
-        self.offer = nil
-        // If a newer share replaced the reviewed envelope, surface it rather
-        // than losing it with the older cancellation.
-        _ = refresh(destination: destination, now: now)
-    }
-
-    func discardAll() {
-        store?.discardAll()
-        offer = nil
-    }
-}

bitchat/BitchatApp.swift

@@ -41,7 +41,6 @@ struct BitchatApp: App {
                 .environmentObject(runtime.peerListModel)
                 .environmentObject(runtime.appChromeModel)
                 .environmentObject(runtime.boardAlertsModel)
-                .environmentObject(runtime.sharedContentImportModel)
                 .onAppear {
                     appDelegate.runtime = runtime
                     runtime.start()

bitchat/Features/voice/VoiceCaptureSession.swift

@@ -26,6 +26,8 @@ protocol VoiceCaptureSession: AnyObject {
     /// nothing valid was captured.
     func finish() async -> URL?
     func cancel() async
+    /// Stops capture and suppresses every later send before returning.
+    func panicCancelSynchronously()
 }
 
 /// The classic record-then-send backend, wrapping the shared `VoiceRecorder`.
@@ -55,6 +57,10 @@ final class VoiceNoteCaptureSession: VoiceCaptureSession {
     func cancel() async {
         await recorder.cancelRecording(owner: owner)
     }
+
+    func panicCancelSynchronously() {
+        recorder.panicCancelSynchronously(owner: owner)
+    }
 }
 
 /// Testable surface of the live capture engine. Production uses
@@ -216,6 +222,13 @@ final class PTTLiveVoiceSession: VoiceCaptureSession {
         }
     }
 
+    func panicCancelSynchronously() {
+        // Do not emit a canceled packet: it would itself be pre-panic
+        // conversation data racing the emergency transport reset.
+        completed = true
+        capture.cancel()
+    }
+
     private func sendControlPacket(_ kind: VoiceBurstPacket.Kind) {
         guard let packet = VoiceBurstPacket(burstID: burstID, seq: stream.packetizer.nextSeq, kind: kind) else { return }
         sendPacket(packet.encode())

bitchat/Features/voice/VoiceRecorder.swift

@@ -246,6 +246,21 @@ actor VoiceRecorder {
         currentURL = nil
     }
 
+    /// Panic is a synchronous security boundary: the caller must know the
+    /// microphone, audio-session lease, and partial file are gone before it
+    /// rotates identities or deletes the media tree. VoiceRecorder is an
+    /// independent actor and this cleanup path never hops to MainActor, so a
+    /// short semaphore join is safe even when invoked by the UI actor.
+    nonisolated
+    func panicCancelSynchronously(owner: RecordingOwner) {
+        let finished = DispatchSemaphore(value: 0)
+        Task {
+            await cancelRecording(owner: owner)
+            finished.signal()
+        }
+        finished.wait()
+    }
+
     /// The audio session was interrupted (call, Siri) or reconfigured: stop
     /// the recorder but keep `recorder`/`currentURL` so the caller's pending
     /// `stopRecording()` still returns the partial note.

bitchat/Identity/IdentityModels.swift

@@ -189,6 +189,18 @@ struct IdentityCache: Codable {
     // Fingerprint -> when we verified it (orders outgoing vouch batches;
     // entries verified before this field exists sort as oldest)
     var verifiedAt: [String: Date]? = nil
+
+    // Stable Noise fingerprints that proved encrypted private-media support
+    // inside an authenticated Noise session. Optional for decoding caches
+    // written before this migration. Entries are monotonic until a panic wipe
+    // so an old/replayed announce cannot silently downgrade a peer.
+    var privateMediaCapableFingerprints: Set<String>? = nil
+
+    // Noise-fingerprint -> Ed25519 announcement key, learned only from the
+    // authenticated peer-state payload. This prevents a self-signed announce
+    // containing a copied public Noise key from replacing a previously bound
+    // public-message signing identity. Optional for old cache compatibility.
+    var authenticatedSigningKeysByFingerprint: [String: Data]? = nil
 }
 
 //

bitchat/Identity/SecureIdentityStateManager.swift

@@ -140,6 +140,14 @@ protocol SecureIdentityStateManagerProtocol {
     func markVouchBatchSent(to fingerprint: String, at date: Date)
     func signingPublicKey(forFingerprint fingerprint: String) -> Data?
     func mostRecentlyVerifiedFingerprints(limit: Int, excluding fingerprint: String) -> [String]
+
+    // MARK: Noise-authenticated announcement identity
+    func bindAuthenticatedSigningPublicKey(_ signingPublicKey: Data, fingerprint: String)
+    func authenticatedSigningPublicKey(forFingerprint fingerprint: String) -> Data?
+
+    // MARK: Private-media downgrade protection
+    func markPrivateMediaCapable(fingerprint: String)
+    func hasObservedPrivateMediaCapability(fingerprint: String) -> Bool
 }
 
 /// Singleton manager for secure identity state persistence and retrieval.
@@ -157,6 +165,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     
     // Thread safety
     private let queue = DispatchQueue(label: "bitchat.identity.state", attributes: .concurrent)
+    private let queueSpecificKey = DispatchSpecificKey<UInt8>()
     
     // Pending-save coalescing flag. Reads/writes are serialized on `queue`.
     // Persistence is done with a fire-and-forget `queue.async(.barrier)` rather
@@ -214,6 +223,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
 
         self.encryptionKey = loadedKey
         self.encryptionKeyIsEphemeral = keyIsEphemeral
+        queue.setSpecific(key: queueSpecificKey, value: 1)
 
         // Only read the persisted cache when we hold the real key; with an
         // ephemeral key the decrypt would fail and discard the real cache.
@@ -370,6 +380,66 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
             return cryptographicIdentities.values.filter { $0.fingerprint.hasPrefix(peerID.id) }
         }
     }
+
+    // MARK: - Private-media downgrade protection
+
+    func markPrivateMediaCapable(fingerprint: String) {
+        guard !fingerprint.isEmpty else { return }
+        let insertAndPersist = {
+            var pinned = self.cache.privateMediaCapableFingerprints ?? []
+            guard pinned.insert(fingerprint).inserted else { return }
+            self.cache.privateMediaCapableFingerprints = pinned
+            self.saveIdentityCache()
+        }
+        // Downgrade decisions can run immediately after an authenticated
+        // announce. Make the pin visible before returning; merely enqueueing a
+        // barrier leaves a cross-queue window where a replay can look legacy.
+        // The queue-specific fast path prevents self-deadlock if a future
+        // identity-state mutation records the capability from inside `queue`.
+        if DispatchQueue.getSpecific(key: queueSpecificKey) != nil {
+            insertAndPersist()
+        } else {
+            queue.sync(flags: .barrier, execute: insertAndPersist)
+        }
+    }
+
+    func hasObservedPrivateMediaCapability(fingerprint: String) -> Bool {
+        guard !fingerprint.isEmpty else { return false }
+        return queue.sync {
+            cache.privateMediaCapableFingerprints?.contains(fingerprint) == true
+        }
+    }
+
+    // MARK: - Noise-authenticated announcement identity
+
+    func bindAuthenticatedSigningPublicKey(_ signingPublicKey: Data, fingerprint: String) {
+        guard signingPublicKey.count == AuthenticatedPeerStatePacket.signingPublicKeyLength,
+              !fingerprint.isEmpty else { return }
+        let bindAndPersist = {
+            var bindings = self.cache.authenticatedSigningKeysByFingerprint ?? [:]
+            let bindingChanged = bindings[fingerprint] != signingPublicKey
+            bindings[fingerprint] = signingPublicKey
+            self.cache.authenticatedSigningKeysByFingerprint = bindings
+            if var cryptoIdentity = self.cryptographicIdentities[fingerprint] {
+                cryptoIdentity.signingPublicKey = signingPublicKey
+                self.cryptographicIdentities[fingerprint] = cryptoIdentity
+            }
+            guard bindingChanged else { return }
+            self.saveIdentityCache()
+        }
+        if DispatchQueue.getSpecific(key: queueSpecificKey) != nil {
+            bindAndPersist()
+        } else {
+            queue.sync(flags: .barrier, execute: bindAndPersist)
+        }
+    }
+
+    func authenticatedSigningPublicKey(forFingerprint fingerprint: String) -> Data? {
+        guard !fingerprint.isEmpty else { return nil }
+        return queue.sync {
+            cache.authenticatedSigningKeysByFingerprint?[fingerprint]
+        }
+    }
     
     func updateSocialIdentity(_ identity: SocialIdentity) {
         queue.async(flags: .barrier) {

bitchat/Models/NoisePayload.swift

@@ -30,7 +30,7 @@ struct NoisePayload {
         
         // Safely get the first byte
         let firstByte = data[data.startIndex]
-        guard let type = NoisePayloadType(rawValue: firstByte) else {
+        guard let type = NoisePayloadType.decoded(rawValue: firstByte) else {
             return nil
         }
         

bitchat/Noise/NoiseSecurityConstants.swift

@@ -6,14 +6,60 @@
 // For more information, see <https://unlicense.org>
 //
 
+import BitFoundation
 import Foundation
 
 enum NoiseSecurityConstants {
     // Maximum message size to prevent memory exhaustion
     static let maxMessageSize = 65535 // 64KB as per Noise spec
+
+    /// The extracted transport nonce (4 bytes) and Poly1305 tag (16 bytes)
+    /// added by `NoiseCipherState` around every transport plaintext.
+    static let transportCiphertextOverhead = 20
+
+    /// Private files are an explicit BitChat extension to the ordinary Noise
+    /// message-size ceiling. They remain bounded by the same framed-file cap
+    /// used by the binary and fragment decoders. Only the `.privateFile`
+    /// typed-payload path is allowed to use this larger budget.
+    private static let privateFileOuterPacketOverhead =
+        (BinaryProtocol.v1HeaderSize + 2) // v2 adds two length bytes
+        + BinaryProtocol.senderIDSize
+        + BinaryProtocol.recipientIDSize
+    static let maxPrivateFilePlaintextSize = FileTransferLimits.maxFramedFileBytes
+        - privateFileOuterPacketOverhead
+        - transportCiphertextOverhead
+    static let maxPrivateFileCiphertextSize =
+        maxPrivateFilePlaintextSize + transportCiphertextOverhead
     
     // Maximum handshake message size
     static let maxHandshakeMessageSize = 2048 // 2KB to accommodate XX pattern
+
+    // Noise XX message 1 contains only the initiator's 32-byte ephemeral key.
+    static let xxInitialMessageSize = 32
+
+    // Bounds an ordinary initiator whose message 1 or 2 is lost.
+    static let ordinaryHandshakeTimeout: TimeInterval = 10
+
+    // Bounds the receive-only rollback quarantine created by an unauthenticated
+    // inbound message 1. A lost message 3 must not strand outbound traffic.
+    static let ordinaryResponderHandshakeTimeout: TimeInterval = 20
+
+    // A released client may immediately retry after both crossed initiators
+    // yielded. Give that unilateral retry a brief head start before the
+    // patched side spends its one bounded recovery.
+    static let handshakeCollisionRecoveryDelay: TimeInterval = 0.2
+
+    // Rate-limited recovery remains actionable without spinning.
+    static let handshakeRateLimitRecoveryDelay: TimeInterval = 60
+
+    // Covers only reordering between a winning message 3 and the losing
+    // crossed message 1.
+    static let recentInitiatorCompletionGracePeriod: TimeInterval = 1
+
+    // After unauthenticated responder rollback, reject another attempt long
+    // enough that paced message 1 traffic cannot keep outbound paused. A
+    // legitimate peer converges through the one manager-owned local retry.
+    static let ordinaryReconnectRollbackCooldown: TimeInterval = 60
     
     // Session timeout - sessions older than this should be renegotiated
     static let sessionTimeout: TimeInterval = 86400 // 24 hours

bitchat/Noise/NoiseSecurityValidator.swift

@@ -14,6 +14,19 @@ struct NoiseSecurityValidator {
     static func validateMessageSize(_ data: Data) -> Bool {
         return data.count <= NoiseSecurityConstants.maxMessageSize
     }
+
+    static func validateCiphertextSize(_ data: Data) -> Bool {
+        data.count <= NoiseSecurityConstants.maxMessageSize
+            + NoiseSecurityConstants.transportCiphertextOverhead
+    }
+
+    static func validatePrivateFileMessageSize(_ data: Data) -> Bool {
+        data.count <= NoiseSecurityConstants.maxPrivateFilePlaintextSize
+    }
+
+    static func validatePrivateFileCiphertextSize(_ data: Data) -> Bool {
+        data.count <= NoiseSecurityConstants.maxPrivateFileCiphertextSize
+    }
     
     /// Validate handshake message size
     static func validateHandshakeMessageSize(_ data: Data) -> Bool {

bitchat/Noise/NoiseSession.swift

@@ -66,7 +66,10 @@ class NoiseSession {
             
             // Only initiator writes the first message
             if role == .initiator {
-                let message = try handshakeState!.writeMessage()
+                guard let handshake = handshakeState else {
+                    throw NoiseSessionError.invalidState
+                }
+                let message = try handshake.writeMessage()
                 sentHandshakeMessages.append(message)
                 return message
             } else {

bitchat/Noise/NoiseSessionError.swift

@@ -11,4 +11,11 @@ enum NoiseSessionError: Error, Equatable {
     case notEstablished
     case sessionNotFound
     case alreadyEstablished
+    case peerIdentityMismatch
+}
+
+/// The manager owns the exact attempt's one bounded recovery. Packet handling
+/// must not launch its historical second, immediate restart for this failure.
+struct NoiseManagedHandshakeFailure: Error {
+    let underlying: Error
 }

bitchat/Noise/SecureNoiseSession.swift

@@ -24,8 +24,12 @@ final class SecureNoiseSession: NoiseSession {
             throw NoiseSecurityError.sessionExhausted
         }
         
-        // Validate message size
-        guard NoiseSecurityValidator.validateMessageSize(plaintext) else {
+        // Ordinary Noise messages keep the protocol ceiling. Finalized media
+        // is the sole typed-payload extension and remains under the framed-file
+        // cap enforced again at the service and file-decoder layers.
+        let isPrivateFile = NoisePayloadType.isPrivateFile(rawValue: plaintext.first)
+            && NoiseSecurityValidator.validatePrivateFileMessageSize(plaintext)
+        guard NoiseSecurityValidator.validateMessageSize(plaintext) || isPrivateFile else {
             throw NoiseSecurityError.messageTooLarge
         }
         
@@ -42,8 +46,11 @@ final class SecureNoiseSession: NoiseSession {
             throw NoiseSecurityError.sessionExpired
         }
         
-        // Validate message size
-        guard NoiseSecurityValidator.validateMessageSize(ciphertext) else {
+        // The payload type is encrypted, so a large candidate can only be
+        // bounded here; `NoiseEncryptionService.decrypt` authenticates it and
+        // then requires the resulting type to be `.privateFile`.
+        guard NoiseSecurityValidator.validateCiphertextSize(ciphertext)
+                || NoiseSecurityValidator.validatePrivateFileCiphertextSize(ciphertext) else {
             throw NoiseSecurityError.messageTooLarge
         }
         

bitchat/Nostr/NostrIdentity.swift

@@ -1,7 +1,8 @@
 import Foundation
 import P256K
 
-/// Manages Nostr identity (secp256k1 keypair) for NIP-17 private messaging
+/// Manages the secp256k1 identity used by BitChat's Nostr relay features,
+/// including the proprietary private-envelope transport.
 struct NostrIdentity: Codable {
     let privateKey: Data
     let publicKey: Data

bitchat/Nostr/NostrProtocol.swift

@@ -1,4 +1,3 @@
-import BitLogger
 import Foundation
 import CryptoKit
 import P256K
@@ -7,16 +6,31 @@ import Security
 // Note: This file depends on Data extension from BinaryEncodingUtils.swift
 // Make sure BinaryEncodingUtils.swift is included in the target
 
-/// NIP-17 Protocol Implementation for Private Direct Messages
+/// BitChat's private-envelope protocol transported over Nostr relays.
+///
+/// This is deliberately BitChat-specific and is not NIP-17, NIP-44, or NIP-59.
+/// It uses Nostr events and secp256k1 identities, but its XChaCha20-Poly1305
+/// payload layout is proprietary and interoperates only with BitChat clients.
 struct NostrProtocol {
     
     /// Nostr event kinds
     enum EventKind: Int {
         case metadata = 0
         case textNote = 1
-        case dm = 14 // NIP-17 DM rumor kind
-        case seal = 13 // NIP-17 sealed event
-        case giftWrap = 1059 // NIP-59 gift wrap
+        // Compatibility for BitChat releases that incorrectly emitted the
+        // proprietary payload under standard NIP kinds. Kind 1059 continues
+        // to be published and read until a coordinated cross-platform release
+        // explicitly removes it; all three legacy layers remain readable.
+        case legacyNIP59Seal = 13
+        case legacyNIP17DirectMessage = 14
+        case legacyNIP59GiftWrap = 1059
+        // Provisional BitChat-specific regular event kinds. These are not
+        // formally reserved by the Nostr kind registry. Only
+        // `privateEnvelope` is published; message and seal exist solely
+        // inside ciphertext.
+        case privateEnvelope = 1402
+        case privateSeal = 1403
+        case privateMessage = 1404
         case ephemeralEvent = 20000
         case geohashPresence = 20001
         case deletion = 5 // NIP-09 event deletion request
@@ -25,145 +39,290 @@ struct NostrProtocol {
         /// its NIP-40 expiration — the whole point is store-and-forward.
         case courierDrop = 1401
     }
+
+    /// Prefix for BitChat private-envelope ciphertext. The suffix is
+    /// base64url(nonce24 || ciphertext || poly1305Tag).
+    static let privateEnvelopeContentPrefix = "bitchat-pm-v1:"
+
+    /// Bound work before Base64 decoding either encrypted layer. Current
+    /// private messages are normally only a few KiB; 64 KiB leaves ample
+    /// migration headroom without allowing an addressed relay event to drive
+    /// unbounded allocation.
+    static let maximumPrivateEnvelopeCiphertextBytes = 64 * 1024
+
+    /// Bound the inner authenticated message JSON before allocation/parsing.
+    /// This is intentionally an envelope limit, not the generic composer
+    /// limit. Raising it alone would not make larger private-message packets
+    /// compatible with released readers; callers must surface a rejected
+    /// packet or envelope as a failed send.
+    static let maximumPrivateEnvelopePlaintextBytes = 32 * 1024
+
+    /// The outer authenticated seal JSON contains a Base64-encoded encrypted
+    /// copy of the inner JSON, so it needs expansion headroom of its own. Keep
+    /// the layer-specific cap below the public ciphertext ceiling.
+    private static let maximumPrivateEnvelopeSealPlaintextBytes = 48 * 1024
+
+    /// New clients subscribe to the provisional BitChat-specific kind and the
+    /// compatibility legacy kind so both sides of a rolling rollout can
+    /// recover stored messages. Do not remove kind 1059 here until all
+    /// supported iOS and Android releases have migrated.
+    static let acceptedPrivateEnvelopeKinds = [
+        EventKind.privateEnvelope.rawValue,
+        EventKind.legacyNIP59GiftWrap.rawValue
+    ]
+
+    private enum PrivateEnvelopeWireFormat {
+        case bitchatV1
+        case legacyMislabelledV2
+
+        init?(outerKind: Int) {
+            switch outerKind {
+            case EventKind.privateEnvelope.rawValue:
+                self = .bitchatV1
+            case EventKind.legacyNIP59GiftWrap.rawValue:
+                self = .legacyMislabelledV2
+            default:
+                return nil
+            }
+        }
+
+        var messageKind: EventKind {
+            switch self {
+            case .bitchatV1: .privateMessage
+            case .legacyMislabelledV2: .legacyNIP17DirectMessage
+            }
+        }
+
+        var sealKind: EventKind {
+            switch self {
+            case .bitchatV1: .privateSeal
+            case .legacyMislabelledV2: .legacyNIP59Seal
+            }
+        }
+
+        var envelopeKind: EventKind {
+            switch self {
+            case .bitchatV1: .privateEnvelope
+            case .legacyMislabelledV2: .legacyNIP59GiftWrap
+            }
+        }
+
+        var contentPrefix: String {
+            switch self {
+            case .bitchatV1: NostrProtocol.privateEnvelopeContentPrefix
+            case .legacyMislabelledV2: "v2:"
+            }
+        }
+
+        var hkdfSalt: Data {
+            switch self {
+            case .bitchatV1: Data("bitchat-private-envelope-v1".utf8)
+            case .legacyMislabelledV2: Data()
+            }
+        }
+
+        var hkdfInfo: Data {
+            switch self {
+            case .bitchatV1: Data()
+            case .legacyMislabelledV2: Data("nip44-v2".utf8)
+            }
+        }
+    }
     
-    /// Create a NIP-17 private message
-    static func createPrivateMessage(
+    /// Create a BitChat private envelope for relay transport.
+    static func createPrivateEnvelope(
         content: String,
         recipientPubkey: String,
         senderIdentity: NostrIdentity
     ) throws -> NostrEvent {
-        
-        // Creating private message
-        
-        // 1. Create the rumor (unsigned event)
-        let rumor = NostrEvent(
+        try createPrivateEnvelope(
+            content: content,
+            recipientPubkey: recipientPubkey,
+            senderIdentity: senderIdentity,
+            format: .bitchatV1
+        )
+    }
+
+    /// Events to publish for one logical private payload. The primary
+    /// BitChat-specific format is always first and a legacy copy follows for
+    /// clients that still subscribe only to kind 1059. There is deliberately
+    /// no date-based cutoff: removal requires a coordinated iOS/Android
+    /// release after supported old clients have migrated. Both encrypt the
+    /// exact same embedded BitChat payload, so receive-side logical-payload
+    /// dedup collapses the pair.
+    static func createPrivateEnvelopePublicationBatch(
+        content: String,
+        recipientPubkey: String,
+        senderIdentity: NostrIdentity
+    ) throws -> [NostrEvent] {
+        let primary = try createPrivateEnvelope(
+            content: content,
+            recipientPubkey: recipientPubkey,
+            senderIdentity: senderIdentity
+        )
+        let compatibilityCopy = try createPrivateEnvelope(
+            content: content,
+            recipientPubkey: recipientPubkey,
+            senderIdentity: senderIdentity,
+            format: .legacyMislabelledV2
+        )
+        return [primary, compatibilityCopy]
+    }
+
+    private static func createPrivateEnvelope(
+        content: String,
+        recipientPubkey: String,
+        senderIdentity: NostrIdentity,
+        format: PrivateEnvelopeWireFormat,
+        messageTags: [[String]] = []
+    ) throws -> NostrEvent {
+        // 1. Create the unsigned inner BitChat message.
+        let message = NostrEvent(
             pubkey: senderIdentity.publicKeyHex,
             createdAt: Date(),
-            kind: .dm, // NIP-17: DM rumor kind 14
-            tags: [],
+            kind: format.messageKind,
+            tags: messageTags,
             content: content
         )
         
-        // 2. Seal the rumor (encrypt to recipient) and sign it with the SENDER'S
-        //    real identity key. NIP-17 requires the seal be signed by the sender
-        //    so the recipient can authenticate who sent the message; signing with
-        //    a throwaway key leaves DMs forgeable/impersonatable.
+        // 2. Encrypt the message to the recipient and sign the private seal
+        // with the sender's stable Nostr identity for sender authentication.
         let senderKey = try senderIdentity.schnorrSigningKey()
-        let sealedEvent = try createSeal(
-            rumor: rumor,
+        let sealedEvent = try createPrivateSeal(
+            message: message,
             recipientPubkey: recipientPubkey,
-            senderKey: senderKey
+            senderKey: senderKey,
+            format: format
         )
 
-        // 3. Gift wrap the sealed event with a throwaway ephemeral key (the wrap
-        //    layer hides the sender's identity from relays; createGiftWrap mints
-        //    its own ephemeral key internally).
-        let giftWrap = try createGiftWrap(
+        // 3. Encrypt the seal under a one-time key so the public envelope does
+        // not reveal the stable sender identity.
+        return try createPrivateEnvelopeEvent(
             seal: sealedEvent,
-            recipientPubkey: recipientPubkey
+            recipientPubkey: recipientPubkey,
+            format: format
         )
-        
-        // Created gift wrap
-        
-        return giftWrap
     }
     
-    /// Decrypt a received NIP-17 message
-    /// Returns the content, sender pubkey, and the actual message timestamp (not the randomized gift wrap timestamp)
-    static func decryptPrivateMessage(
-        giftWrap: NostrEvent,
+    /// Decrypt a BitChat private envelope. Legacy proprietary envelopes that
+    /// older BitChat releases placed under kinds 1059/13/14 are accepted only
+    /// through the format-isolated receive path.
+    static func decryptPrivateEnvelope(
+        envelope: NostrEvent,
         recipientIdentity: NostrIdentity
     ) throws -> (content: String, senderPubkey: String, timestamp: Int) {
-        
-        // Starting decryption
-        
-        // 1. Unwrap the gift wrap
-        let seal: NostrEvent
-        do {
-            seal = try unwrapGiftWrap(
-                giftWrap: giftWrap,
-                recipientKey: recipientIdentity.schnorrSigningKey()
-            )
-            // Successfully unwrapped gift wrap
-        } catch {
-            SecureLogger.error("❌ Failed to unwrap gift wrap: \(error)", category: .session)
-            throw error
-        }
-        
-        // 2. Authenticate the seal. The seal MUST be signed by the sender's real
-        //    identity key (NIP-17); without this check a DM is forgeable by anyone
-        //    who knows the recipient's npub. Verify the seal's own signature.
-        guard seal.isValidSignature() else {
-            SecureLogger.error("❌ Rejecting DM: seal signature is missing or invalid", category: .session)
-            throw NostrError.invalidEvent
-        }
-
-        // 3. Open the seal
-        let rumor: NostrEvent
-        do {
-            rumor = try openSeal(
-                seal: seal,
-                recipientKey: recipientIdentity.schnorrSigningKey()
-            )
-            // Successfully opened seal
-        } catch {
-            SecureLogger.error("❌ Failed to open seal: \(error)", category: .session)
-            throw error
-        }
-
-        // 4. The sender claimed inside the rumor must match the key that actually
-        //    signed the seal, otherwise the sender field is unauthenticated and
-        //    spoofable.
-        guard seal.pubkey == rumor.pubkey else {
-            SecureLogger.error("❌ Rejecting DM: rumor pubkey does not match seal signer", category: .session)
-            throw NostrError.invalidEvent
-        }
-
-        // Return the seal signer's pubkey as the authenticated sender.
-        return (content: rumor.content, senderPubkey: seal.pubkey, timestamp: rumor.created_at)
+        let layers = try decodePrivateEnvelopeLayers(
+            envelope: envelope,
+            recipientIdentity: recipientIdentity
+        )
+        return (
+            content: layers.message.content,
+            senderPubkey: layers.seal.pubkey,
+            timestamp: layers.message.created_at
+        )
     }
 
     #if DEBUG
-    static func createPrivateMessageWithInvalidSealSignatureForTesting(
+    static func createPrivateEnvelopeWithInvalidSealSignatureForTesting(
         content: String,
         recipientPubkey: String,
         senderIdentity: NostrIdentity
     ) throws -> NostrEvent {
-        let rumor = NostrEvent(
+        let format = PrivateEnvelopeWireFormat.bitchatV1
+        let message = NostrEvent(
             pubkey: senderIdentity.publicKeyHex,
             createdAt: Date(),
-            kind: .dm,
+            kind: format.messageKind,
             tags: [],
             content: content
         )
-        var seal = try createSeal(
-            rumor: rumor,
+        var seal = try createPrivateSeal(
+            message: message,
             recipientPubkey: recipientPubkey,
-            senderKey: senderIdentity.schnorrSigningKey()
+            senderKey: senderIdentity.schnorrSigningKey(),
+            format: format
         )
         seal.sig = String(repeating: "0", count: 128)
-        return try createGiftWrap(seal: seal, recipientPubkey: recipientPubkey)
+        return try createPrivateEnvelopeEvent(
+            seal: seal,
+            recipientPubkey: recipientPubkey,
+            format: format
+        )
     }
 
-    static func createPrivateMessageWithMismatchedSealRumorPubkeyForTesting(
+    static func createPrivateEnvelopeWithMismatchedSealMessagePubkeyForTesting(
         content: String,
         recipientPubkey: String,
-        rumorIdentity: NostrIdentity,
+        messageIdentity: NostrIdentity,
         sealSignerIdentity: NostrIdentity
     ) throws -> NostrEvent {
-        let rumor = NostrEvent(
-            pubkey: rumorIdentity.publicKeyHex,
+        let format = PrivateEnvelopeWireFormat.bitchatV1
+        let message = NostrEvent(
+            pubkey: messageIdentity.publicKeyHex,
             createdAt: Date(),
-            kind: .dm,
+            kind: format.messageKind,
             tags: [],
             content: content
         )
-        let seal = try createSeal(
-            rumor: rumor,
+        let seal = try createPrivateSeal(
+            message: message,
             recipientPubkey: recipientPubkey,
-            senderKey: sealSignerIdentity.schnorrSigningKey()
+            senderKey: sealSignerIdentity.schnorrSigningKey(),
+            format: format
         )
-        return try createGiftWrap(seal: seal, recipientPubkey: recipientPubkey)
+        return try createPrivateEnvelopeEvent(
+            seal: seal,
+            recipientPubkey: recipientPubkey,
+            format: format
+        )
+    }
+
+    static func createPrivateEnvelopeWithInnerTagsForTesting(
+        content: String,
+        recipientPubkey: String,
+        senderIdentity: NostrIdentity,
+        innerMessageTags: [[String]]
+    ) throws -> NostrEvent {
+        try createPrivateEnvelope(
+            content: content,
+            recipientPubkey: recipientPubkey,
+            senderIdentity: senderIdentity,
+            format: .bitchatV1,
+            messageTags: innerMessageTags
+        )
+    }
+
+    static func createLegacyPrivateEnvelopeForTesting(
+        content: String,
+        recipientPubkey: String,
+        senderIdentity: NostrIdentity,
+        innerMessageTags: [[String]] = []
+    ) throws -> NostrEvent {
+        // Current Android legacy envelopes use exactly one recipient `p` tag
+        // on the unsigned inner kind-14 event; released iOS envelopes use no
+        // inner tags. Tests pass the Android shape explicitly so this helper
+        // cannot silently make the production encoder depend on that quirk.
+        try createPrivateEnvelope(
+            content: content,
+            recipientPubkey: recipientPubkey,
+            senderIdentity: senderIdentity,
+            format: .legacyMislabelledV2,
+            messageTags: innerMessageTags
+        )
+    }
+
+    static func decodePrivateEnvelopeLayersForTesting(
+        envelope: NostrEvent,
+        recipientIdentity: NostrIdentity
+    ) throws -> (seal: NostrEvent, message: NostrEvent) {
+        try decodePrivateEnvelopeLayers(
+            envelope: envelope,
+            recipientIdentity: recipientIdentity
+        )
+    }
+
+    static func decodePrivateEnvelopeEventJSONForTesting(_ json: String) throws -> NostrEvent {
+        try decodePrivateEnvelopeEventJSON(json)
     }
     #endif
 
@@ -400,151 +559,207 @@ struct NostrProtocol {
 
     // MARK: - Private Methods
     
-    private static func createSeal(
-        rumor: NostrEvent,
+    private static func createPrivateSeal(
+        message: NostrEvent,
         recipientPubkey: String,
-        senderKey: P256K.Schnorr.PrivateKey
+        senderKey: P256K.Schnorr.PrivateKey,
+        format: PrivateEnvelopeWireFormat
     ) throws -> NostrEvent {
-        
-        let rumorJSON = try rumor.jsonString()
         let encrypted = try encrypt(
-            plaintext: rumorJSON,
+            plaintext: message.jsonString(),
             recipientPubkey: recipientPubkey,
-            senderKey: senderKey
+            senderKey: senderKey,
+            format: format,
+            maximumPlaintextBytes: maximumPrivateEnvelopePlaintextBytes
         )
-        
+
         let seal = NostrEvent(
             pubkey: Data(senderKey.xonly.bytes).hexEncodedString(),
-            createdAt: randomizedTimestamp(),
-            kind: .seal,
+            createdAt: randomizedPastTimestamp(),
+            kind: format.sealKind,
             tags: [],
             content: encrypted
         )
-        
-        // Sign the seal with the sender's Schnorr private key
         return try seal.sign(with: senderKey)
     }
-    
-    private static func createGiftWrap(
-        seal: NostrEvent,
-        recipientPubkey: String
-    ) throws -> NostrEvent {
 
-        let sealJSON = try seal.jsonString()
-        
-        // Create new ephemeral key for gift wrap
-        let wrapKey = try P256K.Schnorr.PrivateKey()
-        // Creating gift wrap with ephemeral key
-        
-        // Encrypt the seal with the new ephemeral key (not the seal's key)
+    private static func createPrivateEnvelopeEvent(
+        seal: NostrEvent,
+        recipientPubkey: String,
+        format: PrivateEnvelopeWireFormat
+    ) throws -> NostrEvent {
+        // A fresh signing/encryption key for every public envelope keeps the
+        // stable sender identity inside ciphertext.
+        let envelopeKey = try P256K.Schnorr.PrivateKey()
         let encrypted = try encrypt(
-            plaintext: sealJSON,
+            plaintext: seal.jsonString(),
             recipientPubkey: recipientPubkey,
-            senderKey: wrapKey  // Use the gift wrap ephemeral key
+            senderKey: envelopeKey,
+            format: format,
+            maximumPlaintextBytes: maximumPrivateEnvelopeSealPlaintextBytes
         )
-        
-        let giftWrap = NostrEvent(
-            pubkey: Data(wrapKey.xonly.bytes).hexEncodedString(),
-            createdAt: randomizedTimestamp(),
-            kind: .giftWrap,
-            tags: [["p", recipientPubkey]], // Tag recipient
+
+        let envelope = NostrEvent(
+            pubkey: Data(envelopeKey.xonly.bytes).hexEncodedString(),
+            createdAt: randomizedPastTimestamp(),
+            kind: format.envelopeKind,
+            tags: [["p", recipientPubkey]],
             content: encrypted
         )
-        
-        // Sign the gift wrap with the wrap Schnorr private key
-        return try giftWrap.sign(with: wrapKey)
+        return try envelope.sign(with: envelopeKey)
     }
-    
-    private static func unwrapGiftWrap(
-        giftWrap: NostrEvent,
-        recipientKey: P256K.Schnorr.PrivateKey
-    ) throws -> NostrEvent {
-        
-        // Unwrapping gift wrap
-        
-        let decrypted = try decrypt(
-            ciphertext: giftWrap.content,
-            senderPubkey: giftWrap.pubkey,
-            recipientKey: recipientKey
-        )
-        
-        guard let data = decrypted.data(using: .utf8),
-              let sealDict = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+
+    private static func decodePrivateEnvelopeLayers(
+        envelope: NostrEvent,
+        recipientIdentity: NostrIdentity
+    ) throws -> (seal: NostrEvent, message: NostrEvent) {
+        guard envelope.content.utf8.count <= maximumPrivateEnvelopeCiphertextBytes else {
+            throw NostrError.invalidCiphertext
+        }
+        guard let format = PrivateEnvelopeWireFormat(outerKind: envelope.kind),
+              envelope.tags == [["p", recipientIdentity.publicKeyHex]],
+              envelope.isValidSignature() else {
             throw NostrError.invalidEvent
         }
-        
-        let seal = try NostrEvent(from: sealDict)
-        // Unwrapped seal
-        
-        return seal
-    }
-    
-    private static func openSeal(
-        seal: NostrEvent,
-        recipientKey: P256K.Schnorr.PrivateKey
-    ) throws -> NostrEvent {
-        
-        let decrypted = try decrypt(
+
+        let recipientKey = try recipientIdentity.schnorrSigningKey()
+        let sealJSON = try decrypt(
+            ciphertext: envelope.content,
+            senderPubkey: envelope.pubkey,
+            recipientKey: recipientKey,
+            format: format,
+            maximumPlaintextBytes: maximumPrivateEnvelopeSealPlaintextBytes
+        )
+        let seal = try decodePrivateEnvelopeEventJSON(
+            sealJSON,
+            maximumBytes: maximumPrivateEnvelopeSealPlaintextBytes
+        )
+        guard seal.kind == format.sealKind.rawValue,
+              seal.tags.isEmpty,
+              seal.isValidSignature() else {
+            throw NostrError.invalidEvent
+        }
+
+        let messageJSON = try decrypt(
             ciphertext: seal.content,
             senderPubkey: seal.pubkey,
-            recipientKey: recipientKey
+            recipientKey: recipientKey,
+            format: format,
+            maximumPlaintextBytes: maximumPrivateEnvelopePlaintextBytes
         )
-        
-        guard let data = decrypted.data(using: .utf8),
-              let rumorDict = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+        let message = try decodePrivateEnvelopeEventJSON(
+            messageJSON,
+            maximumBytes: maximumPrivateEnvelopePlaintextBytes
+        )
+
+        // The inner message is intentionally unsigned; sender authentication
+        // comes from the seal. Bind its claimed sender and custom kind to that
+        // authenticated layer before exposing content.
+        guard message.kind == format.messageKind.rawValue,
+              validInnerMessageTags(
+                message.tags,
+                format: format,
+                recipientPubkey: recipientIdentity.publicKeyHex
+              ),
+              message.sig == nil,
+              seal.pubkey == message.pubkey else {
             throw NostrError.invalidEvent
         }
-        
-        return try NostrEvent(from: rumorDict)
+
+        return (seal, message)
     }
-    
-    // MARK: - Encryption (NIP-44 v2)
-    
+
+    /// Released iOS legacy envelopes used no inner tags, while current
+    /// Android legacy envelopes use exactly the authenticated recipient tag.
+    /// Accept only those two historical shapes for kind 1059. The new kind
+    /// 1402 format remains strict and rejects every inner tag.
+    private static func validInnerMessageTags(
+        _ tags: [[String]],
+        format: PrivateEnvelopeWireFormat,
+        recipientPubkey: String
+    ) -> Bool {
+        switch format {
+        case .bitchatV1:
+            return tags.isEmpty
+        case .legacyMislabelledV2:
+            return tags.isEmpty || tags == [["p", recipientPubkey]]
+        }
+    }
+
+    private static func decodePrivateEnvelopeEventJSON(
+        _ json: String,
+        maximumBytes: Int = maximumPrivateEnvelopePlaintextBytes
+    ) throws -> NostrEvent {
+        // Check UTF-8 size before allocating Data or invoking the general JSON
+        // parser. `decrypt` enforces the same cap on authenticated bytes; this
+        // local guard keeps the parser boundary explicit and independently
+        // testable.
+        guard json.utf8.count <= maximumBytes else {
+            throw NostrError.invalidCiphertext
+        }
+        guard let data = json.data(using: .utf8),
+              let dictionary = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+            throw NostrError.invalidEvent
+        }
+        return try NostrEvent(from: dictionary)
+    }
+
+    // MARK: - BitChat private-envelope encryption
+
     private static func encrypt(
         plaintext: String,
         recipientPubkey: String,
-        senderKey: P256K.Schnorr.PrivateKey
+        senderKey: P256K.Schnorr.PrivateKey,
+        format: PrivateEnvelopeWireFormat,
+        maximumPlaintextBytes: Int
     ) throws -> String {
-        
         guard let recipientPubkeyData = Data(hexString: recipientPubkey) else {
             throw NostrError.invalidPublicKey
         }
-        
-        // Encrypting message (NIP-44 v2: XChaCha20-Poly1305, versioned)
-        
-        // Derive shared secret
+
         let sharedSecret = try deriveSharedSecret(
             privateKey: senderKey,
             publicKey: recipientPubkeyData
         )
-        // Derive NIP-44 v2 symmetric key (HKDF-SHA256 with label in info)
-        let key = try deriveNIP44V2Key(from: sharedSecret)
-        
-        // 24-byte random nonce for XChaCha20-Poly1305
+        let key = derivePrivateEnvelopeKey(from: sharedSecret, format: format)
+
         var nonce24 = Data(count: 24)
-        _ = nonce24.withUnsafeMutableBytes { ptr in
+        let randomStatus = nonce24.withUnsafeMutableBytes { ptr in
             SecRandomCopyBytes(kSecRandomDefault, 24, ptr.baseAddress!)
         }
-        
-        let pt = Data(plaintext.utf8)
-        let sealed = try XChaCha20Poly1305Compat.seal(plaintext: pt, key: key, nonce24: nonce24)
-        
-        // v2: base64url(nonce24 || ciphertext || tag)
+        guard randomStatus == errSecSuccess else {
+            throw NostrError.cryptographicFailure
+        }
+
+        let plaintextData = Data(plaintext.utf8)
+        guard plaintextData.count <= maximumPlaintextBytes else {
+            throw NostrError.invalidCiphertext
+        }
+        let sealed = try XChaCha20Poly1305Compat.seal(
+            plaintext: plaintextData,
+            key: key,
+            nonce24: nonce24
+        )
+
         var combined = Data()
         combined.append(nonce24)
         combined.append(sealed.ciphertext)
         combined.append(sealed.tag)
-        return "v2:" + Base64URLCoding.encode(combined)
+        return format.contentPrefix + Base64URLCoding.encode(combined)
     }
-    
+
     private static func decrypt(
         ciphertext: String,
         senderPubkey: String,
-        recipientKey: P256K.Schnorr.PrivateKey
+        recipientKey: P256K.Schnorr.PrivateKey,
+        format: PrivateEnvelopeWireFormat,
+        maximumPlaintextBytes: Int
     ) throws -> String {
-        // Expect NIP-44 v2 format
-        guard ciphertext.hasPrefix("v2:") else { throw NostrError.invalidCiphertext }
-        let encoded = String(ciphertext.dropFirst(3))
+        guard ciphertext.utf8.count <= maximumPrivateEnvelopeCiphertextBytes,
+              ciphertext.hasPrefix(format.contentPrefix) else {
+            throw NostrError.invalidCiphertext
+        }
+        let encoded = String(ciphertext.dropFirst(format.contentPrefix.count))
         guard let data = Base64URLCoding.decode(encoded),
               data.count > (24 + 16),
               let senderPubkeyData = Data(hexString: senderPubkey) else {
@@ -554,33 +769,40 @@ struct NostrProtocol {
         let nonce24 = data.prefix(24)
         let rest = data.dropFirst(24)
         let tag = rest.suffix(16)
-        let ct = rest.dropLast(16)
+        let ciphertextBytes = rest.dropLast(16)
 
-        // Try decryption with even-Y then odd-Y when sender pubkey is x-only
-        func attemptDecrypt(using pubKeyData: Data) throws -> Data {
-            let ss = try deriveSharedSecret(privateKey: recipientKey, publicKey: pubKeyData)
-            let key = try deriveNIP44V2Key(from: ss)
+        func attemptDecrypt(using publicKeyData: Data) throws -> Data {
+            let sharedSecret = try deriveSharedSecret(
+                privateKey: recipientKey,
+                publicKey: publicKeyData
+            )
+            let key = derivePrivateEnvelopeKey(from: sharedSecret, format: format)
             return try XChaCha20Poly1305Compat.open(
-                ciphertext: Data(ct),
+                ciphertext: Data(ciphertextBytes),
                 tag: Data(tag),
                 key: key,
                 nonce24: Data(nonce24)
             )
         }
 
-        // If 32 bytes (x-only) try both parities, otherwise single try
+        let plaintext: Data
         if senderPubkeyData.count == 32 {
-            let even = Data([0x02]) + senderPubkeyData
-            if let pt = try? attemptDecrypt(using: even) {
-                return String(data: pt, encoding: .utf8) ?? ""
+            let evenKey = Data([0x02]) + senderPubkeyData
+            if let opened = try? attemptDecrypt(using: evenKey) {
+                plaintext = opened
+            } else {
+                let oddKey = Data([0x03]) + senderPubkeyData
+                plaintext = try attemptDecrypt(using: oddKey)
             }
-            let odd = Data([0x03]) + senderPubkeyData
-            let pt = try attemptDecrypt(using: odd)
-            return String(data: pt, encoding: .utf8) ?? ""
         } else {
-            let pt = try attemptDecrypt(using: senderPubkeyData)
-            return String(data: pt, encoding: .utf8) ?? ""
+            plaintext = try attemptDecrypt(using: senderPubkeyData)
         }
+
+        guard plaintext.count <= maximumPlaintextBytes,
+              let decoded = String(data: plaintext, encoding: .utf8) else {
+            throw NostrError.invalidCiphertext
+        }
+        return decoded
     }
     
     private static func deriveSharedSecret(
@@ -640,29 +862,17 @@ struct NostrProtocol {
         let sharedSecretData = sharedSecret.withUnsafeBytes { Data($0) }
         // ECDH shared secret derived
         
-        // Return raw ECDH shared secret; HKDF is applied by deriveNIP44V2Key
+        // Return raw ECDH shared secret; the wire-format-specific HKDF is
+        // applied by derivePrivateEnvelopeKey.
         return sharedSecretData
     }
     
-    private static func randomizedTimestamp() -> Date {
-        // Add random offset to current time for privacy
-        // This prevents timing correlation attacks while the actual message timestamp
-        // is preserved in the encrypted rumor
-        let offset = TimeInterval.random(in: -900...900) // +/- 15 minutes
-        let now = Date()
-        let randomized = now.addingTimeInterval(offset)
-        
-        // Log with explicit UTC and local time for debugging
-        let formatter = DateFormatter()
-        //
-        formatter.dateFormat = "yyyy-MM-dd HH:mm:ss"
-        formatter.timeZone = TimeZone(abbreviation: "UTC")
-        
-        formatter.timeZone = TimeZone.current
-        
-        // Timestamp randomized for privacy
-        
-        return randomized
+    private static func randomizedPastTimestamp() -> Date {
+        // Keep public timestamps in the past: future-dated events are rejected
+        // by some relays. The actual message timestamp remains encrypted.
+        Date().addingTimeInterval(
+            -TimeInterval.random(in: 0...TransportConfig.nostrPrivateEnvelopeTimestampFuzzSeconds)
+        )
     }
 }
 
@@ -700,6 +910,10 @@ struct NostrEvent: Codable {
               let content = dict["content"] as? String else {
             throw NostrError.invalidEvent
         }
+
+        guard Self.isWithinInboundTagLimits(tags) else {
+            throw NostrError.invalidEvent
+        }
         
         self.id = dict["id"] as? String ?? ""
         self.pubkey = pubkey
@@ -709,6 +923,21 @@ struct NostrEvent: Codable {
         self.content = content
         self.sig = dict["sig"] as? String
     }
+
+    /// Bounds untrusted relay tag arrays so attackers cannot force large
+    /// allocations or expensive joins on the inbound hot path.
+    static func isWithinInboundTagLimits(_ tags: [[String]]) -> Bool {
+        guard tags.count <= TransportConfig.nostrMaxEventTags else { return false }
+
+        for tag in tags {
+            guard tag.count <= TransportConfig.nostrMaxEventTagValues else { return false }
+            guard tag.allSatisfy({ $0.utf8.count <= TransportConfig.nostrMaxEventTagValueBytes }) else {
+                return false
+            }
+        }
+
+        return true
+    }
     
     func sign(with key: P256K.Schnorr.PrivateKey) throws -> NostrEvent {
         let (eventId, eventIdHash) = try calculateEventId()
@@ -775,16 +1004,20 @@ enum NostrError: Error {
     case invalidPublicKey
     case invalidEvent
     case invalidCiphertext
+    case cryptographicFailure
 }
 
-// MARK: - NIP-44 v2 helpers (XChaCha20-Poly1305)
+// MARK: - BitChat private-envelope key derivation
 
 private extension NostrProtocol {
-    static func deriveNIP44V2Key(from sharedSecretData: Data) throws -> Data {
+    private static func derivePrivateEnvelopeKey(
+        from sharedSecretData: Data,
+        format: PrivateEnvelopeWireFormat
+    ) -> Data {
         let derivedKey = HKDF<CryptoKit.SHA256>.deriveKey(
             inputKeyMaterial: SymmetricKey(data: sharedSecretData),
-            salt: Data(),
-            info: Data("nip44-v2".utf8),
+            salt: format.hkdfSalt,
+            info: format.hkdfInfo,
             outputByteCount: 32
         )
         return derivedKey.withUnsafeBytes { Data($0) }

bitchat/Protocols/BitchatFilePacket.swift

@@ -154,3 +154,90 @@ struct BitchatFilePacket {
         )
     }
 }
+
+/// Wire-compatible identity for private media exchanged by clients using the
+/// current iOS entropy-bearing filenames, without extending the deployed file
+/// TLV. Android clients reject unknown file tags, so eligible senders and
+/// receivers derive the receipt key from fields already on the wire.
+///
+/// Locally-created image and voice-note filenames contain a UUID or live-voice
+/// burst ID. Including the normalized direction keeps a reused filename
+/// distinct across chats while allowing short and full Noise-key peer IDs to
+/// converge. Android and older-iOS timestamp-only names remain ineligible and
+/// retain their legacy random local IDs (transfer-compatible, no receipts).
+enum PrivateMediaMessageIdentity {
+    private static let domain = Data("bitchat-private-media-message-v1".utf8)
+    private static let idPrefix = "media-"
+    private static let digestHexLength = 32
+
+    static func isStableID(_ candidate: String) -> Bool {
+        guard candidate.hasPrefix(idPrefix) else { return false }
+        let digest = candidate.dropFirst(idPrefix.count)
+        guard digest.utf8.count == digestHexLength else { return false }
+        return digest.utf8.allSatisfy { byte in
+            (UInt8(ascii: "0")...UInt8(ascii: "9")).contains(byte)
+                || (UInt8(ascii: "a")...UInt8(ascii: "f")).contains(byte)
+        }
+    }
+
+    static func stableID(
+        senderPeerID: PeerID,
+        recipientPeerID: PeerID,
+        fileName: String?
+    ) -> String? {
+        guard let fileName, !fileName.isEmpty else { return nil }
+        let leafName = (fileName as NSString).lastPathComponent
+        guard leafName == fileName else { return nil }
+
+        let path = leafName as NSString
+        let stem = path.deletingPathExtension
+        let fileExtension = path.pathExtension.lowercased()
+        switch true {
+        case stem.hasPrefix("img_"):
+            guard fileExtension == "jpg" || fileExtension == "jpeg" else { return nil }
+        case stem.hasPrefix("voice_"):
+            guard fileExtension == "m4a" else { return nil }
+        default:
+            return nil
+        }
+        let entropyToken = stem.split(separator: "_").last.map(String.init)
+        let hasUUIDEntropy = entropyToken.flatMap(UUID.init(uuidString:)) != nil
+        let voiceBurstID = stem.hasPrefix("voice_")
+            ? String(stem.dropFirst("voice_".count))
+            : ""
+        let hasBurstEntropy = voiceBurstID.count == 16
+            && voiceBurstID.allSatisfy(\.isHexDigit)
+        guard hasUUIDEntropy || hasBurstEntropy else {
+            return nil
+        }
+
+        let fields = [
+            Data(senderPeerID.toShort().bare.utf8),
+            Data(recipientPeerID.toShort().bare.utf8),
+            Data(leafName.utf8)
+        ]
+        var input = domain
+        for field in fields {
+            guard let length = UInt32(exactly: field.count) else { return nil }
+            var bigEndianLength = length.bigEndian
+            withUnsafeBytes(of: &bigEndianLength) {
+                input.append(contentsOf: $0)
+            }
+            input.append(field)
+        }
+
+        return "\(idPrefix)\(input.sha256Hex().prefix(digestHexLength))"
+    }
+
+    static func stableID(
+        for packet: BitchatFilePacket,
+        senderPeerID: PeerID,
+        recipientPeerID: PeerID
+    ) -> String? {
+        stableID(
+            senderPeerID: senderPeerID,
+            recipientPeerID: recipientPeerID,
+            fileName: packet.fileName
+        )
+    }
+}

bitchat/Protocols/BitchatProtocol.swift

@@ -79,12 +79,35 @@ enum NoisePayloadType: UInt8 {
     case groupKeyUpdate = 0x07      // Creator-signed group state (key rotation / roster update)
     // Live voice (push-to-talk)
     case voiceFrame = 0x08          // One live voice-burst packet (see VoiceBurstPacket)
+    // Finalized private media. `0x20` is the value already deployed by the
+    // Android client. The complete BitchatFilePacket is encrypted inside
+    // Noise before the outer noiseEncrypted packet is fragmented.
+    case privateFile = 0x20
+    // Versioned peer state authenticated by the surrounding Noise session.
+    // This is intentionally distinct from the public announce: announce
+    // capabilities are discovery hints, while this payload proves possession
+    // of the advertised Noise static key before downgrade state is pinned.
+    case authenticatedPeerState = 0x21
     // Verification (QR-based OOB binding)
     case verifyChallenge = 0x10     // Verification challenge
     case verifyResponse  = 0x11     // Verification response
     // Transitive verification (web of trust)
     case vouch = 0x12               // Batch of vouch attestations
 
+    /// #1434 briefly used 0x09 before release. Accept it while prerelease
+    /// builds age out, but never emit it. Decoders canonicalize both values to
+    /// `.privateFile` so the compatibility alias cannot leak into app logic.
+    static let prereleasePrivateFileRawValue: UInt8 = 0x09
+
+    static func decoded(rawValue: UInt8) -> NoisePayloadType? {
+        rawValue == prereleasePrivateFileRawValue ? .privateFile : Self(rawValue: rawValue)
+    }
+
+    static func isPrivateFile(rawValue: UInt8?) -> Bool {
+        guard let rawValue else { return false }
+        return rawValue == privateFile.rawValue || rawValue == prereleasePrivateFileRawValue
+    }
+
     var description: String {
         switch self {
         case .privateMessage: return "privateMessage"
@@ -93,6 +116,8 @@ enum NoisePayloadType: UInt8 {
         case .groupInvite: return "groupInvite"
         case .groupKeyUpdate: return "groupKeyUpdate"
         case .voiceFrame: return "voiceFrame"
+        case .privateFile: return "privateFile"
+        case .authenticatedPeerState: return "authenticatedPeerState"
         case .verifyChallenge: return "verifyChallenge"
         case .verifyResponse: return "verifyResponse"
         case .vouch: return "vouch"

bitchat/Protocols/Packets.swift

@@ -156,6 +156,89 @@ struct AnnouncementPacket {
     }
 }
 
+/// State that is authoritative only because it is carried inside an
+/// established Noise session. The public announce remains useful for
+/// discovery, but its self-signature cannot prove possession of the copied
+/// Noise public key it contains.
+///
+/// Wire format (v1):
+/// `[version=0x01][type][length][value]...`
+/// - TLV `0x01`: canonical minimal little-endian `PeerCapabilities`
+/// - TLV `0x02`: 32-byte Ed25519 signing public key
+///
+/// Unknown TLVs are skipped for forward compatibility. Unknown versions,
+/// duplicates, non-canonical capability fields, and malformed lengths are
+/// rejected without changing authenticated state.
+struct AuthenticatedPeerStatePacket: Equatable {
+    static let currentVersion: UInt8 = 1
+    static let signingPublicKeyLength = 32
+
+    let capabilities: PeerCapabilities
+    let signingPublicKey: Data
+
+    private enum TLVType: UInt8 {
+        case capabilities = 0x01
+        case signingPublicKey = 0x02
+    }
+
+    func encode() -> Data? {
+        guard signingPublicKey.count == Self.signingPublicKeyLength else { return nil }
+        let capabilityBytes = capabilities.encoded()
+        guard !capabilityBytes.isEmpty, capabilityBytes.count <= 8 else { return nil }
+
+        var data = Data([Self.currentVersion])
+        data.append(TLVType.capabilities.rawValue)
+        data.append(UInt8(capabilityBytes.count))
+        data.append(capabilityBytes)
+        data.append(TLVType.signingPublicKey.rawValue)
+        data.append(UInt8(signingPublicKey.count))
+        data.append(signingPublicKey)
+        return data
+    }
+
+    static func decode(from data: Data) -> AuthenticatedPeerStatePacket? {
+        guard data.first == Self.currentVersion else { return nil }
+
+        var offset = 1
+        var capabilities: PeerCapabilities?
+        var signingPublicKey: Data?
+
+        while offset < data.count {
+            guard offset + 2 <= data.count else { return nil }
+            let typeRaw = data[offset]
+            let length = Int(data[offset + 1])
+            offset += 2
+            guard offset + length <= data.count else { return nil }
+            let value = Data(data[offset..<(offset + length)])
+            offset += length
+
+            guard let type = TLVType(rawValue: typeRaw) else {
+                continue
+            }
+            switch type {
+            case .capabilities:
+                guard capabilities == nil,
+                      !value.isEmpty,
+                      value.count <= 8 else { return nil }
+                let decoded = PeerCapabilities(encoded: value)
+                guard decoded.encoded() == value else { return nil }
+                capabilities = decoded
+
+            case .signingPublicKey:
+                guard signingPublicKey == nil,
+                      value.count == Self.signingPublicKeyLength else { return nil }
+                signingPublicKey = value
+            }
+        }
+
+        guard let capabilities, let signingPublicKey else { return nil }
+        return AuthenticatedPeerStatePacket(
+            capabilities: capabilities,
+            signingPublicKey: signingPublicKey
+        )
+    }
+}
+
 struct PrivateMessagePacket {
     let messageID: String
     let content: String

bitchat/Protocols/PeerCapabilities+Local.swift

@@ -3,5 +3,11 @@ import BitFoundation
 extension PeerCapabilities {
     /// Capabilities this build advertises in its announce packets.
     /// Each feature adds its bit here when it ships.
-    static let localSupported: PeerCapabilities = [.vouch, .prekeys, .groups]
+    static let localSupported: PeerCapabilities = [
+        .vouch,
+        .prekeys,
+        .groups,
+        .privateMedia,
+        .privateMediaReceipts
+    ]
 }

bitchat/Services/BLE/BLEAnnounceHandler.swift

@@ -16,6 +16,9 @@ struct BLEAnnounceHandlerEnvironment {
     let now: () -> Date
     /// Noise public key already recorded for the peer, if any (registry read).
     let existingNoisePublicKey: (PeerID) -> Data?
+    /// Ed25519 key previously bound to this Noise identity by an authenticated
+    /// peer-state payload, if any (persistent identity-state read).
+    let authenticatedSigningPublicKey: (_ noisePublicKey: Data) -> Data?
     /// Verifies the packet signature against the announced signing key.
     let verifySignature: (_ packet: BitchatPacket, _ signingPublicKey: Data) -> Bool
     /// Direct link state for the peer (BLE-queue read).
@@ -130,11 +133,21 @@ final class BLEAnnounceHandler {
             hasSignature: hasSignature,
             signatureValid: signatureValid,
             existingNoisePublicKey: existingNoisePublicKey,
-            announcedNoisePublicKey: announcement.noisePublicKey
+            announcedNoisePublicKey: announcement.noisePublicKey,
+            authenticatedSigningPublicKey: env.authenticatedSigningPublicKey(
+                announcement.noisePublicKey
+            ),
+            announcedSigningPublicKey: announcement.signingPublicKey
         )
         if case .reject(.keyMismatch) = trustDecision {
             SecureLogger.warning("⚠️ Announce key mismatch for \(peerID.id.prefix(8))… — keeping unverified", category: .security)
         }
+        if case .reject(.authenticatedSigningKeyMismatch) = trustDecision {
+            SecureLogger.warning(
+                "⚠️ Announce signing-key replacement rejected for Noise-authenticated peer \(peerID.id.prefix(8))…",
+                category: .security
+            )
+        }
         let verifiedAnnounce = trustDecision.isVerified
 
         var isNewPeer = false

bitchat/Services/BLE/BLEAnnounceHandlingPolicy.swift

@@ -56,6 +56,7 @@ enum BLEAnnounceTrustRejection: Equatable {
     case missingSignature
     case invalidSignature
     case keyMismatch
+    case authenticatedSigningKeyMismatch
 }
 
 enum BLEAnnounceTrustDecision: Equatable {
@@ -72,12 +73,19 @@ enum BLEAnnounceTrustPolicy {
         hasSignature: Bool,
         signatureValid: Bool,
         existingNoisePublicKey: Data?,
-        announcedNoisePublicKey: Data
+        announcedNoisePublicKey: Data,
+        authenticatedSigningPublicKey: Data? = nil,
+        announcedSigningPublicKey: Data? = nil
     ) -> BLEAnnounceTrustDecision {
         if let existingNoisePublicKey, existingNoisePublicKey != announcedNoisePublicKey {
             return .reject(.keyMismatch)
         }
 
+        if let authenticatedSigningPublicKey,
+           announcedSigningPublicKey != authenticatedSigningPublicKey {
+            return .reject(.authenticatedSigningKeyMismatch)
+        }
+
         guard hasSignature else {
             return .reject(.missingSignature)
         }

bitchat/Services/BLE/BLEFileTransferHandler.swift

@@ -16,6 +16,8 @@ struct BLEFileTransferHandlerEnvironment {
     let peersSnapshot: () -> [PeerID: BLEPeerInfo]
     /// Verifies a packet's signature against a candidate signing key (registry path).
     let verifyPacketSignature: (_ packet: BitchatPacket, _ signingPublicKey: Data) -> Bool
+    /// Local signing key used to authenticate our own gossip-sync replays.
+    let localSigningPublicKey: () -> Data
     /// Resolves a display name from a verified packet signature for peers missing from the registry.
     let signedSenderDisplayName: (_ packet: BitchatPacket, _ peerID: PeerID) -> String?
     /// Tracks the broadcast file packet for gossip sync.
@@ -30,10 +32,85 @@ struct BLEFileTransferHandlerEnvironment {
         _ fallbackExtension: String?,
         _ defaultPrefix: String
     ) -> URL?
+    /// Resolves the durable receiver decision for a stable private-media ID.
+    let privateMediaReceiptState: (
+        _ messageID: String
+    ) -> BLEPrivateMediaReceiptState
+    /// Atomically records a stable private-media ID after the payload save.
+    let commitPrivateMediaFile: (_ messageID: String, _ storedURL: URL) -> Bool
+    /// Rolls back a saved payload when its durable receipt commit fails.
+    let removeIncomingFile: (_ storedURL: URL) -> Void
+    /// Releases the allocator's save-to-UI ownership guard after synchronous
+    /// conversation insertion has completed.
+    let finishIncomingFileDelivery: (_ storedURL: URL) -> Void
+    /// Checks the authenticated sender before any private-media disk work.
+    let isPrivateMediaSenderBlocked: (PeerID) -> Bool
     /// Updates the registry last-seen timestamp for the peer (async barrier write).
     let updatePeerLastSeen: (PeerID) -> Void
-    /// Delivers `.messageReceived` to the UI as one main-actor hop.
-    let deliverMessage: (BitchatMessage) -> Void
+    /// Acknowledges stable private media only after its synchronous
+    /// conversation delivery has completed.
+    let acknowledgePrivateMedia: (_ messageID: String, _ peerID: PeerID) -> Void
+    /// Delivers `.messageReceived` as one main-actor hop while
+    /// `shouldDeliver` remains true before and after the synchronous sink.
+    /// The completion authorizes the stable-media ACK. Finalization runs after
+    /// every delivery attempt, including rejection, so allocator ownership
+    /// cannot leak indefinitely.
+    let deliverMessage: (
+        _ message: BitchatMessage,
+        _ shouldDeliver: @escaping () -> Bool,
+        _ completion: @escaping () -> Void,
+        _ finalization: @escaping (TransportEventDeliveryOutcome) -> Void
+    ) -> Void
+}
+
+/// Process-lifetime reservation cache for stable private-media IDs.
+///
+/// The first arrival reserves its ID before quota enforcement. Concurrent
+/// arrivals remain coalesced in memory, while accepted state is resolved from
+/// the durable ID-to-file ledger so it survives relaunch and becomes retryable
+/// if quota cleanup removed the file.
+private final class PrivateMediaArrivalDeduplicator {
+    enum Reservation {
+        case reserved
+        case pending
+        case accepted(URL)
+        case tombstoned
+        case unavailable
+    }
+
+    private let lock = NSLock()
+    private var pending: Set<String> = []
+
+    func reserve(
+        _ messageID: String,
+        receiptState: () -> BLEPrivateMediaReceiptState
+    ) -> Reservation {
+        lock.lock()
+        defer { lock.unlock() }
+        if pending.contains(messageID) {
+            return .pending
+        }
+
+        switch receiptState() {
+        case .accepted(let existingURL):
+            return .accepted(existingURL)
+        case .tombstoned:
+            return .tombstoned
+        case .unavailable:
+            return .unavailable
+        case .absent:
+            break
+        }
+
+        pending.insert(messageID)
+        return .reserved
+    }
+
+    func finish(_ messageID: String) {
+        lock.lock()
+        defer { lock.unlock() }
+        pending.remove(messageID)
+    }
 }
 
 /// Orchestrates inbound file transfers: self-echo policy, sender display-name
@@ -41,61 +118,204 @@ struct BLEFileTransferHandlerEnvironment {
 /// and UI delivery.
 final class BLEFileTransferHandler {
     private let environment: BLEFileTransferHandlerEnvironment
+    private let privateMediaArrivals = PrivateMediaArrivalDeduplicator()
 
     init(environment: BLEFileTransferHandlerEnvironment) {
         self.environment = environment
     }
 
-    /// Returns `false` when the packet fails sender authentication and must
-    /// not be relayed onward. Every other outcome returns `true`: files
-    /// directed to another peer are forwarded untouched, and local-only drops
-    /// (malformed payload, quota, save failure) don't affect multi-hop
-    /// delivery to nodes that may handle them fine.
+    /// Returns `false` when the raw packet fails sender authentication (or is
+    /// a live self-echo) and must not be relayed onward. Authentication runs
+    /// before the routing decision, so a forged directed packet cannot use a
+    /// node that is not its recipient as an unsigned forwarding hop.
     @discardableResult
     func handle(_ packet: BitchatPacket, from peerID: PeerID) -> Bool {
         let env = environment
-        if BLEFileTransferPolicy.isSelfEcho(packet: packet, from: peerID, localPeerID: env.localPeerID()) { return true }
-
-        guard let deliveryPlan = BLEFileTransferPolicy.deliveryPlan(packet: packet, localPeerID: env.localPeerID()) else {
-            return true
-        }
-
+        let localPeerID = env.localPeerID()
         let peersSnapshot = env.peersSnapshot()
-        guard let senderNickname = resolveSenderNickname(
+
+        guard let senderNickname = authenticatedRawSenderNickname(
             packet: packet,
             from: peerID,
-            isBroadcast: !deliveryPlan.isPrivateMessage,
             peers: peersSnapshot,
             env: env
         ) else {
-            SecureLogger.warning("🚫 Dropping file transfer from unverified or unknown peer \(peerID.id.prefix(8))…", category: .security)
+            SecureLogger.warning("🚫 Dropping raw file transfer with missing/invalid signature from \(peerID.id.prefix(8))…", category: .security)
             return false
         }
 
+        if BLEFileTransferPolicy.isSelfEcho(packet: packet, from: peerID, localPeerID: localPeerID) {
+            return false
+        }
+
+        guard let deliveryPlan = BLEFileTransferPolicy.deliveryPlan(packet: packet, localPeerID: localPeerID) else {
+            return true
+        }
+
         if deliveryPlan.shouldTrackForSync {
             env.trackPacketSeen(packet)
         }
 
+        _ = storeIncomingPayload(
+            packet.payload,
+            from: peerID,
+            senderNickname: senderNickname,
+            timestamp: Date(timeIntervalSince1970: Double(packet.timestamp) / 1000),
+            isPrivate: deliveryPlan.isPrivateMessage,
+            usesDurableReceipts: false,
+            env: env
+        )
+        // Once authenticated, a local decode/quota/save failure is not proof
+        // that downstream nodes should be denied the valid signed packet.
+        return true
+    }
+
+    /// Accepts a file packet only after it has been authenticated and
+    /// decrypted by the peer's Noise session. The inner packet deliberately
+    /// has no redundant signature: Noise supplies sender authentication and
+    /// confidentiality, while this handler retains the same validation,
+    /// quota, persistence, and UI-delivery behavior as public files.
+    @discardableResult
+    func handlePrivatePayload(_ payload: Data, from peerID: PeerID, timestamp: Date) -> Bool {
+        let env = environment
+        let peers = env.peersSnapshot()
+        let senderNickname = BLEPeerSenderDisplayName.resolveKnownPeer(
+            peerID: peerID,
+            localPeerID: env.localPeerID(),
+            localNickname: env.localNickname(),
+            peers: peers,
+            allowConnectedUnverified: true
+        ) ?? BLEPeerSenderDisplayName.anonymousNickname(for: peerID)
+
+        return storeIncomingPayload(
+            payload,
+            from: peerID,
+            senderNickname: senderNickname,
+            timestamp: timestamp,
+            isPrivate: true,
+            // Every authenticated Noise private-file keeps the stable ID/ACK
+            // contract introduced with capability bit 8. Bit 9 advertises
+            // sender-side automatic retry support; it must not downgrade
+            // prior iOS clients to random IDs or single-check delivery.
+            usesDurableReceipts: true,
+            env: env
+        )
+    }
+
+    private func storeIncomingPayload(
+        _ payload: Data,
+        from peerID: PeerID,
+        senderNickname: String,
+        timestamp: Date,
+        isPrivate: Bool,
+        usesDurableReceipts: Bool,
+        env: BLEFileTransferHandlerEnvironment
+    ) -> Bool {
+
+        let localPeerID = env.localPeerID()
         let filePacket: BitchatFilePacket
         let mime: MimeType
-        switch BLEIncomingFileValidator.validate(payload: packet.payload) {
+        switch BLEIncomingFileValidator.validate(payload: payload) {
         case .success(let acceptance):
             filePacket = acceptance.filePacket
             mime = acceptance.mime
         case .failure(.malformedPayload):
             SecureLogger.error("❌ Failed to decode file transfer payload", category: .session)
-            return true
+            return false
         case .failure(.payloadTooLarge(let bytes)):
             SecureLogger.warning("🚫 Dropping file transfer exceeding size cap (\(bytes) bytes)", category: .security)
-            return true
+            return false
         case .failure(.unsupportedMime(let mimeType, let bytes)):
             SecureLogger.warning("🚫 MIME REJECT: '\(mimeType ?? "<empty>")' not supported. Size=\(bytes)b from \(peerID.id.prefix(8))...", category: .security)
-            return true
+            return false
         case .failure(.magicMismatch(let mime, let bytes, let prefixHex)):
             SecureLogger.warning("🚫 MAGIC REJECT: MIME='\(mime)' size=\(bytes)b prefix=[\(prefixHex)] from \(peerID.id.prefix(8))...", category: .security)
+            return false
+        }
+
+        if isPrivate, env.isPrivateMediaSenderBlocked(peerID) {
+            SecureLogger.debug(
+                "🚫 Dropping private media from blocked peer \(peerID.id.prefix(8))… before disk write",
+                category: .security
+            )
             return true
         }
 
+        let messageID = usesDurableReceipts
+            ? PrivateMediaMessageIdentity.stableID(
+                for: filePacket,
+                senderPeerID: peerID,
+                recipientPeerID: localPeerID
+            )
+            : nil
+        if let messageID {
+            switch privateMediaArrivals.reserve(
+                messageID,
+                receiptState: { env.privateMediaReceiptState(messageID) }
+            ) {
+            case .reserved:
+                break
+            case .pending:
+                // The first arrival has not reached durable storage yet.
+                // Coalesce this retry without ACKing so a failed first save
+                // remains retryable by the sender.
+                SecureLogger.debug(
+                    "📁 Coalesced in-flight private media id=\(messageID.prefix(12))… from \(peerID.id.prefix(8))…",
+                    category: .session
+                )
+                return true
+            case .accepted(let existingFile):
+                env.updatePeerLastSeen(peerID)
+                let message = incomingMessage(
+                    messageID: messageID,
+                    senderNickname: senderNickname,
+                    timestamp: timestamp,
+                    isPrivate: true,
+                    peerID: peerID,
+                    destination: existingFile,
+                    category: storedMediaCategory(
+                        for: existingFile,
+                        fallback: mime.category
+                    ),
+                    env: env
+                )
+                SecureLogger.debug(
+                    "📁 Restored durable private media duplicate id=\(messageID.prefix(12))… from \(peerID.id.prefix(8))… -> \(existingFile.lastPathComponent)",
+                    category: .session
+                )
+                deliverStableMessage(
+                    message,
+                    messageID: messageID,
+                    peerID: peerID,
+                    expectedURL: existingFile,
+                    env: env
+                )
+                return true
+            case .tombstoned:
+                // Explicit deletion is a durable terminal receiver decision.
+                env.updatePeerLastSeen(peerID)
+                env.acknowledgePrivateMedia(messageID, peerID)
+                SecureLogger.debug(
+                    "📁 Dropped explicitly deleted private media id=\(messageID.prefix(12))… from \(peerID.id.prefix(8))…",
+                    category: .session
+                )
+                return true
+            case .unavailable:
+                // Never turn an unreadable ledger into an empty ledger. The
+                // sender can retry after the transient storage failure clears.
+                SecureLogger.warning(
+                    "📁 Withholding private media id=\(messageID.prefix(12))… while durable receipt state is unavailable",
+                    category: .session
+                )
+                return true
+            }
+        }
+        defer {
+            if let messageID {
+                privateMediaArrivals.finish(messageID)
+            }
+        }
+
         // BCH-01-002: Enforce storage quota before saving
         env.enforceStorageQuota(filePacket.content.count)
 
@@ -106,82 +326,175 @@ final class BLEFileTransferHandler {
             mime.defaultExtension,
             mime.category.rawValue
         ) else {
-            return true
+            return false
         }
 
-        if deliveryPlan.isPrivateMessage {
+        if let messageID,
+           !env.commitPrivateMediaFile(messageID, destination) {
+            // A payload without its durable ID mapping cannot safely suppress
+            // a retry after relaunch. Roll it back and withhold UI/ACK.
+            env.removeIncomingFile(destination)
+            return false
+        }
+
+        if isPrivate {
             env.updatePeerLastSeen(peerID)
         }
 
-        let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
-        let message = BitchatMessage(
-            sender: senderNickname,
-            content: "\(mime.category.messagePrefix)\(destination.lastPathComponent)",
-            timestamp: ts,
-            isRelay: false,
-            originalSender: nil,
-            isPrivate: deliveryPlan.isPrivateMessage,
-            recipientNickname: nil,
-            senderPeerID: peerID,
-            // Received messages need an explicit status: BitchatMessage
-            // defaults private messages to .sending, which the media views
-            // render as an in-flight send (empty reveal mask, disabled tap).
-            deliveryStatus: deliveryPlan.isPrivateMessage
-                ? .delivered(to: env.localNickname(), at: ts)
-                : nil
+        let message = incomingMessage(
+            messageID: messageID,
+            senderNickname: senderNickname,
+            timestamp: timestamp,
+            isPrivate: isPrivate,
+            peerID: peerID,
+            destination: destination,
+            category: mime.category,
+            env: env
         )
 
         SecureLogger.debug("📁 Stored incoming media from \(peerID.id.prefix(8))… -> \(destination.lastPathComponent)", category: .session)
 
-        env.deliverMessage(message)
+        if let messageID {
+            deliverStableMessage(
+                message,
+                messageID: messageID,
+                peerID: peerID,
+                expectedURL: destination,
+                env: env
+            )
+        } else {
+            env.deliverMessage(
+                message,
+                { true },
+                {},
+                { outcome in
+                    if outcome == .rejected {
+                        // Raw media has no durable receipt that can redeliver
+                        // it later. Do not leave a newly saved, UI-unowned file
+                        // available for a stale fallback path to misidentify.
+                        env.removeIncomingFile(destination)
+                    } else {
+                        // Plain delegates are invoked without synchronous
+                        // insertion confirmation. Preserve the payload for
+                        // that supported delivery path.
+                        env.finishIncomingFileDelivery(destination)
+                    }
+                }
+            )
+        }
         return true
     }
 
-    /// Resolves the authenticated display name for a file transfer's sender.
-    ///
-    /// Directed (private) transfers are addressed to us specifically and keep
-    /// the lenient connected-peer path. Broadcast transfers carry an
-    /// attacker-controllable `senderID` exactly like public messages and public
-    /// voice frames — registry membership alone is NOT proof of identity, so a
-    /// valid packet signature from the claimed sender is required before we
-    /// trust it. Without this, a peer that observed a public voice burst could
-    /// spoof a broadcast `voice_<burstID>.m4a` note under the talker's ID and
-    /// overwrite the signature-verified live bubble with attacker audio.
-    private func resolveSenderNickname(
+    private func deliverStableMessage(
+        _ message: BitchatMessage,
+        messageID: String,
+        peerID: PeerID,
+        expectedURL: URL,
+        env: BLEFileTransferHandlerEnvironment
+    ) {
+        env.deliverMessage(
+            message,
+            {
+                guard case .accepted(let resolvedURL) =
+                        env.privateMediaReceiptState(messageID) else {
+                    return false
+                }
+                return resolvedURL.standardizedFileURL
+                    == expectedURL.standardizedFileURL
+            },
+            {
+                env.acknowledgePrivateMedia(messageID, peerID)
+            },
+            { _ in
+                env.finishIncomingFileDelivery(expectedURL)
+            }
+        )
+    }
+
+    private func incomingMessage(
+        messageID: String?,
+        senderNickname: String,
+        timestamp: Date,
+        isPrivate: Bool,
+        peerID: PeerID,
+        destination: URL,
+        category: MimeType.Category,
+        env: BLEFileTransferHandlerEnvironment
+    ) -> BitchatMessage {
+        BitchatMessage(
+            id: messageID,
+            sender: senderNickname,
+            content: "\(category.messagePrefix)\(destination.lastPathComponent)",
+            timestamp: timestamp,
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: isPrivate,
+            recipientNickname: nil,
+            senderPeerID: peerID,
+            // Received messages need an explicit status: BitchatMessage
+            // defaults private messages to .sending, which media views render
+            // as an in-flight send.
+            deliveryStatus: isPrivate
+                ? .delivered(to: env.localNickname(), at: timestamp)
+                : nil
+        )
+    }
+
+    /// The durable URL is authoritative during reconstruction. A sender that
+    /// reuses a stable filename with a different MIME type must not change how
+    /// the already-stored payload renders.
+    private func storedMediaCategory(
+        for url: URL,
+        fallback: MimeType.Category
+    ) -> MimeType.Category {
+        let mediaDirectory = url
+            .deletingLastPathComponent()
+            .deletingLastPathComponent()
+            .lastPathComponent
+        switch mediaDirectory {
+        case MimeType.Category.audio.mediaDir:
+            return .audio
+        case MimeType.Category.image.mediaDir:
+            return .image
+        case MimeType.Category.file.mediaDir:
+            return .file
+        default:
+            return fallback
+        }
+    }
+
+    /// Every remaining raw file transfer is signed, regardless of whether it
+    /// is broadcast, addressed to us, or merely passing through. Registry
+    /// signing keys are preferred; persisted identities cover peers that have
+    /// rotated or are not currently present in the registry.
+    private func authenticatedRawSenderNickname(
         packet: BitchatPacket,
         from peerID: PeerID,
-        isBroadcast: Bool,
         peers: [PeerID: BLEPeerInfo],
         env: BLEFileTransferHandlerEnvironment
     ) -> String? {
-        guard isBroadcast else {
-            return BLEPeerSenderDisplayName.resolveKnownPeer(
-                peerID: peerID,
-                localPeerID: env.localPeerID(),
-                localNickname: env.localNickname(),
-                peers: peers,
-                allowConnectedUnverified: true
-            ) ?? env.signedSenderDisplayName(packet, peerID)
-        }
+        guard packet.signature != nil else { return nil }
 
-        // Our own broadcasts replayed back via gossip sync (ttl==0) are
-        // trivially authentic and cannot be verified against the peer registry
-        // or identity cache, so exempt self exactly as `BLEPublicMessageHandler`
-        // does. Verify against the signing key already in the
-        // (synchronously-updated) registry first, then fall back to the
-        // persisted-identity signature lookup for peers not yet cached there.
-        let isSelf = peerID == env.localPeerID()
-        let registrySigningKey = peers[peerID]?.signingPublicKey
-        let verifiedViaRegistry = !isSelf && (registrySigningKey.map { env.verifyPacketSignature(packet, $0) } ?? false)
-        let signedDisplayName = (isSelf || verifiedViaRegistry) ? nil : env.signedSenderDisplayName(packet, peerID)
-        guard isSelf || verifiedViaRegistry || signedDisplayName != nil else { return nil }
+        let localPeerID = env.localPeerID()
+        let candidateKey = peerID == localPeerID
+            ? env.localSigningPublicKey()
+            : peers[peerID]?.signingPublicKey
+        let verifiedWithKnownKey = candidateKey.map {
+            env.verifyPacketSignature(packet, $0)
+        } ?? false
+        let signedDisplayName = verifiedWithKnownKey
+            ? nil
+            : env.signedSenderDisplayName(packet, peerID)
+        guard verifiedWithKnownKey || signedDisplayName != nil else { return nil }
 
         return BLEPeerSenderDisplayName.resolveKnownPeer(
             peerID: peerID,
-            localPeerID: env.localPeerID(),
+            localPeerID: localPeerID,
             localNickname: env.localNickname(),
             peers: peers,
-            allowConnectedUnverified: false
-        ) ?? signedDisplayName
+            // The packet signature authenticates the announced peer; the old
+            // connected-but-unsigned leniency is not involved.
+            allowConnectedUnverified: true
+        ) ?? signedDisplayName ?? BLEPeerSenderDisplayName.anonymousNickname(for: peerID)
     }
 }

bitchat/Services/BLE/BLEFragmentAssemblyBuffer.swift

@@ -201,8 +201,11 @@ struct BLEFragmentAssemblyBuffer {
     }
 
     private static func assemblyLimit(for originalType: UInt8) -> Int {
-        if originalType == MessageType.fileTransfer.rawValue {
+        if originalType == MessageType.fileTransfer.rawValue
+            || originalType == MessageType.noiseEncrypted.rawValue {
             // Allow headroom for TLV metadata and binary framing overhead.
+            // A large noiseEncrypted packet can be an E2E-encrypted private
+            // file; its authenticated plaintext is validated after decrypt.
             return FileTransferLimits.maxFramedFileBytes
         }
 

bitchat/Services/BLE/BLEIncomingFileStore.swift

@@ -2,9 +2,134 @@ import BitLogger
 import BitFoundation
 import Foundation
 
-struct BLEIncomingFileStore {
-    private static let quotaBytes: Int64 = 100 * 1024 * 1024
+struct PanicRecoveryIntent {
+    let fileMarkerEstablished: Bool
+    let externalMarkerEstablished: Bool
 
+    var hasDurableMarker: Bool {
+        fileMarkerEstablished || externalMarkerEstablished
+    }
+}
+
+/// Small, dependency-injectable transaction surface used by ChatViewModel.
+/// Production persists the same intent in two independent locations before
+/// any application state is erased. Tests can inject an ephemeral operation
+/// set without touching the developer's Application Support directory.
+struct PanicRecoveryOperations {
+    let isPending: () throws -> Bool
+    let begin: () -> PanicRecoveryIntent
+    let wipeMedia: (PanicRecoveryIntent) throws -> Void
+    let complete: () throws -> Void
+
+    static func ephemeral(
+        wipeMedia: @escaping () throws -> Void = {}
+    ) -> PanicRecoveryOperations {
+        PanicRecoveryOperations(
+            isPending: { false },
+            begin: {
+                PanicRecoveryIntent(
+                    fileMarkerEstablished: false,
+                    externalMarkerEstablished: false
+                )
+            },
+            wipeMedia: { _ in try wipeMedia() },
+            complete: {}
+        )
+    }
+
+    static func live(
+        fileStore: BLEIncomingFileStore = BLEIncomingFileStore(),
+        defaults: UserDefaults = .standard
+    ) -> PanicRecoveryOperations {
+        let defaultsKey = "bitchat.panicResetPending"
+        return PanicRecoveryOperations(
+            isPending: {
+                if defaults.bool(forKey: defaultsKey) {
+                    return true
+                }
+                return try fileStore.isPanicRecoveryPending()
+            },
+            begin: {
+                defaults.set(true, forKey: defaultsKey)
+                let externalMarkerEstablished =
+                    defaults.synchronize()
+                    && defaults.bool(forKey: defaultsKey)
+
+                let fileMarkerEstablished: Bool
+                do {
+                    try fileStore.markPanicRecoveryPending()
+                    fileMarkerEstablished = true
+                } catch {
+                    fileMarkerEstablished = false
+                    SecureLogger.error(
+                        "Failed to persist file panic-recovery marker: \(error)",
+                        category: .security
+                    )
+                }
+
+                return PanicRecoveryIntent(
+                    fileMarkerEstablished: fileMarkerEstablished,
+                    externalMarkerEstablished: externalMarkerEstablished
+                )
+            },
+            wipeMedia: { intent in
+                try fileStore.panicWipe(
+                    hasDurablePendingMarker: intent.hasDurableMarker
+                )
+            },
+            complete: {
+                // Keep the independent defaults latch until the file marker
+                // has definitely cleared. Any failure therefore remains
+                // visible to the next launch.
+                try fileStore.completePanicRecovery()
+                defaults.removeObject(forKey: defaultsKey)
+                guard defaults.synchronize(),
+                      !defaults.bool(forKey: defaultsKey) else {
+                    throw BLEIncomingFileStore.PanicRecoveryError
+                        .externalMarkerCommitFailed
+                }
+            }
+        )
+    }
+}
+
+struct BLEIncomingFileStore: @unchecked Sendable {
+    enum PanicRecoveryError: Error {
+        case externalMarkerCommitFailed
+        case markerWriteFailed(Error)
+        case markerWriteAndMediaWipeFailed(
+            markerError: Error,
+            mediaError: Error
+        )
+    }
+
+    struct PrivateMediaDeletionReservation: Sendable {
+        fileprivate let id: UUID
+    }
+
+    private final class PayloadCoordination: @unchecked Sendable {
+        let lock = NSLock()
+        var pendingDeliveryPaths: Set<String> = []
+        var deletionReservations: [UUID: Set<String>] = [:]
+    }
+
+    private static let defaultQuotaBytes: Int64 = 100 * 1024 * 1024
+    /// Kept outside `files/` so deleting the media tree cannot erase the
+    /// fail-closed startup decision before the full panic has committed.
+    private static let panicRecoveryPendingMarkerFileName =
+        ".panic-recovery-pending"
+    /// Compatibility with a short-lived development build that used the
+    /// media-specific name for the same full-transaction latch.
+    private static let legacyPanicRecoveryPendingMarkerFileName =
+        ".panic-media-wipe-pending"
+    private static let mediaSubdirectories = [
+        "voicenotes/incoming",
+        "voicenotes/outgoing",
+        "images/incoming",
+        "images/outgoing",
+        "files/incoming",
+        "files/outgoing"
+    ]
     /// Name prefix of in-flight live voice captures (progressively written by
     /// `ChatLiveVoiceCoordinator`). Quota eviction skips them by pattern —
     /// deleting one mid-stream unlinks the inode under an open `FileHandle`
@@ -17,11 +142,123 @@ struct BLEIncomingFileStore {
     let fileManager: FileManager
     private let baseDirectory: URL?
     private let dateProvider: () -> Date
+    private let panicMarkerWriter: (Data, URL) throws -> Void
+    private let quotaBytes: Int64
+    private let privateMediaReceipts: BLEPrivateMediaReceiptStore
+    private let payloadCoordination: PayloadCoordination
 
-    init(fileManager: FileManager = .default, baseDirectory: URL? = nil, dateProvider: @escaping () -> Date = Date.init) {
+    init(
+        fileManager: FileManager = .default,
+        baseDirectory: URL? = nil,
+        dateProvider: @escaping () -> Date = Date.init,
+        panicMarkerWriter: @escaping (Data, URL) throws -> Void = {
+            try $0.write(to: $1, options: .atomic)
+        },
+        quotaBytes: Int64 = Self.defaultQuotaBytes
+    ) {
         self.fileManager = fileManager
         self.baseDirectory = baseDirectory
         self.dateProvider = dateProvider
+        self.panicMarkerWriter = panicMarkerWriter
+        self.quotaBytes = max(0, quotaBytes)
+        self.privateMediaReceipts = BLEPrivateMediaReceiptStore(
+            fileManager: fileManager,
+            baseDirectory: baseDirectory,
+            now: dateProvider
+        )
+        self.payloadCoordination = PayloadCoordination()
+    }
+
+    /// Panic-wipe every managed incoming and outgoing media artifact before
+    /// returning. Recreating the directory tree keeps later capture/receive
+    /// paths usable without allowing a detached cleanup task to race them.
+    ///
+    /// Marker persistence and deletion are deliberately separate error
+    /// domains: even when both durable marker channels fail, deletion is
+    /// still attempted before this method reports the marker failure.
+    func panicWipe(
+        hasDurablePendingMarker: Bool = false
+    ) throws {
+        // The receipt index caches tombstones as well as accepted payloads,
+        // while payload coordination retains save/delete reservations. Always
+        // invalidate both on return, including partial-failure paths, so no
+        // pre-panic receiver decision survives after identity reset.
+        defer {
+            privateMediaReceipts.resetForPanic()
+            payloadCoordination.lock.lock()
+            payloadCoordination.pendingDeliveryPaths.removeAll(
+                keepingCapacity: false
+            )
+            payloadCoordination.deletionReservations.removeAll(
+                keepingCapacity: false
+            )
+            payloadCoordination.lock.unlock()
+        }
+
+        let markerError: Error?
+        do {
+            try markPanicRecoveryPending()
+            markerError = nil
+        } catch {
+            markerError = error
+            SecureLogger.error(
+                "Could not persist file panic-recovery marker; attempting media deletion anyway: \(error)",
+                category: .security
+            )
+        }
+
+        do {
+            let filesDirectory = try rootDirectory()
+                .appendingPathComponent("files", isDirectory: true)
+            if fileManager.fileExists(atPath: filesDirectory.path) {
+                try fileManager.removeItem(at: filesDirectory)
+            }
+            for subdirectory in Self.mediaSubdirectories {
+                try fileManager.createDirectory(
+                    at: filesDirectory.appendingPathComponent(
+                        subdirectory,
+                        isDirectory: true
+                    ),
+                    withIntermediateDirectories: true,
+                    attributes: nil
+                )
+            }
+        } catch {
+            if let markerError {
+                throw PanicRecoveryError.markerWriteAndMediaWipeFailed(
+                    markerError: markerError,
+                    mediaError: error
+                )
+            }
+            throw error
+        }
+
+        if let markerError, !hasDurablePendingMarker {
+            throw PanicRecoveryError.markerWriteFailed(markerError)
+        }
+    }
+
+    func markPanicRecoveryPending() throws {
+        let markerURL = try panicRecoveryPendingMarkerURL()
+        try fileManager.createDirectory(
+            at: markerURL.deletingLastPathComponent(),
+            withIntermediateDirectories: true,
+            attributes: nil
+        )
+        try panicMarkerWriter(Data([1]), markerURL)
+    }
+
+    func isPanicRecoveryPending() throws -> Bool {
+        try panicRecoveryMarkerURLs().contains {
+            fileManager.fileExists(atPath: $0.path)
+        }
+    }
+
+    func completePanicRecovery() throws {
+        for markerURL in try panicRecoveryMarkerURLs()
+        where fileManager.fileExists(atPath: markerURL.path) {
+            try fileManager.removeItem(at: markerURL)
+        }
     }
 
     /// Resolves (and creates) an incoming-media directory for callers that
@@ -39,6 +276,9 @@ struct BLEIncomingFileStore {
         fallbackExtension: String?,
         defaultPrefix: String
     ) -> URL? {
+        payloadCoordination.lock.lock()
+        defer { payloadCoordination.lock.unlock() }
+
         do {
             let base = try filesDirectory().appendingPathComponent(subdirectory, isDirectory: true)
             try fileManager.createDirectory(at: base, withIntermediateDirectories: true, attributes: nil)
@@ -47,8 +287,26 @@ struct BLEIncomingFileStore {
                 defaultName: "\(defaultPrefix)_\(Self.timestampString(from: dateProvider()))",
                 fallbackExtension: fallbackExtension
             )
-            let destination = uniqueFileURL(in: base, fileName: sanitized)
+            let reservedPaths = privateMediaReceipts.reservedPayloadPaths()
+            let deletionPaths = payloadCoordination
+                .deletionReservations.values.reduce(into: Set<String>()) {
+                    $0.formUnion($1)
+                }
+            let allocationReservations = deletionPaths.union(
+                payloadCoordination.pendingDeliveryPaths
+            )
+            let destination = uniqueFileURL(
+                in: base,
+                fileName: sanitized,
+                reservedPaths: (reservedPaths ?? []).union(
+                    allocationReservations
+                ),
+                forceRandomizedName: reservedPaths == nil
+            )
             try data.write(to: destination, options: .atomic)
+            payloadCoordination.pendingDeliveryPaths.insert(
+                destination.standardizedFileURL.path
+            )
             return destination
         } catch {
             SecureLogger.error("❌ Failed to persist incoming media: \(error)", category: .session)
@@ -56,12 +314,111 @@ struct BLEIncomingFileStore {
         }
     }
 
+    func privateMediaReceiptState(
+        messageID: String
+    ) -> BLEPrivateMediaReceiptState {
+        privateMediaReceipts.state(for: messageID)
+    }
+
+    func commitPrivateMediaFile(
+        messageID: String,
+        storedURL: URL
+    ) -> Bool {
+        privateMediaReceipts.commitAccepted(
+            messageID: messageID,
+            storedURL: storedURL
+        )
+    }
+
+    /// Reserves every receipt/UI path before the asynchronous deletion
+    /// barrier. Allocation and reservation share one lock, so either an
+    /// in-flight raw arrival is observed and deletion fails closed, or the
+    /// arrival is forced onto a different filename.
+    func reservePrivateMediaDeletion(
+        messageIDs: [String],
+        payloadRelativePaths: [String: String]
+    ) -> PrivateMediaDeletionReservation? {
+        payloadCoordination.lock.lock()
+        defer { payloadCoordination.lock.unlock() }
+
+        guard let paths = privateMediaReceipts
+            .prospectiveDeletionPayloadPaths(
+                messageIDs: messageIDs,
+                payloadRelativePaths: payloadRelativePaths
+            ),
+        paths.isDisjoint(
+            with: payloadCoordination.pendingDeliveryPaths
+        ) else {
+            return nil
+        }
+
+        let reservation = PrivateMediaDeletionReservation(id: UUID())
+        payloadCoordination.deletionReservations[reservation.id] = paths
+        return reservation
+    }
+
+    func commitPrivateMediaDeletion(
+        reservation: PrivateMediaDeletionReservation,
+        messageIDs: [String],
+        payloadRelativePaths: [String: String],
+        protectedPayloadRelativePaths: Set<String>
+    ) -> Bool {
+        payloadCoordination.lock.lock()
+        defer {
+            payloadCoordination.deletionReservations.removeValue(
+                forKey: reservation.id
+            )
+            payloadCoordination.lock.unlock()
+        }
+        guard payloadCoordination.deletionReservations[reservation.id] != nil
+        else {
+            return false
+        }
+        return privateMediaReceipts.recordDeleted(
+            messageIDs: messageIDs,
+            payloadRelativePaths: payloadRelativePaths,
+            protectedPayloadRelativePaths: protectedPayloadRelativePaths
+        )
+    }
+
+    /// Releases the short window between disk save and synchronous
+    /// conversation insertion. Before this callback, a deletion transaction
+    /// may not infer ownership from a stale bubble that names the same path.
+    func finishIncomingFileDelivery(at storedURL: URL) {
+        payloadCoordination.lock.lock()
+        defer { payloadCoordination.lock.unlock() }
+        payloadCoordination.pendingDeliveryPaths.remove(
+            storedURL.standardizedFileURL.path
+        )
+    }
+
+    /// Best-effort rollback for a payload whose durable receipt commit failed.
+    func removeIncomingFile(at storedURL: URL) {
+        payloadCoordination.lock.lock()
+        defer { payloadCoordination.lock.unlock() }
+        payloadCoordination.pendingDeliveryPaths.remove(
+            storedURL.standardizedFileURL.path
+        )
+        guard isURLInsideFilesDirectory(storedURL) else { return }
+        do {
+            try fileManager.removeItem(at: storedURL)
+        } catch {
+            SecureLogger.warning(
+                "⚠️ Failed to roll back uncommitted incoming media: \(error)",
+                category: .session
+            )
+        }
+    }
+
     /// Frees least-recently-modified incoming files until `reservingBytes`
     /// fits under the quota. Files named `voice_live_*` (in-flight live
     /// captures) are never evicted regardless of who triggers enforcement —
     /// a finalized transfer can arrive at quota while a burst is still
     /// streaming — but they still count toward usage.
     func enforceQuota(reservingBytes: Int) {
+        payloadCoordination.lock.lock()
+        defer { payloadCoordination.lock.unlock() }
+
         do {
             let base = try filesDirectory()
             let incomingDirs = [
@@ -87,14 +444,26 @@ struct BLEIncomingFileStore {
             }
 
             let currentUsage = allFiles.reduce(0) { $0 + $1.size }
-            let targetUsage = Self.quotaBytes - Int64(reservingBytes)
+            let targetUsage = quotaBytes - Int64(reservingBytes)
             guard currentUsage > targetUsage else { return }
 
             let needToFree = currentUsage - targetUsage
+            let activeDeletionPaths = payloadCoordination
+                .deletionReservations.values.reduce(into: Set<String>()) {
+                    $0.formUnion($1)
+                }
+            let protectedPaths = activeDeletionPaths.union(
+                payloadCoordination.pendingDeliveryPaths
+            )
             var freedSpace: Int64 = 0
             for file in allFiles.sorted(by: { $0.modified < $1.modified }) {
                 guard freedSpace < needToFree else { break }
                 guard !file.url.lastPathComponent.hasPrefix(Self.liveCapturePrefix) else { continue }
+                guard !protectedPaths.contains(
+                    file.url.standardizedFileURL.path
+                ) else {
+                    continue
+                }
                 do {
                     try fileManager.removeItem(at: file.url)
                     freedSpace += file.size
@@ -113,15 +482,46 @@ struct BLEIncomingFileStore {
     }
 
     private func filesDirectory() throws -> URL {
-        let root = try baseDirectory ?? fileManager.url(
+        let filesDir = try rootDirectory().appendingPathComponent("files", isDirectory: true)
+        try fileManager.createDirectory(at: filesDir, withIntermediateDirectories: true, attributes: nil)
+        return filesDir
+    }
+
+    private func rootDirectory() throws -> URL {
+        try baseDirectory ?? fileManager.url(
             for: .applicationSupportDirectory,
             in: .userDomainMask,
             appropriateFor: nil,
             create: true
         )
-        let filesDir = root.appendingPathComponent("files", isDirectory: true)
-        try fileManager.createDirectory(at: filesDir, withIntermediateDirectories: true, attributes: nil)
-        return filesDir
+    }
+
+    private func panicRecoveryPendingMarkerURL() throws -> URL {
+        try rootDirectory().appendingPathComponent(
+            Self.panicRecoveryPendingMarkerFileName,
+            isDirectory: false
+        )
+    }
+
+    private func panicRecoveryMarkerURLs() throws -> [URL] {
+        let root = try rootDirectory()
+        return [
+            root.appendingPathComponent(
+                Self.panicRecoveryPendingMarkerFileName,
+                isDirectory: false
+            ),
+            root.appendingPathComponent(
+                Self.legacyPanicRecoveryPendingMarkerFileName,
+                isDirectory: false
+            )
+        ]
+    }
+
+    private func isURLInsideFilesDirectory(_ url: URL) -> Bool {
+        guard let filesDirectory = try? filesDirectory().standardizedFileURL else {
+            return false
+        }
+        return url.standardizedFileURL.path.hasPrefix(filesDirectory.path + "/")
     }
 
     private func sanitizedFileName(_ name: String?, defaultName: String, fallbackExtension: String?) -> String {
@@ -151,11 +551,20 @@ struct BLEIncomingFileStore {
         return candidate.isEmpty ? defaultName : candidate
     }
 
-    private func uniqueFileURL(in directory: URL, fileName: String) -> URL {
+    private func uniqueFileURL(
+        in directory: URL,
+        fileName: String,
+        reservedPaths: Set<String>,
+        forceRandomizedName: Bool
+    ) -> URL {
         let directoryPath = directory.standardizedFileURL.path
         func isInsideDirectory(_ url: URL) -> Bool {
             url.standardizedFileURL.path.hasPrefix(directoryPath + "/")
         }
+        func isAvailable(_ url: URL) -> Bool {
+            !reservedPaths.contains(url.standardizedFileURL.path)
+                && !fileManager.fileExists(atPath: url.path)
+        }
 
         var candidate = directory.appendingPathComponent(fileName)
         guard isInsideDirectory(candidate) else {
@@ -163,19 +572,27 @@ struct BLEIncomingFileStore {
             return directory.appendingPathComponent("blocked_\(UUID().uuidString)")
         }
 
-        if !fileManager.fileExists(atPath: candidate.path) {
+        let baseName = (fileName as NSString).deletingPathExtension
+        let ext = (fileName as NSString).pathExtension
+        if forceRandomizedName {
+            let suffix = UUID().uuidString
+            let randomizedName = ext.isEmpty
+                ? "\(baseName)_\(suffix)"
+                : "\(baseName)_\(suffix).\(ext)"
+            return directory.appendingPathComponent(randomizedName)
+        }
+
+        if isAvailable(candidate) {
             return candidate
         }
 
-        let baseName = (fileName as NSString).deletingPathExtension
-        let ext = (fileName as NSString).pathExtension
         for counter in 1..<100 {
             let newName = ext.isEmpty ? "\(baseName) (\(counter))" : "\(baseName) (\(counter)).\(ext)"
             candidate = directory.appendingPathComponent(newName)
             guard isInsideDirectory(candidate) else {
                 return directory.appendingPathComponent("blocked_\(UUID().uuidString)")
             }
-            if !fileManager.fileExists(atPath: candidate.path) {
+            if isAvailable(candidate) {
                 return candidate
             }
         }

bitchat/Services/BLE/BLENoisePacketHandler.swift

@@ -1,7 +1,18 @@
 import BitFoundation
 import BitLogger
+import CryptoKit
 import Foundation
 
+struct BLENoiseHandshakeHandlingResult {
+    let processed: Bool
+    let didEstablishAuthenticatedSession: Bool
+}
+
+struct BLENoiseDecryptionResult {
+    let plaintext: Data
+    let sessionGeneration: UUID
+}
+
 /// Narrow environment for `BLENoisePacketHandler`.
 ///
 /// All queue hops (collections barrier writes, main-actor UI notification)
@@ -16,10 +27,15 @@ struct BLENoisePacketHandlerEnvironment {
     let messageTTL: UInt8
     /// Current time source.
     let now: () -> Date
-    /// Processes an inbound handshake message, returning an optional response payload (crypto).
-    let processHandshakeMessage: (_ peerID: PeerID, _ message: Data) throws -> Data?
+    /// Processes an inbound handshake message, returning its optional response
+    /// and whether that exact candidate authenticated (crypto).
+    let processHandshakeMessage:
+        (_ peerID: PeerID, _ message: Data) throws
+            -> NoiseHandshakeProcessingResult
     /// Whether any Noise session (established or pending) exists for the peer (crypto).
     let hasNoiseSession: (PeerID) -> Bool
+    /// Whether an inbound ordinary XX responder is waiting for message 3.
+    let isAwaitingResponderHandshakeCompletion: (PeerID) -> Bool
     /// Initiates a fresh Noise handshake with the peer (crypto + send).
     let initiateHandshake: (PeerID) -> Void
     /// Broadcasts a packet on the mesh (caller is already on the message queue).
@@ -27,9 +43,16 @@ struct BLENoisePacketHandlerEnvironment {
     /// Updates the registry last-seen timestamp for the peer (async barrier write).
     let updatePeerLastSeen: (PeerID) -> Void
     /// Decrypts an encrypted payload from the peer (crypto).
-    let decrypt: (_ payload: Data, _ peerID: PeerID) throws -> Data
+    let decrypt: (_ payload: Data, _ peerID: PeerID) throws -> BLENoiseDecryptionResult
     /// Clears the peer's Noise session after an unrecoverable decrypt failure (crypto).
     let clearSession: (PeerID) -> Void
+    /// Consumes session-authenticated protocol state inside the transport. It
+    /// must never escape to UI or Nostr payload dispatch.
+    let handleAuthenticatedPeerState: (
+        _ peerID: PeerID,
+        _ payload: Data,
+        _ sessionGeneration: UUID
+    ) -> Void
     /// Delivers `.noisePayloadReceived` to the UI as one main-actor hop.
     let deliverNoisePayload: (
         _ peerID: PeerID,
@@ -43,19 +66,55 @@ struct BLENoisePacketHandlerEnvironment {
 /// processing (with response), encrypted payload decryption and dispatch,
 /// and session recovery on decrypt failure.
 final class BLENoisePacketHandler {
+    private struct DeferredCiphertext {
+        let packet: BitchatPacket
+        let receivedAt: Date
+    }
+
+    /// Early post-handshake packets are normally tiny control messages or
+    /// queued DMs. Keep the recovery surface deliberately small so an
+    /// unauthenticated half-handshake cannot create an unbounded memory queue.
+    private static let maxDeferredPacketsPerPeer = 4
+    private static let maxDeferredPacketsGlobal = 32
+    /// One legacy sender can immediately follow message 3 with the largest
+    /// valid private-file ciphertext and has no application-level retry. Keep
+    /// room for that packet plus a small control-message budget.
+    private static let maxDeferredBytes =
+        NoiseSecurityConstants.maxPrivateFileCiphertextSize + 256 * 1024
+    private static let deferredLifetime =
+        NoiseSecurityConstants.ordinaryResponderHandshakeTimeout
+
     private let environment: BLENoisePacketHandlerEnvironment
+    private let deferredLock = NSLock()
+    private var deferredCiphertexts: [PeerID: [DeferredCiphertext]] = [:]
+    private var deferredCiphertextBytes = 0
 
     init(environment: BLENoisePacketHandlerEnvironment) {
         self.environment = environment
     }
 
-    func handleHandshake(_ packet: BitchatPacket, from peerID: PeerID) {
+    /// Returns true when the handshake message was processed successfully.
+    /// Callers use this to distinguish an authenticated reconnect completion
+    /// from a rejected ordinary responder while rollback state is restored.
+    @discardableResult
+    func handleHandshake(_ packet: BitchatPacket, from peerID: PeerID) -> Bool {
+        handleHandshakeWithResult(packet, from: peerID).processed
+    }
+
+    func handleHandshakeWithResult(
+        _ packet: BitchatPacket,
+        from peerID: PeerID
+    ) -> BLENoiseHandshakeHandlingResult {
         let env = environment
         // Use NoiseEncryptionService for handshake processing
         if PeerID(hexData: packet.recipientID) == env.localPeerID() {
             // Handshake is for us
             do {
-                if let response = try env.processHandshakeMessage(peerID, packet.payload) {
+                let result = try env.processHandshakeMessage(
+                    peerID,
+                    packet.payload
+                )
+                if let response = result.response {
                     // Send response
                     let responsePacket = BitchatPacket(
                         type: MessageType.noiseHandshake.rawValue,
@@ -70,19 +129,76 @@ final class BLENoisePacketHandler {
                     env.broadcastPacket(responsePacket)
                 }
 
-                // Session establishment will trigger onPeerAuthenticated callback
-                // which will send any pending messages at the right time
+                // The serialized authentication callback installs transport
+                // state before it drains any bounded early ciphertext.
+                return BLENoiseHandshakeHandlingResult(
+                    processed: true,
+                    didEstablishAuthenticatedSession:
+                        result.didEstablishAuthenticatedSession
+                )
+            } catch let managedFailure as NoiseManagedHandshakeFailure {
+                SecureLogger.error(
+                    "Failed to process handshake; manager owns recovery: \(managedFailure.underlying)"
+                )
+                return BLENoiseHandshakeHandlingResult(
+                    processed: false,
+                    didEstablishAuthenticatedSession: false
+                )
+            } catch NoiseSessionError.peerIdentityMismatch {
+                // The responder was already discarded by the session manager.
+                // Do not let a spoofed claimed ID trigger a fresh outbound
+                // handshake or recreate state for the attacker-selected ID.
+                SecureLogger.warning(
+                    "Rejected Noise handshake whose static key does not match \(peerID.id.prefix(8))…",
+                    category: .security
+                )
+                return BLENoiseHandshakeHandlingResult(
+                    processed: false,
+                    didEstablishAuthenticatedSession: false
+                )
             } catch {
                 SecureLogger.error("Failed to process handshake: \(error)")
                 // Try initiating a new handshake
                 if !env.hasNoiseSession(peerID) {
                     env.initiateHandshake(peerID)
                 }
+                return BLENoiseHandshakeHandlingResult(
+                    processed: false,
+                    didEstablishAuthenticatedSession: false
+                )
             }
         }
+        return BLENoiseHandshakeHandlingResult(
+            processed: false,
+            didEstablishAuthenticatedSession: false
+        )
     }
 
     func handleEncrypted(_ packet: BitchatPacket, from peerID: PeerID) {
+        handleEncrypted(packet, from: peerID, isDeferredRetry: false)
+    }
+
+    /// Called by the transport's serialized authentication callback after it
+    /// has installed state for the promoted or restored session generation.
+    func handleSessionAuthenticated(_ peerID: PeerID) {
+        drainDeferredCiphertextsIfReady(for: peerID)
+    }
+
+    /// Synchronously discards ciphertext retained for a pre-panic Noise
+    /// generation. The handler survives the service's identity replacement,
+    /// so keeping this queue would replay old bytes after post-panic auth.
+    func resetForPanic() {
+        deferredLock.lock()
+        deferredCiphertexts.removeAll(keepingCapacity: false)
+        deferredCiphertextBytes = 0
+        deferredLock.unlock()
+    }
+
+    private func handleEncrypted(
+        _ packet: BitchatPacket,
+        from peerID: PeerID,
+        isDeferredRetry: Bool
+    ) {
         let env = environment
         guard let recipientID = PeerID(hexData: packet.recipientID) else {
             SecureLogger.warning("⚠️ Encrypted message has no recipient ID", category: .session)
@@ -98,35 +214,231 @@ final class BLENoisePacketHandler {
         env.updatePeerLastSeen(peerID)
 
         do {
-            let decrypted = try env.decrypt(packet.payload, peerID)
+            let decryption = try env.decrypt(packet.payload, peerID)
+            let decrypted = decryption.plaintext
             guard decrypted.count > 0 else { return }
 
             // First byte indicates the payload type
             let payloadType = decrypted[0]
             let payloadData = decrypted.dropFirst()
 
-            guard let noisePayloadType = NoisePayloadType(rawValue: payloadType) else {
+            guard let noisePayloadType = NoisePayloadType.decoded(rawValue: payloadType) else {
                 SecureLogger.warning("⚠️ Unknown noise payload type: \(payloadType)")
                 return
             }
 
             SecureLogger.debug("🔐 Decrypted noise payload type \(noisePayloadType.description) from \(peerID.id.prefix(8))…", category: .session)
 
+            if noisePayloadType == .authenticatedPeerState {
+                env.handleAuthenticatedPeerState(
+                    peerID,
+                    Data(payloadData),
+                    decryption.sessionGeneration
+                )
+                return
+            }
+
             let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
             env.deliverNoisePayload(peerID, noisePayloadType, Data(payloadData), ts)
+        } catch NoiseEncryptionError.transportGenerationNotReady {
+            if isDeferredRetry {
+                SecureLogger.warning(
+                    "Dropping deferred Noise ciphertext from \(peerID.id.prefix(8))… because its authenticated transport generation changed again",
+                    category: .session
+                )
+                return
+            }
+            // The manager promoted or restored keys before BLE's serialized
+            // callback installed generation-bound transport state. The
+            // manager rejected this before decrypting, so replay is safe.
+            deferCiphertext(packet, from: peerID)
         } catch NoiseEncryptionError.sessionNotEstablished {
+            if isDeferredRetry {
+                SecureLogger.warning(
+                    "Dropping deferred Noise ciphertext from \(peerID.id.prefix(8))… because the authenticated session is unavailable",
+                    category: .session
+                )
+                return
+            }
             // We received an encrypted message before establishing a session with this peer.
-            // Trigger a handshake so future messages can be decrypted.
+            // An initiator may already have sent message 3 followed by this
+            // ciphertext, with BLE delivering the ciphertext first.
+            if env.isAwaitingResponderHandshakeCompletion(peerID) {
+                deferCiphertext(packet, from: peerID)
+                return
+            }
+            // Otherwise trigger a handshake so future messages can decrypt.
             SecureLogger.debug("🔑 Encrypted message from \(peerID.id.prefix(8))… without session; initiating handshake")
             if !env.hasNoiseSession(peerID) {
                 env.initiateHandshake(peerID)
             }
         } catch {
+            if isDeferredRetry {
+                // An early packet cannot tear down the authenticated session
+                // merely because its single bounded retry still fails.
+                SecureLogger.warning(
+                    "Dropping deferred Noise ciphertext from \(peerID.id.prefix(8))… after retry failed: \(error)",
+                    category: .session
+                )
+                return
+            }
+            // A responder may retain an older transport as receive-only
+            // rollback state while ordinary XX waits for message 3. New-key
+            // ciphertext can fail against those retained receive keys first.
+            if env.isAwaitingResponderHandshakeCompletion(peerID) {
+                if isDeferrableEarlyHandshakeFailure(error) {
+                    deferCiphertext(packet, from: peerID)
+                } else {
+                    SecureLogger.warning(
+                        "Dropping invalid Noise ciphertext from \(peerID.id.prefix(8))… while responder handshake is completing: \(error)",
+                        category: .session
+                    )
+                }
+                return
+            }
+            if isDropOnlyCiphertextFailure(error) {
+                // The packet is attacker-controlled and did not prove a
+                // transport-state failure. Never let malformed, replayed,
+                // forged, oversized, or rate-limited bytes evict working keys.
+                SecureLogger.warning(
+                    "Dropping rejected Noise ciphertext from \(peerID.id.prefix(8))… without clearing its session: \(error)",
+                    category: .security
+                )
+                return
+            }
             // Decryption failed - clear the corrupted session and re-initiate handshake
-            // This handles cases where session state got out of sync (nonce mismatch, etc.)
+            // Only local/session lifecycle failures reach this path.
             SecureLogger.error("❌ Failed to decrypt message from \(peerID.id.prefix(8))…: \(error) - clearing session and re-initiating handshake")
             env.clearSession(peerID)
             env.initiateHandshake(peerID)
         }
     }
+
+    private func isDeferrableEarlyHandshakeFailure(_ error: Error) -> Bool {
+        if let noiseError = error as? NoiseError {
+            switch noiseError {
+            case .authenticationFailure, .replayDetected:
+                return true
+            default:
+                return false
+            }
+        }
+        if let cryptoError = error as? CryptoKitError,
+           case .authenticationFailure = cryptoError {
+            return true
+        }
+        return false
+    }
+
+    private func isDropOnlyCiphertextFailure(_ error: Error) -> Bool {
+        if let securityError = error as? NoiseSecurityError {
+            switch securityError {
+            case .messageTooLarge, .rateLimitExceeded, .invalidPeerID:
+                return true
+            case .sessionExpired, .sessionExhausted:
+                return false
+            }
+        }
+        if let noiseError = error as? NoiseError {
+            switch noiseError {
+            case .invalidCiphertext, .authenticationFailure, .replayDetected:
+                return true
+            case .uninitializedCipher, .handshakeComplete,
+                    .handshakeNotComplete, .missingLocalStaticKey,
+                    .missingKeys, .invalidMessage, .invalidPublicKey,
+                    .nonceExceeded:
+                return false
+            }
+        }
+        return error is CryptoKitError
+    }
+
+    private func deferCiphertext(_ packet: BitchatPacket, from peerID: PeerID) {
+        guard NoiseSecurityValidator.validatePrivateFileCiphertextSize(
+            packet.payload
+        ) else {
+            SecureLogger.warning(
+                "Dropping oversized early Noise ciphertext from \(peerID.id.prefix(8))…",
+                category: .security
+            )
+            return
+        }
+
+        let now = environment.now()
+        deferredLock.lock()
+        defer { deferredLock.unlock() }
+        purgeExpiredCiphertextsLocked(now: now)
+
+        let peerCount = deferredCiphertexts[peerID]?.count ?? 0
+        let globalCount = deferredCiphertexts.values.reduce(0) {
+            $0 + $1.count
+        }
+        guard peerCount < Self.maxDeferredPacketsPerPeer,
+              globalCount < Self.maxDeferredPacketsGlobal,
+              deferredCiphertextBytes + packet.payload.count
+                <= Self.maxDeferredBytes else {
+            SecureLogger.warning(
+                "Dropping early Noise ciphertext from \(peerID.id.prefix(8))… because the handshake buffer is full",
+                category: .security
+            )
+            return
+        }
+
+        deferredCiphertexts[peerID, default: []].append(
+            DeferredCiphertext(packet: packet, receivedAt: now)
+        )
+        deferredCiphertextBytes += packet.payload.count
+        SecureLogger.debug(
+            "Deferring early Noise ciphertext from \(peerID.id.prefix(8))… until responder handshake completion",
+            category: .session
+        )
+    }
+
+    private func drainDeferredCiphertextsIfReady(for peerID: PeerID) {
+        let env = environment
+        guard !env.isAwaitingResponderHandshakeCompletion(peerID),
+              env.hasNoiseSession(peerID) else {
+            return
+        }
+
+        let now = env.now()
+        deferredLock.lock()
+        purgeExpiredCiphertextsLocked(now: now)
+        let deferred = deferredCiphertexts.removeValue(forKey: peerID) ?? []
+        deferredCiphertextBytes -= deferred.reduce(0) {
+            $0 + $1.packet.payload.count
+        }
+        deferredLock.unlock()
+
+        guard !deferred.isEmpty else { return }
+        SecureLogger.debug(
+            "Retrying \(deferred.count) early Noise ciphertext packet(s) from \(peerID.id.prefix(8))… after handshake completion",
+            category: .session
+        )
+        for item in deferred {
+            handleEncrypted(item.packet, from: peerID, isDeferredRetry: true)
+        }
+    }
+
+    private func purgeExpiredCiphertextsLocked(now: Date) {
+        for peerID in Array(deferredCiphertexts.keys) {
+            guard let items = deferredCiphertexts[peerID] else { continue }
+            let retained = items.filter {
+                now.timeIntervalSince($0.receivedAt) <= Self.deferredLifetime
+            }
+            guard retained.count != items.count else { continue }
+
+            deferredCiphertextBytes -= items.reduce(0) {
+                $0 + $1.packet.payload.count
+            }
+            deferredCiphertextBytes += retained.reduce(0) {
+                $0 + $1.packet.payload.count
+            }
+            if retained.isEmpty {
+                deferredCiphertexts.removeValue(forKey: peerID)
+            } else {
+                deferredCiphertexts[peerID] = retained
+            }
+        }
+    }
 }

bitchat/Services/BLE/BLENoisePayloadFactory.swift

@@ -17,6 +17,16 @@ enum BLENoisePayloadFactory {
         typedPayload(.delivered, payload: Data(messageID.utf8))
     }
 
+    static func privateFile(_ filePacket: BitchatFilePacket) -> Data? {
+        guard let payload = filePacket.encode() else { return nil }
+        return typedPayload(.privateFile, payload: payload)
+    }
+
+    static func authenticatedPeerState(_ state: AuthenticatedPeerStatePacket) -> Data? {
+        guard let payload = state.encode() else { return nil }
+        return typedPayload(.authenticatedPeerState, payload: payload)
+    }
+
     static func typedPayload(_ type: NoisePayloadType, payload: Data) -> Data {
         var typed = Data([type.rawValue])
         typed.append(payload)

bitchat/Services/BLE/BLENoiseReconnectPolicy.swift

@@ -0,0 +1,40 @@
+import Foundation
+
+/// Bounds ordinary Noise revalidation to one attempt per physical-link epoch.
+/// A live epoch may retry after the cooldown so a lost handshake cannot leave
+/// the link permanently unauthenticated.
+struct BLENoiseReconnectPolicy {
+    static let minimumRetryInterval: TimeInterval = 60
+
+    private var lastAttemptAt: [BLEIngressLinkID: Date] = [:]
+
+    mutating func shouldRevalidate(
+        on link: BLEIngressLinkID,
+        hasEstablishedSession: Bool,
+        isNoiseAuthenticatedLink: Bool,
+        hasAuthenticatedPeerLink: Bool,
+        now: Date
+    ) -> Bool {
+        guard hasEstablishedSession,
+              !isNoiseAuthenticatedLink,
+              !hasAuthenticatedPeerLink else {
+            return false
+        }
+        if let previous = lastAttemptAt[link],
+           now.timeIntervalSince(previous) < Self.minimumRetryInterval {
+            return false
+        }
+        lastAttemptAt[link] = now
+        return true
+    }
+
+    /// Link identifiers can be stable across CoreBluetooth reconnects, so a
+    /// disconnect explicitly starts a new epoch and permits one fresh attempt.
+    mutating func endLinkEpoch(_ link: BLEIngressLinkID) {
+        lastAttemptAt.removeValue(forKey: link)
+    }
+
+    mutating func removeAll() {
+        lastAttemptAt.removeAll()
+    }
+}

bitchat/Services/BLE/BLENoiseSessionQueues.swift

@@ -6,9 +6,16 @@ struct BLEPendingPrivateMessage: Equatable {
     let messageID: String
 }
 
+struct BLEPendingTypedPayload: Equatable {
+    let payload: Data
+    /// Present for app-initiated media so handshake queuing preserves the
+    /// fragment scheduler's progress/cancellation identity.
+    let transferId: String?
+}
+
 struct BLENoiseSessionQueues {
     private var privateMessagesByPeerID: [PeerID: [BLEPendingPrivateMessage]] = [:]
-    private var typedPayloadsByPeerID: [PeerID: [Data]] = [:]
+    private var typedPayloadsByPeerID: [PeerID: [BLEPendingTypedPayload]] = [:]
 
     var isEmpty: Bool {
         privateMessagesByPeerID.isEmpty && typedPayloadsByPeerID.isEmpty
@@ -34,13 +41,35 @@ struct BLENoiseSessionQueues {
         privateMessagesByPeerID[peerID, default: []].insert(contentsOf: messages, at: 0)
     }
 
-    mutating func appendTypedPayload(_ payload: Data, for peerID: PeerID) {
-        typedPayloadsByPeerID[peerID, default: []].append(payload)
+    mutating func appendTypedPayload(_ payload: Data, transferId: String? = nil, for peerID: PeerID) {
+        typedPayloadsByPeerID[peerID, default: []].append(
+            BLEPendingTypedPayload(payload: payload, transferId: transferId)
+        )
     }
 
-    mutating func takeTypedPayloads(for peerID: PeerID) -> [Data] {
+    mutating func takeTypedPayloads(for peerID: PeerID) -> [BLEPendingTypedPayload] {
         let payloads = typedPayloadsByPeerID[peerID] ?? []
         typedPayloadsByPeerID.removeValue(forKey: peerID)
         return payloads
     }
+
+    func containsTypedPayload(transferId: String) -> Bool {
+        typedPayloadsByPeerID.values.contains { payloads in
+            payloads.contains { $0.transferId == transferId }
+        }
+    }
+
+    @discardableResult
+    mutating func removeTypedPayload(transferId: String) -> Bool {
+        for peerID in Array(typedPayloadsByPeerID.keys) {
+            guard var payloads = typedPayloadsByPeerID[peerID],
+                  let index = payloads.firstIndex(where: { $0.transferId == transferId }) else {
+                continue
+            }
+            payloads.remove(at: index)
+            typedPayloadsByPeerID[peerID] = payloads.isEmpty ? nil : payloads
+            return true
+        }
+        return false
+    }
 }

bitchat/Services/BLE/BLEOutboundFragmentPlanner.swift

@@ -17,6 +17,9 @@ struct BLEOutboundFragmentPlan {
 }
 
 enum BLEOutboundFragmentPlanner {
+    /// Current Android receivers reject fragment sets above 256. Private
+    /// media v1 treats that deployed ceiling as a cross-platform contract.
+    static let privateMediaV1MaxFragments = 256
     private static let minimumChunkSize = 64
     private static let fragmentIDLength = 8
 
@@ -71,6 +74,10 @@ enum BLEOutboundFragmentPlanner {
         )
     }
 
+    static func isPrivateMediaV1Compatible(_ plan: BLEOutboundFragmentPlan) -> Bool {
+        plan.totalFragments <= privateMediaV1MaxFragments
+    }
+
     private static func sizingPolicy(
         for packet: BitchatPacket,
         requestedMaxChunk: Int?,

bitchat/Services/BLE/BLEOutboundFragmentTransferScheduler.swift

@@ -29,8 +29,9 @@ struct BLEOutboundFragmentTransferRequest {
     }
 
     var resolvedTransferId: String? {
+        if let transferId { return transferId }
         guard packet.type == MessageType.fileTransfer.rawValue else { return nil }
-        return transferId ?? packet.payload.sha256Hex()
+        return packet.payload.sha256Hex()
     }
 
     /// Content identity independent of the caller-chosen transfer ID: the

bitchat/Services/BLE/BLEPeerRegistry.swift

@@ -10,6 +10,9 @@ struct BLEPeerInfo: Equatable {
     var isVerifiedNickname: Bool
     var lastSeen: Date
     var capabilities: PeerCapabilities = []
+    /// Distinguishes an old client that omitted the capabilities TLV from a
+    /// modern client that explicitly advertised a set without a given bit.
+    var capabilitiesWereExplicitlyAdvertised: Bool = false
     /// Rendezvous cell from the peer's announce when it advertises `.bridge`.
     var bridgeGeohash: String?
 }
@@ -114,6 +117,10 @@ struct BLEPeerRegistry {
         peers[peerID.toShort()]?.capabilities ?? []
     }
 
+    func capabilitiesWereExplicitlyAdvertised(for peerID: PeerID) -> Bool {
+        peers[peerID.toShort()]?.capabilitiesWereExplicitlyAdvertised == true
+    }
+
     /// Peers whose last verified announce advertised the given capability.
     func peers(advertising capability: PeerCapabilities) -> [PeerID] {
         peers.values.filter { $0.capabilities.contains(capability) }.map(\.peerID)
@@ -174,6 +181,14 @@ struct BLEPeerRegistry {
         peers[peerID] = peer
     }
 
+    /// Replaces the announcement signing key only after the surrounding Noise
+    /// session proved possession of this peer's static key.
+    mutating func bindAuthenticatedSigningPublicKey(_ key: Data, for peerID: PeerID) {
+        guard var peer = peers[peerID.toShort()] else { return }
+        peer.signingPublicKey = key
+        peers[peer.peerID] = peer
+    }
+
     mutating func upsertVerifiedAnnounce(
         peerID: PeerID,
         nickname: String,
@@ -181,7 +196,7 @@ struct BLEPeerRegistry {
         signingPublicKey: Data?,
         isConnected: Bool,
         now: Date,
-        capabilities: PeerCapabilities = [],
+        capabilities: PeerCapabilities? = nil,
         bridgeGeohash: String? = nil
     ) -> BLEPeerAnnounceUpdate {
         let existing = peers[peerID]
@@ -199,7 +214,8 @@ struct BLEPeerRegistry {
             signingPublicKey: signingPublicKey,
             isVerifiedNickname: true,
             lastSeen: now,
-            capabilities: capabilities,
+            capabilities: capabilities ?? [],
+            capabilitiesWereExplicitlyAdvertised: capabilities != nil,
             bridgeGeohash: bridgeGeohash
         )
 

bitchat/Services/Courier/CourierStore.swift

@@ -322,7 +322,7 @@ final class CourierStore {
 
     /// Envelopes eligible to park on relays as bridge courier drops. Merely
     /// offering one does not start its cooldown: the caller commits that only
-    /// after a relay explicitly accepts the event via NIP-20 OK.
+    /// after a relay explicitly accepts the event via NIP-01 `OK`.
     func envelopesForBridgePublish(cooldown: TimeInterval) -> [CourierEnvelope] {
         let date = now()
         return queue.sync {

bitchat/Services/Courier/MessageOutboxStore.swift

@@ -110,6 +110,10 @@ final class MessageOutboxStore {
     /// Delivery/read acknowledgments received before a deferred cold-load
     /// reveals the durable queue. Applied to every merge before persistence.
     private var pendingRemovalMessageIDs = Set<String>()
+    /// Peer-scoped acknowledgments received before a deferred cold-load
+    /// reveals the durable queue. Unlike the legacy global tombstones above,
+    /// these must not remove a colliding message ID queued for another peer.
+    private var pendingScopedRemovalMessageIDs: [PeerID: Set<String>] = [:]
     private var recoveryHandler: (@MainActor (Snapshot) -> Void)?
     /// Recovery loaded durable state that MessageRouter has not merged yet.
     /// While true, router saves must union with `cachedSnapshot` instead of
@@ -195,7 +199,7 @@ final class MessageOutboxStore {
                 ? (pendingSnapshot ?? [:])
                 : Self.merge(durable, pendingSnapshot ?? [:]))
             diskState = .loaded
-            if pendingSnapshot != nil || !pendingRemovalMessageIDs.isEmpty {
+            if pendingSnapshot != nil || hasPendingRemovalsLocked {
                 if persistSnapshotAndClearRemovalsLocked(cachedSnapshot) {
                     pendingSnapshot = nil
                     pendingSnapshotIsAuthoritative = false
@@ -212,7 +216,7 @@ final class MessageOutboxStore {
         case .missing:
             cachedSnapshot = applyingPendingRemovalsLocked(pendingSnapshot ?? [:])
             diskState = .loaded
-            if pendingSnapshot != nil || !pendingRemovalMessageIDs.isEmpty {
+            if pendingSnapshot != nil || hasPendingRemovalsLocked {
                 if persistSnapshotAndClearRemovalsLocked(cachedSnapshot) {
                     pendingSnapshot = nil
                     pendingSnapshotIsAuthoritative = false
@@ -235,7 +239,7 @@ final class MessageOutboxStore {
             diskState = .loaded
             cachedSnapshot = applyingPendingRemovalsLocked(pendingSnapshot ?? [:])
             SecureLogger.error("Failed to decode encrypted outbox: \(error)", category: .session)
-            if pendingSnapshot != nil || !pendingRemovalMessageIDs.isEmpty {
+            if pendingSnapshot != nil || hasPendingRemovalsLocked {
                 if persistSnapshotAndClearRemovalsLocked(cachedSnapshot) {
                     pendingSnapshot = nil
                     pendingSnapshotIsAuthoritative = false
@@ -442,6 +446,25 @@ final class MessageOutboxStore {
         lock.unlock()
     }
 
+    /// Records an ack for only the supplied peer aliases. This preserves
+    /// another recipient's queued entry when message IDs happen to collide,
+    /// including while the durable snapshot is hidden by protected data.
+    func recordRemoval(messageID: String, for peerIDs: Set<PeerID>) {
+        guard !peerIDs.isEmpty else { return }
+
+        lock.lock()
+        for peerID in peerIDs {
+            pendingScopedRemovalMessageIDs[peerID, default: []].insert(messageID)
+        }
+        cachedSnapshot = Self.removing(pendingScopedRemovalMessageIDs, from: cachedSnapshot)
+        unseenRecoveredSnapshot = Self.removing(pendingScopedRemovalMessageIDs, from: unseenRecoveredSnapshot)
+        recoveryRouterSnapshot = Self.removing(pendingScopedRemovalMessageIDs, from: recoveryRouterSnapshot)
+        if let pendingSnapshot {
+            self.pendingSnapshot = Self.removing(pendingScopedRemovalMessageIDs, from: pendingSnapshot)
+        }
+        lock.unlock()
+    }
+
     /// Retries a deferred protected-data load. The returned snapshot includes
     /// both durable messages and any messages queued during the locked wake.
     @discardableResult
@@ -478,7 +501,7 @@ final class MessageOutboxStore {
                 : (pendingSnapshotIsAuthoritative ? known : Self.merge(durable, known)))
             cachedSnapshot = merged
             diskState = .loaded
-            if (pendingSnapshot == nil && pendingRemovalMessageIDs.isEmpty) ||
+            if (pendingSnapshot == nil && !hasPendingRemovalsLocked) ||
                 persistSnapshotAndClearRemovalsLocked(merged) {
                 pendingSnapshot = nil
                 pendingSnapshotIsAuthoritative = false
@@ -507,7 +530,7 @@ final class MessageOutboxStore {
                 : known)
             cachedSnapshot = merged
             diskState = .loaded
-            if (pendingSnapshot == nil && pendingRemovalMessageIDs.isEmpty) ||
+            if (pendingSnapshot == nil && !hasPendingRemovalsLocked) ||
                 persistSnapshotAndClearRemovalsLocked(merged) {
                 pendingSnapshot = nil
                 pendingSnapshotIsAuthoritative = false
@@ -539,7 +562,7 @@ final class MessageOutboxStore {
                 : known)
             cachedSnapshot = merged
             diskState = .loaded
-            if (pendingSnapshot == nil && pendingRemovalMessageIDs.isEmpty) ||
+            if (pendingSnapshot == nil && !hasPendingRemovalsLocked) ||
                 persistSnapshotAndClearRemovalsLocked(merged) {
                 pendingSnapshot = nil
                 pendingSnapshotIsAuthoritative = false
@@ -578,6 +601,7 @@ final class MessageOutboxStore {
         pendingSnapshot = nil
         pendingSnapshotIsAuthoritative = false
         pendingRemovalMessageIDs.removeAll()
+        pendingScopedRemovalMessageIDs.removeAll()
         recoveryDeliveryPending = false
         unseenRecoveryPendingPersistence = false
         unseenRecoveredSnapshot = [:]
@@ -742,12 +766,21 @@ final class MessageOutboxStore {
     private func persistSnapshotAndClearRemovalsLocked(_ snapshot: Snapshot) -> Bool {
         guard persistSnapshotLocked(snapshot) else { return false }
         pendingRemovalMessageIDs.removeAll()
+        pendingScopedRemovalMessageIDs.removeAll()
         return true
     }
 
     /// Must be called with `lock` held.
     private func applyingPendingRemovalsLocked(_ snapshot: Snapshot) -> Snapshot {
-        Self.removing(pendingRemovalMessageIDs, from: snapshot)
+        Self.removing(
+            pendingScopedRemovalMessageIDs,
+            from: Self.removing(pendingRemovalMessageIDs, from: snapshot)
+        )
+    }
+
+    /// Must be read with `lock` held.
+    private var hasPendingRemovalsLocked: Bool {
+        !pendingRemovalMessageIDs.isEmpty || !pendingScopedRemovalMessageIDs.isEmpty
     }
 
     private static func removing(_ messageIDs: Set<String>, from snapshot: Snapshot) -> Snapshot {
@@ -760,9 +793,28 @@ final class MessageOutboxStore {
         return filtered
     }
 
+    private static func removing(
+        _ messageIDsByPeer: [PeerID: Set<String>],
+        from snapshot: Snapshot
+    ) -> Snapshot {
+        guard !messageIDsByPeer.isEmpty else { return snapshot }
+        var filtered = snapshot
+        for (peerID, messageIDs) in messageIDsByPeer {
+            guard !messageIDs.isEmpty, let queue = filtered[peerID] else { continue }
+            let remaining = queue.filter { !messageIDs.contains($0.messageID) }
+            filtered[peerID] = remaining.isEmpty ? nil : remaining
+        }
+        return filtered
+    }
+
     private static func excludingKnownMessages(from durable: Snapshot, known: Snapshot) -> Snapshot {
-        let knownIDs = Set(known.values.flatMap { $0.map(\.messageID) })
-        return removing(knownIDs, from: durable)
+        var unseen: Snapshot = [:]
+        for (peerID, durableQueue) in durable {
+            let knownIDs = Set(known[peerID]?.map(\.messageID) ?? [])
+            let remaining = durableQueue.filter { !knownIDs.contains($0.messageID) }
+            if !remaining.isEmpty { unseen[peerID] = remaining }
+        }
+        return unseen
     }
 
     private static func merge(_ durable: Snapshot, _ pending: Snapshot) -> Snapshot {

bitchat/Services/Gateway/BridgeCourierService.swift

@@ -67,7 +67,7 @@ final class BridgeCourierService: ObservableObject {
     var relaysConnected: (@MainActor () -> Bool)?
     /// Publishes a signed drop event directly to connected default (DM)
     /// relays. Completion is true only after at least one relay explicitly
-    /// accepts the event via NIP-20 OK; this must never mean "queued in RAM"
+    /// accepts the event via NIP-01 `OK`; this must never mean "queued in RAM"
     /// or merely "written to a socket".
     var publishEvent: (@MainActor (NostrEvent, @escaping @MainActor (Bool) -> Void) -> Void)?
     /// (Re)opens the drop subscription for the given hex tags.
@@ -106,13 +106,14 @@ final class BridgeCourierService: ObservableObject {
         dedupKey: String?,
         operationID: UUID?
     )] = []
-    /// Message IDs already published as drops (sender-side dedup) and drop
-    /// event IDs already handled (multi-relay dedup). Both persist across
-    /// relaunches: relays hold drops for the full 24h NIP-40 window and the
-    /// persisted outbox keeps re-depositing, so in-memory-only dedup meant
-    /// every relaunch republished the same message as a fresh drop and every
-    /// gateway relaunch re-delivered the whole backlog (field-verified
-    /// amplification storm). Entries age out with the 24h drop window.
+    /// Opaque recipient/message keys already published as drops (sender-side
+    /// dedup) and drop event IDs already handled (multi-relay dedup). Both
+    /// persist across relaunches: relays hold drops for the full 24h NIP-40
+    /// window and the persisted outbox keeps re-depositing, so in-memory-only
+    /// dedup meant every relaunch republished the same message as a fresh drop
+    /// and every gateway relaunch re-delivered the whole backlog
+    /// (field-verified amplification storm). Entries age out with the 24h drop
+    /// window.
     private var publishedDropKeys: ExpiringIDSet
     private var seenDropEventIDs: ExpiringIDSet
     private var subscriptionOpen = false
@@ -126,10 +127,10 @@ final class BridgeCourierService: ObservableObject {
     }
     /// Sender operations queued locally or awaiting relay confirmation.
     /// The per-attempt ID prevents a stale pre-wipe callback from completing
-    /// a newer attempt for the same message.
+    /// a newer attempt for the same recipient/message pair.
     private var activeDropOperations: [String: ActiveDropOperation] = [:]
     /// Held-envelope publishes have no sender message ID, but still need an
-    /// in-flight identity: repeated refreshes inside the NIP-20 wait window
+    /// in-flight identity: repeated refreshes inside the relay-OK wait window
     /// must not mint duplicate relay events for the same opaque envelope.
     private var heldDropOperations: [Data: UUID] = [:]
     /// Deterministically invalid envelopes are suppressed for this process,
@@ -214,11 +215,46 @@ final class BridgeCourierService: ObservableObject {
 
     // MARK: - Sender role
 
+    /// Stable, opaque sender-side dedup key. Recipient scope prevents one
+    /// conversation's colliding message ID from suppressing another's drop,
+    /// while hashing keeps recipient keys out of the persisted snapshot.
+    private static func senderDropKey(
+        messageID: String,
+        recipientNoiseKey: Data
+    ) -> String {
+        var material = Data("bitchat-bridge-drop-dedup-v2".utf8)
+        appendLengthPrefixed(Data(messageID.utf8), to: &material)
+        appendLengthPrefixed(recipientNoiseKey, to: &material)
+        return "v2:\(material.sha256Hex())"
+    }
+
+    private static func appendLengthPrefixed(_ value: Data, to output: inout Data) {
+        let length = UInt32(value.count)
+        output.append(UInt8((length >> 24) & 0xFF))
+        output.append(UInt8((length >> 16) & 0xFF))
+        output.append(UInt8((length >> 8) & 0xFF))
+        output.append(UInt8(length & 0xFF))
+        output.append(value)
+    }
+
+    /// Previous releases persisted raw message IDs without recipient scope.
+    /// They remain conservative wildcards for their original 24-hour
+    /// lifetime: assigning one to a recipient would be guesswork and could
+    /// republish the original drop. New acceptances persist only v2 keys.
+    private func wasPublished(
+        legacyMessageID: String,
+        dedupKey: String,
+        now date: Date
+    ) -> Bool {
+        publishedDropKeys.contains(dedupKey, now: date)
+            || publishedDropKeys.contains(legacyMessageID, now: date)
+    }
+
     /// Parallel-deposit a sealed copy of an outbound private message as a
     /// relay drop. Called by the message router alongside physical courier
-    /// deposits; idempotent per message ID. Completion becomes true only
-    /// after a real relay acceptance arrives, which is when the router may
-    /// show "carried".
+    /// deposits; idempotent per recipient/message pair. Completion becomes
+    /// true only after a real relay acceptance arrives, which is when the
+    /// router may show "carried".
     func depositDrop(
         content: String,
         messageID: String,
@@ -229,9 +265,18 @@ final class BridgeCourierService: ObservableObject {
             completion(false)
             return
         }
-        guard !publishedDropKeys.contains(messageID, now: now()),
-              activeDropOperations[messageID] == nil,
-              !rejectedDropKeys.contains(messageID, now: now()) else {
+        let date = now()
+        let dedupKey = Self.senderDropKey(
+            messageID: messageID,
+            recipientNoiseKey: recipientNoiseKey
+        )
+        guard !wasPublished(
+            legacyMessageID: messageID,
+            dedupKey: dedupKey,
+            now: date
+        ),
+              activeDropOperations[dedupKey] == nil,
+              !rejectedDropKeys.contains(dedupKey, now: date) else {
             completion(false)
             return
         }
@@ -244,13 +289,13 @@ final class BridgeCourierService: ObservableObject {
         // of the sealing); suppress it in-memory so the retry sweep does not
         // churn, but never persist it as a published drop.
         guard let encoded = envelope.encode(), encoded.count <= Limits.maxDropEnvelopeBytes else {
-            rejectedDropKeys.insert(messageID, now: now())
+            rejectedDropKeys.insert(dedupKey, now: date)
             completion(false)
             return
         }
         let operationID = UUID()
-        activeDropOperations[messageID] = ActiveDropOperation(id: operationID, completion: completion)
-        publishDrop(envelope, messageID: messageID, operationID: operationID)
+        activeDropOperations[dedupKey] = ActiveDropOperation(id: operationID, completion: completion)
+        publishDrop(envelope, dedupKey: dedupKey, operationID: operationID)
     }
 
     /// Publishes held envelopes (mail we carry for others) as drops,
@@ -272,13 +317,14 @@ final class BridgeCourierService: ObservableObject {
         }
     }
 
-    /// Publishes a drop, or queues it when relays are down. `messageID` is the
-    /// sender-side dedup key (nil for held/relayed envelopes we don't track);
-    /// it rides the pending queue so an evicted or failed drop can release its
-    /// in-flight slot. Completion reports actual NIP-20 relay acceptance.
+    /// Publishes a drop, or queues it when relays are down. `dedupKey` is the
+    /// opaque sender-side recipient/message key (nil for held/relayed
+    /// envelopes we don't track); it rides the pending queue so an evicted or
+    /// failed drop can release its in-flight slot. Completion reports actual
+    /// NIP-01 relay acceptance.
     private func publishDrop(
         _ envelope: CourierEnvelope,
-        messageID: String? = nil,
+        dedupKey: String? = nil,
         operationID: UUID? = nil,
         untrackedCompletion: (@MainActor (Bool) -> Void)? = nil
     ) {
@@ -286,7 +332,7 @@ final class BridgeCourierService: ObservableObject {
               encoded.count <= Limits.maxDropEnvelopeBytes,
               !envelope.isExpired else {
             finishPublish(
-                messageID: messageID,
+                dedupKey: dedupKey,
                 operationID: operationID,
                 succeeded: false,
                 untrackedCompletion: untrackedCompletion
@@ -297,15 +343,15 @@ final class BridgeCourierService: ObservableObject {
             // Held mail remains in CourierStore and has no sender operation to
             // recover after an in-memory queue loss. Leave its cooldown unset
             // and let the next connected refresh offer it again.
-            guard messageID != nil else {
+            guard dedupKey != nil else {
                 untrackedCompletion?(false)
                 return
             }
-            pendingDrops.append((envelope, messageID, operationID))
+            pendingDrops.append((envelope, dedupKey, operationID))
             while pendingDrops.count > Limits.maxPendingDrops {
                 let evicted = pendingDrops.removeFirst()
                 finishPublish(
-                    messageID: evicted.dedupKey,
+                    dedupKey: evicted.dedupKey,
                     operationID: evicted.operationID,
                     succeeded: false
                 )
@@ -321,7 +367,7 @@ final class BridgeCourierService: ObservableObject {
               ) else {
             SecureLogger.error("📦🌉 Failed to compose courier drop", category: .encryption)
             finishPublish(
-                messageID: messageID,
+                dedupKey: dedupKey,
                 operationID: operationID,
                 succeeded: false,
                 untrackedCompletion: untrackedCompletion
@@ -331,7 +377,7 @@ final class BridgeCourierService: ObservableObject {
         guard let publishEvent else {
             SecureLogger.error("📦🌉 Courier drop publisher is not configured", category: .session)
             finishPublish(
-                messageID: messageID,
+                dedupKey: dedupKey,
                 operationID: operationID,
                 succeeded: false,
                 untrackedCompletion: untrackedCompletion
@@ -341,7 +387,7 @@ final class BridgeCourierService: ObservableObject {
         publishEvent(event) { [weak self] succeeded in
             guard let self else { return }
             guard self.finishPublish(
-                messageID: messageID,
+                dedupKey: dedupKey,
                 operationID: operationID,
                 succeeded: succeeded,
                 untrackedCompletion: untrackedCompletion
@@ -356,23 +402,23 @@ final class BridgeCourierService: ObservableObject {
 
     @discardableResult
     private func finishPublish(
-        messageID: String?,
+        dedupKey: String?,
         operationID: UUID?,
         succeeded: Bool,
         untrackedCompletion: (@MainActor (Bool) -> Void)? = nil
     ) -> Bool {
-        guard let messageID else {
+        guard let dedupKey else {
             untrackedCompletion?(succeeded)
             return true
         }
         // Missing/mismatched means this callback was duplicated, invalidated
         // by panic wipe, or belongs to an older attempt for the same key.
         guard let operationID,
-              let operation = activeDropOperations[messageID],
+              let operation = activeDropOperations[dedupKey],
               operation.id == operationID else { return false }
-        activeDropOperations.removeValue(forKey: messageID)
+        activeDropOperations.removeValue(forKey: dedupKey)
         if succeeded {
-            publishedDropKeys.insert(messageID, now: now())
+            publishedDropKeys.insert(dedupKey, now: now())
             persistDedup()
         }
         operation.completion(succeeded)
@@ -387,7 +433,7 @@ final class BridgeCourierService: ObservableObject {
         for item in queued {
             publishDrop(
                 item.envelope,
-                messageID: item.dedupKey,
+                dedupKey: item.dedupKey,
                 operationID: item.operationID
             )
         }

bitchat/Services/Gateway/BridgeDropDedupStore.swift

@@ -64,11 +64,11 @@ struct ExpiringIDSet {
 /// fresh drop (fresh throwaway seal, undeduplicatable downstream) and every
 /// gateway relaunch re-delivered the whole backlog. Field-verified: ~20
 /// copies of one DM delivered in 40ms fed the storm behind a permanent
-/// device freeze. Persisting both sides caps this at one drop per message
-/// ID per 24h regardless of relaunch count.
+/// device freeze. Persisting both sides caps this at one drop per
+/// recipient/message pair per 24h regardless of relaunch count.
 ///
-/// Contents are opaque IDs (message UUIDs, relay event IDs) — no plaintext,
-/// no peer identities — so until-first-unlock protection matches
+/// Contents are opaque hashes and relay event IDs — no plaintext or peer
+/// identities — so until-first-unlock protection matches
 /// `NostrProcessedEventStore`, and the file must load during a
 /// locked-background restoration relaunch. Wiped on panic with the rest of
 /// the courier state.

bitchat/Services/GeohashPresenceService.swift

@@ -45,6 +45,9 @@ final class GeohashPresenceService: ObservableObject {
 
     private var subscriptions = Set<AnyCancellable>()
     private var heartbeatTimer: GeohashPresenceTimerProtocol?
+    private var pendingBroadcastTasks: [UUID: Task<Void, Never>] = [:]
+    private var heartbeatGeneration: UInt64 = 0
+    private var started = false
     private let availableChannelsProvider: () -> [GeohashChannel]
     private let locationChanges: AnyPublisher<[GeohashChannel], Never>
     private let torReadyPublisher: AnyPublisher<Void, Never>
@@ -147,10 +150,25 @@ final class GeohashPresenceService: ObservableObject {
     
     /// Start the service (safe to call multiple times)
     func start() {
+        guard !started else { return }
+        started = true
+        heartbeatGeneration &+= 1
         SecureLogger.info("Presence: service starting...", category: .session)
         scheduleNextHeartbeat()
     }
 
+    /// Stops the timer and every decorrelation task synchronously at the panic
+    /// boundary. Generation checks also protect against custom sleepers that
+    /// ignore task cancellation and return later.
+    func stopForPanic() {
+        started = false
+        heartbeatGeneration &+= 1
+        heartbeatTimer?.invalidate()
+        heartbeatTimer = nil
+        pendingBroadcastTasks.values.forEach { $0.cancel() }
+        pendingBroadcastTasks.removeAll(keepingCapacity: false)
+    }
+
     private func setupObservers() {
         // Monitor location channel changes
         locationChanges
@@ -169,20 +187,26 @@ final class GeohashPresenceService: ObservableObject {
     }
 
     func handleLocationChange() {
+        guard started else { return }
         // When location changes, we trigger an immediate (but slightly delayed) heartbeat
         // to announce presence in the new zone, then reset the loop.
         SecureLogger.debug("Presence: location changed, scheduling update", category: .session)
         heartbeatTimer?.invalidate()
         
         // Small delay to allow location state to settle
+        let generation = heartbeatGeneration
         heartbeatTimer = scheduleTimer(5.0) { [weak self] in
             Task { @MainActor [weak self] in
-                self?.performHeartbeat()
+                guard let self,
+                      self.started,
+                      self.heartbeatGeneration == generation else { return }
+                self.performHeartbeat()
             }
         }
     }
     
     func handleConnectivityChange() {
+        guard started else { return }
         SecureLogger.debug("Presence: connectivity restored, triggering heartbeat", category: .session)
         // If we were waiting for network, do it now
         if heartbeatTimer == nil || !heartbeatTimer!.isValid {
@@ -191,18 +215,29 @@ final class GeohashPresenceService: ObservableObject {
     }
 
     func scheduleNextHeartbeat() {
+        guard started else { return }
         heartbeatTimer?.invalidate()
         let interval = TimeInterval.random(in: loopMinInterval...loopMaxInterval)
+        let generation = heartbeatGeneration
         heartbeatTimer = scheduleTimer(interval) { [weak self] in
             Task { @MainActor [weak self] in
-                self?.performHeartbeat()
+                guard let self,
+                      self.started,
+                      self.heartbeatGeneration == generation else { return }
+                self.performHeartbeat()
             }
         }
     }
 
     func performHeartbeat() {
+        guard started else { return }
+        let generation = heartbeatGeneration
         // Always schedule next loop first ensures continuity even if this one fails/skips
-        defer { scheduleNextHeartbeat() }
+        defer {
+            if started, heartbeatGeneration == generation {
+                scheduleNextHeartbeat()
+            }
+        }
 
         // 1. Check preconditions
         guard torIsReady() else {
@@ -228,14 +263,27 @@ final class GeohashPresenceService: ObservableObject {
             }
             
             // Launch independent task for each channel's delay
-            Task { @MainActor in
+            let taskID = UUID()
+            let sleeper = self.sleeper
+            let delay = TimeInterval.random(
+                in: burstMinDelay...burstMaxDelay
+            )
+            let nanoseconds = UInt64(delay * 1_000_000_000)
+            let task = Task { @MainActor [weak self] in
                 // Random delay for decorrelation
-                let delay = TimeInterval.random(in: self.burstMinDelay...self.burstMaxDelay)
-                let nanoseconds = UInt64(delay * 1_000_000_000)
-                await self.sleeper(nanoseconds)
-                
+                await sleeper(nanoseconds)
+
+                guard let self else { return }
+                guard !Task.isCancelled,
+                      self.started,
+                      self.heartbeatGeneration == generation else {
+                    self.pendingBroadcastTasks.removeValue(forKey: taskID)
+                    return
+                }
+                self.pendingBroadcastTasks.removeValue(forKey: taskID)
                 self.broadcastPresence(for: channel.geohash)
             }
+            pendingBroadcastTasks[taskID] = task
         }
     }
 

bitchat/Services/KeychainManager.swift

@@ -11,6 +11,54 @@ import BitFoundation
 import Foundation
 import Security
 
+enum KeychainInstallLifecycleAction: Equatable {
+    case markerPresent
+    case bootstrapMarker
+    case clearStaleKeys
+    case retryLater
+}
+
+/// Process-local fail-closed gate for an unresolved install lifecycle.
+///
+/// A blocked caller may perform one synchronous reconciliation attempt.
+/// Concurrent callers fail closed instead of reading while that cleanup is
+/// in flight. Once reconciliation succeeds, access remains open.
+final class KeychainInstallAccessGate: @unchecked Sendable {
+    private let lock = NSLock()
+    private var blocked = false
+    private var reconciliationInProgress = false
+
+    func block() {
+        lock.lock()
+        blocked = true
+        lock.unlock()
+    }
+
+    func allowsAccess(reconcile: () -> Bool) -> Bool {
+        lock.lock()
+        if !blocked {
+            lock.unlock()
+            return true
+        }
+        guard !reconciliationInProgress else {
+            lock.unlock()
+            return false
+        }
+        reconciliationInProgress = true
+        lock.unlock()
+
+        let completed = reconcile()
+
+        lock.lock()
+        if completed {
+            blocked = false
+        }
+        reconciliationInProgress = false
+        lock.unlock()
+        return completed
+    }
+}
+
 final class KeychainManager: KeychainManagerProtocol {
     /// Default keychain for components that construct their own rather than
     /// having one injected. Under test this is an in-memory keychain: the
@@ -41,53 +89,281 @@ final class KeychainManager: KeychainManagerProtocol {
     // Use consistent service name for all keychain items
     private let service = BitchatApp.bundleID
     private let appGroup = "group.\(BitchatApp.bundleID)"
-
+    #if os(iOS)
+    private let installAccessGate = KeychainInstallAccessGate()
+    #endif
+    /// Every generic-password service owned by this app, including names used
+    /// by older releases. Keep custom services here so one-time security
+    /// migrations and panic deletion cannot silently miss them.
+    private static let additionalApplicationOwnedServices = [
+        "chat.bitchat.nostr",
+        "chat.bitchat.favorites",
+        "chat.bitchat.outbox",
+        "com.bitchat.passwords",
+        "com.bitchat.deviceidentity",
+        "com.bitchat.noise.identity",
+        "chat.bitchat.passwords",
+        "bitchat.keychain",
+        "bitchat",
+        "com.bitchat"
+    ]
     // AfterFirstUnlock, not WhenUnlocked: the mesh keeps running with the
     // device locked (identity-cache saves failed with -25308 throughout
     // locked-phone testing), and a wake-on-proximity relaunch via BLE state
     // restoration must be able to read the noise keys before the user
-    // unlocks. Backup/sync semantics are unchanged (not ThisDeviceOnly).
-    private static let itemAccessibility = kSecAttrAccessibleAfterFirstUnlock
+    // unlocks. ThisDeviceOnly prevents private identities and group keys from
+    // migrating through device backups onto a second device.
+    private static let itemAccessibility = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
 
     init() {
         #if os(iOS)
-        migrateAccessibilityIfNeeded()
+        if reconcileInstallLifecycle() {
+            migrateAccessibilityIfNeeded()
+        } else {
+            installAccessGate.block()
+        }
         #endif
     }
 
+    static func installLifecycleAction(
+        containerKnowsMarker: Bool,
+        cleanupPending: Bool = false,
+        markerRead: KeychainReadResult
+    ) -> KeychainInstallLifecycleAction {
+        // Once a reinstall cleanup has started, its container-local latch
+        // must win even if the keychain marker was deleted before a later
+        // keychain operation failed. Otherwise the next launch could mistake
+        // a partial cleanup for a fresh bootstrap and preserve stale secrets.
+        if cleanupPending {
+            return .clearStaleKeys
+        }
+
+        switch markerRead {
+        case .success:
+            return containerKnowsMarker ? .markerPresent : .clearStaleKeys
+        case .itemNotFound:
+            return .bootstrapMarker
+        case .accessDenied, .deviceLocked, .authenticationFailed, .otherError:
+            return .retryLater
+        }
+    }
+
+    static func applicationOwnedKeychainServices(primaryService: String) -> [String] {
+        var seen = Set<String>()
+        return ([primaryService] + additionalApplicationOwnedServices).filter {
+            seen.insert($0).inserted
+        }
+    }
+
+    /// Runs every service update even after one failure. Successful updates
+    /// are idempotent, while returning false keeps the one-time flag unset so
+    /// a later unlocked launch retries the incomplete migration.
+    static func migrateAccessibilityForApplicationOwnedServices(
+        primaryService: String,
+        updateService: (String) -> OSStatus
+    ) -> Bool {
+        var completed = true
+        for serviceName in applicationOwnedKeychainServices(
+            primaryService: primaryService
+        ) {
+            let status = updateService(serviceName)
+            if status != errSecSuccess && status != errSecItemNotFound {
+                completed = false
+            }
+        }
+        return completed
+    }
+
+    /// Deletes every declared service even after one failure. An empty scope
+    /// is already clean, while any other status leaves the cleanup
+    /// incomplete so its durable retry marker remains set.
+    static func deleteApplicationOwnedKeychainServices(
+        primaryService: String,
+        deleteService: (String) -> OSStatus
+    ) -> Bool {
+        var completed = true
+        for serviceName in applicationOwnedKeychainServices(
+            primaryService: primaryService
+        ) {
+            let status = deleteService(serviceName)
+            if status != errSecSuccess && status != errSecItemNotFound {
+                completed = false
+            }
+        }
+        return completed
+    }
+
+    /// The app currently has an application-group entitlement, not a
+    /// keychain-access-group entitlement. Keep the historical group cleanup
+    /// probe as best effort without making its expected -34018 response block
+    /// panic recovery forever.
+    static func completedApplicationGroupDelete(status: OSStatus) -> Bool {
+        status == errSecSuccess
+            || status == errSecItemNotFound
+            || status == -34018
+    }
+
     #if os(iOS)
+
+    private static let installMarkerAccount = "install_lifecycle_marker"
+    private static let installMarkerDefaultsKey = "keychain.installLifecycleMarker.present"
+    private static let installCleanupPendingDefaultsKey =
+        "keychain.installLifecycleCleanup.pending"
+
+    /// Keychain items can survive app removal while the app container and its
+    /// UserDefaults do not. The first version carrying this marker bootstraps
+    /// without deleting existing users' identities. On a later reinstall, a
+    /// surviving keychain marker plus a missing defaults marker proves the app
+    /// container was replaced, so stale secrets are removed before use.
+    @discardableResult
+    private func reconcileInstallLifecycle() -> Bool {
+        let defaults = UserDefaults.standard
+        let containerKnowsMarker = defaults.bool(forKey: Self.installMarkerDefaultsKey)
+        let cleanupPending = defaults.bool(
+            forKey: Self.installCleanupPendingDefaultsKey
+        )
+
+        let markerRead = retrieveDataWithResult(forKey: Self.installMarkerAccount)
+        switch Self.installLifecycleAction(
+            containerKnowsMarker: containerKnowsMarker,
+            cleanupPending: cleanupPending,
+            markerRead: markerRead
+        ) {
+        case .markerPresent:
+            defaults.set(true, forKey: Self.installMarkerDefaultsKey)
+            return true
+
+        case .bootstrapMarker:
+            if case .success = saveDataWithResult(Data([1]), forKey: Self.installMarkerAccount) {
+                defaults.set(true, forKey: Self.installMarkerDefaultsKey)
+            }
+            // A missing marker is the intentional bootstrap path for both a
+            // fresh install and the first marker-carrying upgrade. Preserve
+            // existing users' identities even if marker creation must retry
+            // on a later construction.
+            return true
+
+        case .clearStaleKeys:
+            // Establish a container-local retry latch before deleting the
+            // surviving keychain marker. If the process exits or any keychain
+            // operation fails, the next launch retries even when that marker
+            // can no longer be read.
+            defaults.set(true, forKey: Self.installCleanupPendingDefaultsKey)
+            guard defaults.synchronize(),
+                  defaults.bool(forKey: Self.installCleanupPendingDefaultsKey)
+            else {
+                SecureLogger.error(
+                    "Could not persist reinstall keychain-cleanup intent",
+                    category: .security
+                )
+                return false
+            }
+
+            guard deleteAllKeychainData() else {
+                SecureLogger.error(
+                    "Reinstall keychain cleanup incomplete; retry remains pending",
+                    category: .security
+                )
+                return false
+            }
+
+            defaults.set(true, forKey: Self.installMarkerDefaultsKey)
+            defaults.removeObject(
+                forKey: Self.installCleanupPendingDefaultsKey
+            )
+            guard defaults.synchronize(),
+                  defaults.bool(forKey: Self.installMarkerDefaultsKey),
+                  !defaults.bool(
+                    forKey: Self.installCleanupPendingDefaultsKey
+                  )
+            else {
+                // Preserve the fail-closed state in memory and make one more
+                // best-effort persistence attempt before startup continues.
+                defaults.set(
+                    true,
+                    forKey: Self.installCleanupPendingDefaultsKey
+                )
+                _ = defaults.synchronize()
+                SecureLogger.error(
+                    "Could not commit reinstall keychain-cleanup state; retry remains pending",
+                    category: .security
+                )
+                return false
+            }
+            return true
+
+        case .retryLater:
+            // Do not guess that a temporarily unreadable marker is absent.
+            // An established container may keep using ordinary protected-data
+            // semantics: reads fail while locked and recover after unlock. A
+            // container that has not committed the marker must stay blocked
+            // until the marker becomes readable and this state machine can
+            // distinguish bootstrap from reinstall.
+            return containerKnowsMarker
+        }
+    }
+
     /// One-time upgrade of items created under WhenUnlocked. New saves get
     /// the right class on their own (saves are delete-then-add), but the
     /// long-lived identity keys are written once and would otherwise stay
     /// unreadable while the device is locked.
     private func migrateAccessibilityIfNeeded() {
-        let flag = "keychain.accessibility.afterFirstUnlock.migrated"
+        let flag = "keychain.accessibility.afterFirstUnlockThisDeviceOnly.migrated"
         guard !UserDefaults.standard.bool(forKey: flag) else { return }
 
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service
-        ]
         let update: [String: Any] = [
             kSecAttrAccessible as String: Self.itemAccessibility
         ]
-        let status = SecItemUpdate(query as CFDictionary, update as CFDictionary)
-        switch status {
-        case errSecSuccess, errSecItemNotFound:
-            // Nothing to migrate on a fresh install; both are terminal.
+        let completed = Self.migrateAccessibilityForApplicationOwnedServices(
+            primaryService: service
+        ) { serviceName in
+            let query: [String: Any] = [
+                kSecClass as String: kSecClassGenericPassword,
+                kSecAttrService as String: serviceName
+            ]
+            return SecItemUpdate(
+                query as CFDictionary,
+                update as CFDictionary
+            )
+        }
+        if completed {
+            // Missing services on a fresh install are terminal, but the flag is
+            // set only after every application-owned service was considered.
             UserDefaults.standard.set(true, forKey: flag)
-            SecureLogger.info("Keychain accessibility migrated to AfterFirstUnlock (status \(status))", category: .keychain)
-        default:
+            SecureLogger.info(
+                "Keychain accessibility migrated to AfterFirstUnlockThisDeviceOnly",
+                category: .keychain
+            )
+        } else {
             // Likely errSecInteractionNotAllowed (relaunched while locked) —
             // leave the flag unset so the next launch retries.
-            SecureLogger.warning("Keychain accessibility migration deferred (status \(status))", category: .keychain)
+            SecureLogger.warning(
+                "Keychain accessibility migration deferred for at least one application-owned service",
+                category: .keychain
+            )
         }
     }
     #endif
 
+    private func installAccessAllowed() -> Bool {
+        #if os(iOS)
+        return installAccessGate.allowsAccess { [self] in
+            guard reconcileInstallLifecycle() else { return false }
+            migrateAccessibilityIfNeeded()
+            return true
+        }
+        #else
+        return true
+        #endif
+    }
+
     // MARK: - Identity Keys
     
     func saveIdentityKey(_ keyData: Data, forKey key: String) -> Bool {
+        guard installAccessAllowed() else {
+            SecureLogger.logKeyOperation(.save, keyType: key, success: false)
+            return false
+        }
         let fullKey = "identity_\(key)"
         let result = saveData(keyData, forKey: fullKey)
         SecureLogger.logKeyOperation(.save, keyType: key, success: result)
@@ -95,11 +371,16 @@ final class KeychainManager: KeychainManagerProtocol {
     }
     
     func getIdentityKey(forKey key: String) -> Data? {
+        guard installAccessAllowed() else { return nil }
         let fullKey = "identity_\(key)"
         return retrieveData(forKey: fullKey)
     }
     
     func deleteIdentityKey(forKey key: String) -> Bool {
+        guard installAccessAllowed() else {
+            SecureLogger.logKeyOperation(.delete, keyType: key, success: false)
+            return false
+        }
         let result = delete(forKey: "identity_\(key)")
         SecureLogger.logKeyOperation(.delete, keyType: key, success: result)
         return result
@@ -110,12 +391,14 @@ final class KeychainManager: KeychainManagerProtocol {
     /// Get identity key with detailed result for proper error handling
     /// Distinguishes between missing keys (expected) and critical failures
     func getIdentityKeyWithResult(forKey key: String) -> KeychainReadResult {
+        guard installAccessAllowed() else { return .accessDenied }
         let fullKey = "identity_\(key)"
         return retrieveDataWithResult(forKey: fullKey)
     }
 
     /// Save identity key with detailed result and retry logic for transient errors
     func saveIdentityKeyWithResult(_ keyData: Data, forKey key: String) -> KeychainSaveResult {
+        guard installAccessAllowed() else { return .accessDenied }
         let fullKey = "identity_\(key)"
         return saveDataWithResult(keyData, forKey: fullKey)
     }
@@ -385,114 +668,165 @@ final class KeychainManager: KeychainManagerProtocol {
     // Delete ALL keychain data for panic mode
     func deleteAllKeychainData() -> Bool {
         SecureLogger.warning("Panic mode - deleting all keychain data", category: .security)
-        
-        var totalDeleted = 0
-        
-        // Search without service restriction to catch all items
+
+        let ownedServices = Set(
+            Self.applicationOwnedKeychainServices(
+                primaryService: service
+            )
+        )
+        var enumerationCompleted = true
         let searchQuery: [String: Any] = [
             kSecClass as String: kSecClassGenericPassword,
             kSecMatchLimit as String: kSecMatchLimitAll,
             kSecReturnAttributes as String: true
         ]
-        
         var result: AnyObject?
-        let searchStatus = SecItemCopyMatching(searchQuery as CFDictionary, &result)
-        
-        if searchStatus == errSecSuccess, let items = result as? [[String: Any]] {
+        let searchStatus = SecItemCopyMatching(
+            searchQuery as CFDictionary,
+            &result
+        )
+        switch searchStatus {
+        case errSecSuccess:
+            guard let items = result as? [[String: Any]] else {
+                enumerationCompleted = false
+                SecureLogger.error(
+                    "Unable to decode application-owned keychain inventory",
+                    category: .security
+                )
+                break
+            }
+
+            // Preserve the access-group sweep for custom services that are
+            // not yet in the declared legacy-service list.
             for item in items {
-                var shouldDelete = false
-                let account = item[kSecAttrAccount as String] as? String ?? ""
-                let service = item[kSecAttrService as String] as? String ?? ""
-                let accessGroup = item[kSecAttrAccessGroup as String] as? String
-                
-                // More precise deletion criteria:
-                // 1. Check for our specific app group
-                // 2. OR check for our exact service name
-                // 3. OR check for known legacy service names
-                if accessGroup == appGroup {
-                    shouldDelete = true
-                } else if service == self.service {
-                    shouldDelete = true
-                } else if [
-                    "com.bitchat.passwords",
-                    "com.bitchat.deviceidentity",
-                    "com.bitchat.noise.identity",
-                    "chat.bitchat.passwords",
-                    "bitchat.keychain",
-                    "bitchat",
-                    "com.bitchat"
-                ].contains(service) {
-                    shouldDelete = true
+                let account =
+                    item[kSecAttrAccount as String] as? String ?? ""
+                let itemService =
+                    item[kSecAttrService as String] as? String ?? ""
+                let accessGroup =
+                    item[kSecAttrAccessGroup as String] as? String
+                guard accessGroup == appGroup
+                        || ownedServices.contains(itemService)
+                else {
+                    continue
                 }
-                
-                if shouldDelete {
-                    // Build delete query with all available attributes for precise deletion
-                    var deleteQuery: [String: Any] = [
-                        kSecClass as String: kSecClassGenericPassword
-                    ]
-                    
-                    if !account.isEmpty {
-                        deleteQuery[kSecAttrAccount as String] = account
-                    }
-                    if !service.isEmpty {
-                        deleteQuery[kSecAttrService as String] = service
-                    }
-                    
-                    // Add access group if present
-                    if let accessGroup = item[kSecAttrAccessGroup as String] as? String,
-                       !accessGroup.isEmpty && accessGroup != "test" {
-                        deleteQuery[kSecAttrAccessGroup as String] = accessGroup
-                    }
-                    
-                    let deleteStatus = SecItemDelete(deleteQuery as CFDictionary)
-                    if deleteStatus == errSecSuccess {
-                        totalDeleted += 1
-                        SecureLogger.info("Deleted keychain item: \(account) from \(service)", category: .keychain)
-                    }
+
+                var deleteQuery: [String: Any] = [
+                    kSecClass as String: kSecClassGenericPassword
+                ]
+                if !account.isEmpty {
+                    deleteQuery[kSecAttrAccount as String] = account
+                }
+                if !itemService.isEmpty {
+                    deleteQuery[kSecAttrService as String] = itemService
+                }
+                if let accessGroup,
+                   !accessGroup.isEmpty,
+                   accessGroup != "test" {
+                    deleteQuery[kSecAttrAccessGroup as String] = accessGroup
+                }
+
+                let status = SecItemDelete(deleteQuery as CFDictionary)
+                if status != errSecSuccess && status != errSecItemNotFound {
+                    enumerationCompleted = false
+                    SecureLogger.error(
+                        NSError(domain: "Keychain", code: Int(status)),
+                        context: "Unable to delete enumerated application-owned keychain item",
+                        category: .keychain
+                    )
                 }
             }
+
+        case errSecItemNotFound:
+            break
+
+        default:
+            enumerationCompleted = false
+            SecureLogger.error(
+                NSError(domain: "Keychain", code: Int(searchStatus)),
+                context: "Unable to enumerate application-owned keychain items",
+                category: .keychain
+            )
         }
-        
-        // Also try to delete by known service names and app group
-        // This catches any items that might have been missed above
-        let knownServices = [
-            self.service,  // Current service name
-            "com.bitchat.passwords",
-            "com.bitchat.deviceidentity", 
-            "com.bitchat.noise.identity",
-            "chat.bitchat.passwords",
-            "chat.bitchat.nostr",
-            "bitchat.keychain",
-            "bitchat",
-            "com.bitchat"
-        ]
-        
-        for serviceName in knownServices {
-            let query: [String: Any] = [
-                kSecClass as String: kSecClassGenericPassword,
-                kSecAttrService as String: serviceName
-            ]
-            
-            let status = SecItemDelete(query as CFDictionary)
-            if status == errSecSuccess {
-                totalDeleted += 1
+
+        // Bulk deletion by every application-owned service is authoritative
+        // and idempotent. It also verifies that every known service scope is
+        // empty even when the inventory pass found no items.
+        let servicesCompleted =
+            Self.deleteApplicationOwnedKeychainServices(
+                primaryService: service
+            ) { serviceName in
+                let query: [String: Any] = [
+                    kSecClass as String: kSecClassGenericPassword,
+                    kSecAttrService as String: serviceName
+                ]
+                let status = SecItemDelete(query as CFDictionary)
+                if status != errSecSuccess && status != errSecItemNotFound {
+                    SecureLogger.error(
+                        NSError(domain: "Keychain", code: Int(status)),
+                        context: "Unable to delete application-owned keychain service \(serviceName)",
+                        category: .keychain
+                    )
+                }
+                return status
             }
-        }
-        
-        // Also delete by app group to ensure complete cleanup
+
+        // Historical builds attempted this application-group identifier as a
+        // keychain access group. It is not currently entitled, so -34018
+        // means the scope is inapplicable rather than partially deleted.
         let groupQuery: [String: Any] = [
             kSecClass as String: kSecClassGenericPassword,
             kSecAttrAccessGroup as String: appGroup
         ]
-        
         let groupStatus = SecItemDelete(groupQuery as CFDictionary)
-        if groupStatus == errSecSuccess {
-            totalDeleted += 1
+        let groupCompleted = Self.completedApplicationGroupDelete(
+            status: groupStatus
+        )
+        if !groupCompleted {
+            SecureLogger.error(
+                NSError(domain: "Keychain", code: Int(groupStatus)),
+                context: "Unable to delete historical application-group keychain items",
+                category: .keychain
+            )
         }
-        
-        SecureLogger.warning("Panic mode cleanup completed. Total items deleted: \(totalDeleted)", category: .keychain)
-        
-        return totalDeleted > 0
+
+        var markerCompleted = true
+        #if os(iOS)
+        // The non-secret marker is intentionally recreated after a panic so a
+        // later uninstall/reinstall can still be distinguished from an in-place
+        // upgrade. Do not commit the container-side marker here: reinstall
+        // reconciliation may still need to retry an incomplete cleanup.
+        if case .success = saveDataWithResult(
+            Data([1]),
+            forKey: Self.installMarkerAccount
+        ) {
+            markerCompleted = true
+        } else {
+            markerCompleted = false
+            SecureLogger.error(
+                "Unable to restore install-lifecycle keychain marker",
+                category: .security
+            )
+        }
+        #endif
+
+        let completed =
+            enumerationCompleted
+            && servicesCompleted
+            && groupCompleted
+            && markerCompleted
+        if completed {
+            SecureLogger.warning(
+                "Panic mode keychain cleanup completed",
+                category: .keychain
+            )
+        } else {
+            SecureLogger.error(
+                "Panic mode keychain cleanup incomplete",
+                category: .security
+            )
+        }
+        return completed
     }
     
     // MARK: - Security Utilities
@@ -518,6 +852,7 @@ final class KeychainManager: KeychainManagerProtocol {
     // MARK: - Debug
 
     func verifyIdentityKeyExists() -> Bool {
+        guard installAccessAllowed() else { return false }
         let key = "identity_noiseStaticKey"
         return retrieveData(forKey: key) != nil
     }
@@ -526,18 +861,40 @@ final class KeychainManager: KeychainManagerProtocol {
 
     /// Save data with a custom service name
     func save(key: String, data: Data, service customService: String, accessible: CFString?) {
-        var query: [String: Any] = [
+        guard installAccessAllowed() else { return }
+        let primaryKeyQuery: [String: Any] = [
             kSecClass as String: kSecClassGenericPassword,
             kSecAttrService as String: customService,
-            kSecAttrAccount as String: key,
-            kSecValueData as String: data
+            kSecAttrAccount as String: key
         ]
-        if let accessible = accessible {
-            query[kSecAttrAccessible as String] = accessible
-        }
+        var addQuery = primaryKeyQuery
+        addQuery.merge([
+            kSecValueData as String: data,
+            kSecAttrAccessible as String: accessible ?? Self.itemAccessibility,
+            kSecAttrSynchronizable as String: false
+        ]) { _, new in new }
 
-        SecItemDelete(query as CFDictionary)
-        SecItemAdd(query as CFDictionary, nil)
+        // Delete by the item's primary key only. Value/accessibility fields
+        // are add attributes, not valid selectors for replacing an existing
+        // item; including them can leave the old item in place and make the
+        // subsequent add fail as a duplicate.
+        let deleteStatus = SecItemDelete(primaryKeyQuery as CFDictionary)
+        guard deleteStatus == errSecSuccess || deleteStatus == errSecItemNotFound else {
+            SecureLogger.error(
+                NSError(domain: "Keychain", code: Int(deleteStatus)),
+                context: "Unable to replace custom-service keychain item",
+                category: .keychain
+            )
+            return
+        }
+        let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+        if addStatus != errSecSuccess {
+            SecureLogger.error(
+                NSError(domain: "Keychain", code: Int(addStatus)),
+                context: "Unable to save custom-service keychain item",
+                category: .keychain
+            )
+        }
     }
 
     /// Load data from a custom service
@@ -551,6 +908,7 @@ final class KeychainManager: KeychainManagerProtocol {
     /// Load custom-service data without collapsing `itemNotFound` and
     /// protected-data/keychain failures into the same nil result.
     func loadWithResult(key: String, service customService: String) -> KeychainReadResult {
+        guard installAccessAllowed() else { return .accessDenied }
         let query: [String: Any] = [
             kSecClass as String: kSecClassGenericPassword,
             kSecAttrService as String: customService,
@@ -565,6 +923,7 @@ final class KeychainManager: KeychainManagerProtocol {
 
     /// Delete data from a custom service
     func delete(key: String, service customService: String) {
+        guard installAccessAllowed() else { return }
         let query: [String: Any] = [
             kSecClass as String: kSecClassGenericPassword,
             kSecAttrService as String: customService,
@@ -576,6 +935,7 @@ final class KeychainManager: KeychainManagerProtocol {
 
     /// Delete every item stored under a custom service
     func deleteAll(service customService: String) {
+        guard installAccessAllowed() else { return }
         let query: [String: Any] = [
             kSecClass as String: kSecClassGenericPassword,
             kSecAttrService as String: customService,

bitchat/Services/MessageDeduplicationService.swift

@@ -172,11 +172,11 @@ final class MessageDeduplicationService {
     /// Cache for Nostr ACK deduplication (messageId:ackType:senderPubkey format)
     private let nostrAckCache: LRUDeduplicationCache<Bool>
 
-    /// Optional cross-launch persistence for the Nostr event cache. NIP-59
-    /// randomizes gift-wrap timestamps, so DM subscriptions look back 24h and
-    /// relays redeliver the same events on every launch; without this record
-    /// each relaunch reprocesses old PMs and acks. Nil (tests, macOS callers
-    /// that don't opt in) keeps the cache purely in-memory.
+    /// Optional cross-launch persistence for the Nostr event cache. BitChat
+    /// randomizes private-envelope timestamps, so DM subscriptions look back
+    /// 24h and relays redeliver the same events on every launch; without this
+    /// record each relaunch reprocesses old PMs and acks. Nil (tests, macOS
+    /// callers that don't opt in) keeps the cache purely in-memory.
     private let nostrEventStore: NostrProcessedEventStore?
     private let nostrEventCapacity: Int
     private var persistScheduled = false
@@ -314,7 +314,7 @@ final class MessageDeduplicationService {
     // MARK: - Clear
 
     /// Clears all caches. This is the wipe/panic path: the persisted
-    /// gift-wrap record goes with everything else.
+    /// private-envelope record goes with everything else.
     func clearAll() {
         contentCache.clear()
         nostrEventCache.clear()
@@ -325,7 +325,7 @@ final class MessageDeduplicationService {
 
     /// Clears only the in-memory Nostr caches (events and ACKs). Runs on
     /// every geohash channel switch, so the disk record deliberately
-    /// survives — wiping it here would forfeit cross-launch gift-wrap dedup
+    /// survives — wiping it here would forfeit cross-launch private-envelope dedup
     /// each time the user changes channels (flagged by Codex on #1398).
     func clearNostrCaches() {
         nostrEventCache.clear()

bitchat/Services/MessageFormattingEngine.swift

@@ -251,9 +251,9 @@ final class MessageFormattingEngine {
         isSelf: Bool,
         isMentioned: Bool
     ) -> AttributedString {
-        // For very long content without special tokens, use plain formatting
-        let containsCashu = containsCashuToken(content)
-        if (content.count > 4000 || content.hasVeryLongToken(threshold: 1024)) && !containsCashu {
+        // For very long content, use plain formatting to avoid expensive
+        // regex/detector work. Cashu presence must not disable this guard.
+        if content.isOversizedForRichFormatting() {
             return formatPlainContent(content, baseColor: baseColor, isSelf: isSelf)
         }
 

bitchat/Services/MessageRouter.swift

@@ -34,6 +34,20 @@ struct CourierDirectory {
 final class MessageRouter {
     typealias QueuedMessage = MessageOutboxStore.QueuedMessage
 
+    private struct PeerMessageKey: Hashable {
+        let peerID: PeerID
+        let messageID: String
+
+        static func == (lhs: PeerMessageKey, rhs: PeerMessageKey) -> Bool {
+            lhs.peerID == rhs.peerID && lhs.messageID == rhs.messageID
+        }
+
+        func hash(into hasher: inout Hasher) {
+            hasher.combine(peerID)
+            hasher.combine(messageID)
+        }
+    }
+
     private let transports: [Transport]
     private let now: () -> Date
     private let courierDirectory: CourierDirectory
@@ -104,15 +118,25 @@ final class MessageRouter {
     }
 
     private var bridgeSweepTask: Task<Void, Never>?
-    private var bridgeDepositsInFlight = Set<String>()
+    private var bridgeDepositsInFlight = Set<PeerMessageKey>()
 
     private var outbox: [PeerID: [QueuedMessage]] = [:]
+    /// Peer/message pairs whose latest router-owned transmission used an
+    /// already-established secure session and still await an ack. Peer scope
+    /// is required because message IDs are not globally unique across direct
+    /// conversations. This deliberately excludes messages handed to BLE while
+    /// a handshake is pending: BLE owns those sends and drains its queue after
+    /// authentication, so retrying them here would duplicate every normal
+    /// first-handshake DM.
+    private var secureTransmissions = Set<PeerMessageKey>()
 
     // Outbox limits to prevent unbounded memory growth
     private static let maxMessagesPerPeer = 100
     private static let messageTTLSeconds: TimeInterval = 24 * 60 * 60 // 24 hours
-    // Bound resends of messages sent on a weak reachability signal that never
-    // get a delivery ack (e.g. peer on an old client that doesn't ack).
+    // Bound actual sends that never receive an ack, whether they used weak
+    // reachability or an apparently secure session that keeps being replaced.
+    // Connected pre-handshake sends are transport-owned and do not burn this
+    // cap because BLE queues/drains them itself.
     private static let maxSendAttempts = 8
     // Redundant couriers improve delivery odds; receivers dedup by message ID.
     private static let maxCouriersPerMessage = 3
@@ -158,6 +182,16 @@ final class MessageRouter {
         }
     }
 
+    /// Wire one typed event sink to every route, including the queue-backed
+    /// Nostr transport. Keeping this at the router boundary prevents a relay
+    /// admission failure from disappearing merely because only the primary
+    /// mesh transport was assigned a UI delegate.
+    func setEventDelegate(_ delegate: TransportEventDelegate?) {
+        for transport in transports {
+            transport.eventDelegate = delegate
+        }
+    }
+
     // MARK: - Transport Selection
 
     private func reachableTransport(for peerID: PeerID) -> Transport? {
@@ -171,15 +205,28 @@ final class MessageRouter {
     // MARK: - Message Sending
 
     func sendPrivate(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
+        let message = QueuedMessage(
+            content: content,
+            nickname: recipientNickname,
+            messageID: messageID,
+            timestamp: now(),
+            sendAttempts: 1
+        )
+
         if let transport = connectedTransport(for: peerID), transport.canDeliverSecurely(to: peerID) {
-            // A live link that can complete an encrypted delivery is a
-            // strong delivery signal; trust it outright.
+            // Even an established Noise session can be stale after the peer
+            // restarts or replaces its app. Persist before handing the packet
+            // to the transport so a fast ack cannot race ahead of retention,
+            // then keep the copy until a delivery/read ack clears it. A
+            // replacement handshake will retry this same message ID, which
+            // receivers deduplicate.
+            enqueue(message, for: peerID)
+            secureTransmissions.insert(PeerMessageKey(peerID: peerID, messageID: messageID))
             SecureLogger.debug("Routing PM via \(type(of: transport)) (connected) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
             transport.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
             return
         }
 
-        let message = QueuedMessage(content: content, nickname: recipientNickname, messageID: messageID, timestamp: now(), sendAttempts: 1)
         if let transport = connectedTransport(for: peerID) {
             // "Connected" without an established secure session is forgeable:
             // link bindings heal on signature-verified "direct" announces, but
@@ -197,8 +244,9 @@ final class MessageRouter {
             // deposit is cleared on ack. Don't "optimize" the courier call
             // away.
             SecureLogger.debug("Routing PM via \(type(of: transport)) (connected, no secure session) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-            transport.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
             enqueue(message, for: peerID)
+            secureTransmissions.remove(PeerMessageKey(peerID: peerID, messageID: messageID))
+            transport.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
             attemptCourierDeposit(messageID: messageID, for: peerID)
             return
         }
@@ -209,8 +257,8 @@ final class MessageRouter {
             // Send now, but retain a copy until a delivery/read ack clears it;
             // receivers dedup resends by message ID.
             SecureLogger.debug("Routing PM via \(type(of: transport)) (reachable) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-            transport.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
             enqueue(message, for: peerID)
+            transport.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
             // "Reachable" without prompt delivery means the send only joined
             // a queue (Nostr with relays down): also hand a sealed copy to
             // any connected couriers rather than waiting for internet that
@@ -333,11 +381,12 @@ final class MessageRouter {
         for peerID: PeerID,
         recipientKey: Data
     ) {
+        let inFlightKey = PeerMessageKey(peerID: peerID, messageID: message.messageID)
         guard let bridgeCourierDeposit,
-              bridgeDepositsInFlight.insert(message.messageID).inserted else { return }
+              bridgeDepositsInFlight.insert(inFlightKey).inserted else { return }
         bridgeCourierDeposit(message.content, message.messageID, recipientKey) { [weak self] succeeded in
             guard let self else { return }
-            self.bridgeDepositsInFlight.remove(message.messageID)
+            self.bridgeDepositsInFlight.remove(inFlightKey)
             // A direct delivery may have cleared the outbox while the relay
             // relay confirmation was in flight; do not regress its UI state.
             guard succeeded, self.queuedMessage(message.messageID, for: peerID) != nil else { return }
@@ -356,15 +405,40 @@ final class MessageRouter {
 
     // MARK: - Outbox Management
 
-    /// A delivery or read ack confirms receipt; stop retaining the message.
+    /// A locally trusted delivery transition confirms receipt; stop retaining
+    /// every copy of the message. Authenticated remote receipts must use the
+    /// peer-bound overload below instead.
     func markDelivered(_ messageID: String) {
+        clearRetainedMessage(messageID, allowedPeerIDs: nil)
+    }
+
+    /// Stops retaining a message only for the authenticated conversation
+    /// aliases that produced the accepted receipt. A peer that learns another
+    /// conversation's message ID cannot use it to clear that conversation's
+    /// retry state.
+    func markDelivered(_ messageID: String, from peerIDs: Set<PeerID>) {
+        guard !peerIDs.isEmpty else { return }
+        _ = markDelivered(messageID, for: Array(peerIDs))
+    }
+
+    private func clearRetainedMessage(
+        _ messageID: String,
+        allowedPeerIDs: Set<PeerID>?
+    ) {
         var cleared = false
         for (peerID, queue) in outbox {
+            if let allowedPeerIDs, !allowedPeerIDs.contains(peerID) {
+                continue
+            }
             let filtered = queue.filter { $0.messageID != messageID }
             guard filtered.count != queue.count else { continue }
             outbox[peerID] = filtered.isEmpty ? nil : filtered
             cleared = true
         }
+        let matchingSecureTransmissions = secureTransmissions.filter {
+            $0.messageID == messageID
+        }
+        secureTransmissions.subtract(matchingSecureTransmissions)
         // The durable snapshot may still be hidden by protected data. Record
         // the ack even when this cold-load view cannot find the message, then
         // persist the current view so the store retains a removal tombstone.
@@ -375,6 +449,35 @@ final class MessageRouter {
         persistOutbox()
     }
 
+    /// A delivery or read ack authenticated to one account confirms receipt
+    /// only for that account's transport aliases. A colliding message ID
+    /// queued for another peer must remain retained.
+    @discardableResult
+    func markDelivered(_ messageID: String, for peerAliases: [PeerID]) -> Bool {
+        let peerIDs = Set(peerAliases)
+        guard !peerIDs.isEmpty else { return false }
+
+        var cleared = false
+        for peerID in peerIDs {
+            guard let queue = outbox[peerID] else { continue }
+            let filtered = queue.filter { $0.messageID != messageID }
+            guard filtered.count != queue.count else { continue }
+            outbox[peerID] = filtered.isEmpty ? nil : filtered
+            cleared = true
+        }
+        for peerID in peerIDs {
+            secureTransmissions.remove(PeerMessageKey(peerID: peerID, messageID: messageID))
+        }
+        // Preserve the scoped ack even when protected data hides the durable
+        // queue during a cold launch.
+        outboxStore?.recordRemoval(messageID: messageID, for: peerIDs)
+        if cleared {
+            metrics?.record(.outboxDelivered)
+        }
+        persistOutbox()
+        return cleared
+    }
+
     private func enqueue(_ message: QueuedMessage, for peerID: PeerID) {
         var message = message
         var queue = outbox[peerID] ?? []
@@ -398,7 +501,34 @@ final class MessageRouter {
         persistOutbox()
     }
 
+    @discardableResult
+    private func removeQueuedMessage(_ messageID: String, for peerID: PeerID) -> Bool {
+        guard let queue = outbox[peerID],
+              let index = queue.firstIndex(where: { $0.messageID == messageID }) else {
+            return false
+        }
+        var updated = queue
+        updated.remove(at: index)
+        outbox[peerID] = updated.isEmpty ? nil : updated
+        return true
+    }
+
+    @discardableResult
+    private func incrementSendAttemptsIfQueued(_ messageID: String, for peerID: PeerID) -> Bool {
+        guard var queue = outbox[peerID],
+              let index = queue.firstIndex(where: { $0.messageID == messageID }) else {
+            // A synchronous delivery/read ack may have cleared the retained
+            // copy while `sendPrivateMessage` was on the stack. Never
+            // resurrect it from the flush snapshot.
+            return false
+        }
+        queue[index].sendAttempts += 1
+        outbox[peerID] = queue
+        return true
+    }
+
     private func dropMessage(_ messageID: String, for peerID: PeerID) {
+        secureTransmissions.remove(PeerMessageKey(peerID: peerID, messageID: messageID))
         metrics?.record(.outboxDropped)
         onMessageDropped?(messageID, peerID)
     }
@@ -442,6 +572,7 @@ final class MessageRouter {
     /// Panic wipe: forget queued mail on disk and in memory.
     func wipeOutbox() {
         outbox.removeAll()
+        secureTransmissions.removeAll()
         outboxStore?.wipe()
     }
 
@@ -469,26 +600,160 @@ final class MessageRouter {
         }
     }
 
+    /// Retries only messages that the router previously transmitted through
+    /// an already-established secure session and that still await an ack.
+    ///
+    /// A peer restart can leave that local session looking usable until the
+    /// replacement handshake arrives; the first ciphertext is then
+    /// undecryptable remotely. Normal pre-handshake sends are intentionally
+    /// absent from `secureTransmissions` because BLE already queues
+    /// and drains them when authentication completes.
+    func retrySecurePrivateMessagesAfterAuthentication(for peerIDAliases: [PeerID]) {
+        typealias Candidate = (
+            peerID: PeerID,
+            message: QueuedMessage,
+            aliasOrder: Int,
+            queueOrder: Int
+        )
+
+        var visitedPeerIDs = Set<PeerID>()
+        var retriedMessageIDs = Set<String>()
+        var outboxChanged = false
+        let currentDate = now()
+        var candidates: [Candidate] = []
+
+        for (aliasOrder, peerID) in peerIDAliases.enumerated() {
+            guard visitedPeerIDs.insert(peerID).inserted else { continue }
+            guard let queued = outbox[peerID], !queued.isEmpty,
+                  let transport = connectedTransport(for: peerID),
+                  transport.canDeliverSecurely(to: peerID) else {
+                continue
+            }
+
+            for (queueOrder, message) in queued.enumerated() {
+                let key = PeerMessageKey(peerID: peerID, messageID: message.messageID)
+                guard secureTransmissions.contains(key) else { continue }
+                candidates.append((
+                    peerID: peerID,
+                    message: message,
+                    aliasOrder: aliasOrder,
+                    queueOrder: queueOrder
+                ))
+            }
+        }
+
+        // Conversation migration can leave retained messages split across the
+        // ephemeral and stable outbox keys. Merge both queues into one
+        // chronological stream so callback alias order cannot send newer mail
+        // ahead of older mail.
+        candidates.sort { lhs, rhs in
+            if lhs.message.timestamp != rhs.message.timestamp {
+                return lhs.message.timestamp < rhs.message.timestamp
+            }
+            if lhs.aliasOrder != rhs.aliasOrder {
+                return lhs.aliasOrder < rhs.aliasOrder
+            }
+            if lhs.queueOrder != rhs.queueOrder {
+                return lhs.queueOrder < rhs.queueOrder
+            }
+            return lhs.message.messageID < rhs.message.messageID
+        }
+
+        for candidate in candidates {
+            let peerID = candidate.peerID
+            let message = candidate.message
+            let key = PeerMessageKey(peerID: peerID, messageID: message.messageID)
+            guard retriedMessageIDs.insert(message.messageID).inserted,
+                  secureTransmissions.contains(key),
+                  queuedMessage(message.messageID, for: peerID) != nil,
+                  let transport = connectedTransport(for: peerID),
+                  transport.canDeliverSecurely(to: peerID) else {
+                continue
+            }
+
+            if currentDate.timeIntervalSince(message.timestamp) > Self.messageTTLSeconds {
+                if removeQueuedMessage(message.messageID, for: peerID) {
+                    dropMessage(message.messageID, for: peerID)
+                    outboxChanged = true
+                }
+                continue
+            }
+
+            guard message.sendAttempts < Self.maxSendAttempts else {
+                SecureLogger.warning(
+                    "📤 Dropping unacked PM for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))… after \(message.sendAttempts) secure attempts",
+                    category: .session
+                )
+                if removeQueuedMessage(message.messageID, for: peerID) {
+                    dropMessage(message.messageID, for: peerID)
+                    outboxChanged = true
+                }
+                continue
+            }
+
+            SecureLogger.debug(
+                "Auth retry -> \(type(of: transport)) for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))…",
+                category: .session
+            )
+            transport.sendPrivateMessage(
+                message.content,
+                to: peerID,
+                recipientNickname: message.nickname,
+                messageID: message.messageID
+            )
+            metrics?.record(.outboxResent)
+            outboxChanged = incrementSendAttemptsIfQueued(message.messageID, for: peerID) || outboxChanged
+        }
+
+        if outboxChanged {
+            persistOutbox()
+        }
+    }
+
     func flushOutbox(for peerID: PeerID) {
         guard let queued = outbox[peerID], !queued.isEmpty else { return }
         SecureLogger.debug("Flushing outbox for \(peerID.id.prefix(8))… count=\(queued.count)", category: .session)
 
         let now = now()
-        var remaining: [QueuedMessage] = []
+        var outboxChanged = false
 
         for message in queued {
+            // A synchronous ack from an earlier send in this flush may have
+            // removed an entry from the live outbox. The snapshot is only an
+            // iteration order; never use it to recreate removed messages.
+            guard queuedMessage(message.messageID, for: peerID) != nil else { continue }
+
             // Skip expired messages (TTL exceeded)
             if now.timeIntervalSince(message.timestamp) > Self.messageTTLSeconds {
                 SecureLogger.debug("⏰ Expired queued message for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))… (age: \(Int(now.timeIntervalSince(message.timestamp)))s)", category: .session)
-                dropMessage(message.messageID, for: peerID)
+                if removeQueuedMessage(message.messageID, for: peerID) {
+                    dropMessage(message.messageID, for: peerID)
+                    outboxChanged = true
+                }
                 continue
             }
 
             if let transport = connectedTransport(for: peerID), transport.canDeliverSecurely(to: peerID) {
-                // Live link with a secure session: send and stop retaining.
+                // A secure session is meaningful enough to retry, but not
+                // proof that this particular ciphertext reached the peer: the
+                // remote app may have restarted while our old session still
+                // looked established. Retain until an ack, while bounding
+                // actual secure transmissions for peers that never ack.
+                guard message.sendAttempts < Self.maxSendAttempts else {
+                    SecureLogger.warning("📤 Dropping unacked PM for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))… after \(message.sendAttempts) attempts", category: .session)
+                    if removeQueuedMessage(message.messageID, for: peerID) {
+                        dropMessage(message.messageID, for: peerID)
+                        outboxChanged = true
+                    }
+                    continue
+                }
                 SecureLogger.debug("Outbox -> \(type(of: transport)) (connected) for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))…", category: .session)
+                secureTransmissions.insert(
+                    PeerMessageKey(peerID: peerID, messageID: message.messageID)
+                )
                 transport.sendPrivateMessage(message.content, to: peerID, recipientNickname: message.nickname, messageID: message.messageID)
                 metrics?.record(.outboxResent)
+                outboxChanged = incrementSendAttemptsIfQueued(message.messageID, for: peerID) || outboxChanged
             } else if let transport = connectedTransport(for: peerID) {
                 // "Connected" without a secure session — possibly a stolen
                 // binding from a replayed announce: send (a genuine link
@@ -501,9 +766,11 @@ final class MessageRouter {
                 // preserve. Retention stays bounded by the 24h outbox TTL
                 // and the per-peer FIFO cap.
                 SecureLogger.debug("Outbox -> \(type(of: transport)) (connected, no secure session) for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))…", category: .session)
+                secureTransmissions.remove(
+                    PeerMessageKey(peerID: peerID, messageID: message.messageID)
+                )
                 transport.sendPrivateMessage(message.content, to: peerID, recipientNickname: message.nickname, messageID: message.messageID)
                 metrics?.record(.outboxResent)
-                remaining.append(message)
             } else if let transport = reachableTransport(for: peerID) {
                 // Reachability without a connection is a freshness heuristic,
                 // so the send can silently go nowhere: send but keep retaining
@@ -511,26 +778,22 @@ final class MessageRouter {
                 // that never ack.
                 guard message.sendAttempts < Self.maxSendAttempts else {
                     SecureLogger.warning("📤 Dropping unacked PM for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))… after \(message.sendAttempts) attempts", category: .session)
-                    dropMessage(message.messageID, for: peerID)
+                    if removeQueuedMessage(message.messageID, for: peerID) {
+                        dropMessage(message.messageID, for: peerID)
+                        outboxChanged = true
+                    }
                     continue
                 }
                 SecureLogger.debug("Outbox -> \(type(of: transport)) (reachable) for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))…", category: .session)
                 transport.sendPrivateMessage(message.content, to: peerID, recipientNickname: message.nickname, messageID: message.messageID)
                 metrics?.record(.outboxResent)
-                var retained = message
-                retained.sendAttempts += 1
-                remaining.append(retained)
-            } else {
-                remaining.append(message)
+                outboxChanged = incrementSendAttemptsIfQueued(message.messageID, for: peerID) || outboxChanged
             }
         }
 
-        if remaining.isEmpty {
-            outbox.removeValue(forKey: peerID)
-        } else {
-            outbox[peerID] = remaining
+        if outboxChanged {
+            persistOutbox()
         }
-        persistOutbox()
     }
 
     func flushAllOutbox() {

bitchat/Services/NetworkActivationService.swift

@@ -154,6 +154,19 @@ final class NetworkActivationService: ObservableObject {
             .store(in: &cancellables)
     }
 
+    /// Stops all internet-facing work at the synchronous panic boundary.
+    /// `start()` may be called again only after the full wipe commits.
+    func stopForPanic() {
+        cancellables.removeAll()
+        started = false
+        reachabilityMonitor.stop()
+        activationAllowed = false
+        torAutoStartDesired = false
+        relayController.disconnect()
+        torController.setAutoStartAllowed(false)
+        applyTorState(torDesired: false)
+    }
+
     func setUserTorEnabled(_ enabled: Bool) {
         guard enabled != userTorEnabled else { return }
         userTorEnabled = enabled
@@ -167,6 +180,7 @@ final class NetworkActivationService: ObservableObject {
     }
 
     private func reevaluate() {
+        guard started else { return }
         let allowed = effectiveAllowed()
         let torDesired = allowed && userTorEnabled
         let statusChanged = allowed != activationAllowed

bitchat/Services/NetworkReachabilityMonitor.swift

@@ -27,6 +27,8 @@ protocol NetworkReachabilityMonitoring: AnyObject {
     var reachabilityPublisher: AnyPublisher<Bool, Never> { get }
     /// Begin monitoring. Idempotent.
     func start()
+    /// Stop monitoring and discard pending debounce work. Idempotent.
+    func stop()
 }
 
 /// Pure debounce/decision logic for reachability, split out so it can be
@@ -88,18 +90,6 @@ struct ReachabilityDebounce {
     }
 }
 
-/// Always-reachable stub. Used as the default in tests and as the fallback on
-/// platforms without the Network framework, so reachability never suppresses
-/// startup by itself.
-@MainActor
-final class AlwaysReachableMonitor: NetworkReachabilityMonitoring {
-    var isReachable: Bool { true }
-    var reachabilityPublisher: AnyPublisher<Bool, Never> {
-        Empty(completeImmediately: false).eraseToAnyPublisher()
-    }
-    func start() {}
-}
-
 /// `NWPathMonitor`-backed reachability. All state lives on the main actor; the
 /// background path callback hops here before touching the debounce.
 @MainActor
@@ -146,6 +136,18 @@ final class NWPathReachabilityMonitor: NetworkReachabilityMonitoring {
         #endif
     }
 
+    func stop() {
+        guard started else { return }
+        started = false
+        flushWorkItem?.cancel()
+        flushWorkItem = nil
+        #if canImport(Network)
+        monitor?.pathUpdateHandler = nil
+        monitor?.cancel()
+        monitor = nil
+        #endif
+    }
+
     /// Feed an observation into the debounce and publish committed changes.
     /// Exposed internally so higher layers/tests could drive it if needed.
     func ingest(reachable: Bool) {

bitchat/Services/NoiseEncryptionService.swift

@@ -97,7 +97,7 @@ enum EncryptionStatus: Equatable {
     case noiseHandshaking   // Currently establishing
     case noiseSecured       // Established but not verified
     case noiseVerified      // Established and verified
-    
+
     var icon: String? {  // Made optional to hide icon when no handshake
         switch self {
         case .none:
@@ -165,7 +165,6 @@ final class NoiseEncryptionService {
     // Peer fingerprints (SHA256 hash of static public key)
     private var peerFingerprints: [PeerID: String] = [:]
     private var fingerprintToPeerID: [String: PeerID] = [:]
-    
     // Thread safety
     private let serviceQueue = DispatchQueue(label: "chat.bitchat.noise.service", attributes: .concurrent)
     
@@ -183,12 +182,24 @@ final class NoiseEncryptionService {
     
     // Callbacks
     private var onPeerAuthenticatedHandlers: [((PeerID, String) -> Void)] = [] // Array of handlers for peer authentication
+    private var onPeerAuthenticatedWithGenerationHandlers: [((PeerID, String, UUID) -> Void)] = []
     var onHandshakeRequired: ((PeerID) -> Void)? // peerID needs handshake
+    /// Automatic rekey prepared XX message 1. The transport must claim the
+    /// exact attempt at its actual BLE handoff; a crossed inbound initiation
+    /// can invalidate the token before that point.
+    var onRekeyHandshakeReady:
+        ((_ peerID: PeerID, _ initiation: NoiseHandshakeInitiation) -> Void)?
+    var onHandshakeRecoveryRequired:
+        ((_ request: NoiseHandshakeRecoveryRequest) -> Void)?
+    /// An unauthenticated reconnect attempt failed or timed out and the
+    /// receive-only rollback session became the active transport again.
+    /// Transport queues must be drained for this exact restored generation.
+    var onSessionRestoredWithGeneration: ((_ peerID: PeerID, _ generation: UUID) -> Void)?
     
     // Add a handler for peer authentication
     func addOnPeerAuthenticatedHandler(_ handler: @escaping (PeerID, String) -> Void) {
-        serviceQueue.async(flags: .barrier) { [weak self] in
-            self?.onPeerAuthenticatedHandlers.append(handler)
+        serviceQueue.sync(flags: .barrier) {
+            onPeerAuthenticatedHandlers.append(handler)
         }
     }
     
@@ -201,8 +212,30 @@ final class NoiseEncryptionService {
             }
         }
     }
+
+    /// Generation-aware authentication notifications are used by protocols
+    /// whose state must be bound to one exact Noise transport session.
+    var onPeerAuthenticatedWithGeneration: ((PeerID, String, UUID) -> Void)? {
+        get { nil }
+        set {
+            guard let handler = newValue else { return }
+            serviceQueue.sync(flags: .barrier) {
+                onPeerAuthenticatedWithGenerationHandlers.append(handler)
+            }
+        }
+    }
     
-    init(keychain: KeychainManagerProtocol) {
+    init(
+        keychain: KeychainManagerProtocol,
+        ordinaryHandshakeTimeout: TimeInterval =
+            NoiseSecurityConstants.ordinaryHandshakeTimeout,
+        ordinaryResponderHandshakeTimeout: TimeInterval =
+            NoiseSecurityConstants.ordinaryResponderHandshakeTimeout,
+        recentInitiatorCompletionGracePeriod: TimeInterval =
+            NoiseSecurityConstants.recentInitiatorCompletionGracePeriod,
+        ordinaryReconnectRollbackCooldown: TimeInterval =
+            NoiseSecurityConstants.ordinaryReconnectRollbackCooldown
+    ) {
         self.keychain = keychain
         self.localPrekeys = LocalPrekeyStore(keychain: keychain)
 
@@ -292,11 +325,31 @@ final class NoiseEncryptionService {
         self.signingPublicKey = signingKey.publicKey
 
         // Initialize session manager
-        self.sessionManager = NoiseSessionManager(localStaticKey: staticIdentityKey, keychain: keychain)
+        self.sessionManager = NoiseSessionManager(
+            localStaticKey: staticIdentityKey,
+            keychain: keychain,
+            ordinaryHandshakeTimeout: ordinaryHandshakeTimeout,
+            ordinaryResponderHandshakeTimeout:
+                ordinaryResponderHandshakeTimeout,
+            recentInitiatorCompletionGracePeriod:
+                recentInitiatorCompletionGracePeriod,
+            ordinaryReconnectRollbackCooldown:
+                ordinaryReconnectRollbackCooldown
+        )
 
         // Set up session callbacks
-        sessionManager.onSessionEstablished = { [weak self] peerID, remoteStaticKey in
-            self?.handleSessionEstablished(peerID: peerID, remoteStaticKey: remoteStaticKey)
+        sessionManager.onSessionEstablished = { [weak self] peerID, remoteStaticKey, generation in
+            self?.handleSessionEstablished(
+                peerID: peerID,
+                remoteStaticKey: remoteStaticKey,
+                sessionGeneration: generation
+            )
+        }
+        sessionManager.onSessionRestored = { [weak self] peerID, generation in
+            self?.onSessionRestoredWithGeneration?(peerID, generation)
+        }
+        sessionManager.onHandshakeRecoveryRequired = { [weak self] request in
+            self?.onHandshakeRecoveryRequired?(request)
         }
 
         // Start session maintenance timer
@@ -607,7 +660,7 @@ final class NoiseEncryptionService {
         guard let packetData = packet.toBinaryDataForSigning() else {
             return nil
         }
-        
+
         // Sign with the noise private key (converted to Ed25519 for signing)
         guard let signature = signData(packetData) else {
             return nil
@@ -661,9 +714,105 @@ final class NoiseEncryptionService {
         let handshakeData = try sessionManager.initiateHandshake(with: peerID)
         return handshakeData
     }
+
+    /// Atomically admits and prepares one initial ordinary handshake. Returns
+    /// nil when another discovery callback already created a session.
+    func initiateHandshakeIfNeeded(
+        with peerID: PeerID,
+        retryOnTimeout: Bool = false
+    ) throws -> NoiseHandshakeInitiation? {
+        guard peerID.isValid else {
+            SecureLogger.warning(.authenticationFailed(peerID: peerID.id))
+            throw NoiseSecurityError.invalidPeerID
+        }
+
+        guard let initiation = try sessionManager.initiateHandshakeIfAbsent(
+            with: peerID,
+            notifyOnTimeout: retryOnTimeout,
+            authorize: { [rateLimiter] in
+                guard rateLimiter.allowHandshake(from: peerID) else {
+                    SecureLogger.warning(
+                        .authenticationFailed(peerID: "Rate limited: \(peerID)")
+                    )
+                    throw NoiseSecurityError.rateLimitExceeded
+                }
+            }
+        ) else {
+            return nil
+        }
+        SecureLogger.info(.handshakeStarted(peerID: peerID.id))
+        return initiation
+    }
+
+    /// Atomically prepares an ordinary reconnect for a peer whose cached
+    /// transport belongs to an earlier physical link. Failed authorization or
+    /// handshake setup preserves the established session.
+    func initiateReconnectHandshake(
+        with peerID: PeerID,
+        retryOnTimeout: Bool = false
+    ) throws -> NoiseHandshakeInitiation {
+        guard peerID.isValid else {
+            SecureLogger.warning(.authenticationFailed(peerID: peerID.id))
+            throw NoiseSecurityError.invalidPeerID
+        }
+
+        return try sessionManager.initiateReconnectHandshake(
+            with: peerID,
+            notifyOnTimeout: retryOnTimeout,
+            authorize: { [rateLimiter] in
+                guard rateLimiter.allowHandshake(from: peerID) else {
+                    SecureLogger.warning(
+                        .authenticationFailed(peerID: "Rate limited: \(peerID)")
+                    )
+                    throw NoiseSecurityError.rateLimitExceeded
+                }
+            }
+        )
+    }
+
+    func prepareHandshakeRecovery(
+        _ request: NoiseHandshakeRecoveryRequest
+    ) throws -> NoiseHandshakeRecoveryPreparation? {
+        try sessionManager.prepareHandshakeRecovery(
+            request,
+            authorizeAttempt: { [rateLimiter] in
+                guard rateLimiter.allowHandshake(from: request.peerID) else {
+                    SecureLogger.warning(
+                        .authenticationFailed(
+                            peerID: "Rate limited: \(request.peerID)"
+                        )
+                    )
+                    throw NoiseSecurityError.rateLimitExceeded
+                }
+            }
+        )
+    }
+
+    func cancelHandshakeRecovery(_ request: NoiseHandshakeRecoveryRequest) {
+        sessionManager.cancelHandshakeRecovery(request)
+    }
+
+    func claimHandshakeInitiation(
+        _ initiation: NoiseHandshakeInitiation,
+        for peerID: PeerID
+    ) -> Data? {
+        sessionManager.claimHandshakeInitiation(initiation, for: peerID)
+    }
     
     /// Process an incoming handshake message
     func processHandshakeMessage(from peerID: PeerID, message: Data) throws -> Data? {
+        try processHandshakeMessageWithResult(
+            from: peerID,
+            message: message
+        ).response
+    }
+
+    /// Process an incoming handshake message and report whether the exact
+    /// session that consumed it completed authenticated establishment.
+    func processHandshakeMessageWithResult(
+        from peerID: PeerID,
+        message: Data
+    ) throws -> NoiseHandshakeProcessingResult {
         
         // Validate peer ID
         guard peerID.isValid else {
@@ -685,11 +834,14 @@ final class NoiseEncryptionService {
         
         // For handshakes, we process the raw data directly without NoiseMessage wrapper
         // The Noise protocol handles its own message format
-        let responsePayload = try sessionManager.handleIncomingHandshake(from: peerID, message: message)
+        let result = try sessionManager.handleIncomingHandshakeWithResult(
+            from: peerID,
+            message: message
+        )
         
         
         // Return raw response without wrapper
-        return responsePayload
+        return result
     }
     
     /// Check if we have an established session with a peer
@@ -701,6 +853,13 @@ final class NoiseEncryptionService {
     func hasSession(with peerID: PeerID) -> Bool {
         return sessionManager.getSession(for: peerID) != nil
     }
+
+    /// True while an inbound ordinary XX responder is waiting for message 3.
+    /// A small amount of immediately-following ciphertext may arrive first
+    /// over BLE and must be retried only after responder promotion.
+    func isAwaitingResponderHandshakeCompletion(with peerID: PeerID) -> Bool {
+        sessionManager.isAwaitingResponderHandshakeCompletion(for: peerID)
+    }
     
     // MARK: - Encryption/Decryption
     
@@ -725,25 +884,87 @@ final class NoiseEncryptionService {
         
         return try sessionManager.encrypt(data, for: peerID)
     }
-    
-    /// Decrypt data from a specific peer
-    func decrypt(_ data: Data, from peerID: PeerID) throws -> Data {
-        // Validate message size
-        guard NoiseSecurityValidator.validateMessageSize(data) else {
+
+    /// Encrypts a finalized private-media packet. Ordinary Noise application
+    /// messages retain the 64 KiB ceiling; this purpose-specific path permits
+    /// the bounded `BitchatFilePacket` envelope and refuses every other typed
+    /// payload so the larger allocation budget cannot become a generic bypass.
+    func encryptPrivateFilePayload(
+        _ data: Data,
+        for peerID: PeerID,
+        sessionGeneration: UUID? = nil
+    ) throws -> Data {
+        guard NoisePayloadType.isPrivateFile(rawValue: data.first),
+              NoiseSecurityValidator.validatePrivateFileMessageSize(data) else {
             throw NoiseSecurityError.messageTooLarge
         }
-        
-        // Check rate limit
+
         guard rateLimiter.allowMessage(from: peerID) else {
             throw NoiseSecurityError.rateLimitExceeded
         }
-        
-        // Check if we have an established session
+
         guard hasEstablishedSession(with: peerID) else {
+            onHandshakeRequired?(peerID)
+            throw NoiseEncryptionError.handshakeRequired
+        }
+
+        // `maxPrivateFilePlaintextSize` already subtracts the cipher's fixed
+        // nonce/tag overhead, so the result is bounded without a second copy.
+        if let sessionGeneration {
+            return try sessionManager.encrypt(
+                data,
+                for: peerID,
+                expectedSessionGeneration: sessionGeneration
+            )
+        }
+        return try sessionManager.encrypt(data, for: peerID)
+    }
+
+    /// Decrypt data from a specific peer
+    func decrypt(_ data: Data, from peerID: PeerID) throws -> Data {
+        try decryptWithSessionGeneration(data, from: peerID).plaintext
+    }
+
+    func decryptWithSessionGeneration(
+        _ data: Data,
+        from peerID: PeerID,
+        establishedGenerationIsReady: (UUID) -> Bool = { _ in true }
+    ) throws -> (plaintext: Data, sessionGeneration: UUID) {
+        // Standard transport ciphertext has 20 bytes of nonce/tag overhead.
+        // A larger ciphertext is admitted only up to the framed-file ceiling;
+        // after authenticated decryption it must prove it is `.privateFile`.
+        let isStandardCiphertext = NoiseSecurityValidator.validateCiphertextSize(data)
+        let isAdmittedCiphertext = isStandardCiphertext
+            || NoiseSecurityValidator.validatePrivateFileCiphertextSize(data)
+
+        // A quarantined transport is deliberately unavailable for outbound
+        // state, but remains receive-only until the responder proves identity
+        // or the bounded rollback restores it.
+        guard sessionManager.hasReceiveSession(for: peerID) else {
             throw NoiseEncryptionError.sessionNotEstablished
         }
         
-        return try sessionManager.decrypt(data, from: peerID)
+        let result = try sessionManager.decryptWithSessionGeneration(
+            data,
+            from: peerID,
+            establishedGenerationIsReady:
+                establishedGenerationIsReady,
+            authorizeDecrypt: { [rateLimiter] in
+                guard isAdmittedCiphertext else {
+                    throw NoiseSecurityError.messageTooLarge
+                }
+                guard rateLimiter.allowMessage(from: peerID) else {
+                    throw NoiseSecurityError.rateLimitExceeded
+                }
+            }
+        )
+        if !isStandardCiphertext {
+            guard NoisePayloadType.isPrivateFile(rawValue: result.plaintext.first),
+                  NoiseSecurityValidator.validatePrivateFileMessageSize(result.plaintext) else {
+                throw NoiseSecurityError.messageTooLarge
+            }
+        }
+        return result
     }
     
     // MARK: - Peer Management
@@ -755,6 +976,25 @@ final class NoiseEncryptionService {
         }
     }
 
+    func sessionGeneration(for peerID: PeerID) -> UUID? {
+        sessionManager.sessionGeneration(for: peerID)
+    }
+
+    /// Runs `body` while holding a read lease on the exact session generation.
+    /// Session insertion, replacement, and removal use the same manager
+    /// barrier, so they cannot interleave with an authenticated-state commit.
+    func withCurrentSessionGeneration<Result>(
+        for peerID: PeerID,
+        expected: UUID,
+        _ body: () -> Result
+    ) -> Result? {
+        sessionManager.withCurrentSessionGeneration(
+            for: peerID,
+            expected: expected,
+            body
+        )
+    }
+
     func clearEphemeralStateForPanic() {
         sessionManager.removeAllSessions()
         serviceQueue.sync(flags: .barrier) {
@@ -777,24 +1017,36 @@ final class NoiseEncryptionService {
     
     // MARK: - Private Helpers
     
-    private func handleSessionEstablished(peerID: PeerID, remoteStaticKey: Curve25519.KeyAgreement.PublicKey) {
+    private func handleSessionEstablished(
+        peerID: PeerID,
+        remoteStaticKey: Curve25519.KeyAgreement.PublicKey,
+        sessionGeneration: UUID
+    ) {
         // Calculate fingerprint
         let fingerprint = remoteStaticKey.rawRepresentation.sha256Fingerprint()
         
-        // Store fingerprint mapping
-        serviceQueue.sync(flags: .barrier) {
+        // Registering handlers is synchronous, and this barrier snapshots them
+        // with the fingerprint update. Invoke the snapshot outside the queue:
+        // parallel Swift Testing workers must not block behind queued callback
+        // registration or allow a handler to re-enter serviceQueue.
+        let handlers: (
+            generationAware: [(PeerID, String, UUID) -> Void],
+            legacy: [(PeerID, String) -> Void]
+        ) = serviceQueue.sync(flags: .barrier) {
             peerFingerprints[peerID] = fingerprint
             fingerprintToPeerID[fingerprint] = peerID
+            return (onPeerAuthenticatedWithGenerationHandlers, onPeerAuthenticatedHandlers)
         }
         
         // Log security event
         SecureLogger.info(.handshakeCompleted(peerID: peerID.id))
         
-        // Notify all handlers about authentication
-        serviceQueue.async { [weak self] in
-            self?.onPeerAuthenticatedHandlers.forEach { handler in
-                handler(peerID, fingerprint)
-            }
+        // Notify all handlers about authentication.
+        handlers.generationAware.forEach { handler in
+            handler(peerID, fingerprint, sessionGeneration)
+        }
+        handlers.legacy.forEach { handler in
+            handler(peerID, fingerprint)
         }
     }
         
@@ -815,19 +1067,26 @@ final class NoiseEncryptionService {
         let sessionsNeedingRekey = sessionManager.getSessionsNeedingRekey()
         
         for (peerID, needsRekey) in sessionsNeedingRekey where needsRekey {
-            
-            // Attempt to rekey the session
             do {
-                try sessionManager.initiateRekey(for: peerID)
-                SecureLogger.debug("Key rotation initiated for peer: \(peerID)", category: .security)
-                
-                // Signal that handshake is needed
-                onHandshakeRequired?(peerID)
+                try initiateAutomaticRekey(for: peerID)
             } catch {
                 SecureLogger.error(error, context: "Failed to initiate rekey for peer: \(peerID)", category: .session)
             }
         }
     }
+
+    private func initiateAutomaticRekey(for peerID: PeerID) throws {
+        let initiation = try sessionManager.initiateRekey(for: peerID)
+        SecureLogger.debug("Key rotation initiated for peer: \(peerID)", category: .security)
+        onRekeyHandshakeReady?(peerID, initiation)
+        onHandshakeRequired?(peerID)
+    }
+
+    #if DEBUG
+    func _test_initiateAutomaticRekey(for peerID: PeerID) throws {
+        try initiateAutomaticRekey(for: peerID)
+    }
+    #endif
     
     deinit {
         stopRekeyTimer()
@@ -915,6 +1174,9 @@ struct NoiseMessage: Codable {
 enum NoiseEncryptionError: Error {
     case handshakeRequired
     case sessionNotEstablished
+    /// Manager keys are established or restored, but BLE has not installed
+    /// generation-bound transport state. No receive nonce was consumed.
+    case transportGenerationNotReady
     /// Envelope references a prekey ID we don't hold (never ours, already
     /// deleted after its grace window, or wiped in a panic).
     case unknownPrekey

bitchat/Services/NostrProcessedEventStore.swift

@@ -9,10 +9,10 @@
 import BitLogger
 import Foundation
 
-/// Disk persistence for processed gift-wrap event IDs. NIP-59 randomizes
-/// gift-wrap timestamps, so DM subscriptions must look back generously (24h)
-/// and relays redeliver the same events on every launch — without a
-/// cross-launch record, each relaunch reprocesses old PMs and acks
+/// Disk persistence for processed private-envelope event IDs. BitChat
+/// randomizes envelope timestamps, so DM subscriptions must look back
+/// generously (24h) and relays redeliver the same events on every launch —
+/// without a cross-launch record, each relaunch reprocesses old PMs and acks
 /// (re-sent DELIVERED bursts, "delivered ack for unknown mid" noise).
 ///
 /// Contents are event IDs already visible to every relay, so

bitchat/Services/NostrTransport.swift

@@ -11,8 +11,12 @@ final class NostrTransport: Transport, @unchecked Sendable {
         let favoriteStatusForNoiseKey: @MainActor (Data) -> FavoritesPersistenceService.FavoriteRelationship?
         let favoriteStatusForPeerID: @MainActor (PeerID) -> FavoritesPersistenceService.FavoriteRelationship?
         let currentIdentity: @MainActor () throws -> NostrIdentity?
-        let registerPendingGiftWrap: @MainActor (String) -> Void
-        let sendEvent: @MainActor (NostrEvent) -> Void
+        let registerPendingPrivateEnvelope: @MainActor (String) -> Void
+        let sendPrivateEnvelopeBatch: @MainActor (
+            [NostrEvent],
+            @escaping @MainActor () -> Void
+        ) -> Bool
+        let envelopeRetryQueue: NostrPrivateEnvelopeRetryQueue
         /// Emits whether a relay that carries private messages is up
         /// (fail-closed behind Tor). A connected geohash/custom relay alone
         /// doesn't count: DM sends target the default relay set and would
@@ -22,25 +26,35 @@ final class NostrTransport: Transport, @unchecked Sendable {
         /// serialize behind each other; `live` passes the process-wide one.
         let ackPacer: AckPacer
 
+        @MainActor
         init(
             notificationCenter: NotificationCenter,
             loadFavorites: @escaping @MainActor () -> [Data: FavoritesPersistenceService.FavoriteRelationship],
             favoriteStatusForNoiseKey: @escaping @MainActor (Data) -> FavoritesPersistenceService.FavoriteRelationship?,
             favoriteStatusForPeerID: @escaping @MainActor (PeerID) -> FavoritesPersistenceService.FavoriteRelationship?,
             currentIdentity: @escaping @MainActor () throws -> NostrIdentity?,
-            registerPendingGiftWrap: @escaping @MainActor (String) -> Void,
-            sendEvent: @escaping @MainActor (NostrEvent) -> Void,
+            registerPendingPrivateEnvelope: @escaping @MainActor (String) -> Void,
+            sendPrivateEnvelopeBatch: @escaping @MainActor (
+                [NostrEvent],
+                @escaping @MainActor () -> Void
+            ) -> Bool,
             scheduleAfter: @escaping @Sendable (TimeInterval, @escaping @Sendable () -> Void) -> Void,
             relayConnectivity: @escaping @MainActor () -> AnyPublisher<Bool, Never>,
-            ackPacer: AckPacer? = nil
+            ackPacer: AckPacer? = nil,
+            envelopeRetryQueue: NostrPrivateEnvelopeRetryQueue? = nil
         ) {
             self.notificationCenter = notificationCenter
             self.loadFavorites = loadFavorites
             self.favoriteStatusForNoiseKey = favoriteStatusForNoiseKey
             self.favoriteStatusForPeerID = favoriteStatusForPeerID
             self.currentIdentity = currentIdentity
-            self.registerPendingGiftWrap = registerPendingGiftWrap
-            self.sendEvent = sendEvent
+            self.registerPendingPrivateEnvelope = registerPendingPrivateEnvelope
+            self.sendPrivateEnvelopeBatch = sendPrivateEnvelopeBatch
+            self.envelopeRetryQueue = envelopeRetryQueue ?? NostrPrivateEnvelopeRetryQueue(
+                sendPrivateEnvelopeBatch: sendPrivateEnvelopeBatch,
+                registerPendingPrivateEnvelope: registerPendingPrivateEnvelope,
+                scheduleAfter: scheduleAfter
+            )
             self.relayConnectivity = relayConnectivity
             // Default pacer drives its throttle through the same injected
             // scheduler, so tests that step scheduleAfter manually keep
@@ -56,13 +70,19 @@ final class NostrTransport: Transport, @unchecked Sendable {
                 favoriteStatusForNoiseKey: { FavoritesPersistenceService.shared.getFavoriteStatus(for: $0) },
                 favoriteStatusForPeerID: { FavoritesPersistenceService.shared.getFavoriteStatus(forPeerID: $0) },
                 currentIdentity: { try idBridge.getCurrentNostrIdentity() },
-                registerPendingGiftWrap: { NostrRelayManager.registerPendingGiftWrap(id: $0) },
-                sendEvent: { NostrRelayManager.shared.sendEvent($0) },
+                registerPendingPrivateEnvelope: { NostrRelayManager.registerPendingPrivateEnvelope(id: $0) },
+                sendPrivateEnvelopeBatch: { events, terminalFailure in
+                    NostrRelayManager.shared.sendPrivateEnvelopeBatch(
+                        events,
+                        terminalFailure: terminalFailure
+                    )
+                },
                 scheduleAfter: { delay, action in
                     DispatchQueue.main.asyncAfter(deadline: .now() + delay, execute: action)
                 },
                 relayConnectivity: { NostrRelayManager.shared.$isDMRelayConnected.eraseToAnyPublisher() },
-                ackPacer: NostrTransport.sharedAckPacer
+                ackPacer: NostrTransport.sharedAckPacer,
+                envelopeRetryQueue: NostrTransport.sharedEnvelopeRetryQueue
             )
         }
     }
@@ -128,7 +148,37 @@ final class NostrTransport: Transport, @unchecked Sendable {
         }
     }
     static let sharedAckPacer = AckPacer()
+    // Geohash acknowledgements use short-lived NostrTransport instances, so
+    // the retry owner must be process-wide. A per-transport cap would still be
+    // globally unbounded under outage as throwaway instances accumulated.
+    @MainActor
+    private static let sharedEnvelopeRetryQueue = NostrPrivateEnvelopeRetryQueue(
+        sendPrivateEnvelopeBatch: { events, terminalFailure in
+            NostrRelayManager.shared.sendPrivateEnvelopeBatch(
+                events,
+                terminalFailure: terminalFailure
+            )
+        },
+        registerPendingPrivateEnvelope: {
+            NostrRelayManager.registerPendingPrivateEnvelope(id: $0)
+        },
+        scheduleAfter: { delay, action in
+            DispatchQueue.main.asyncAfter(deadline: .now() + delay, execute: action)
+        }
+    )
+
+    @MainActor
+    static func resetControlRetriesForPanicWipe() {
+        sharedEnvelopeRetryQueue.removeAll()
+    }
+
+    private enum PrivateEnvelopeFailurePolicy {
+        case userMessage(messageID: String)
+        case retry(retryKey: String)
+    }
+
     private let dependencies: Dependencies
+    private let envelopeRetryQueue: NostrPrivateEnvelopeRetryQueue
     private var favoriteStatusObserver: NSObjectProtocol?
 
     // Reachability Cache (thread-safe)
@@ -145,7 +195,9 @@ final class NostrTransport: Transport, @unchecked Sendable {
         idBridge: NostrIdentityBridge,
         dependencies: Dependencies? = nil
     ) {
-        self.dependencies = dependencies ?? .live(idBridge: idBridge)
+        let resolvedDependencies = dependencies ?? .live(idBridge: idBridge)
+        self.dependencies = resolvedDependencies
+        self.envelopeRetryQueue = resolvedDependencies.envelopeRetryQueue
         
         setupObservers()
         
@@ -172,6 +224,18 @@ final class NostrTransport: Transport, @unchecked Sendable {
         }
     }
 
+    #if DEBUG
+    @MainActor
+    func debugEnqueueControlRetry(key: String, events: [NostrEvent]) {
+        envelopeRetryQueue.enqueue(key: key, events: events, registerPending: false)
+    }
+
+    @MainActor
+    var debugControlRetryCount: Int {
+        envelopeRetryQueue.debugPendingCount
+    }
+    #endif
+
     private func setupObservers() {
         favoriteStatusObserver = dependencies.notificationCenter.addObserver(
             forName: .favoriteStatusChanged,
@@ -253,15 +317,49 @@ final class NostrTransport: Transport, @unchecked Sendable {
 
     func sendPrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
         Task { @MainActor in
-            guard let recipientNpub = resolveRecipientNpub(for: peerID),
-                  let recipientHex = npubToHex(recipientNpub),
-                  let senderIdentity = try? dependencies.currentIdentity() else { return }
+            let failurePolicy = PrivateEnvelopeFailurePolicy.userMessage(
+                messageID: messageID
+            )
+            guard let recipientNpub = resolveRecipientNpub(for: peerID) else {
+                handlePrivateEnvelopeFailure(
+                    events: [],
+                    registerPending: false,
+                    policy: failurePolicy
+                )
+                return
+            }
+            guard let recipientHex = npubToHex(recipientNpub) else {
+                handlePrivateEnvelopeFailure(
+                    events: [],
+                    registerPending: false,
+                    policy: failurePolicy
+                )
+                return
+            }
+            guard let senderIdentity = try? dependencies.currentIdentity() else {
+                handlePrivateEnvelopeFailure(
+                    events: [],
+                    registerPending: false,
+                    policy: failurePolicy
+                )
+                return
+            }
             SecureLogger.debug("NostrTransport: preparing PM to \(recipientNpub.prefix(16))… id=\(messageID.prefix(8))…", category: .session)
             guard let embedded = NostrEmbeddedBitChat.encodePMForNostr(content: content, messageID: messageID, recipientPeerID: peerID, senderPeerID: senderPeerID) else {
                 SecureLogger.error("NostrTransport: failed to embed PM packet", category: .session)
+                handlePrivateEnvelopeFailure(
+                    events: [],
+                    registerPending: false,
+                    policy: failurePolicy
+                )
                 return
             }
-            sendWrappedMessage(content: embedded, recipientHex: recipientHex, senderIdentity: senderIdentity)
+            sendPrivateEnvelope(
+                content: embedded,
+                recipientHex: recipientHex,
+                senderIdentity: senderIdentity,
+                failurePolicy: failurePolicy
+            )
         }
     }
 
@@ -287,7 +385,14 @@ final class NostrTransport: Transport, @unchecked Sendable {
                 SecureLogger.error("NostrTransport: failed to embed favorite notification", category: .session)
                 return
             }
-            sendWrappedMessage(content: embedded, recipientHex: recipientHex, senderIdentity: senderIdentity)
+            sendPrivateEnvelope(
+                content: embedded,
+                recipientHex: recipientHex,
+                senderIdentity: senderIdentity,
+                failurePolicy: .retry(
+                    retryKey: privateEnvelopeRetryKey(content: embedded, recipientHex: recipientHex)
+                )
+            )
         }
     }
 
@@ -311,16 +416,48 @@ extension NostrTransport {
     }
 
     // MARK: Geohash DMs (per-geohash identity)
-    func sendPrivateMessageGeohash(content: String, toRecipientHex recipientHex: String, from identity: NostrIdentity, messageID: String) {
-        Task { @MainActor in
-            guard !recipientHex.isEmpty else { return }
-            SecureLogger.debug("GeoDM: send PM mid=\(messageID.prefix(8))…", category: .session)
-            guard let embedded = NostrEmbeddedBitChat.encodePMForNostrNoRecipient(content: content, messageID: messageID, senderPeerID: senderPeerID) else {
-                SecureLogger.error("NostrTransport: failed to embed geohash PM packet", category: .session)
-                return
-            }
-            sendWrappedMessage(content: embedded, recipientHex: recipientHex, senderIdentity: identity, registerPending: true)
+    /// Returns true only when the complete migration pair entered the relay
+    /// delivery queue. GeoDM callers use this synchronous admission result
+    /// before showing "sent"; deterministic packet/envelope failures must not
+    /// be hidden behind an unobserved MainActor task.
+    @MainActor
+    @discardableResult
+    func sendPrivateMessageGeohash(
+        content: String,
+        toRecipientHex recipientHex: String,
+        from identity: NostrIdentity,
+        messageID: String
+    ) -> Bool {
+        let failurePolicy = PrivateEnvelopeFailurePolicy.userMessage(messageID: messageID)
+        guard !recipientHex.isEmpty else {
+            handlePrivateEnvelopeFailure(
+                events: [],
+                registerPending: false,
+                policy: failurePolicy
+            )
+            return false
         }
+        SecureLogger.debug("GeoDM: send PM mid=\(messageID.prefix(8))…", category: .session)
+        guard let embedded = NostrEmbeddedBitChat.encodePMForNostrNoRecipient(
+            content: content,
+            messageID: messageID,
+            senderPeerID: senderPeerID
+        ) else {
+            SecureLogger.error("NostrTransport: failed to embed geohash PM packet", category: .session)
+            handlePrivateEnvelopeFailure(
+                events: [],
+                registerPending: false,
+                policy: failurePolicy
+            )
+            return false
+        }
+        return sendPrivateEnvelope(
+            content: embedded,
+            recipientHex: recipientHex,
+            senderIdentity: identity,
+            registerPending: true,
+            failurePolicy: failurePolicy
+        )
     }
 }
 
@@ -340,17 +477,112 @@ extension NostrTransport {
         }
     }
 
-    /// Creates and sends a gift-wrapped private message event
+    /// Creates and sends a BitChat private-envelope event over Nostr.
     @MainActor
-    private func sendWrappedMessage(content: String, recipientHex: String, senderIdentity: NostrIdentity, registerPending: Bool = false) {
-        guard let event = try? NostrProtocol.createPrivateMessage(content: content, recipientPubkey: recipientHex, senderIdentity: senderIdentity) else {
-            SecureLogger.error("NostrTransport: failed to build Nostr event", category: .session)
-            return
+    @discardableResult
+    private func sendPrivateEnvelope(
+        content: String,
+        recipientHex: String,
+        senderIdentity: NostrIdentity,
+        registerPending: Bool = false,
+        failurePolicy: PrivateEnvelopeFailurePolicy
+    ) -> Bool {
+        let events: [NostrEvent]
+        do {
+            events = try NostrProtocol.createPrivateEnvelopePublicationBatch(
+                content: content,
+                recipientPubkey: recipientHex,
+                senderIdentity: senderIdentity
+            )
+        } catch {
+            SecureLogger.error(
+                "NostrTransport: failed to build Nostr private-envelope batch: \(error)",
+                category: .session
+            )
+            // Construction failures are deterministic. User-authored messages
+            // must become visibly failed; control payloads have no valid event
+            // pair to retain and retry.
+            handlePrivateEnvelopeFailure(
+                events: [],
+                registerPending: false,
+                policy: failurePolicy
+            )
+            return false
         }
-        if registerPending {
-            dependencies.registerPendingGiftWrap(event.id)
+        let accepted = dependencies.sendPrivateEnvelopeBatch(events) { [self] in
+            handlePrivateEnvelopeFailure(
+                events: events,
+                registerPending: registerPending,
+                policy: failurePolicy
+            )
+        }
+        guard accepted else {
+            SecureLogger.error(
+                "NostrTransport: private-envelope migration pair was not accepted for relay delivery",
+                category: .session
+            )
+            handlePrivateEnvelopeFailure(
+                events: events,
+                registerPending: registerPending,
+                policy: failurePolicy
+            )
+            return false
+        }
+        registerPendingPrivateEnvelopesIfNeeded(events, registerPending: registerPending)
+        return true
+    }
+
+    @MainActor
+    private func handlePrivateEnvelopeFailure(
+        events: [NostrEvent],
+        registerPending: Bool,
+        policy: PrivateEnvelopeFailurePolicy
+    ) {
+        switch policy {
+        case .userMessage(let messageID):
+            deliverTransportEvent(.messageDeliveryStatusUpdated(
+                messageID: messageID,
+                status: .failed(reason: String(
+                    localized: "content.delivery.reason.not_delivered",
+                    comment: "Failure reason shown when a private message could not enter the relay delivery queue"
+                ))
+            ))
+        case .retry(let retryKey):
+            // A deterministic packet/envelope construction failure has no
+            // events to retry. Only relay admission/delivery failures reach
+            // this branch with the complete atomic pair.
+            guard !events.isEmpty else { return }
+            envelopeRetryQueue.enqueue(
+                key: retryKey,
+                events: events,
+                registerPending: registerPending
+            )
+        }
+    }
+
+    @MainActor
+    private func registerPendingPrivateEnvelopesIfNeeded(
+        _ events: [NostrEvent],
+        registerPending: Bool
+    ) {
+        guard registerPending else { return }
+        for event in events {
+            dependencies.registerPendingPrivateEnvelope(event.id)
+        }
+    }
+
+    @MainActor
+    private func privateEnvelopeRetryKey(content: String, recipientHex: String) -> String {
+        "\(recipientHex.lowercased()):\(Data(content.utf8).sha256Fingerprint())"
+    }
+
+    @MainActor
+    private func deliverTransportEvent(_ event: TransportEvent) {
+        if let eventDelegate {
+            eventDelegate.didReceiveTransportEvent(event)
+        } else {
+            delegate?.receiveTransportEvent(event)
         }
-        dependencies.sendEvent(event)
     }
 
 
@@ -367,7 +599,14 @@ extension NostrTransport {
                     SecureLogger.error("NostrTransport: failed to embed READ ack", category: .session)
                     return
                 }
-                sendWrappedMessage(content: ack, recipientHex: recipientHex, senderIdentity: senderIdentity)
+                sendPrivateEnvelope(
+                    content: ack,
+                    recipientHex: recipientHex,
+                    senderIdentity: senderIdentity,
+                    failurePolicy: .retry(
+                        retryKey: privateEnvelopeRetryKey(content: ack, recipientHex: recipientHex)
+                    )
+                )
 
             case .deliveredDirect(let messageID, let peerID):
                 guard let recipientNpub = resolveRecipientNpub(for: peerID),
@@ -378,17 +617,40 @@ extension NostrTransport {
                     SecureLogger.error("NostrTransport: failed to embed DELIVERED ack", category: .session)
                     return
                 }
-                sendWrappedMessage(content: ack, recipientHex: recipientHex, senderIdentity: senderIdentity)
+                sendPrivateEnvelope(
+                    content: ack,
+                    recipientHex: recipientHex,
+                    senderIdentity: senderIdentity,
+                    failurePolicy: .retry(
+                        retryKey: privateEnvelopeRetryKey(content: ack, recipientHex: recipientHex)
+                    )
+                )
 
             case .deliveredGeohash(let messageID, let recipientHex, let identity):
                 SecureLogger.debug("GeoDM: send DELIVERED mid=\(messageID.prefix(8))…", category: .session)
                 guard let embedded = NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(type: .delivered, messageID: messageID, senderPeerID: senderPeerID) else { return }
-                sendWrappedMessage(content: embedded, recipientHex: recipientHex, senderIdentity: identity, registerPending: true)
+                sendPrivateEnvelope(
+                    content: embedded,
+                    recipientHex: recipientHex,
+                    senderIdentity: identity,
+                    registerPending: true,
+                    failurePolicy: .retry(
+                        retryKey: privateEnvelopeRetryKey(content: embedded, recipientHex: recipientHex)
+                    )
+                )
 
             case .readGeohash(let messageID, let recipientHex, let identity):
                 SecureLogger.debug("GeoDM: send READ mid=\(messageID.prefix(8))…", category: .session)
                 guard let embedded = NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(type: .readReceipt, messageID: messageID, senderPeerID: senderPeerID) else { return }
-                sendWrappedMessage(content: embedded, recipientHex: recipientHex, senderIdentity: identity, registerPending: true)
+                sendPrivateEnvelope(
+                    content: embedded,
+                    recipientHex: recipientHex,
+                    senderIdentity: identity,
+                    registerPending: true,
+                    failurePolicy: .retry(
+                        retryKey: privateEnvelopeRetryKey(content: embedded, recipientHex: recipientHex)
+                    )
+                )
             }
         }
     }
@@ -408,3 +670,122 @@ extension NostrTransport {
         return nil
     }
 }
+
+/// Bounded retry owner for non-user private control payloads. It is separate
+/// from `NostrTransport` so a scheduled retry from a short-lived geohash
+/// transport remains valid after that transport deinitializes. Scheduler
+/// callbacks retain this queue, never the transport; an evicted key simply
+/// becomes a harmless no-op when its already-scheduled callback fires.
+@MainActor
+final class NostrPrivateEnvelopeRetryQueue {
+    private struct PendingRetry {
+        let events: [NostrEvent]
+        let registerPending: Bool
+        var attempt: Int
+        var isScheduled: Bool
+    }
+
+    private let sendPrivateEnvelopeBatch: @MainActor (
+        [NostrEvent],
+        @escaping @MainActor () -> Void
+    ) -> Bool
+    private let registerPendingPrivateEnvelope: @MainActor (String) -> Void
+    private let scheduleAfter: @Sendable (
+        TimeInterval,
+        @escaping @Sendable () -> Void
+    ) -> Void
+    private var pending: [String: PendingRetry] = [:]
+    private var insertionOrder: [String] = []
+
+    init(
+        sendPrivateEnvelopeBatch: @escaping @MainActor (
+            [NostrEvent],
+            @escaping @MainActor () -> Void
+        ) -> Bool,
+        registerPendingPrivateEnvelope: @escaping @MainActor (String) -> Void,
+        scheduleAfter: @escaping @Sendable (
+            TimeInterval,
+            @escaping @Sendable () -> Void
+        ) -> Void
+    ) {
+        self.sendPrivateEnvelopeBatch = sendPrivateEnvelopeBatch
+        self.registerPendingPrivateEnvelope = registerPendingPrivateEnvelope
+        self.scheduleAfter = scheduleAfter
+    }
+
+    func enqueue(key: String, events: [NostrEvent], registerPending: Bool) {
+        guard pending[key] == nil else { return }
+        if pending.count >= TransportConfig.nostrPrivateEnvelopeRetryQueueCap,
+           let evictedKey = insertionOrder.first {
+            insertionOrder.removeFirst()
+            pending.removeValue(forKey: evictedKey)
+            // These are control payloads, never user-authored messages. Keep
+            // the bounded-loss decision explicit rather than silently growing
+            // memory during a prolonged outage.
+            SecureLogger.warning(
+                "📮 Private control retry queue full — evicted oldest whole migration pair",
+                category: .session
+            )
+        }
+        pending[key] = PendingRetry(
+            events: events,
+            registerPending: registerPending,
+            attempt: 0,
+            isScheduled: false
+        )
+        insertionOrder.append(key)
+        schedule(key: key)
+    }
+
+    private func schedule(key: String) {
+        guard var item = pending[key], !item.isScheduled else { return }
+        item.isScheduled = true
+        pending[key] = item
+        let exponent = min(item.attempt, 5)
+        let delay = min(2.0 * pow(2.0, Double(exponent)), 60.0)
+        scheduleAfter(delay) { [self] in
+            Task { @MainActor [self] in
+                self.retry(key: key)
+            }
+        }
+    }
+
+    private func retry(key: String) {
+        guard var item = pending[key] else { return }
+        item.isScheduled = false
+        pending[key] = item
+
+        let accepted = sendPrivateEnvelopeBatch(item.events) { [self] in
+            self.enqueue(
+                key: key,
+                events: item.events,
+                registerPending: item.registerPending
+            )
+        }
+        if accepted {
+            remove(key: key)
+            if item.registerPending {
+                for event in item.events {
+                    registerPendingPrivateEnvelope(event.id)
+                }
+            }
+        } else {
+            item.attempt += 1
+            pending[key] = item
+            schedule(key: key)
+        }
+    }
+
+    private func remove(key: String) {
+        pending.removeValue(forKey: key)
+        insertionOrder.removeAll { $0 == key }
+    }
+
+    func removeAll() {
+        pending.removeAll()
+        insertionOrder.removeAll()
+    }
+
+    var debugPendingCount: Int { pending.count }
+    func debugContains(key: String) -> Bool { pending[key] != nil }
+}

bitchat/Services/SharedContentHandoff.swift

@@ -1,212 +0,0 @@
-import Foundation
-
-enum SharedContentKind: String, Codable, Sendable, Equatable {
-    case text
-    case url
-}
-
-/// The single, bounded payload handed from the share extension to the app.
-///
-/// The app-group store intentionally contains at most one envelope. A newer
-/// share replaces an older one, which prevents unbounded shared-container
-/// growth while still surviving suspension and a later app launch.
-struct SharedContentPayload: Codable, Sendable, Equatable, Identifiable {
-    static let currentVersion = 1
-    static let maxContentBytes = 16_000
-    static let maxTitleBytes = 512
-    static let maxEnvelopeBytes = 24_000
-    static let retentionSeconds: TimeInterval = 24 * 60 * 60
-    static let allowedFutureSkewSeconds: TimeInterval = 5 * 60
-
-    let version: Int
-    let id: UUID
-    let kind: SharedContentKind
-    let content: String
-    let title: String?
-    let createdAt: Date
-
-    init(
-        version: Int = Self.currentVersion,
-        id: UUID = UUID(),
-        kind: SharedContentKind,
-        content: String,
-        title: String? = nil,
-        createdAt: Date = Date()
-    ) {
-        self.version = version
-        self.id = id
-        self.kind = kind
-        self.content = content
-        self.title = title
-        self.createdAt = createdAt
-    }
-
-    static func text(_ content: String, createdAt: Date = Date()) -> SharedContentPayload {
-        SharedContentPayload(kind: .text, content: content, createdAt: createdAt)
-    }
-
-    var composerText: String { content }
-
-    var preview: String {
-        let normalized = content
-            .replacingOccurrences(of: "\r\n", with: "\n")
-            .replacingOccurrences(of: "\r", with: "\n")
-        guard normalized.count > 240 else { return normalized }
-        return String(normalized.prefix(240)) + "…"
-    }
-
-    func validate(now: Date = Date()) throws {
-        guard version == Self.currentVersion else {
-            throw SharedContentHandoffError.unsupportedVersion
-        }
-
-        let trimmed = content.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !trimmed.isEmpty else {
-            throw SharedContentHandoffError.emptyContent
-        }
-        guard content.utf8.count <= Self.maxContentBytes else {
-            throw SharedContentHandoffError.contentTooLarge
-        }
-        if let title {
-            guard title.utf8.count <= Self.maxTitleBytes else {
-                throw SharedContentHandoffError.titleTooLarge
-            }
-            guard !Self.containsDisallowedControl(in: title, allowsTextLayout: false) else {
-                throw SharedContentHandoffError.invalidCharacters
-            }
-        }
-
-        let age = now.timeIntervalSince(createdAt)
-        guard age >= -Self.allowedFutureSkewSeconds,
-              age <= Self.retentionSeconds else {
-            throw SharedContentHandoffError.expired
-        }
-
-        switch kind {
-        case .text:
-            guard !Self.containsDisallowedControl(in: content, allowsTextLayout: true) else {
-                throw SharedContentHandoffError.invalidCharacters
-            }
-        case .url:
-            guard !Self.containsDisallowedControl(in: content, allowsTextLayout: false),
-                  let components = URLComponents(string: content),
-                  let scheme = components.scheme?.lowercased(),
-                  scheme == "http" || scheme == "https",
-                  components.host?.isEmpty == false else {
-                throw SharedContentHandoffError.unsupportedURL
-            }
-        }
-    }
-
-    private static func containsDisallowedControl(
-        in value: String,
-        allowsTextLayout: Bool
-    ) -> Bool {
-        value.unicodeScalars.contains { scalar in
-            guard CharacterSet.controlCharacters.contains(scalar) else { return false }
-            if allowsTextLayout, scalar == "\n" || scalar == "\r" || scalar == "\t" {
-                return false
-            }
-            return true
-        }
-    }
-}
-
-enum SharedContentHandoffError: Error, Equatable {
-    case unsupportedVersion
-    case emptyContent
-    case contentTooLarge
-    case titleTooLarge
-    case invalidCharacters
-    case expired
-    case unsupportedURL
-    case envelopeTooLarge
-    case encodingFailed
-}
-
-/// Durable, single-item app-group storage used by both the extension and app.
-final class SharedContentStore {
-    static let storageKey = "sharedContentEnvelopeV1"
-
-    private static let legacyKeys = [
-        "sharedContent",
-        "sharedContentType",
-        "sharedContentDate"
-    ]
-
-    private let defaults: UserDefaults
-    private let encoder: JSONEncoder
-    private let decoder: JSONDecoder
-
-    init(defaults: UserDefaults) {
-        self.defaults = defaults
-        self.encoder = JSONEncoder()
-        self.decoder = JSONDecoder()
-    }
-
-    /// Replaces any older pending share with a validated, bounded envelope.
-    func stage(_ payload: SharedContentPayload, now: Date = Date()) throws {
-        try payload.validate(now: now)
-        guard let encoded = try? encoder.encode(payload) else {
-            throw SharedContentHandoffError.encodingFailed
-        }
-        guard encoded.count <= SharedContentPayload.maxEnvelopeBytes else {
-            throw SharedContentHandoffError.envelopeTooLarge
-        }
-
-        defaults.set(encoded, forKey: Self.storageKey)
-        clearLegacyKeys()
-    }
-
-    /// Reads the pending share without consuming it. Invalid and expired data
-    /// is removed immediately so malformed app-group state cannot linger.
-    func pending(now: Date = Date()) -> SharedContentPayload? {
-        clearLegacyKeys()
-
-        guard let encoded = defaults.data(forKey: Self.storageKey) else { return nil }
-        guard encoded.count <= SharedContentPayload.maxEnvelopeBytes,
-              let payload = try? decoder.decode(SharedContentPayload.self, from: encoded) else {
-            defaults.removeObject(forKey: Self.storageKey)
-            return nil
-        }
-
-        do {
-            try payload.validate(now: now)
-            return payload
-        } catch {
-            defaults.removeObject(forKey: Self.storageKey)
-            return nil
-        }
-    }
-
-    /// Consumes only the envelope the user actually reviewed. If a newer share
-    /// already replaced it, the newer content remains pending.
-    func consume(id: UUID, now: Date = Date()) -> SharedContentPayload? {
-        guard let payload = pending(now: now), payload.id == id else { return nil }
-        defaults.removeObject(forKey: Self.storageKey)
-        return payload
-    }
-
-    /// Explicit cancellation has the same identity guard as consumption so it
-    /// can never discard a newer share that arrived while a prompt was open.
-    func discard(id: UUID) {
-        guard let encoded = defaults.data(forKey: Self.storageKey),
-              encoded.count <= SharedContentPayload.maxEnvelopeBytes,
-              let payload = try? decoder.decode(SharedContentPayload.self, from: encoded),
-              payload.id == id else {
-            return
-        }
-        defaults.removeObject(forKey: Self.storageKey)
-    }
-
-    func discardAll() {
-        defaults.removeObject(forKey: Self.storageKey)
-        clearLegacyKeys()
-    }
-
-    private func clearLegacyKeys() {
-        for key in Self.legacyKeys {
-            defaults.removeObject(forKey: key)
-        }
-    }
-}

bitchat/Services/TransferProgressManager.swift

@@ -11,6 +11,7 @@ final class TransferProgressManager {
         case updated(id: String, sentFragments: Int, totalFragments: Int)
         case completed(id: String, totalFragments: Int)
         case cancelled(id: String, sentFragments: Int, totalFragments: Int)
+        case rejected(id: String, reason: String)
     }
 
     private let subject = PassthroughSubject<Event, Never>()
@@ -49,6 +50,17 @@ final class TransferProgressManager {
         }
     }
 
+    /// Fails a preflight check while keeping the outgoing placeholder visible
+    /// with an actionable reason instead of treating policy/size rejection as
+    /// a user cancellation.
+    func rejectBeforeStart(id: String, reason: String) {
+        queue.async(flags: .barrier) { [weak self] in
+            guard let self = self else { return }
+            self.states.removeValue(forKey: id)
+            self.subject.send(.rejected(id: id, reason: reason))
+        }
+    }
+
     func snapshot(id: String) -> (sent: Int, total: Int)? {
         var result: (sent: Int, total: Int)?
         queue.sync {

bitchat/Services/Transport.swift

@@ -83,10 +83,44 @@ enum TransportEvent: @unchecked Sendable {
     case bluetoothStateUpdated(CBManagerState)
 }
 
+/// Downgrade-safe decision for a private-media recipient. Callers ask before
+/// prompting, and BLEService checks again when it consumes any one-shot
+/// legacy consent.
+enum PrivateMediaSendPolicy: Equatable {
+    case encrypted
+    /// A public announce hinted at encrypted media (or a prior authenticated
+    /// pin exists), but this exact Noise session has not yet supplied its
+    /// authenticated peer-state proof. Callers wait boundedly; they must not
+    /// pre-queue encrypted bytes or silently select the legacy path.
+    case awaitingCapabilityProof
+    case legacyRequiresConsent
+    case blockedDowngrade
+}
+
+/// Receiver-only persistence surface for explicit private-media deletion.
+/// Kept separate from `Transport` so sender retry branches can rebase without
+/// inheriting or implementing receiver storage concerns.
+protocol PrivateMediaDeletionPersisting: AnyObject {
+    @MainActor
+    func persistDeletedPrivateMedia(
+        messageIDs: [String],
+        payloadRelativePaths: [String: String],
+        protectedPayloadRelativePaths: Set<String>,
+        completion: @escaping @MainActor (Bool) -> Void
+    )
+}
+
 protocol TransportEventDelegate: AnyObject {
     @MainActor func didReceiveTransportEvent(_ event: TransportEvent)
 }
 
+/// Optional typed-event contract for sinks that can synchronously decide
+/// whether an inbound message was accepted.
+protocol SynchronousMessageTransportEventDelegate: TransportEventDelegate {
+    @MainActor
+    func didReceiveTransportMessageSynchronously(_ message: BitchatMessage) -> Bool
+}
+
 protocol Transport: AnyObject {
     // Event sink
     var delegate: BitchatDelegate? { get set }
@@ -163,6 +197,20 @@ protocol Transport: AnyObject {
     func sendDeliveryAck(for messageID: String, to peerID: PeerID)
     func sendFileBroadcast(_ packet: BitchatFilePacket, transferId: String)
     func sendFilePrivate(_ packet: BitchatFilePacket, to peerID: PeerID, transferId: String)
+    func sendFilePrivate(
+        _ packet: BitchatFilePacket,
+        to peerID: PeerID,
+        transferId: String,
+        allowLegacyFallback: Bool
+    )
+    /// Automatic whole-file retry is admitted only while this exact Noise
+    /// generation authenticates bit 9. It must never queue across a session
+    /// replacement or enter the signed raw legacy path.
+    func sendFilePrivateReceiptRetry(
+        _ packet: BitchatFilePacket,
+        to peerID: PeerID,
+        transferId: String
+    )
     func cancelTransfer(_ transferId: String)
 
     // Live voice / push-to-talk (mesh transports only): one encoded
@@ -208,6 +256,16 @@ protocol Transport: AnyObject {
     /// Capabilities the peer advertised in its last verified announce;
     /// empty for peers that predate the capabilities TLV.
     func peerCapabilities(_ peerID: PeerID) -> PeerCapabilities
+    func privateMediaSendPolicy(to peerID: PeerID) -> PrivateMediaSendPolicy
+    /// The exact current Noise generation that authenticated both encrypted
+    /// private media (bit 8) and durable receipts/retry (bit 9).
+    func authenticatedPrivateMediaReceiptSessionGeneration(
+        to peerID: PeerID
+    ) -> UUID?
+    func resolvePrivateMediaSendPolicy(
+        to peerID: PeerID,
+        completion: @escaping @MainActor (PrivateMediaSendPolicy) -> Void
+    )
     /// Sends an encoded vouch-attestation batch inside the Noise session.
     func sendVouchAttestations(_ payload: Data, to peerID: PeerID)
     /// Appends a peer-authenticated observer. Unlike
@@ -278,6 +336,21 @@ extension Transport {
     func sendGroupKeyUpdate(_ statePayload: Data, to peerID: PeerID) {}
     func broadcastGroupMessage(_ envelope: Data) {}
     func peerCapabilities(_ peerID: PeerID) -> PeerCapabilities { [] }
+    func privateMediaSendPolicy(to peerID: PeerID) -> PrivateMediaSendPolicy { .blockedDowngrade }
+    func authenticatedPrivateMediaReceiptSessionGeneration(
+        to peerID: PeerID
+    ) -> UUID? {
+        nil
+    }
+    func resolvePrivateMediaSendPolicy(
+        to peerID: PeerID,
+        completion: @escaping @MainActor (PrivateMediaSendPolicy) -> Void
+    ) {
+        let policy = privateMediaSendPolicy(to: peerID)
+        Task { @MainActor in
+            completion(policy == .awaitingCapabilityProof ? .blockedDowngrade : policy)
+        }
+    }
     func sendVouchAttestations(_ payload: Data, to peerID: PeerID) {}
     func addPeerAuthenticatedObserver(_ handler: @escaping (PeerID, String) -> Void) {}
     func sendCourierMessage(_ content: String, messageID: String, recipientNoiseKey: Data, via couriers: [PeerID]) -> Bool { false }
@@ -294,6 +367,20 @@ extension Transport {
     func currentMeshTopology() -> MeshTopologySnapshot? { nil }
     func sendFileBroadcast(_ packet: BitchatFilePacket, transferId: String) {}
     func sendFilePrivate(_ packet: BitchatFilePacket, to peerID: PeerID, transferId: String) {}
+    func sendFilePrivate(
+        _ packet: BitchatFilePacket,
+        to peerID: PeerID,
+        transferId: String,
+        allowLegacyFallback: Bool
+    ) {
+        guard !allowLegacyFallback else { return }
+        sendFilePrivate(packet, to: peerID, transferId: transferId)
+    }
+    func sendFilePrivateReceiptRetry(
+        _ packet: BitchatFilePacket,
+        to peerID: PeerID,
+        transferId: String
+    ) {}
     func cancelTransfer(_ transferId: String) {}
 
     func sendMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date) {

bitchat/Services/TransportConfig.swift

@@ -9,6 +9,19 @@ enum TransportConfig {
     static let bleMaxInFlightAssemblies: Int = 128          // Cap concurrent fragment assemblies
     static let bleHighDegreeThreshold: Int = 6              // For adaptive TTL/probabilistic relays
     static let bleMaxConcurrentTransfers: Int = 2           // Limit simultaneous large media sends
+    // Bounded wait for the session-authenticated capability proof used by
+    // private-media migration. Expiry never auto-sends clear bytes; it only
+    // resolves to the existing one-shot consent or downgrade-blocked path.
+    static let privateMediaCapabilityProofTimeoutSeconds: TimeInterval = 5
+    static let privateMediaCapabilityProofPendingPeerCap: Int = 64
+    static let privateMediaCapabilityProofWaitersPerPeerCap: Int = 16
+    /// Accepted private-media receipts and explicit-deletion tombstones each
+    /// receive this independent capacity.
+    static let privateMediaReceivedLedgerCapacity: Int = 4_096
+    /// A bounded retry horizon prevents stable receipt state from growing into
+    /// permanent application history.
+    static let privateMediaReceivedLedgerTTLSeconds: TimeInterval =
+        7 * 24 * 60 * 60
     static let bleFragmentRelayMinDelayMs: Int = 8          // Faster forwarding for media fragments
     static let bleFragmentRelayMaxDelayMs: Int = 25         // Upper jitter bound for fragment relays
     // Fragment relay TTL in sparse graphs; matches messageTTLDefault so media
@@ -46,6 +59,7 @@ enum TransportConfig {
     static let privateChatCap: Int = 1337
     static let meshTimelineCap: Int = 1337
     static let geoTimelineCap: Int = 1337
+    static let geoNicknameParticipantsCap: Int = 1337
     static let contentLRUCap: Int = 2000
     static let geoSamplingEventLRUCap: Int = 2000
 
@@ -81,6 +95,11 @@ enum TransportConfig {
     static let nostrDuplicateEventLogInterval: Int = 50
     // Sample interval for per-event debug logs on the inbound hot path.
     static let nostrInboundEventLogInterval: Int = 100
+    // Reject oversized/untrusted relay frames before JSON parse / store.
+    static let nostrMaxInboundMessageBytes: Int = 256 * 1024
+    static let nostrMaxEventTags: Int = 64
+    static let nostrMaxEventTagValues: Int = 16
+    static let nostrMaxEventTagValueBytes: Int = 1024
 
     // Conversation store diagnostics (field observability)
     // Sample interval for the periodic store-audit "OK" heartbeat line
@@ -98,11 +117,16 @@ enum TransportConfig {
     static let uiSenderRateBucketRefillPerSec: Double = 1.0
     static let uiContentRateBucketCapacity: Double = 3
     static let uiContentRateBucketRefillPerSec: Double = 0.5
+    // Bound attacker-keyed bucket maps (sender IDs / content digests).
+    static let uiSenderRateBucketMaxEntries: Int = 2000
+    static let uiContentRateBucketMaxEntries: Int = 2000
+    static let uiRateBucketIdleTTL: TimeInterval = 10 * 60
+    // Cap teleported-participant markers so remote events cannot grow the set.
+    static let geoTeleportedParticipantsCap: Int = 1337
 
     // UI sleeps/delays
     static let uiStartupInitialDelaySeconds: TimeInterval = 1.0
     static let uiStartupPhaseDurationSeconds: TimeInterval = 2.0
-    static let uiAsyncShortSleepNs: UInt64 = 100_000_000
     static let uiReadReceiptRetryShortSeconds: TimeInterval = 0.1
     static let uiReadReceiptRetryLongSeconds: TimeInterval = 0.5
     static let uiBatchDispatchStaggerSeconds: TimeInterval = 0.15
@@ -171,7 +195,22 @@ enum TransportConfig {
     static let nostrGeoRelayCount: Int = 5
     static let nostrGeohashSampleLookbackSeconds: TimeInterval = 300
     static let nostrGeohashSampleLimit: Int = 100
-    static let nostrDMSubscribeLookbackSeconds: TimeInterval = 86400
+    /// New iOS public-envelope timestamps are deliberately shifted into the
+    /// past for privacy and relay compatibility.
+    static let nostrPrivateEnvelopeTimestampFuzzSeconds: TimeInterval = 15 * 60
+    /// Deployed Android clients can shift legacy kind-1059 timestamps by the
+    /// full preceding 48 hours.
+    static let nostrLegacyAndroidTimestampFuzzSeconds: TimeInterval = 48 * 60 * 60
+    /// Private mail remains eligible for delivery for the same 24-hour window
+    /// as the persistent sender outbox. The relay query must add timestamp
+    /// randomization to that window rather than replacing it: an Android event
+    /// sent at t0 can legitimately be stamped t0-48h and fetched at t0+24h.
+    static let nostrPrivateEnvelopeDeliveryWindowSeconds: TimeInterval = 24 * 60 * 60
+    static let nostrDMSubscribeClockSkewSeconds: TimeInterval = 15 * 60
+    static let nostrDMSubscribeLookbackSeconds: TimeInterval =
+        nostrPrivateEnvelopeDeliveryWindowSeconds
+        + nostrLegacyAndroidTimestampFuzzSeconds
+        + nostrDMSubscribeClockSkewSeconds
     // A sampled chat message this recent means "a conversation is happening
     // there" for the empty-timeline nearby-activity hint.
     static let uiGeohashChatActivityWindowSeconds: TimeInterval = 900
@@ -199,11 +238,20 @@ enum TransportConfig {
     // Reconnect delays get ±20% random jitter so relays that dropped together
     // (e.g. a network blip) don't thundering-herd the same reconnect instant.
     static let nostrRelayBackoffJitterRatio: Double = 0.2
-    static let nostrRelayDefaultFetchLimit: Int = 100
+    /// Migration recovery uses one independent relay filter per wire kind so
+    /// primary traffic cannot consume the legacy result budget (or vice
+    /// versa). Five hundred per kind bounds startup work while preserving a
+    /// materially deeper offline mailbox than the generic feed default.
+    static let nostrPrivateEnvelopeFetchLimitPerKind: Int = 500
     // How many consecutive Tor-readiness waits (each bounded by TorManager's
     // bootstrap deadline) to attempt before unblocking pending EOSE callers.
     static let nostrTorReadyMaxWaitAttempts: Int = 3
     static let nostrPendingSendQueueCap: Int = 200
+    /// Control-payload pairs (delivery/read acknowledgements and favorite
+    /// notifications) that could not enter the relay queue. User messages do
+    /// not use this queue: they fail visibly, while direct messages also
+    /// remain in the router outbox.
+    static let nostrPrivateEnvelopeRetryQueueCap: Int = 256
     // Sample interval for the send-queue overflow warning (first + every Nth
     // dropped event). Drops are ephemeral presence/geo traffic — log-only.
     static let nostrPendingSendDropLogInterval: Int = 10
@@ -215,7 +263,7 @@ enum TransportConfig {
     // Fallback deadline for treating a subscription's initial fetch as complete
     // when a relay never sends EOSE (generous to cover Tor circuit setup).
     static let nostrSubscriptionEOSEFallbackSeconds: TimeInterval = 10.0
-    // A bridge drop is durable only after NIP-20 OK. Relays that omit OK must
+    // A bridge drop is durable only after NIP-01 `OK`. Relays that omit `OK` must
     // not pin the router's in-flight state indefinitely.
     static let nostrConfirmedSendAckTimeoutSeconds: TimeInterval = 10.0
     // After this long, a relay marked permanently failed gets another chance.
@@ -314,6 +362,7 @@ enum TransportConfig {
 
     // Share extension
     static let uiShareExtensionDismissDelaySeconds: TimeInterval = 2.0
+    static let uiShareAcceptWindowSeconds: TimeInterval = 30.0
     static let uiMigrationCutoffSeconds: TimeInterval = 24 * 60 * 60
 
     // Gossip Sync Configuration

bitchat/Utils/AppLanguageSettings.swift

@@ -0,0 +1,40 @@
+import Foundation
+
+/// In-app override for the UI language, on top of the system per-app
+/// language. Apple resolves localization from the AppleLanguages default at
+/// process start, so a new choice takes effect on the next launch — callers
+/// surface a "restart to apply" note after changing it.
+enum AppLanguageSettings {
+    /// "" means no override: follow the device (or per-app system) language.
+    static let overrideKey = "app.languageOverride"
+    private static let appleLanguagesKey = "AppleLanguages"
+
+    /// Language codes the app ships translations for, straight from the
+    /// built bundle so this never drifts from the string catalog.
+    static var availableLanguages: [String] {
+        Bundle.main.localizations
+            .filter { $0 != "Base" }
+            .sorted { endonym(for: $0).localizedCaseInsensitiveCompare(endonym(for: $1)) == .orderedAscending }
+    }
+
+    /// The language's name in that language ("فارسی", "한국어") so every user
+    /// can find their own entry regardless of the current UI language.
+    static func endonym(for code: String) -> String {
+        let locale = Locale(identifier: code)
+        let name = locale.localizedString(forIdentifier: code) ?? code
+        return name.lowercased(with: locale)
+    }
+
+    /// Persists the override (nil clears it). AppleLanguages drives the
+    /// actual localization lookup on next launch.
+    static func setOverride(_ code: String?) {
+        let defaults = UserDefaults.standard
+        if let code, !code.isEmpty {
+            defaults.set(code, forKey: overrideKey)
+            defaults.set([code], forKey: appleLanguagesKey)
+        } else {
+            defaults.removeObject(forKey: overrideKey)
+            defaults.removeObject(forKey: appleLanguagesKey)
+        }
+    }
+}

bitchat/ViewModels/ChatDeliveryCoordinator.swift

@@ -21,6 +21,14 @@ protocol ChatDeliveryContext: AnyObject {
     /// message is unknown or no copy changed.
     @discardableResult
     func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool
+    /// Applies an authenticated receipt only to the direct conversations
+    /// represented by the supplied peer aliases.
+    @discardableResult
+    func setDeliveryStatus(
+        _ status: DeliveryStatus,
+        forMessageID messageID: String,
+        inDirectPeerAliases peerIDs: Set<PeerID>
+    ) -> Bool
     /// Current delivery status of the message in whichever conversation holds it.
     func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus?
     /// Message IDs across all direct conversations (read-receipt pruning).
@@ -33,6 +41,12 @@ protocol ChatDeliveryContext: AnyObject {
     func notifyUIChanged()
     /// Confirms receipt so the message router stops retaining the message for resend.
     func markMessageDelivered(_ messageID: String)
+    /// Peer-bound form for authenticated remote receipts. Only the supplied
+    /// conversation aliases may have retained state terminalized.
+    func markMessageDelivered(_ messageID: String, from peerIDs: Set<PeerID>)
+    /// Returns true only when `messageID` is one of our outgoing messages in
+    /// at least one of the authenticated peer's direct-conversation aliases.
+    func isOutgoingPrivateMessage(_ messageID: String, toAny peerIDs: Set<PeerID>) -> Bool
 }
 
 extension ChatViewModel: ChatDeliveryContext {
@@ -41,6 +55,19 @@ extension ChatViewModel: ChatDeliveryContext {
         conversations.setDeliveryStatus(status, forMessageID: messageID)
     }
 
+    @discardableResult
+    func setDeliveryStatus(
+        _ status: DeliveryStatus,
+        forMessageID messageID: String,
+        inDirectPeerAliases peerIDs: Set<PeerID>
+    ) -> Bool {
+        conversations.setDeliveryStatus(
+            status,
+            forMessageID: messageID,
+            inDirectPeerAliases: peerIDs
+        )
+    }
+
     func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus? {
         conversations.deliveryStatus(forMessageID: messageID)
     }
@@ -55,6 +82,27 @@ extension ChatViewModel: ChatDeliveryContext {
 
     func markMessageDelivered(_ messageID: String) {
         messageRouter.markDelivered(messageID)
+        mediaTransferCoordinator.confirmPrivateMediaDelivery(
+            messageID: messageID
+        )
+    }
+
+    func markMessageDelivered(_ messageID: String, from peerIDs: Set<PeerID>) {
+        messageRouter.markDelivered(messageID, from: peerIDs)
+        // The caller has already bound this receipt to one of our outgoing
+        // conversations. Release the matching media retry only after that
+        // peer-scoped validation and accepted delivery-status transition.
+        mediaTransferCoordinator.confirmPrivateMediaDelivery(
+            messageID: messageID
+        )
+    }
+
+    func isOutgoingPrivateMessage(_ messageID: String, toAny peerIDs: Set<PeerID>) -> Bool {
+        peerIDs.contains { peerID in
+            privateMessages(for: peerID).contains { message in
+                message.id == messageID && message.senderPeerID == myPeerID
+            }
+        }
     }
 }
 
@@ -83,9 +131,10 @@ final class ChatDeliveryCoordinator {
 
     @MainActor
     func didReceiveReadReceipt(_ receipt: ReadReceipt) {
-        updateMessageDeliveryStatus(
+        updateAcknowledgedMessageDeliveryStatus(
             receipt.originalMessageID,
-            status: .read(by: receipt.readerNickname, at: receipt.timestamp)
+            status: .read(by: receipt.readerNickname, at: receipt.timestamp),
+            from: [receipt.readerID]
         )
     }
 
@@ -102,17 +151,47 @@ final class ChatDeliveryCoordinator {
     @MainActor
     @discardableResult
     func updateMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool {
+        guard context.setDeliveryStatus(status, forMessageID: messageID) else {
+            return false
+        }
         switch status {
         case .delivered, .read:
-            // Confirmed receipt — stop retaining the message for resend.
+            // Terminalize only after the store accepted the transition.
             context.markMessageDelivered(messageID)
         default:
             break
         }
+        context.notifyUIChanged()
+        return true
+    }
 
-        guard context.setDeliveryStatus(status, forMessageID: messageID) else {
+    /// Applies an authenticated remote delivery/read receipt only when it
+    /// belongs to one of our outgoing messages in that peer's conversation.
+    /// Retry state is cleared after, never before, the status transition is
+    /// accepted by the store.
+    @MainActor
+    @discardableResult
+    func updateAcknowledgedMessageDeliveryStatus(
+        _ messageID: String,
+        status: DeliveryStatus,
+        from peerIDAliases: Set<PeerID>
+    ) -> Bool {
+        switch status {
+        case .delivered, .read:
+            break
+        default:
             return false
         }
+        guard !peerIDAliases.isEmpty,
+              context.isOutgoingPrivateMessage(messageID, toAny: peerIDAliases),
+              context.setDeliveryStatus(
+                status,
+                forMessageID: messageID,
+                inDirectPeerAliases: peerIDAliases
+              ) else {
+            return false
+        }
+        context.markMessageDelivered(messageID, from: peerIDAliases)
         context.notifyUIChanged()
         return true
     }

bitchat/ViewModels/ChatLiveVoiceCoordinator.swift

@@ -10,6 +10,7 @@ import Foundation
 @MainActor
 protocol ChatLiveVoiceContext: AnyObject {
     var nickname: String { get }
+    var myPeerID: PeerID { get }
     var selectedPrivateChatPeer: PeerID? { get }
     /// Whether the public mesh timeline is what's on screen (autoplay gate
     /// for public bursts).
@@ -30,6 +31,12 @@ protocol ChatLiveVoiceContext: AnyObject {
     func upsertPublicMeshMessage(_ message: BitchatMessage)
     @discardableResult
     func removePrivateMessage(withID messageID: String) -> BitchatMessage?
+    /// Records and sends the finalized note's read receipt after a live
+    /// bubble adopts its wire-derivable message ID.
+    func hasSentReadReceipt(_ messageID: String) -> Bool
+    @discardableResult
+    func markReadReceiptSent(_ messageID: String) -> Bool
+    func sendMeshReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID)
     /// Removes a message from whichever conversation holds it.
     func removeMessage(withID messageID: String, cleanupFile: Bool)
     /// Publishes who is currently talking live in the public mesh channel
@@ -226,6 +233,21 @@ final class ChatLiveVoiceCoordinator {
         assemblies.values.contains { $0.messageID == message.id }
     }
 
+    /// Stop every live file handle/player before the panic media directory is
+    /// removed. This prevents an in-flight assembly from continuing to write
+    /// through an unlinked file after the wipe returns.
+    func resetForPanic() {
+        for assembly in Array(assemblies.values) {
+            cancelAssembly(assembly)
+        }
+        for player in drainingPlayers.values {
+            player.stop()
+        }
+        drainingPlayers.removeAll(keepingCapacity: false)
+        finishedBursts.removeAll(keepingCapacity: false)
+        updatePublicTalkerIndicator()
+    }
+
     /// Called for every inbound private message: when it is the finalized
     /// voice note of a burst we assembled (matched by burst ID in the file
     /// name), swap it into the existing live bubble and report `true` so the
@@ -257,8 +279,16 @@ final class ChatLiveVoiceCoordinator {
         guard let entry = finishedBursts.first(where: { matches($0.key) }) else { return false }
         let finished = entry.value
 
+        // A DM live bubble starts before the finalized file exists and
+        // therefore has a receiver-local random ID. Adopt the finalized
+        // message's deterministic ID so delivery/read ACKs address the same
+        // row as the sender's media placeholder. Public notes retain their
+        // live-bubble ID because public transfers have no private receipts.
+        let replacementID = finished.scope == .directMessage
+            ? message.id
+            : finished.messageID
         let replacement = BitchatMessage(
-            id: finished.messageID,
+            id: replacementID,
             sender: message.sender,
             content: message.content,
             timestamp: finished.messageTimestamp,
@@ -272,7 +302,31 @@ final class ChatLiveVoiceCoordinator {
         )
         switch finished.scope {
         case .directMessage:
+            // Capture read state before rekeying. The user may have read the
+            // live bubble and navigated away before the finalized .m4a lands.
+            let shouldSendAdoptedReadReceipt =
+                context.hasSentReadReceipt(finished.messageID)
+                || context.selectedPrivateChatPeer == finished.peerID
+
+            // Insert first so replacing the only row in a DM never
+            // transiently deletes its conversation, unread state, or current
+            // selection. Then remove the receiver-local live-bubble alias.
             context.upsertPrivateMessage(replacement, in: finished.peerID)
+            if replacementID != finished.messageID {
+                context.removePrivateMessage(withID: finished.messageID)
+            }
+            // The live bubble may already have emitted a receiver-local READ
+            // before the sender created its finalized media row. Re-emit once
+            // for the adopted stable ID now that the file has arrived.
+            if shouldSendAdoptedReadReceipt,
+               context.markReadReceiptSent(replacementID) {
+                let receipt = ReadReceipt(
+                    originalMessageID: replacementID,
+                    readerID: context.myPeerID,
+                    readerNickname: context.nickname
+                )
+                context.sendMeshReadReceipt(receipt, to: finished.peerID)
+            }
         case .publicMesh:
             context.upsertPublicMeshMessage(replacement)
         }

bitchat/ViewModels/ChatMessageFormatter.swift

@@ -71,12 +71,8 @@ final class ChatMessageFormatter {
             let content = message.content
             let nsContent = content as NSString
             let nsLen = nsContent.length
-            let containsCashuEarly: Bool = {
-                let regex = Patterns.quickCashuPresence
-                return regex.numberOfMatches(in: content, options: [], range: NSRange(location: 0, length: nsLen)) > 0
-            }()
 
-            if (content.count > 4000 || content.hasVeryLongToken(threshold: 1024)) && !containsCashuEarly {
+            if content.isOversizedForRichFormatting() {
                 var plainStyle = AttributeContainer()
                 plainStyle.foregroundColor = baseColor
                 plainStyle.font = isSelf

bitchat/ViewModels/ChatPeerListCoordinator.swift

@@ -100,9 +100,14 @@ final class ChatPeerListCoordinator: @unchecked Sendable {
 
     func didUpdatePeerList(_ peers: [PeerID]) {
         Task { @MainActor [weak self] in
-            self?.handlePeerListUpdate(peers)
+            self?.didUpdatePeerListSynchronously(peers)
         }
     }
+
+    @MainActor
+    func didUpdatePeerListSynchronously(_ peers: [PeerID]) {
+        handlePeerListUpdate(peers)
+    }
 }
 
 private extension ChatPeerListCoordinator {

bitchat/ViewModels/ChatPrivateConversationCoordinator.swift

@@ -85,8 +85,19 @@ protocol ChatPrivateConversationContext: AnyObject {
     func routePrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String)
     @discardableResult
     func routeReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) -> Bool
+    /// Confirms an authenticated delivery/read acknowledgement so the router
+    /// stops retaining the original private message for resend. The peer
+    /// aliases scope the removal to the authenticated sender.
+    @discardableResult
+    func markMessageDelivered(_ messageID: String, for peerIDs: [PeerID]) -> Bool
     func sendMeshReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID)
-    func sendGeohashPrivateMessage(_ content: String, toRecipientHex recipientHex: String, from identity: NostrIdentity, messageID: String)
+    @discardableResult
+    func sendGeohashPrivateMessage(
+        _ content: String,
+        toRecipientHex recipientHex: String,
+        from identity: NostrIdentity,
+        messageID: String
+    ) -> Bool
     func sendGeohashDeliveryAck(for messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
     func sendGeohashReadReceipt(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
 
@@ -166,6 +177,11 @@ extension ChatViewModel: ChatPrivateConversationContext {
         messageRouter.sendReadReceipt(receipt, to: peerID)
     }
 
+    @discardableResult
+    func markMessageDelivered(_ messageID: String, for peerIDs: [PeerID]) -> Bool {
+        messageRouter.markDelivered(messageID, for: peerIDs)
+    }
+
     func routeFavoriteNotification(to peerID: PeerID, isFavorite: Bool) {
         messageRouter.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
     }
@@ -174,7 +190,13 @@ extension ChatViewModel: ChatPrivateConversationContext {
         meshService.sendReadReceipt(receipt, to: peerID)
     }
 
-    func sendGeohashPrivateMessage(_ content: String, toRecipientHex recipientHex: String, from identity: NostrIdentity, messageID: String) {
+    @discardableResult
+    func sendGeohashPrivateMessage(
+        _ content: String,
+        toRecipientHex recipientHex: String,
+        from identity: NostrIdentity,
+        messageID: String
+    ) -> Bool {
         makeGeohashNostrTransport().sendPrivateMessageGeohash(
             content: content,
             toRecipientHex: recipientHex,
@@ -216,9 +238,16 @@ extension ChatViewModel: ChatPrivateConversationContext {
         NotificationService.shared.sendPrivateMessageNotification(from: senderName, message: message, peerID: peerID)
     }
 
-    private func makeGeohashNostrTransport() -> NostrTransport {
-        let transport = NostrTransport(keychain: keychain, idBridge: idBridge)
+    func makeGeohashNostrTransport(
+        dependencies: NostrTransport.Dependencies? = nil
+    ) -> NostrTransport {
+        let transport = NostrTransport(
+            keychain: keychain,
+            idBridge: idBridge,
+            dependencies: dependencies
+        )
         transport.senderPeerID = meshService.myPeerID
+        transport.eventDelegate = self
         return transport
     }
 }
@@ -227,7 +256,7 @@ extension ChatViewModel: ChatPrivateConversationContext {
 final class ChatPrivateConversationCoordinator {
     private unowned let context: any ChatPrivateConversationContext
 
-    // Outbox retries re-wrap the same message in fresh gift-wrap events, so
+    // Outbox retries re-envelope the same message in fresh private events, so
     // relay-level event-ID dedup can't catch them; track inbound GeoDM
     // message IDs so each copy past the first costs one (already-deduped)
     // ack check and nothing else.
@@ -250,6 +279,60 @@ final class ChatPrivateConversationCoordinator {
         return true
     }
 
+    /// Account DMs can arrive under the authenticated peer's full Noise key
+    /// while an existing mesh conversation is keyed by its derived short ID.
+    /// These are the only aliases we may safely join: the short ID is derived
+    /// directly from the authenticated key, rather than guessed from a
+    /// nickname or found by scanning unrelated chats.
+    private func accountConversationAliases(for peerID: PeerID) -> [PeerID] {
+        guard peerID.noiseKey != nil else { return [peerID] }
+        let shortPeerID = peerID.toShort()
+        return shortPeerID == peerID ? [peerID] : [peerID, shortPeerID]
+    }
+
+    /// Keeps a connected account DM on its short routing ID and an offline DM
+    /// on its stable Noise-key ID, folding the other authenticated alias into
+    /// it and handing an open sheet across without closing it.
+    private func consolidateAccountConversationAliases(for peerID: PeerID) -> PeerID {
+        let aliases = accountConversationAliases(for: peerID)
+        guard aliases.count > 1 else { return peerID }
+
+        let shortPeerID = peerID.toShort()
+        let targetPeerID = context.isPeerConnected(shortPeerID) ? shortPeerID : peerID
+        let sourcePeerIDs = aliases.filter { $0 != targetPeerID }
+
+        for sourcePeerID in sourcePeerIDs where !context.privateMessages(for: sourcePeerID).isEmpty {
+            context.migratePrivateChat(from: sourcePeerID, to: targetPeerID)
+            // ConversationStore deliberately preserves message values during a
+            // generic migration, including its destination-wins rule for
+            // duplicate IDs. Rewrite the resulting canonical copies so later
+            // read-receipt scans compare against the new routing key without
+            // replacing a newer destination value with the source snapshot.
+            let canonicalMessages = context.privateMessages(for: targetPeerID)
+            for message in canonicalMessages where message.senderPeerID == sourcePeerID {
+                context.upsertPrivateMessage(
+                    BitchatMessage(
+                        id: message.id,
+                        sender: message.sender,
+                        content: message.content,
+                        timestamp: message.timestamp,
+                        isRelay: message.isRelay,
+                        originalSender: message.originalSender,
+                        isPrivate: message.isPrivate,
+                        recipientNickname: message.recipientNickname,
+                        senderPeerID: targetPeerID,
+                        mentions: message.mentions,
+                        deliveryStatus: message.deliveryStatus,
+                        isBridged: message.isBridged
+                    ),
+                    in: targetPeerID
+                )
+            }
+        }
+        context.handOffSelectedPrivateChat(from: sourcePeerIDs, to: targetPeerID)
+        return targetPeerID
+    }
+
     func sendPrivateMessage(_ content: String, to peerID: PeerID) {
         guard !content.isEmpty else { return }
 
@@ -399,13 +482,21 @@ final class ChatPrivateConversationCoordinator {
                 "GeoDM: local send mid=\(messageID.prefix(8))… to=\(recipientHex.prefix(8))… conv=\(peerID)",
                 category: .session
             )
-            context.sendGeohashPrivateMessage(
+            let accepted = context.sendGeohashPrivateMessage(
                 content,
                 toRecipientHex: recipientHex,
                 from: identity,
                 messageID: messageID
             )
-            context.setPrivateDeliveryStatus(.sent, forMessageID: messageID, peerID: peerID)
+            let status: DeliveryStatus = accepted
+                ? .sent
+                : .failed(
+                    reason: String(
+                        localized: "content.delivery.reason.not_delivered",
+                        comment: "Failure reason shown when a private message could not enter the relay delivery queue"
+                    )
+                )
+            context.setPrivateDeliveryStatus(status, forMessageID: messageID, peerID: peerID)
         } catch {
             context.setPrivateDeliveryStatus(
                 .failed(
@@ -464,6 +555,8 @@ final class ChatPrivateConversationCoordinator {
             return
         }
 
+        let conversationPeerID = consolidateAccountConversationAliases(for: convKey)
+
         if context.privateChatsContainMessage(withID: messageId) { return }
 
         let message = BitchatMessage(
@@ -474,18 +567,18 @@ final class ChatPrivateConversationCoordinator {
             isRelay: false,
             isPrivate: true,
             recipientNickname: context.nickname,
-            senderPeerID: convKey,
+            senderPeerID: conversationPeerID,
             deliveryStatus: .delivered(to: context.nickname, at: Date())
         )
 
-        context.appendPrivateMessage(message, to: convKey)
+        context.appendPrivateMessage(message, to: conversationPeerID)
 
-        let isViewing = context.selectedPrivateChatPeer == convKey
+        let isViewing = context.selectedPrivateChatPeer == conversationPeerID
         let wasReadBefore = context.sentReadReceipts.contains(messageId)
         let isRecentMessage = Date().timeIntervalSince(messageTimestamp) < 30
         let shouldMarkUnread = !wasReadBefore && !isViewing && isRecentMessage
         if shouldMarkUnread {
-            context.markPrivateChatUnread(convKey)
+            context.markPrivateChatUnread(conversationPeerID)
         }
 
         if isViewing {
@@ -493,7 +586,7 @@ final class ChatPrivateConversationCoordinator {
         }
 
         if !isViewing && shouldMarkUnread {
-            context.notifyPrivateMessage(from: senderName, message: pm.content, peerID: convKey)
+            context.notifyPrivateMessage(from: senderName, message: pm.content, peerID: conversationPeerID)
         }
 
         context.notifyUIChanged()
@@ -502,17 +595,32 @@ final class ChatPrivateConversationCoordinator {
     func handleDelivered(_ payload: NoisePayload, senderPubkey: String, convKey: PeerID) {
         guard let messageID = String(data: payload.data, encoding: .utf8) else { return }
 
-        if context.privateChat(convKey, containsMessageWithID: messageID) {
-            context.setPrivateDeliveryStatus(
+        let aliases = accountConversationAliases(for: convKey)
+        let clearedRetainedMessage = convKey.noiseKey != nil
+            ? context.markMessageDelivered(messageID, for: aliases)
+            : false
+        let hasConversationMessage = aliases.contains {
+            context.privateChat($0, containsMessageWithID: messageID)
+        }
+        if hasConversationMessage {
+            let conversationPeerID = consolidateAccountConversationAliases(for: convKey)
+            let didChange = context.setPrivateDeliveryStatus(
                 .delivered(to: context.displayNameForNostrPubkey(senderPubkey), at: Date()),
                 forMessageID: messageID,
-                peerID: convKey
+                peerID: conversationPeerID
             )
-            context.notifyUIChanged()
+            if didChange {
+                context.notifyUIChanged()
+            }
             SecureLogger.info(
                 "GeoDM: recv DELIVERED for mid=\(messageID.prefix(8))… from=\(senderPubkey.prefix(8))…",
                 category: .session
             )
+        } else if clearedRetainedMessage {
+            SecureLogger.debug(
+                "GeoDM: recv DELIVERED for cleared mid=\(messageID.prefix(8))… from=\(senderPubkey.prefix(8))…",
+                category: .session
+            )
         } else {
             // A stale ack for a message this device no longer tracks (dropped
             // outbox entry, cleared chat, or a peer re-acking after losing our
@@ -524,14 +632,29 @@ final class ChatPrivateConversationCoordinator {
     func handleReadReceipt(_ payload: NoisePayload, senderPubkey: String, convKey: PeerID) {
         guard let messageID = String(data: payload.data, encoding: .utf8) else { return }
 
-        if context.privateChat(convKey, containsMessageWithID: messageID) {
-            context.setPrivateDeliveryStatus(
+        let aliases = accountConversationAliases(for: convKey)
+        let clearedRetainedMessage = convKey.noiseKey != nil
+            ? context.markMessageDelivered(messageID, for: aliases)
+            : false
+        let hasConversationMessage = aliases.contains {
+            context.privateChat($0, containsMessageWithID: messageID)
+        }
+        if hasConversationMessage {
+            let conversationPeerID = consolidateAccountConversationAliases(for: convKey)
+            let didChange = context.setPrivateDeliveryStatus(
                 .read(by: context.displayNameForNostrPubkey(senderPubkey), at: Date()),
                 forMessageID: messageID,
-                peerID: convKey
+                peerID: conversationPeerID
             )
-            context.notifyUIChanged()
+            if didChange {
+                context.notifyUIChanged()
+            }
             SecureLogger.info("GeoDM: recv READ for mid=\(messageID.prefix(8))… from=\(senderPubkey.prefix(8))…", category: .session)
+        } else if clearedRetainedMessage {
+            SecureLogger.debug(
+                "GeoDM: recv READ for cleared mid=\(messageID.prefix(8))… from=\(senderPubkey.prefix(8))…",
+                category: .session
+            )
         } else {
             SecureLogger.warning("GeoDM: read ack for unknown mid=\(messageID.prefix(8))… conv=\(convKey)", category: .session)
         }

bitchat/ViewModels/ChatTransportEventCoordinator.swift

@@ -62,10 +62,15 @@ protocol ChatTransportEventContext: AnyObject {
     func sendMeshDeliveryAck(for messageID: String, to peerID: PeerID)
 
     // MARK: Delivery status
-    /// Applies the status to every known location of the message.
-    /// Returns `false` when no message with that ID was updated.
+    /// Applies an authenticated receipt to the message only when it belongs
+    /// to the supplied peer conversation aliases. Returns `false` for an
+    /// unknown ID, wrong peer, or rejected status transition.
     @discardableResult
-    func applyMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool
+    func applyAcknowledgedMessageDeliveryStatus(
+        _ messageID: String,
+        status: DeliveryStatus,
+        from peerIDAliases: Set<PeerID>
+    ) -> Bool
     func deliveryStatus(for messageID: String) -> DeliveryStatus?
 
     // MARK: Verification payloads
@@ -122,8 +127,16 @@ extension ChatViewModel: ChatTransportEventContext {
     }
 
     @discardableResult
-    func applyMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool {
-        deliveryCoordinator.updateMessageDeliveryStatus(messageID, status: status)
+    func applyAcknowledgedMessageDeliveryStatus(
+        _ messageID: String,
+        status: DeliveryStatus,
+        from peerIDAliases: Set<PeerID>
+    ) -> Bool {
+        deliveryCoordinator.updateAcknowledgedMessageDeliveryStatus(
+            messageID,
+            status: status,
+            from: peerIDAliases
+        )
     }
 
     func deliveryStatus(for messageID: String) -> DeliveryStatus? {
@@ -163,21 +176,20 @@ final class ChatTransportEventCoordinator {
     }
 
     func didReceiveMessage(_ message: BitchatMessage) {
-        runOnMain { context in
-            guard !context.isMessageBlocked(message) else { return }
-            guard !message.content.trimmed.isEmpty || message.isPrivate else { return }
-
-            if message.isPrivate {
-                context.handlePrivateMessage(message)
-            } else {
-                context.handlePublicMessage(message)
-            }
-
-            context.checkForMentions(message)
-            context.sendHapticFeedback(for: message)
+        runOnMain { [self] context in
+            handleReceivedMessage(message, in: context)
         }
     }
 
+    /// Typed transport events already arrive on the main actor. Handle them
+    /// synchronously so observers see the ConversationStore mutation before
+    /// the transport completes delivery.
+    @MainActor
+    @discardableResult
+    func didReceiveMessageSynchronously(_ message: BitchatMessage) -> Bool {
+        handleReceivedMessage(message, in: context)
+    }
+
     func didReceivePublicMessage(
         from peerID: PeerID,
         nickname: String,
@@ -185,28 +197,36 @@ final class ChatTransportEventCoordinator {
         timestamp: Date,
         messageID: String?
     ) {
-        runOnMain { context in
-            let normalized = content.trimmed
-            let mentions = context.parseMentions(from: normalized)
-            let message = BitchatMessage(
-                id: messageID,
-                sender: nickname,
-                content: normalized,
+        runOnMain { [self] context in
+            handlePublicMessage(
+                from: peerID,
+                nickname: nickname,
+                content: content,
                 timestamp: timestamp,
-                isRelay: false,
-                originalSender: nil,
-                isPrivate: false,
-                recipientNickname: nil,
-                senderPeerID: peerID,
-                mentions: mentions.isEmpty ? nil : mentions
+                messageID: messageID,
+                in: context
             )
-
-            context.handlePublicMessage(message)
-            context.checkForMentions(message)
-            context.sendHapticFeedback(for: message)
         }
     }
 
+    @MainActor
+    func didReceivePublicMessageSynchronously(
+        from peerID: PeerID,
+        nickname: String,
+        content: String,
+        timestamp: Date,
+        messageID: String?
+    ) {
+        handlePublicMessage(
+            from: peerID,
+            nickname: nickname,
+            content: content,
+            timestamp: timestamp,
+            messageID: messageID,
+            in: context
+        )
+    }
+
     func didReceiveNoisePayload(
         from peerID: PeerID,
         type: NoisePayloadType,
@@ -224,59 +244,134 @@ final class ChatTransportEventCoordinator {
         }
     }
 
+    @MainActor
+    func didReceiveNoisePayloadSynchronously(
+        from peerID: PeerID,
+        type: NoisePayloadType,
+        payload: Data,
+        timestamp: Date
+    ) {
+        handleNoisePayload(
+            from: peerID,
+            type: type,
+            payload: payload,
+            timestamp: timestamp,
+            in: context
+        )
+    }
+
     func didConnectToPeer(_ peerID: PeerID) {
-        SecureLogger.debug("🤝 Peer connected: \(peerID)", category: .session)
-
-        runOnMain { context in
-            context.isConnected = true
-            context.registerEphemeralSession(peerID: peerID)
-            context.notifyUIChanged()
-
-            if let peer = context.unifiedPeer(for: peerID) {
-                let stablePeerID = PeerID(hexData: peer.noisePublicKey)
-                context.cacheStablePeerID(stablePeerID, for: peerID)
-            }
-
-            context.flushRouterOutbox(for: peerID)
-            context.retryCourierDeposits(via: peerID)
+        runOnMain { [weak self] _ in
+            self?.didConnectToPeerSynchronously(peerID)
         }
     }
 
+    @MainActor
+    func didConnectToPeerSynchronously(_ peerID: PeerID) {
+        SecureLogger.debug("🤝 Peer connected: \(peerID)", category: .session)
+
+        context.isConnected = true
+        context.registerEphemeralSession(peerID: peerID)
+        context.notifyUIChanged()
+
+        if let peer = context.unifiedPeer(for: peerID) {
+            let stablePeerID = PeerID(hexData: peer.noisePublicKey)
+            context.cacheStablePeerID(stablePeerID, for: peerID)
+        }
+
+        context.flushRouterOutbox(for: peerID)
+        context.retryCourierDeposits(via: peerID)
+    }
+
     func didDisconnectFromPeer(_ peerID: PeerID) {
+        runOnMain { [weak self] _ in
+            self?.didDisconnectFromPeerSynchronously(peerID)
+        }
+    }
+
+    @MainActor
+    func didDisconnectFromPeerSynchronously(_ peerID: PeerID) {
         SecureLogger.debug("👋 Peer disconnected: \(peerID)", category: .session)
 
-        runOnMain { context in
-            context.removeEphemeralSession(peerID: peerID)
+        context.removeEphemeralSession(peerID: peerID)
 
-            var stablePeerID = context.cachedStablePeerID(for: peerID)
-            if stablePeerID == nil,
-               let key = context.noiseSessionPublicKeyData(for: peerID) {
-                let derivedPeerID = PeerID(hexData: key)
-                context.cacheStablePeerID(derivedPeerID, for: peerID)
-                stablePeerID = derivedPeerID
-            }
-
-            if let currentPeerID = context.selectedPrivateChatPeer,
-               currentPeerID == peerID,
-               let stablePeerID {
-                self.migrateSelectedConversationIfNeeded(
-                    from: peerID,
-                    to: stablePeerID,
-                    in: context
-                )
-            }
-
-            let receiptIDs = context.privateMessages(for: peerID)
-                .filter { $0.senderPeerID == peerID }
-                .map(\.id)
-            context.unmarkReadReceiptsSent(receiptIDs)
-
-            context.notifyUIChanged()
+        var stablePeerID = context.cachedStablePeerID(for: peerID)
+        if stablePeerID == nil,
+           let key = context.noiseSessionPublicKeyData(for: peerID) {
+            let derivedPeerID = PeerID(hexData: key)
+            context.cacheStablePeerID(derivedPeerID, for: peerID)
+            stablePeerID = derivedPeerID
         }
+
+        if let currentPeerID = context.selectedPrivateChatPeer,
+           currentPeerID == peerID,
+           let stablePeerID {
+            migrateSelectedConversationIfNeeded(
+                from: peerID,
+                to: stablePeerID,
+                in: context
+            )
+        }
+
+        let receiptIDs = context.privateMessages(for: peerID)
+            .filter { $0.senderPeerID == peerID }
+            .map(\.id)
+        context.unmarkReadReceiptsSent(receiptIDs)
+
+        context.notifyUIChanged()
     }
 }
 
 private extension ChatTransportEventCoordinator {
+    @MainActor
+    func handlePublicMessage(
+        from peerID: PeerID,
+        nickname: String,
+        content: String,
+        timestamp: Date,
+        messageID: String?,
+        in context: any ChatTransportEventContext
+    ) {
+        let normalized = content.trimmed
+        let mentions = context.parseMentions(from: normalized)
+        let message = BitchatMessage(
+            id: messageID,
+            sender: nickname,
+            content: normalized,
+            timestamp: timestamp,
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: false,
+            recipientNickname: nil,
+            senderPeerID: peerID,
+            mentions: mentions.isEmpty ? nil : mentions
+        )
+
+        context.handlePublicMessage(message)
+        context.checkForMentions(message)
+        context.sendHapticFeedback(for: message)
+    }
+
+    @MainActor
+    @discardableResult
+    func handleReceivedMessage(
+        _ message: BitchatMessage,
+        in context: any ChatTransportEventContext
+    ) -> Bool {
+        guard !context.isMessageBlocked(message) else { return false }
+        guard !message.content.trimmed.isEmpty || message.isPrivate else { return false }
+
+        if message.isPrivate {
+            context.handlePrivateMessage(message)
+        } else {
+            context.handlePublicMessage(message)
+        }
+
+        context.checkForMentions(message)
+        context.sendHapticFeedback(for: message)
+        return true
+    }
+
     func runOnMain(_ action: @escaping @MainActor (any ChatTransportEventContext) -> Void) {
         Task { @MainActor [weak context = self.context] in
             guard let context else { return }
@@ -364,9 +459,10 @@ private extension ChatTransportEventCoordinator {
             guard let messageID = String(data: payload, encoding: .utf8) else { return }
 
             let name = deliveryStatusName(for: peerID, in: context)
-            let didUpdate = context.applyMessageDeliveryStatus(
+            let didUpdate = context.applyAcknowledgedMessageDeliveryStatus(
                 messageID,
-                status: .delivered(to: name, at: Date())
+                status: .delivered(to: name, at: Date()),
+                from: receiptPeerAliases(for: peerID, in: context)
             )
 
             if !didUpdate {
@@ -381,9 +477,10 @@ private extension ChatTransportEventCoordinator {
             guard let messageID = String(data: payload, encoding: .utf8) else { return }
 
             let name = deliveryStatusName(for: peerID, in: context)
-            let didUpdate = context.applyMessageDeliveryStatus(
+            let didUpdate = context.applyAcknowledgedMessageDeliveryStatus(
                 messageID,
-                status: .read(by: name, at: Date())
+                status: .read(by: name, at: Date()),
+                from: receiptPeerAliases(for: peerID, in: context)
             )
 
             if !didUpdate {
@@ -407,6 +504,13 @@ private extension ChatTransportEventCoordinator {
 
         case .voiceFrame:
             context.handleVoiceFramePayload(from: peerID, payload: payload, timestamp: timestamp)
+
+        case .privateFile, .authenticatedPeerState:
+            // BLEService validates and persists decrypted private files before
+            // emitting a normal `.messageReceived` event, and consumes peer
+            // state inside the transport. Neither payload crosses this
+            // UI-facing typed-payload fallback.
+            break
         }
     }
 
@@ -414,4 +518,21 @@ private extension ChatTransportEventCoordinator {
     func deliveryStatusName(for peerID: PeerID, in context: any ChatTransportEventContext) -> String {
         context.unifiedPeer(for: peerID)?.nickname ?? context.resolveNickname(for: peerID)
     }
+
+    @MainActor
+    func receiptPeerAliases(
+        for peerID: PeerID,
+        in context: any ChatTransportEventContext
+    ) -> Set<PeerID> {
+        var aliases: Set<PeerID> = [peerID]
+        // The active authenticated Noise key is authoritative. A cached
+        // ephemeral→stable mapping can predate an identity replacement, so
+        // use it only when the live session cannot provide its static key.
+        if let keyData = context.noiseSessionPublicKeyData(for: peerID) {
+            aliases.insert(PeerID(hexData: keyData))
+        } else if let stablePeerID = context.cachedStablePeerID(for: peerID) {
+            aliases.insert(stablePeerID)
+        }
+        return aliases
+    }
 }

bitchat/ViewModels/ChatVerificationCoordinator.swift

@@ -58,6 +58,11 @@ protocol ChatVerificationContext: AnyObject {
     func noiseStaticPublicKeyData() -> Data
     func hasEstablishedNoiseSession(with peerID: PeerID) -> Bool
     func triggerHandshake(with peerID: PeerID)
+    func privateMediaPeerDidAuthenticate(_ peerID: PeerID)
+    /// Retries only private messages previously transmitted through a secure
+    /// session and still pending an ack. Both ephemeral and stable aliases
+    /// are supplied because either can own the outbox entry.
+    func retrySecurePrivateMessagesAfterAuthentication(for peerIDAliases: [PeerID])
     func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data)
     func sendVerifyResponse(to peerID: PeerID, noiseKeyHex: String, nonceA: Data)
 
@@ -116,6 +121,14 @@ extension ChatViewModel: ChatVerificationContext {
         meshService.noiseStaticPublicKeyData()
     }
 
+    func privateMediaPeerDidAuthenticate(_ peerID: PeerID) {
+        mediaTransferCoordinator.peerDidAuthenticate(peerID.toShort())
+    }
+
+    func retrySecurePrivateMessagesAfterAuthentication(for peerIDAliases: [PeerID]) {
+        messageRouter.retrySecurePrivateMessagesAfterAuthentication(for: peerIDAliases)
+    }
+
     func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {
         meshService.sendVerifyChallenge(to: peerID, noiseKeyHex: noiseKeyHex, nonceA: nonceA)
     }
@@ -129,6 +142,10 @@ extension ChatViewModel: ChatVerificationContext {
     }
 }
 
+extension ChatVerificationContext {
+    func privateMediaPeerDidAuthenticate(_ peerID: PeerID) {}
+}
+
 @MainActor
 final class ChatVerificationCoordinator {
     struct PendingVerification {
@@ -197,6 +214,7 @@ final class ChatVerificationCoordinator {
                     guard let self else { return }
 
                     SecureLogger.debug("🔐 Authenticated: \(peerID)", category: .security)
+                    self.context.privateMediaPeerDidAuthenticate(peerID)
 
                     if self.context.isVerifiedFingerprint(fingerprint) {
                         self.context.setEncryptionStatus(.noiseVerified, for: peerID)
@@ -206,16 +224,37 @@ final class ChatVerificationCoordinator {
 
                     self.context.invalidateEncryptionCache(for: peerID)
 
-                    if self.context.cachedStablePeerID(for: peerID) == nil,
-                       let keyData = self.context.noiseSessionPublicKeyData(for: peerID) {
+                    var authenticatedStablePeerID: PeerID?
+                    if let keyData = self.context.noiseSessionPublicKeyData(for: peerID) {
                         let stablePeerID = PeerID(hexData: keyData)
-                        self.context.cacheStablePeerID(stablePeerID, for: peerID)
+                        authenticatedStablePeerID = stablePeerID
+                        if self.context.cachedStablePeerID(for: peerID) != stablePeerID {
+                            // The freshly authenticated Noise key outranks a
+                            // stale announce-derived alias.
+                            self.context.cacheStablePeerID(stablePeerID, for: peerID)
+                        }
                         SecureLogger.debug(
                             "🗺️ Mapped short peerID to Noise key for header continuity: \(peerID) -> \(stablePeerID.id.prefix(8))…",
                             category: .session
                         )
                     }
 
+                    // A locally established session may have belonged to the
+                    // peer's previous app process. The first ciphertext sent
+                    // into that stale session is retained by MessageRouter;
+                    // retry it now that this newly authenticated/replacement
+                    // session can actually decrypt it.
+                    var peerIDAliases = [peerID]
+                    if let stablePeerID = authenticatedStablePeerID
+                        ?? self.context.cachedStablePeerID(for: peerID),
+                       stablePeerID != peerID {
+                        // Conversations can migrate from the ephemeral BLE ID
+                        // to the authenticated Noise-key ID. Retry both aliases
+                        // because either may own the retained outbox entry.
+                        peerIDAliases.append(stablePeerID)
+                    }
+                    self.context.retrySecurePrivateMessagesAfterAuthentication(for: peerIDAliases)
+
                     if var pending = self.pendingQRVerifications[peerID], pending.sent == false {
                         self.context.sendVerifyChallenge(
                             to: peerID,

bitchat/ViewModels/ChatViewModel.swift

@@ -89,10 +89,40 @@ import UIKit
 #endif
 import UniformTypeIdentifiers
 
+struct PanicNetworkLifecycle {
+    let stop: @MainActor () -> Void
+    let restart: @MainActor () -> Void
+
+    static let noop = PanicNetworkLifecycle(stop: {}, restart: {})
+
+    static var live: PanicNetworkLifecycle {
+        PanicNetworkLifecycle(
+            stop: {
+                GeohashPresenceService.shared.stopForPanic()
+                NetworkActivationService.shared.stopForPanic()
+            },
+            restart: {
+                NetworkActivationService.shared.start()
+                GeohashPresenceService.shared.start()
+            }
+        )
+    }
+}
+
+private struct PendingPrivateChatClear {
+    let peerID: PeerID
+    let sourceConversationID: ConversationID
+    let messages: [BitchatMessage]
+    let otherMessageIDs: Set<String>
+    let localPeerID: PeerID
+    let nickname: String
+    let outgoingMedia: [BitchatMessage]
+}
+
 /// Manages the application state and business logic for BitChat.
 /// Acts as the primary coordinator between UI components and backend services,
 /// implementing the BitchatDelegate protocol to handle network events.
-final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDelegate, CommandContextProvider, GeohashParticipantContext, MessageFormattingContext {
+final class ChatViewModel: ObservableObject, BitchatDelegate, SynchronousMessageTransportEventDelegate, CommandContextProvider, GeohashParticipantContext, MessageFormattingContext {
     // Use MessageFormattingEngine.Patterns for regex matching (shared, precompiled)
     typealias Patterns = MessageFormattingEngine.Patterns
 
@@ -142,6 +172,8 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     @Published var currentColorScheme: ColorScheme = .light
     @Published var currentTheme: AppTheme = .matrix
     @Published var isConnected = false
+    @Published private(set) var panicRecoveryBlocked = false
+    var networkActivationAllowed: Bool { !panicRecoveryBlocked }
     @Published var nickname: String = "" {
         didSet {
             // Trim whitespace whenever nickname is set; whitespace-only becomes ""
@@ -151,7 +183,7 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
                 return
             }
             // Update mesh service nickname if it's initialized
-            if !meshService.myPeerID.isEmpty {
+            if !isPanicResetting, !meshService.myPeerID.isEmpty {
                 meshService.setNickname(nickname)
             }
         }
@@ -177,7 +209,10 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     lazy var privateConversationCoordinator = ChatPrivateConversationCoordinator(context: self)
     lazy var nostrCoordinator = ChatNostrCoordinator(context: self)
     lazy var mediaTransferCoordinator = ChatMediaTransferCoordinator(context: self)
-    lazy var liveVoiceCoordinator = ChatLiveVoiceCoordinator(context: self)
+    lazy var liveVoiceCoordinator = ChatLiveVoiceCoordinator(
+        context: self,
+        sweepsOnInit: !TestEnvironment.isRunningTests
+    )
     lazy var verificationCoordinator = ChatVerificationCoordinator(context: self)
     lazy var groupCoordinator = ChatGroupCoordinator(context: self)
     lazy var vouchCoordinator = ChatVouchCoordinator(context: self)
@@ -292,6 +327,9 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     var nostrRelayManager: NostrRelayManager?
     private let userDefaults = UserDefaults.standard
     let keychain: KeychainManagerProtocol
+    private let panicRecoveryOperations: PanicRecoveryOperations
+    private let panicNetworkLifecycle: PanicNetworkLifecycle
+    private var isPanicResetting = false
     /// Private group membership: keys in the keychain, metadata on disk.
     let groupStore: GroupStore
     private let nicknameKey = "bitchat.nickname"
@@ -347,6 +385,13 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     @Published var showBluetoothAlert = false
     @Published var bluetoothAlertMessage = ""
     @Published var bluetoothState: CBManagerState = .unknown
+    @Published private(set) var legacyPrivateMediaConsentRequest: LegacyPrivateMediaConsentRequest?
+    @MainActor private var queuedPrivateChatClears: [
+        PendingPrivateChatClear
+    ] = []
+    @MainActor private var privateChatClearInFlight = false
+    @MainActor private var privateChatClearGeneration: UInt64 = 0
+    private var pendingLegacyPrivateMediaConsents: [PendingLegacyPrivateMediaConsent] = []
 
     private func performDeliveryUpdate(_ update: @escaping @MainActor (ChatDeliveryCoordinator) -> Void) {
         if Thread.isMainThread {
@@ -465,6 +510,12 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         }
     }
 
+    /// Whether a read receipt has already been recorded for `messageID`.
+    @MainActor
+    func hasSentReadReceipt(_ messageID: String) -> Bool {
+        sentReadReceipts.contains(messageID)
+    }
+
     /// Records that a read receipt is being sent for `messageID`.
     /// Returns `false` when one was already recorded — the caller must skip sending.
     @MainActor
@@ -607,7 +658,271 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     /// Empties the peer's chat but keeps the conversation alive (`/clear`).
     @MainActor
     func clearPrivateChat(_ peerID: PeerID) {
-        conversations.clear(.directPeer(peerID))
+        let sourceConversationID = ConversationID.directPeer(peerID)
+        // An active live-voice row owns an open FileHandle and may be
+        // republished as frames/final media arrive. Treat it like an in-flight
+        // arrival rather than unlinking its capture or removing its bubble.
+        let messages = privateMessages(for: peerID).filter {
+            !liveVoiceCoordinator.isLiveVoiceMessage($0)
+        }
+        let localPeerID = meshService.myPeerID.toShort()
+        let currentNickname = nickname
+        let mediaPrefixes = [
+            MimeType.Category.audio.messagePrefix,
+            MimeType.Category.image.messagePrefix,
+            MimeType.Category.file.messagePrefix
+        ]
+        let outgoingMedia = messages.filter { message in
+            guard mediaPrefixes.contains(where: {
+                message.content.hasPrefix($0)
+            }) else {
+                return false
+            }
+            if let senderPeerID = message.senderPeerID {
+                return senderPeerID.toShort() == localPeerID
+            }
+            return message.sender == currentNickname
+                || message.sender.hasPrefix(currentNickname + "#")
+        }
+
+        // Send ownership is canceled at command time even when another clear
+        // transaction is ahead in the queue. UI and files remain untouched
+        // until this request's receiver journal commit succeeds.
+        for message in outgoingMedia {
+            mediaTransferCoordinator
+                .cancelMediaTransferForConversationClear(
+                    messageID: message.id
+                )
+        }
+
+        queuedPrivateChatClears.append(PendingPrivateChatClear(
+            peerID: peerID,
+            sourceConversationID: sourceConversationID,
+            messages: messages,
+            otherMessageIDs: Set(
+                privateChats
+                    .filter { $0.key != peerID }
+                    .flatMap { $0.value.map(\.id) }
+            ),
+            localPeerID: localPeerID,
+            nickname: currentNickname,
+            outgoingMedia: outgoingMedia
+        ))
+        startNextPrivateChatClearIfNeeded()
+    }
+
+    @MainActor
+    private func startNextPrivateChatClearIfNeeded() {
+        guard !privateChatClearInFlight,
+              !queuedPrivateChatClears.isEmpty else {
+            return
+        }
+        privateChatClearInFlight = true
+        let request = queuedPrivateChatClears.removeFirst()
+        let generation = privateChatClearGeneration
+        performPrivateChatClear(
+            request,
+            generation: generation
+        ) { [weak self] in
+            guard let self,
+                  self.privateChatClearGeneration == generation else {
+                return
+            }
+            self.privateChatClearInFlight = false
+            self.startNextPrivateChatClearIfNeeded()
+        }
+    }
+
+    @MainActor
+    private func performPrivateChatClear(
+        _ request: PendingPrivateChatClear,
+        generation: UInt64,
+        completion: @escaping @MainActor () -> Void
+    ) {
+        guard privateChatClearGeneration == generation else {
+            completion()
+            return
+        }
+        let peerID = request.peerID
+        let selectedConversationID = request.sourceConversationID
+        let messagesToClear = request.messages
+        guard !messagesToClear.isEmpty else {
+            completion()
+            return
+        }
+
+        // Capture the transaction's exact UI set before any off-main receipt
+        // I/O. Messages arriving while the journal is written are not part of
+        // this command and must remain visible.
+        let capturedMessageIDs = Set(messagesToClear.map(\.id))
+        let survivingMessageIDs = request.otherMessageIDs
+        let mediaPrefixes = [
+            MimeType.Category.audio.messagePrefix,
+            MimeType.Category.image.messagePrefix,
+            MimeType.Category.file.messagePrefix
+        ]
+        let localPeerID = request.localPeerID
+        let isMedia: (BitchatMessage) -> Bool = { message in
+            mediaPrefixes.contains(where: message.content.hasPrefix)
+        }
+        let isFromMe: (BitchatMessage) -> Bool = { [nickname = request.nickname] message in
+            if let senderPeerID = message.senderPeerID {
+                return senderPeerID.toShort() == localPeerID
+            }
+            return message.sender == nickname
+                || message.sender.hasPrefix(nickname + "#")
+        }
+
+        let outgoingMedia = request.outgoingMedia
+        let outgoingMediaIDs = Set(outgoingMedia.map(\.id))
+
+        let capturedExclusiveIDs =
+            capturedMessageIDs.subtracting(survivingMessageIDs)
+        let capturedIncomingMedia = messagesToClear.filter {
+            isMedia($0) && !isFromMe($0)
+        }
+        let capturedStableMediaIDs = Set(
+            capturedIncomingMedia.compactMap { message in
+                PrivateMediaMessageIdentity.isStableID(message.id)
+                    ? message.id
+                    : nil
+            }
+        )
+
+        func currentRemovalPlan() -> [ConversationID: Set<String>] {
+            // Identity handoff removes the source conversation and inserts its
+            // rows elsewhere. The old source may then be recreated by a new
+            // arrival before journal I/O finishes, so always scan all direct
+            // conversations. Only IDs exclusive at command time may follow a
+            // migration; shared aliases remain outside the source.
+            var plan: [ConversationID: Set<String>] = [:]
+            for (conversationID, conversation) in
+                conversations.conversationsByID {
+                guard case .direct = conversationID else { continue }
+                let eligibleIDs = conversationID == selectedConversationID
+                    ? capturedMessageIDs
+                    : capturedExclusiveIDs
+                let matchingIDs = Set(conversation.messages.map(\.id))
+                    .intersection(eligibleIDs)
+                if !matchingIDs.isEmpty {
+                    plan[conversationID] = matchingIDs
+                }
+            }
+            return plan
+        }
+
+        func hasRemainingCopy(
+            of messageID: String,
+            after plan: [ConversationID: Set<String>]
+        ) -> Bool {
+            conversations.conversationsByID.contains { conversationID, conversation in
+                guard case .direct = conversationID else { return false }
+                return conversation.messages.contains { message in
+                    message.id == messageID
+                        && plan[conversationID]?.contains(messageID) != true
+                }
+            }
+        }
+
+        @MainActor
+        func continueClear(
+            persisted: Bool,
+            durableStableIDs: Set<String>
+        ) {
+            guard privateChatClearGeneration == generation else {
+                completion()
+                return
+            }
+            guard persisted else {
+                SecureLogger.error(
+                    "Refusing to clear private chat without durable media tombstones peer=\(peerID.id.prefix(8))…",
+                    category: .session
+                )
+                completion()
+                return
+            }
+
+            let plan = currentRemovalPlan()
+            let newlyLastStableIDs = Set(
+                capturedStableMediaIDs.filter {
+                    !durableStableIDs.contains($0)
+                        && !hasRemainingCopy(of: $0, after: plan)
+                }
+            )
+            if !newlyLastStableIDs.isEmpty {
+                persistDeletedPrivateMedia(
+                    messageIDs: Array(newlyLastStableIDs).sorted()
+                ) { persisted in
+                    continueClear(
+                        persisted: persisted,
+                        durableStableIDs:
+                            durableStableIDs.union(newlyLastStableIDs)
+                    )
+                }
+                return
+            }
+
+            // A stable receiver tombstone is global for that message ID.
+            // Remove any alias that arrived while journal I/O was in flight.
+            if !durableStableIDs.isEmpty {
+                let directConversationIDs = conversations
+                    .conversationsByID.keys.filter {
+                        if case .direct = $0 { return true }
+                        return false
+                    }
+                for conversationID in directConversationIDs {
+                    conversations.removeMessages(from: conversationID) {
+                        durableStableIDs.contains($0.id)
+                    }
+                }
+            }
+
+            for message in outgoingMedia {
+                mediaTransferCoordinator.cleanupOutgoingLocalFile(
+                    forMessage: message
+                )
+            }
+            if !outgoingMediaIDs.isEmpty {
+                let directConversationIDs = conversations
+                    .conversationsByID.keys.filter {
+                        if case .direct = $0 { return true }
+                        return false
+                    }
+                for conversationID in directConversationIDs {
+                    conversations.removeMessages(from: conversationID) {
+                        outgoingMediaIDs.contains($0.id)
+                    }
+                }
+            }
+
+            // Stable payload cleanup belongs entirely to the durable receiver
+            // journal. Legacy/raw incoming payloads have no durable identity,
+            // so their basenames may already belong to a pending new arrival;
+            // leave those files for bounded quota cleanup.
+            let finalPlan = currentRemovalPlan()
+
+            for (conversationID, messageIDs) in finalPlan {
+                conversations.removeMessages(from: conversationID) {
+                    messageIDs.contains($0.id)
+                }
+            }
+            completion()
+        }
+
+        let initialPlan = currentRemovalPlan()
+        let initialStableIDs = Set(
+            capturedStableMediaIDs.filter {
+                !hasRemainingCopy(of: $0, after: initialPlan)
+            }
+        )
+        persistDeletedPrivateMedia(
+            messageIDs: Array(initialStableIDs).sorted()
+        ) { persisted in
+            continueClear(
+                persisted: persisted,
+                durableStableIDs: initialStableIDs
+            )
+        }
     }
 
     /// Removes the peer's chat entirely, including unread state.
@@ -769,7 +1084,34 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         locationPresenceStore: LocationPresenceStore? = nil,
         locationManager: LocationChannelManager = .shared
     ) {
-        let meshService = BLEService(keychain: keychain, idBridge: idBridge, identityManager: identityManager)
+        let livePanicRecoveryOperations = PanicRecoveryOperations.live()
+        let startSuspendedForRecovery: Bool
+        do {
+            startSuspendedForRecovery =
+                try livePanicRecoveryOperations.isPending()
+        } catch {
+            startSuspendedForRecovery = true
+        }
+        // Preserve the preflight decision used to defer CoreBluetooth. A
+        // transiently successful second read must not skip recovery and leave
+        // the service permanently suspended without running the wipe.
+        let panicRecoveryOperations = PanicRecoveryOperations(
+            isPending: {
+                if startSuspendedForRecovery {
+                    return true
+                }
+                return try livePanicRecoveryOperations.isPending()
+            },
+            begin: livePanicRecoveryOperations.begin,
+            wipeMedia: livePanicRecoveryOperations.wipeMedia,
+            complete: livePanicRecoveryOperations.complete
+        )
+        let meshService = BLEService(
+            keychain: keychain,
+            idBridge: idBridge,
+            identityManager: identityManager,
+            startSuspendedForPanicRecovery: startSuspendedForRecovery
+        )
         meshService.sfMetrics = .shared
         self.init(
             keychain: keychain,
@@ -781,7 +1123,9 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
             locationPresenceStore: locationPresenceStore ?? LocationPresenceStore(),
             locationManager: locationManager,
             outboxStore: MessageOutboxStore(keychain: keychain),
-            sfMetrics: .shared
+            sfMetrics: .shared,
+            panicRecoveryOperations: panicRecoveryOperations,
+            panicNetworkLifecycle: .live
         )
     }
 
@@ -799,7 +1143,10 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         locationManager: LocationChannelManager = .shared,
         readReceiptsDefaults: UserDefaults? = nil,
         outboxStore: MessageOutboxStore? = nil,
-        sfMetrics: StoreAndForwardMetrics? = nil
+        sfMetrics: StoreAndForwardMetrics? = nil,
+        panicMediaWipe: (() throws -> Void)? = nil,
+        panicRecoveryOperations: PanicRecoveryOperations? = nil,
+        panicNetworkLifecycle: PanicNetworkLifecycle = .noop
     ) {
         let conversations = conversations ?? ConversationStore()
         let peerIdentityStore = peerIdentityStore ?? PeerIdentityStore()
@@ -814,6 +1161,9 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         )
 
         self.keychain = keychain
+        self.panicRecoveryOperations = panicRecoveryOperations
+            ?? .ephemeral(wipeMedia: panicMediaWipe ?? {})
+        self.panicNetworkLifecycle = panicNetworkLifecycle
         self.groupStore = GroupStore(keychain: keychain)
         self.idBridge = idBridge
         self.identityManager = identityManager
@@ -849,7 +1199,31 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
             }
             .store(in: &cancellables)
 
-        ChatViewModelBootstrapper(viewModel: self).configure()
+        let recoveryRequired: Bool
+        do {
+            recoveryRequired = try self.panicRecoveryOperations.isPending()
+        } catch {
+            // Failure to read the latch cannot fail open. Re-run the complete
+            // transaction; a persistent storage failure leaves services
+            // blocked below.
+            recoveryRequired = true
+            SecureLogger.error(
+                "Could not read panic-recovery state; retrying the full wipe before startup: \(error)",
+                category: .security
+            )
+        }
+
+        if recoveryRequired {
+            SecureLogger.warning(
+                "Pending panic recovery detected; wiping before runtime services start",
+                category: .security
+            )
+            _ = panicClearAllData(restartServices: false)
+        }
+
+        if networkActivationAllowed {
+            ChatViewModelBootstrapper(viewModel: self).configure()
+        }
     }
 
     // MARK: - Deinitialization
@@ -1153,8 +1527,40 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
 
     // PANIC: Emergency data clearing for activist safety
     @MainActor
-    func panicClearAllData() {
-        // Messages are processed immediately - nothing to flush
+    @discardableResult
+    func panicClearAllData(restartServices: Bool = true) -> Bool {
+        panicRecoveryBlocked = true
+        isPanicResetting = true
+        defer { isPanicResetting = false }
+
+        // Stop internet and location-presence work before clearing identity or
+        // state. These services cancel their subscriptions and delayed tasks,
+        // so old callbacks cannot reconnect during the transaction.
+        panicNetworkLifecycle.stop()
+
+        // Establish both independent durable intents before erasing anything.
+        // `wipeMedia` will still attempt deletion if neither write succeeds.
+        let recoveryIntent = panicRecoveryOperations.begin()
+
+        // Quiesce the mesh before clearing stores. Identity replacement below
+        // deliberately stays stopped until media deletion and marker commit.
+        if let bleService = meshService as? BLEService {
+            bleService.suspendForPanicReset()
+        } else {
+            meshService.emergencyDisconnectAll()
+        }
+
+        // Invalidate detached media preparation and close live capture file
+        // handles before clearing state or removing the media directory.
+        mediaTransferCoordinator.resetForPanic()
+        liveVoiceCoordinator.resetForPanic()
+        privateChatClearGeneration &+= 1
+        queuedPrivateChatClears.removeAll(keepingCapacity: false)
+        privateChatClearInFlight = false
+
+        // Deny and release any clear-media confirmations before identities,
+        // message state, and local files are wiped.
+        cancelAllLegacyPrivateMediaConsents()
 
         // Clear all messages (public timelines and private chats live in the
         // single-writer ConversationStore; the derived `messages` view and
@@ -1163,7 +1569,13 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         pendingGeohashSystemMessages.removeAll()
 
         // Delete all keychain data (including Noise and Nostr keys)
-        _ = keychain.deleteAllKeychainData()
+        let keychainWipeCompleted = keychain.deleteAllKeychainData()
+        if !keychainWipeCompleted {
+            SecureLogger.error(
+                "Panic keychain cleanup incomplete; recovery remains pending",
+                category: .security
+            )
+        }
 
         // Clear UserDefaults identity data
         userDefaults.removeObject(forKey: "bitchat.noiseIdentityKey")
@@ -1176,13 +1588,14 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
 
         // Reset nickname to anonymous
         nickname = "anon\(Int.random(in: 1000...9999))"
-        saveNickname()
+        userDefaults.set(nickname, forKey: nicknameKey)
 
         // Clear favorites and peer mappings
         // Clear through SecureIdentityStateManager instead of directly
         identityManager.clearAllIdentityData()
         peerIdentityStore.clearAll()
         locationPresenceStore.reset()
+        publicRateLimiter.reset()
 
         // Clear persistent favorites from keychain
         FavoritesPersistenceService.shared.clearAllFavorites()
@@ -1241,84 +1654,84 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         // Drop relay subscriptions, handlers, pending sends, and replay state.
         // Geohash DM handlers can capture pre-wipe Nostr identities, so a plain
         // disconnect is not enough here.
+        NostrTransport.resetControlRetriesForPanicWipe()
         NostrRelayManager.shared.resetForPanicWipe()
         nostrRelayManager = nil
 
         // Clear Nostr identity associations
         idBridge.clearAllAssociations()
 
-        // Disconnect from all peers and clear persistent identity
-        // This will force creation of a new identity (new fingerprint) on next launch
-        meshService.emergencyDisconnectAll()
+        // Replace the BLE identity while keeping the radio stopped. It may
+        // reopen only after the durable panic transaction commits.
         if let bleService = meshService as? BLEService {
-            bleService.resetIdentityForPanic(currentNickname: nickname)
+            bleService.resetIdentityForPanic(
+                currentNickname: nickname,
+                restartServices: false
+            )
+        } else {
+            meshService.setNickname(nickname)
         }
 
-        // No need to force UserDefaults synchronization
+        // The wipe must finish before this security action returns. A detached
+        // task could otherwise lose a race with a new capture or app exit and
+        // leave pre-panic media behind.
+        let panicCompleted: Bool
+        do {
+            try panicRecoveryOperations.wipeMedia(recoveryIntent)
+            if keychainWipeCompleted {
+                try panicRecoveryOperations.complete()
+                panicCompleted = true
+                SecureLogger.info(
+                    "🗑️ Deleted all media files during panic clear",
+                    category: .session
+                )
+            } else {
+                // Do not clear either durable recovery marker. Startup must
+                // retry the entire transaction before any transport restarts.
+                panicCompleted = false
+            }
+        } catch {
+            panicCompleted = false
+            SecureLogger.error(
+                "Panic transaction did not commit; services remain stopped: \(error)",
+                category: .security
+            )
+        }
+        panicRecoveryBlocked = !panicCompleted
 
-        // Reinitialize Nostr with new identity
-        // This will generate new Nostr keys derived from new Noise keys.
-        // Skipped under tests: connecting the shared relay singleton starts
-        // real network/reconnect work that never completes and would keep the
-        // test process alive (the singleton, unlike a discardable instance, is
-        // never deallocated to cancel it).
+        // BCH-01-013: Clear iOS app switcher snapshots. Keep tests away from
+        // the host user's real cache tree just as the default media wipe does.
+        #if os(iOS)
         if !TestEnvironment.isRunningTests {
-            Task { @MainActor in
-                // Small delay to ensure cleanup completes
-                try? await Task.sleep(nanoseconds: TransportConfig.uiAsyncShortSleepNs) // 0.1 seconds
+            Self.clearAppSwitcherSnapshots()
+        }
+        #endif
 
-                // Reinitialize Nostr relay manager with new identity. Reuse the
-                // shared singleton — every other component (NostrTransport, geohash
-                // subscriptions, AppRuntime observers) is bound to `.shared`, so
-                // creating a fresh instance here would split relay state and leave
-                // sends running against a disconnected manager.
+        guard panicCompleted else { return false }
+
+        if let bleService = meshService as? BLEService {
+            // Startup recovery reopens admission but leaves actual service
+            // start to the bootstrapper immediately after this method.
+            bleService.completePanicReset(
+                restartServices: restartServices
+            )
+        }
+
+        if restartServices {
+            // All persistent state and media are gone. Bring each service back
+            // only now, under the new identity.
+            if !(meshService is BLEService) {
+                meshService.startServices()
+            }
+
+            if !TestEnvironment.isRunningTests {
                 nostrRelayManager = NostrRelayManager.shared
                 setupNostrMessageHandling()
-                nostrRelayManager?.connect()
             }
+            panicNetworkLifecycle.restart()
         }
 
-        // Delete ALL media files (incoming and outgoing) in background
-        Task.detached(priority: .utility) {
-            // Skipped under tests: the test process shares the user's real
-            // ~/Library/Application Support/files tree, and this detached
-            // utility-priority wipe fires at a nondeterministic time —
-            // deleting media that concurrently running tests (e.g. the
-            // sendImage flow) just wrote there, and the developer's real
-            // app data with it.
-            guard !TestEnvironment.isRunningTests else { return }
-            do {
-                let base = try FileManager.default.url(for: .applicationSupportDirectory, in: .userDomainMask, appropriateFor: nil, create: true)
-                let filesDir = base.appendingPathComponent("files", isDirectory: true)
-
-                // Delete the entire files directory and recreate it
-                if FileManager.default.fileExists(atPath: filesDir.path) {
-                    try FileManager.default.removeItem(at: filesDir)
-                    SecureLogger.info("🗑️ Deleted all media files during panic clear", category: .session)
-                }
-
-                // Recreate empty directory structure
-                try FileManager.default.createDirectory(at: filesDir, withIntermediateDirectories: true, attributes: nil)
-                try FileManager.default.createDirectory(at: filesDir.appendingPathComponent("voicenotes/incoming", isDirectory: true), withIntermediateDirectories: true, attributes: nil)
-                try FileManager.default.createDirectory(at: filesDir.appendingPathComponent("voicenotes/outgoing", isDirectory: true), withIntermediateDirectories: true, attributes: nil)
-                try FileManager.default.createDirectory(at: filesDir.appendingPathComponent("images/incoming", isDirectory: true), withIntermediateDirectories: true, attributes: nil)
-                try FileManager.default.createDirectory(at: filesDir.appendingPathComponent("images/outgoing", isDirectory: true), withIntermediateDirectories: true, attributes: nil)
-                try FileManager.default.createDirectory(at: filesDir.appendingPathComponent("files/incoming", isDirectory: true), withIntermediateDirectories: true, attributes: nil)
-                try FileManager.default.createDirectory(at: filesDir.appendingPathComponent("files/outgoing", isDirectory: true), withIntermediateDirectories: true, attributes: nil)
-            } catch {
-                SecureLogger.error("Failed to clear media files during panic: \(error)", category: .session)
-            }
-
-            // BCH-01-013: Clear iOS app switcher snapshots
-            // These are stored in Library/Caches/Snapshots/<bundle_id>/
-            #if os(iOS)
-            Self.clearAppSwitcherSnapshots()
-            #endif
-        }
-
-        // Force immediate UI update for panic mode
-        // UI updates immediately - no flushing needed
-
+        return true
     }
 
     /// BCH-01-013: Clear iOS app switcher snapshots during panic mode
@@ -1577,7 +1990,82 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
 
     @MainActor
     func didReceiveTransportEvent(_ event: TransportEvent) {
-        receiveTransportEvent(event)
+        switch event {
+        case .messageReceived(let message):
+            _ = didReceiveTransportMessageSynchronously(message)
+
+        case let .publicMessageReceived(
+            peerID,
+            nickname,
+            content,
+            timestamp,
+            messageID
+        ):
+            transportEventCoordinator.didReceivePublicMessageSynchronously(
+                from: peerID,
+                nickname: nickname,
+                content: content,
+                timestamp: timestamp,
+                messageID: messageID
+            )
+
+        case let .noisePayloadReceived(peerID, type, payload, timestamp):
+            transportEventCoordinator.didReceiveNoisePayloadSynchronously(
+                from: peerID,
+                type: type,
+                payload: payload,
+                timestamp: timestamp
+            )
+
+        case let .groupMessageReceived(payload, timestamp):
+            groupCoordinator.handleGroupMessagePayload(
+                payload,
+                timestamp: timestamp
+            )
+
+        case let .publicVoiceFrameReceived(
+            peerID,
+            nickname,
+            payload,
+            timestamp
+        ):
+            liveVoiceCoordinator.handlePublicVoiceFramePayload(
+                from: peerID,
+                nickname: nickname,
+                payload: payload,
+                timestamp: timestamp
+            )
+
+        case .peerConnected(let peerID):
+            transportEventCoordinator.didConnectToPeerSynchronously(peerID)
+            mediaTransferCoordinator.peerDidReconnect(peerID)
+
+        case .peerDisconnected(let peerID):
+            transportEventCoordinator.didDisconnectFromPeerSynchronously(peerID)
+
+        case .peerListUpdated(let peers):
+            peerListCoordinator.didUpdatePeerListSynchronously(peers)
+            // A peer-list update follows every verified announce, which is
+            // where a peer's `.vouch` capability actually arrives.
+            vouchCoordinator.peersUpdated(peers)
+
+        case .peerSnapshotsUpdated:
+            break
+
+        case let .messageDeliveryStatusUpdated(messageID, status):
+            deliveryCoordinator.didUpdateMessageDeliveryStatus(
+                messageID,
+                status: status
+            )
+
+        case .bluetoothStateUpdated(let state):
+            updateBluetoothState(state)
+        }
+    }
+
+    @MainActor
+    func didReceiveTransportMessageSynchronously(_ message: BitchatMessage) -> Bool {
+        transportEventCoordinator.didReceiveMessageSynchronously(message)
     }
 
     func didReceiveMessage(_ message: BitchatMessage) {
@@ -1640,6 +2128,9 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
 
     func didConnectToPeer(_ peerID: PeerID) {
         transportEventCoordinator.didConnectToPeer(peerID)
+        Task { @MainActor [weak self] in
+            self?.mediaTransferCoordinator.peerDidReconnect(peerID)
+        }
     }
 
     func didDisconnectFromPeer(_ peerID: PeerID) {
@@ -1804,4 +2295,91 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         publicConversationCoordinator.sendHapticFeedback(for: message)
     }
 }
+
+@MainActor
+extension ChatViewModel {
+    func enqueueLegacyPrivateMediaConsent(
+        for peerID: PeerID,
+        transferId: String,
+        messageID: String,
+        completion: @escaping @MainActor (Bool) -> Void
+    ) {
+        let request = LegacyPrivateMediaConsentRequest(
+            id: UUID(),
+            peerID: peerID,
+            peerName: nicknameForPeer(peerID),
+            transferId: transferId,
+            messageID: messageID
+        )
+        pendingLegacyPrivateMediaConsents.append(PendingLegacyPrivateMediaConsent(
+            request: request,
+            completion: completion
+        ))
+        if legacyPrivateMediaConsentRequest == nil {
+            legacyPrivateMediaConsentRequest = request
+        }
+    }
+
+    func resolveLegacyPrivateMediaConsent(requestID: UUID, approved: Bool) {
+        // SwiftUI may report both the selected button and the presentation
+        // binding's dismissal. Resolve only the exact request that was shown;
+        // a duplicate callback for it must not consume the next queued send.
+        guard legacyPrivateMediaConsentRequest?.id == requestID,
+              pendingLegacyPrivateMediaConsents.first?.request.id == requestID else {
+            return
+        }
+        let resolved = pendingLegacyPrivateMediaConsents.removeFirst()
+        // Drive the boolean presentation state through false before showing
+        // the next queued per-send warning. Otherwise SwiftUI sees true→true,
+        // closes the first dialog, and never presents the second.
+        legacyPrivateMediaConsentRequest = nil
+        resolved.completion(approved)
+        presentNextLegacyPrivateMediaConsentDeferred()
+    }
+
+    func invalidateLegacyPrivateMediaConsent(transferId: String, messageID: String) {
+        let invalidatedIDs = Set(
+            pendingLegacyPrivateMediaConsents.compactMap { pending -> UUID? in
+                let request = pending.request
+                return request.transferId == transferId && request.messageID == messageID
+                    ? request.id
+                    : nil
+            }
+        )
+        guard !invalidatedIDs.isEmpty else { return }
+
+        pendingLegacyPrivateMediaConsents.removeAll {
+            invalidatedIDs.contains($0.request.id)
+        }
+        if let currentID = legacyPrivateMediaConsentRequest?.id,
+           invalidatedIDs.contains(currentID) {
+            legacyPrivateMediaConsentRequest = nil
+            presentNextLegacyPrivateMediaConsentDeferred()
+        }
+    }
+
+    func cancelAllLegacyPrivateMediaConsents() {
+        let pending = pendingLegacyPrivateMediaConsents
+        pendingLegacyPrivateMediaConsents.removeAll()
+        legacyPrivateMediaConsentRequest = nil
+        for item in pending {
+            item.completion(false)
+        }
+    }
+
+    private func presentNextLegacyPrivateMediaConsentDeferred() {
+        guard legacyPrivateMediaConsentRequest == nil,
+              let nextRequestID = pendingLegacyPrivateMediaConsents.first?.request.id else {
+            return
+        }
+        DispatchQueue.main.async { [weak self] in
+            guard let self,
+                  self.legacyPrivateMediaConsentRequest == nil,
+                  self.pendingLegacyPrivateMediaConsents.first?.request.id == nextRequestID else {
+                return
+            }
+            self.legacyPrivateMediaConsentRequest = self.pendingLegacyPrivateMediaConsents[0].request
+        }
+    }
+}
 // End of ChatViewModel class

bitchat/ViewModels/ChatViewModelBootstrapper.swift

@@ -41,10 +41,11 @@ struct ChatViewModelServiceBundle {
         self.privateChatManager = privateChatManager
         self.unifiedPeerService = unifiedPeerService
         self.autocompleteService = AutocompleteService()
-        // Persist processed gift-wrap event IDs: NIP-59 randomizes their
-        // timestamps, so the 24h-lookback DM subscriptions redeliver the same
-        // events on every launch and only a cross-launch record stops the
-        // reprocessing (re-sent DELIVERED bursts, phantom-ack noise).
+        // Persist processed private-envelope event IDs: legacy Android can
+        // randomize timestamps across the full 72h15m mailbox lookback, so DM
+        // subscriptions redeliver the same events on every launch and only a
+        // cross-launch record stops the reprocessing (re-sent DELIVERED
+        // bursts, phantom-ack noise).
         self.deduplicationService = MessageDeduplicationService(nostrEventStore: NostrProcessedEventStore())
         self.publicMessagePipeline = PublicMessagePipeline()
     }
@@ -156,6 +157,17 @@ private extension ChatViewModelBootstrapper {
                 viewModel?.objectWillChange.send()
             }
             .store(in: &viewModel.cancellables)
+
+        viewModel.participantTracker.$visiblePeople
+            .receive(on: DispatchQueue.main)
+            .sink { [weak viewModel] people in
+                Task { @MainActor [weak viewModel] in
+                    let visible = Set(people.map { $0.id })
+                    viewModel?.locationPresenceStore.retainTeleportedGeo(keeping: visible)
+                    viewModel?.locationPresenceStore.retainGeoNicknames(keeping: visible)
+                }
+            }
+            .store(in: &viewModel.cancellables)
     }
 
     func loadPersistedViewState() {
@@ -165,7 +177,7 @@ private extension ChatViewModelBootstrapper {
 
     func configureTransport() {
         viewModel.meshService.delegate = viewModel
-        viewModel.meshService.eventDelegate = viewModel
+        viewModel.messageRouter.setEventDelegate(viewModel)
 
         DispatchQueue.main.asyncAfter(deadline: .now() + TransportConfig.uiStartupInitialDelaySeconds) { [weak viewModel] in
             guard let viewModel else { return }
@@ -547,7 +559,7 @@ private extension ChatViewModelBootstrapper {
             // Default (DM) relays: drops need the standing global relay set,
             // not geo relays — sender and recipient share no cell.
             // This confirmed path never falls back to the volatile relay
-            // queue; bridge dedup is committed only after NIP-20 OK.
+            // queue; bridge dedup is committed only after NIP-01 `OK`.
             NostrRelayManager.shared.sendEventImmediately(event, completion: completion)
         }
         courier.openSubscription = { tagsHex in

bitchat/ViewModels/Extensions/ChatViewModel+Nostr.swift

@@ -21,8 +21,8 @@ extension ChatViewModel {
     }
 
     @MainActor
-    func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        nostrCoordinator.inbound.subscribeGiftWrap(giftWrap, id: id)
+    func subscribePrivateEnvelope(_ envelope: NostrEvent, id: NostrIdentity) {
+        nostrCoordinator.inbound.subscribePrivateEnvelope(envelope, id: id)
     }
 
     @MainActor
@@ -36,8 +36,8 @@ extension ChatViewModel {
     }
 
     @MainActor
-    func handleGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        nostrCoordinator.inbound.handleGiftWrap(giftWrap, id: id)
+    func handlePrivateEnvelope(_ envelope: NostrEvent, id: NostrIdentity) {
+        nostrCoordinator.inbound.handlePrivateEnvelope(envelope, id: id)
     }
 
     @MainActor

bitchat/ViewModels/GeohashSubscriptionManager.swift

@@ -108,7 +108,7 @@ extension ChatViewModel: GeohashSubscriptionContext {
 }
 
 /// Owns subscription IDs and relay lifecycle for geohash channels, geohash
-/// DMs, the account gift-wrap mailbox, and background geohash sampling. The
+/// DMs, the account private-envelope mailbox, and background geohash sampling. The
 /// only component that talks to `NostrRelayManager`; inbound events are
 /// forwarded to `NostrInboundPipeline` / `GeoPresenceTracker`.
 final class GeohashSubscriptionManager {
@@ -162,13 +162,13 @@ final class GeohashSubscriptionManager {
         if let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
             let dmSub = "geo-dm-\(channel.geohash)"
             context.setGeoDmSubscriptionID(dmSub)
-            let dmFilter = NostrFilter.giftWrapsFor(
+            let dmFilters = NostrFilter.privateEnvelopeFiltersFor(
                 pubkey: identity.publicKeyHex,
                 since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
             )
-            NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
+            NostrRelayManager.shared.subscribe(filters: dmFilters, id: dmSub) { [weak self] envelope in
                 Task { @MainActor [weak self] in
-                    self?.inbound.subscribeGiftWrap(giftWrap, id: identity)
+                    self?.inbound.subscribePrivateEnvelope(envelope, id: identity)
                 }
             }
         }
@@ -260,13 +260,13 @@ final class GeohashSubscriptionManager {
         if TorManager.shared.isReady {
             SecureLogger.debug("GeoDM: subscribing DMs pub=\(identity.publicKeyHex.prefix(8))… sub=\(dmSub)", category: .session)
         }
-        let dmFilter = NostrFilter.giftWrapsFor(
+        let dmFilters = NostrFilter.privateEnvelopeFiltersFor(
             pubkey: identity.publicKeyHex,
             since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
         )
-        NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
+        NostrRelayManager.shared.subscribe(filters: dmFilters, id: dmSub) { [weak self] envelope in
             Task { @MainActor [weak self] in
-                self?.inbound.handleGiftWrap(giftWrap, id: identity)
+                self?.inbound.handlePrivateEnvelope(envelope, id: identity)
             }
         }
     }
@@ -388,14 +388,14 @@ final class GeohashSubscriptionManager {
             category: .session
         )
 
-        let filter = NostrFilter.giftWrapsFor(
+        let filters = NostrFilter.privateEnvelopeFiltersFor(
             pubkey: currentIdentity.publicKeyHex,
             since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
         )
 
-        context.nostrRelayManager?.subscribe(filter: filter, id: "chat-messages") { [weak self] event in
+        context.nostrRelayManager?.subscribe(filters: filters, id: "chat-messages") { [weak self] event in
             Task { @MainActor [weak self] in
-                self?.inbound.handleNostrMessage(event)
+                self?.inbound.handleAccountPrivateEnvelope(event)
             }
         }
     }

bitchat/ViewModels/MessageRateLimiter.swift

@@ -26,6 +26,10 @@ struct MessageRateLimiter {
             }
             return false
         }
+
+        func isIdle(since now: Date, idleTTL: TimeInterval) -> Bool {
+            now.timeIntervalSince(lastRefill) >= idleTTL
+        }
     }
 
     private var senderBuckets: [String: TokenBucket] = [:]
@@ -35,17 +39,26 @@ struct MessageRateLimiter {
     private let senderRefill: Double
     private let contentCapacity: Double
     private let contentRefill: Double
+    private let maxSenderBuckets: Int
+    private let maxContentBuckets: Int
+    private let bucketIdleTTL: TimeInterval
 
     init(
         senderCapacity: Double,
         senderRefillPerSec: Double,
         contentCapacity: Double,
-        contentRefillPerSec: Double
+        contentRefillPerSec: Double,
+        maxSenderBuckets: Int = TransportConfig.uiSenderRateBucketMaxEntries,
+        maxContentBuckets: Int = TransportConfig.uiContentRateBucketMaxEntries,
+        bucketIdleTTL: TimeInterval = TransportConfig.uiRateBucketIdleTTL
     ) {
         self.senderCapacity = senderCapacity
         self.senderRefill = senderRefillPerSec
         self.contentCapacity = contentCapacity
         self.contentRefill = contentRefillPerSec
+        self.maxSenderBuckets = max(1, maxSenderBuckets)
+        self.maxContentBuckets = max(1, maxContentBuckets)
+        self.bucketIdleTTL = bucketIdleTTL
     }
 
     /// - Parameter powBits: validated NIP-13 difficulty of the event
@@ -58,25 +71,83 @@ struct MessageRateLimiter {
         if powBits >= NostrPoW.rateLimitBypassBits {
             senderAllowed = true
         } else {
-            var senderBucket = senderBuckets[senderKey] ?? TokenBucket(
+            var senderBucket = Self.bucket(
+                for: senderKey,
+                in: &senderBuckets,
                 capacity: senderCapacity,
-                tokens: senderCapacity,
                 refillPerSec: senderRefill,
-                lastRefill: now
+                maxBuckets: maxSenderBuckets,
+                idleTTL: bucketIdleTTL,
+                now: now
             )
             senderAllowed = senderBucket.allow(now: now)
             senderBuckets[senderKey] = senderBucket
         }
 
-        var contentBucket = contentBuckets[contentKey] ?? TokenBucket(
+        // Rejected senders must not mint attacker-keyed content entries.
+        guard senderAllowed else { return false }
+
+        var contentBucket = Self.bucket(
+            for: contentKey,
+            in: &contentBuckets,
             capacity: contentCapacity,
-            tokens: contentCapacity,
             refillPerSec: contentRefill,
-            lastRefill: now
+            maxBuckets: maxContentBuckets,
+            idleTTL: bucketIdleTTL,
+            now: now
         )
         let contentAllowed = contentBucket.allow(now: now)
         contentBuckets[contentKey] = contentBucket
 
-        return senderAllowed && contentAllowed
+        return contentAllowed
+    }
+
+    mutating func reset() {
+        senderBuckets.removeAll()
+        contentBuckets.removeAll()
+    }
+
+    var bucketCountsForTesting: (sender: Int, content: Int) {
+        (senderBuckets.count, contentBuckets.count)
+    }
+
+    // Static so we can take `inout` on a stored dictionary without overlapping
+    // exclusive access through a mutating method on `self`.
+    private static func bucket(
+        for key: String,
+        in buckets: inout [String: TokenBucket],
+        capacity: Double,
+        refillPerSec: Double,
+        maxBuckets: Int,
+        idleTTL: TimeInterval,
+        now: Date
+    ) -> TokenBucket {
+        if let existing = buckets[key] {
+            return existing
+        }
+
+        evictIfNeeded(from: &buckets, maxBuckets: maxBuckets, idleTTL: idleTTL, now: now)
+        return TokenBucket(
+            capacity: capacity,
+            tokens: capacity,
+            refillPerSec: refillPerSec,
+            lastRefill: now
+        )
+    }
+
+    private static func evictIfNeeded(
+        from buckets: inout [String: TokenBucket],
+        maxBuckets: Int,
+        idleTTL: TimeInterval,
+        now: Date
+    ) {
+        guard buckets.count >= maxBuckets else { return }
+
+        buckets = buckets.filter { !$0.value.isIdle(since: now, idleTTL: idleTTL) }
+        guard buckets.count >= maxBuckets else { return }
+
+        if let oldestKey = buckets.min(by: { $0.value.lastRefill < $1.value.lastRefill })?.key {
+            buckets.removeValue(forKey: oldestKey)
+        }
     }
 }

bitchat/ViewModels/NostrInboundPipeline.swift

@@ -84,13 +84,21 @@ extension ChatViewModel: NostrInboundPipelineContext {
 /// Ordering is deliberate and performance-critical: cheap rejects (kind,
 /// dedup lookup) run BEFORE Schnorr signature verification because duplicates
 /// dominate real relay traffic; events are recorded only AFTER verification so
-/// a forged-signature copy can never poison the dedup set; gift-wrap
+/// a forged-signature copy can never poison the dedup set; private-envelope
 /// verification for the account mailbox runs off-main with an atomic
 /// main-actor check-and-record.
 final class NostrInboundPipeline {
     private weak var context: (any NostrInboundPipelineContext)?
     private let presence: GeoPresenceTracker
     private var geoEventLogCount = 0
+    // During the coordinated wire-format migration, one logical private
+    // payload is published under both primary and compatibility formats. Outer
+    // event IDs differ, so collapse the authenticated embedded payload before
+    // invoking message/ack side effects. Keep this bounded like the outer-ID
+    // caches; the recipient and authenticated sender are part of the key.
+    private var recentPrivatePayloadFormats: [String: UInt8] = [:]
+    private var recentPrivatePayloadKeyOrder: [String] = []
+    private static let privatePayloadDedupCapacity = 2_048
 
     init(context: any NostrInboundPipelineContext, presence: GeoPresenceTracker) {
         self.context = context
@@ -196,7 +204,10 @@ final class NostrInboundPipeline {
         // Sampled: fires for every geo event and floods dev logs in busy geohashes.
         geoEventLogCount += 1
         if geoEventLogCount == 1 || geoEventLogCount.isMultiple(of: TransportConfig.nostrInboundEventLogInterval) {
-            SecureLogger.debug("GeoTeleport: recv #\(geoEventLogCount) pub=\(event.pubkey.prefix(8))… pow=\(powBits) tags=\(event.tags.map { "[" + $0.joined(separator: ",") + "]" }.joined(separator: ","))", category: .session)
+            SecureLogger.debug(
+                "GeoTeleport: recv #\(geoEventLogCount) pub=\(event.pubkey.prefix(8))… pow=\(powBits) tagCount=\(event.tags.count)",
+                category: .session
+            )
         }
 
         if context.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
@@ -268,15 +279,16 @@ final class NostrInboundPipeline {
     }
 
     @MainActor
-    func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
+    func subscribePrivateEnvelope(_ envelope: NostrEvent, id: NostrIdentity) {
         guard let context else { return }
         // Dedup lookup before Schnorr verification; record only after it passes.
-        guard !context.hasProcessedNostrEvent(giftWrap.id) else { return }
-        guard giftWrap.isValidSignature() else { return }
-        context.recordProcessedNostrEvent(giftWrap.id)
+        guard !context.hasProcessedNostrEvent(envelope.id) else { return }
+        guard envelope.content.utf8.count <= NostrProtocol.maximumPrivateEnvelopeCiphertextBytes else { return }
+        guard envelope.isValidSignature() else { return }
+        context.recordProcessedNostrEvent(envelope.id)
 
-        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
-            giftWrap: giftWrap,
+        guard let (content, senderPubkey, messageTs) = try? NostrProtocol.decryptPrivateEnvelope(
+            envelope: envelope,
             recipientIdentity: id
         ),
         let packet = Self.decodeEmbeddedBitChatPacket(from: content),
@@ -285,8 +297,14 @@ final class NostrInboundPipeline {
         else {
             return
         }
+        guard shouldProcessPrivatePayload(
+            noisePayload,
+            senderPubkey: senderPubkey,
+            recipientPubkey: id.publicKeyHex,
+            envelopeKind: envelope.kind
+        ) else { return }
 
-        let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
+        let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(messageTs))
         let convKey = PeerID(nostr_: senderPubkey)
         context.registerNostrKeyMapping(senderPubkey, for: convKey)
 
@@ -307,31 +325,32 @@ final class NostrInboundPipeline {
         // claiming to be group traffic over Nostr is ignored.
         // Live voice is mesh-only: latency and relay cost make it
         // meaningless over Nostr.
-        case .verifyChallenge, .verifyResponse, .groupInvite, .groupKeyUpdate, .vouch, .voiceFrame:
+        case .verifyChallenge, .verifyResponse, .groupInvite, .groupKeyUpdate, .vouch, .voiceFrame, .privateFile, .authenticatedPeerState:
             break
         }
     }
 
     @MainActor
-    func handleGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
+    func handlePrivateEnvelope(_ envelope: NostrEvent, id: NostrIdentity) {
         guard let context else { return }
         // Dedup lookup before Schnorr verification; record only after it passes.
-        if context.hasProcessedNostrEvent(giftWrap.id) {
+        if context.hasProcessedNostrEvent(envelope.id) {
             return
         }
-        guard giftWrap.isValidSignature() else { return }
-        context.recordProcessedNostrEvent(giftWrap.id)
+        guard envelope.content.utf8.count <= NostrProtocol.maximumPrivateEnvelopeCiphertextBytes else { return }
+        guard envelope.isValidSignature() else { return }
+        context.recordProcessedNostrEvent(envelope.id)
 
-        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
-            giftWrap: giftWrap,
+        guard let (content, senderPubkey, messageTs) = try? NostrProtocol.decryptPrivateEnvelope(
+            envelope: envelope,
             recipientIdentity: id
         ) else {
-            SecureLogger.warning("GeoDM: failed decrypt giftWrap id=\(giftWrap.id.prefix(8))…", category: .session)
+            SecureLogger.warning("GeoDM: failed decrypt private envelope id=\(envelope.id.prefix(8))…", category: .session)
             return
         }
 
         SecureLogger.debug(
-            "GeoDM: decrypted gift-wrap id=\(giftWrap.id.prefix(16))... from=\(senderPubkey.prefix(8))...",
+            "GeoDM: decrypted private envelope id=\(envelope.id.prefix(16))... from=\(senderPubkey.prefix(8))...",
             category: .session
         )
 
@@ -341,13 +360,19 @@ final class NostrInboundPipeline {
         else {
             return
         }
+        guard shouldProcessPrivatePayload(
+            payload,
+            senderPubkey: senderPubkey,
+            recipientPubkey: id.publicKeyHex,
+            envelopeKind: envelope.kind
+        ) else { return }
 
         let convKey = PeerID(nostr_: senderPubkey)
         context.registerNostrKeyMapping(senderPubkey, for: convKey)
 
         switch payload.type {
         case .privateMessage:
-            let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
+            let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(messageTs))
             context.handlePrivateMessage(
                 payload,
                 senderPubkey: senderPubkey,
@@ -363,34 +388,35 @@ final class NostrInboundPipeline {
         // claiming to be group traffic over Nostr is ignored.
         // Live voice is mesh-only: latency and relay cost make it
         // meaningless over Nostr.
-        case .verifyChallenge, .verifyResponse, .groupInvite, .groupKeyUpdate, .vouch, .voiceFrame:
+        case .verifyChallenge, .verifyResponse, .groupInvite, .groupKeyUpdate, .vouch, .voiceFrame, .privateFile, .authenticatedPeerState:
             break
         }
     }
 
     @MainActor
-    func handleNostrMessage(_ giftWrap: NostrEvent) {
+    func handleAccountPrivateEnvelope(_ envelope: NostrEvent) {
         guard let context else { return }
         // Cheap dedup pre-check only; Schnorr verification runs off-main in
-        // processNostrMessage, which then does the authoritative
+        // processAccountPrivateEnvelope, which then does the authoritative
         // check-and-record. Recording stays after verification so a
         // forged-signature copy can never poison the dedup set and suppress
         // the genuine event.
-        if context.hasProcessedNostrEvent(giftWrap.id) { return }
+        if context.hasProcessedNostrEvent(envelope.id) { return }
 
         Task.detached(priority: .userInitiated) { [weak self] in
-            await self?.processNostrMessage(giftWrap)
+            await self?.processAccountPrivateEnvelope(envelope)
         }
     }
 
-    func processNostrMessage(_ giftWrap: NostrEvent) async {
-        guard giftWrap.isValidSignature() else { return }
+    func processAccountPrivateEnvelope(_ envelope: NostrEvent) async {
+        guard envelope.content.utf8.count <= NostrProtocol.maximumPrivateEnvelopeCiphertextBytes else { return }
+        guard envelope.isValidSignature() else { return }
         guard let context else { return }
         // Authoritative check-and-record, atomic on the main actor so two
         // concurrent detached tasks can't both process the same event.
         let alreadyProcessed: Bool = await MainActor.run {
-            if context.hasProcessedNostrEvent(giftWrap.id) { return true }
-            context.recordProcessedNostrEvent(giftWrap.id)
+            if context.hasProcessedNostrEvent(envelope.id) { return true }
+            context.recordProcessedNostrEvent(envelope.id)
             return false
         }
         if alreadyProcessed { return }
@@ -400,8 +426,8 @@ final class NostrInboundPipeline {
         guard let currentIdentity else { return }
 
         do {
-            let (content, senderPubkey, rumorTimestamp) = try NostrProtocol.decryptPrivateMessage(
-                giftWrap: giftWrap,
+            let (content, senderPubkey, messageTimestampSeconds) = try NostrProtocol.decryptPrivateEnvelope(
+                envelope: envelope,
                 recipientIdentity: currentIdentity
             )
 
@@ -425,8 +451,14 @@ final class NostrInboundPipeline {
 
                 if packet.type == MessageType.noiseEncrypted.rawValue,
                    let payload = NoisePayload.decode(packet.payload) {
-                    let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTimestamp))
+                    let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(messageTimestampSeconds))
                     await MainActor.run {
+                        guard self.shouldProcessPrivatePayload(
+                            payload,
+                            senderPubkey: senderPubkey,
+                            recipientPubkey: currentIdentity.publicKeyHex,
+                            envelopeKind: envelope.kind
+                        ) else { return }
                         context.registerNostrKeyMapping(senderPubkey, for: targetPeerID)
 
                         switch payload.type {
@@ -446,7 +478,7 @@ final class NostrInboundPipeline {
                         // in v1; group traffic over Nostr is ignored.
                         // Live voice is mesh-only: latency and relay cost make it
                         // meaningless over Nostr.
-                        case .verifyChallenge, .verifyResponse, .groupInvite, .groupKeyUpdate, .vouch, .voiceFrame:
+                        case .verifyChallenge, .verifyResponse, .groupInvite, .groupKeyUpdate, .vouch, .voiceFrame, .privateFile, .authenticatedPeerState:
                             break
                         }
                     }
@@ -500,6 +532,47 @@ final class NostrInboundPipeline {
 }
 
 private extension NostrInboundPipeline {
+    @MainActor
+    func shouldProcessPrivatePayload(
+        _ payload: NoisePayload,
+        senderPubkey: String,
+        recipientPubkey: String,
+        envelopeKind: Int
+    ) -> Bool {
+        let digest = payload.encode().sha256Fingerprint()
+        let key = "\(recipientPubkey.lowercased()):\(senderPubkey.lowercased()):\(digest)"
+        let formatBit: UInt8
+        switch envelopeKind {
+        case NostrProtocol.EventKind.privateEnvelope.rawValue:
+            formatBit = 1 << 0
+        case NostrProtocol.EventKind.legacyNIP59GiftWrap.rawValue:
+            formatBit = 1 << 1
+        default:
+            return true
+        }
+
+        if let observedFormats = recentPrivatePayloadFormats[key] {
+            if observedFormats & formatBit != 0 {
+                // A same-format re-envelope is a delivery retry. Let it reach
+                // the coordinator so a lost DELIVERED acknowledgement can be
+                // sent again; downstream message-ID dedup prevents rerendering.
+                return true
+            }
+            // The same authenticated payload under the other migration format
+            // is the compatibility twin, not a new message or acknowledgement.
+            recentPrivatePayloadFormats[key] = observedFormats | formatBit
+            return false
+        }
+
+        recentPrivatePayloadFormats[key] = formatBit
+        recentPrivatePayloadKeyOrder.append(key)
+        if recentPrivatePayloadKeyOrder.count > Self.privatePayloadDedupCapacity {
+            let evicted = recentPrivatePayloadKeyOrder.removeFirst()
+            recentPrivatePayloadFormats.removeValue(forKey: evicted)
+        }
+        return true
+    }
+
     @MainActor
     static func decodeEmbeddedBitChatPacket(from content: String) -> BitchatPacket? {
         guard content.hasPrefix("bitchat1:") else { return nil }

bitchat/ViewModels/VoiceRecordingViewModel.swift

@@ -188,8 +188,25 @@ final class VoiceRecordingViewModel: ObservableObject {
 
         Task {
             let finalDuration = Date().timeIntervalSince(startDate)
-            if let url = await session.finish(),
-               isValidRecording(at: url, duration: finalDuration) {
+            if let url = await session.finish() {
+                // Panic and a newer hold both invalidate this completion.
+                // Never route an old recording using a post-panic target.
+                guard generation == holdGeneration else {
+                    try? FileManager.default.removeItem(at: url)
+                    return
+                }
+                guard isValidRecording(
+                    at: url,
+                    duration: finalDuration
+                ) else {
+                    guard state == .idle else { return }
+                    state = .error(
+                        message: finalDuration < VoiceRecorder.minRecordingDuration
+                        ? "Recording is too short."
+                        : "Recording failed to save."
+                    )
+                    return
+                }
                 completion(url)
             } else {
                 guard generation == holdGeneration, state == .idle else { return }
@@ -206,6 +223,17 @@ final class VoiceRecordingViewModel: ObservableObject {
         finish(completion: nil)
     }
 
+    /// Invalidates in-flight permission/start/finalize callbacks and tears
+    /// down an active microphone before the panic transaction continues.
+    func panicWipe() {
+        holdGeneration &+= 1
+        let session = activeSession
+        activeSession = nil
+        state = .idle
+        isLiveStreaming = false
+        session?.panicCancelSynchronously()
+    }
+
     private func isValidRecording(at url: URL, duration: TimeInterval) -> Bool {
         if let attributes = try? FileManager.default.attributesOfItem(atPath: url.path),
            let fileSize = attributes[.size] as? NSNumber,

bitchat/Views/AppInfoView.swift

@@ -26,6 +26,10 @@ struct AppInfoView: View {
     /// introduction), and afterwards the sheet reopens wherever it was left.
     @AppStorage("appInfo.selectedPane") private var selectedPane: Pane = .info
     @State private var showPanicConfirmation = false
+    @AppStorage(AppLanguageSettings.overrideKey) private var languageOverride = ""
+    /// The override changed this session; localization resolves at process
+    /// start, so surface the restart hint.
+    @State private var showLanguageRestartNote = false
 
     private enum Pane: String {
         case settings
@@ -55,6 +59,11 @@ struct AppInfoView: View {
 
             static let connectivityTitle = String(localized: "app_info.settings.connectivity.title", defaultValue: "CONNECTIVITY", comment: "Section header (uppercase) for the connectivity toggles: mesh bridge, internet gateway, tor routing")
 
+            static let languageTitle = String(localized: "app_info.settings.language.title", defaultValue: "LANGUAGE", comment: "Section header (uppercase) for the app language picker in settings")
+            static let languagePickerLabel = String(localized: "app_info.settings.language.picker_label", defaultValue: "app language", comment: "Label of the app language picker row in settings")
+            static let languageSystem = String(localized: "app_info.settings.language.system", defaultValue: "system default", comment: "Menu option that clears the in-app language override so the app follows the device language")
+            static let languageRestartNote = String(localized: "app_info.settings.language.restart_note", defaultValue: "restart bitchat to apply the new language", comment: "Caption shown after the user picks a different app language; the change takes effect on next launch")
+
             static let bridgeTitle = String(localized: "app_info.settings.bridge.title", defaultValue: "mesh bridge", comment: "Title of the mesh bridge toggle in settings")
             static let bridgeSubtitle = String(localized: "app_info.settings.bridge.subtitle", defaultValue: "joins nearby mesh islands over the internet: what you say in the mesh channel also reaches people in your area beyond radio range, and their messages appear here marked with the network glyph. while you have internet, your device also carries bridge and location-channel traffic for phones around you that have none.", comment: "Subtitle explaining what the mesh bridge toggle does")
             static func bridgeCell(_ cell: String) -> String {
@@ -313,6 +322,52 @@ struct AppInfoView: View {
                 }
             }
 
+            // Language — an in-app override so the UI language can differ
+            // from the device language (takes effect on next launch).
+            VStack(alignment: .leading, spacing: 12) {
+                SectionHeader(verbatim: Strings.Settings.languageTitle)
+
+                settingsCard {
+                    Menu {
+                        Button {
+                            selectLanguage(nil)
+                        } label: {
+                            menuItemLabel(Strings.Settings.languageSystem, isSelected: languageOverride.isEmpty)
+                        }
+                        Divider()
+                        ForEach(AppLanguageSettings.availableLanguages, id: \.self) { code in
+                            Button {
+                                selectLanguage(code)
+                            } label: {
+                                menuItemLabel(AppLanguageSettings.endonym(for: code), isSelected: languageOverride == code)
+                            }
+                        }
+                    } label: {
+                        HStack {
+                            Text(Strings.Settings.languagePickerLabel)
+                                .bitchatFont(size: 12, weight: .semibold)
+                                .foregroundColor(textColor)
+                            Spacer()
+                            Text(languageOverride.isEmpty ? Strings.Settings.languageSystem : AppLanguageSettings.endonym(for: languageOverride))
+                                .bitchatFont(size: 12)
+                                .foregroundColor(palette.accent)
+                            Image(systemName: "chevron.up.chevron.down")
+                                .font(.system(size: 10))
+                                .foregroundColor(secondaryTextColor)
+                        }
+                        .contentShape(Rectangle())
+                    }
+                    .buttonStyle(.plain)
+
+                    if showLanguageRestartNote {
+                        Text(Strings.Settings.languageRestartNote)
+                            .bitchatFont(size: 11)
+                            .foregroundColor(secondaryTextColor)
+                            .fixedSize(horizontal: false, vertical: true)
+                    }
+                }
+            }
+
             // Voice — same card + IRC pill as every other toggle setting.
             VStack(alignment: .leading, spacing: 12) {
                 SectionHeader(Strings.Voice.title)
@@ -458,6 +513,24 @@ struct AppInfoView: View {
         .padding()
     }
 
+    private func selectLanguage(_ code: String?) {
+        let previous = languageOverride
+        AppLanguageSettings.setOverride(code)
+        languageOverride = code ?? ""
+        if languageOverride != previous {
+            showLanguageRestartNote = true
+        }
+    }
+
+    private func menuItemLabel(_ title: String, isSelected: Bool) -> some View {
+        HStack {
+            Text(title)
+            if isSelected {
+                Image(systemName: "checkmark")
+            }
+        }
+    }
+
     private var bridgeToggleBinding: Binding<Bool> {
         Binding(
             get: { bridgeService.isEnabled },

bitchat/Views/Components/TextMessageView.swift

@@ -41,7 +41,7 @@ struct TextMessageView: View {
             // first text line; a fixed top padding left the lock's solid body
             // hanging below the line's visual center.
             HStack(alignment: .firstTextBaseline, spacing: 0) {
-                let isLong = (message.content.count > TransportConfig.uiLongMessageLengthThreshold || message.content.hasVeryLongToken(threshold: TransportConfig.uiVeryLongTokenThreshold)) && cashuLinks.isEmpty
+                let isLong = message.content.isLongForDisplay()
                 let isExpanded = expandedMessageIDs.contains(message.id)
                 if message.isPrivate {
                     Image(systemName: "lock.fill")
@@ -103,7 +103,7 @@ struct TextMessageView: View {
             }
             
             // Expand/Collapse for very long messages
-            if (message.content.count > TransportConfig.uiLongMessageLengthThreshold || message.content.hasVeryLongToken(threshold: TransportConfig.uiVeryLongTokenThreshold)) && cashuLinks.isEmpty {
+            if message.content.isLongForDisplay() {
                 let isExpanded = expandedMessageIDs.contains(message.id)
                 let labelKey = isExpanded ? LocalizedStringKey("content.message.show_less") : LocalizedStringKey("content.message.show_more")
                 Button(labelKey) {

bitchat/Views/ContentSheetViews.swift

@@ -6,11 +6,26 @@ import UIKit
 import AppKit
 #endif
 
+struct ContentPeopleSheetModalPresentationState {
+    var isImagePreviewPresented = false
+    var isVerificationSheetPresented = false
+    var legacyPrivateMediaConsentRequest: LegacyPrivateMediaConsentRequest? = nil
+    var isMediaPickerPresented = false
+
+    var hasPresentation: Bool {
+        isImagePreviewPresented
+            || isVerificationSheetPresented
+            || legacyPrivateMediaConsentRequest != nil
+            || isMediaPickerPresented
+    }
+}
+
 struct ContentPeopleSheetView: View {
     @EnvironmentObject private var appChromeModel: AppChromeModel
     @EnvironmentObject private var privateConversationModel: PrivateConversationModel
     @EnvironmentObject private var verificationModel: VerificationModel
     @EnvironmentObject private var conversationUIModel: ConversationUIModel
+    @Environment(\.scenePhase) private var scenePhase
 
     @Binding var showSidebar: Bool
     @Binding var messageText: String
@@ -23,6 +38,7 @@ struct ContentPeopleSheetView: View {
     var isTextFieldFocused: FocusState<Bool>.Binding
     @ObservedObject var voiceRecordingVM: VoiceRecordingViewModel
     @Binding var autocompleteDebounceTimer: Timer?
+    @State private var showVerifySheet = false
     @ThemedPalette private var palette
 
     let headerHeight: CGFloat
@@ -35,7 +51,42 @@ struct ContentPeopleSheetView: View {
     @Binding var showMacImagePicker: Bool
     #endif
 
+    private var hasModalPresentation: Bool {
+        #if os(iOS)
+        let isMediaPickerPresented = showImagePicker
+        #else
+        let isMediaPickerPresented = showMacImagePicker
+        #endif
+
+        return ContentPeopleSheetModalPresentationState(
+            isImagePreviewPresented: imagePreviewURL != nil,
+            isVerificationSheetPresented: showVerifySheet,
+            legacyPrivateMediaConsentRequest:
+                conversationUIModel.legacyPrivateMediaConsentRequest,
+            isMediaPickerPresented: isMediaPickerPresented
+        ).hasPresentation
+    }
+
+    private var bluetoothAlertBinding: Binding<Bool> {
+        Binding(
+            get: {
+                scenePhase == .active
+                    && appChromeModel.showBluetoothAlert
+                    && !hasModalPresentation
+            },
+            set: { isPresented in
+                guard !isPresented,
+                      scenePhase == .active,
+                      !hasModalPresentation else {
+                    return
+                }
+                appChromeModel.showBluetoothAlert = false
+            }
+        )
+    }
+
     var body: some View {
+        let legacyConsentRequest = conversationUIModel.legacyPrivateMediaConsentRequest
         NavigationStack {
             Group {
                 if privateConversationModel.selectedPeerID != nil {
@@ -77,7 +128,8 @@ struct ContentPeopleSheetView: View {
                     #endif
                 } else {
                     ContentPeopleListView(
-                        showSidebar: $showSidebar
+                        showSidebar: $showSidebar,
+                        showVerifySheet: $showVerifySheet
                     )
                 }
             }
@@ -97,6 +149,63 @@ struct ContentPeopleSheetView: View {
         }
         .themedSheetBackground()
         .foregroundColor(palette.primary)
+        .confirmationDialog(
+            String(
+                localized: "content.private_media.legacy_warning.title",
+                defaultValue: "Send without end-to-end encryption?",
+                comment: "Title warning before sending private media to an older client in a clear signed envelope"
+            ),
+            isPresented: Binding(
+                get: { legacyConsentRequest != nil },
+                set: { isPresented in
+                    if !isPresented, let requestID = legacyConsentRequest?.id {
+                        conversationUIModel.resolveLegacyPrivateMediaConsent(
+                            requestID: requestID,
+                            approved: false
+                        )
+                    }
+                }
+            ),
+            titleVisibility: .visible
+        ) {
+            Button(
+                String(
+                    localized: "content.private_media.legacy_warning.send",
+                    defaultValue: "send visible file",
+                    comment: "Destructive confirmation action for one legacy clear private-media send"
+                ),
+                role: .destructive
+            ) {
+                if let requestID = legacyConsentRequest?.id {
+                    conversationUIModel.resolveLegacyPrivateMediaConsent(
+                        requestID: requestID,
+                        approved: true
+                    )
+                }
+            }
+            Button("common.cancel", role: .cancel) {
+                if let requestID = legacyConsentRequest?.id {
+                    conversationUIModel.resolveLegacyPrivateMediaConsent(
+                        requestID: requestID,
+                        approved: false
+                    )
+                }
+            }
+        } message: {
+            if let request = legacyConsentRequest {
+                Text(
+                    String(
+                        format: String(
+                            localized: "content.private_media.legacy_warning.message",
+                            defaultValue: "%@'s client does not advertise encrypted private media. This file will be signed but not end-to-end encrypted, so mesh relays can see it. Send this file anyway?",
+                            comment: "Warning explaining the confidentiality loss for one legacy private-media send; parameter is the peer name"
+                        ),
+                        locale: .current,
+                        request.peerName
+                    )
+                )
+            }
+        }
         #if os(macOS)
         .frame(minWidth: 420, minHeight: 520)
         #endif
@@ -124,6 +233,17 @@ struct ContentPeopleSheetView: View {
             }
         }
         #endif
+        .alert(
+            "content.alert.bluetooth_required.title",
+            isPresented: bluetoothAlertBinding
+        ) {
+            Button("content.alert.bluetooth_required.settings") {
+                SystemSettings.bluetooth.open()
+            }
+            Button("common.ok", role: .cancel) {}
+        } message: {
+            Text(appChromeModel.bluetoothAlertMessage)
+        }
     }
 }
 
@@ -138,8 +258,7 @@ private struct ContentPeopleListView: View {
     @ThemedPalette private var palette
 
     @Binding var showSidebar: Bool
-
-    @State private var showVerifySheet = false
+    @Binding var showVerifySheet: Bool
 
     var body: some View {
         VStack(spacing: 0) {
@@ -446,7 +565,8 @@ private struct ContentPrivateChatSheetView: View {
         if privateConversationModel.selectedPeerID?.isGroup == true {
             return String(localized: "content.private.caption_group", comment: "Caption above the group chat composer noting messages are encrypted to group members")
         }
-        // Geohash DMs are NIP-17 gift-wrapped — always end-to-end encrypted,
+        // Geohash DMs use BitChat's private-envelope transport over Nostr —
+        // always end-to-end encrypted,
         // even though they carry no Noise session status. Mesh DMs earn the
         // "encrypted" claim only once the Noise handshake has secured.
         let isGeoDM = privateConversationModel.selectedPeerID?.isGeoDM == true

bitchat/Views/ContentView.swift

@@ -14,6 +14,61 @@ import AppKit
 #endif
 import BitFoundation
 
+struct ContentRootModalPresentationState {
+    var isPeopleSheetPresented = false
+    var isAppInfoPresented = false
+    var isFingerprintPresented = false
+    var isLocationChannelsSheetPresented = false
+    var isNoticesSheetPresented = false
+    var isImagePreviewPresented = false
+    var isVerificationSheetPresented = false
+    var isVoiceAlertPresented = false
+    var isScreenshotPrivacyAlertPresented = false
+    var isMediaPickerPresented = false
+
+    var hasPresentation: Bool {
+        isPeopleSheetPresented
+            || isAppInfoPresented
+            || isFingerprintPresented
+            || isLocationChannelsSheetPresented
+            || isNoticesSheetPresented
+            || isImagePreviewPresented
+            || isVerificationSheetPresented
+            || isVoiceAlertPresented
+            || isScreenshotPrivacyAlertPresented
+            || isMediaPickerPresented
+    }
+}
+
+extension ContentRootModalPresentationState {
+    @MainActor
+    init(
+        appChromeModel: AppChromeModel,
+        isPeopleSheetPresented: Bool = false,
+        isImagePreviewPresented: Bool = false,
+        isVerificationSheetPresented: Bool = false,
+        isVoiceAlertPresented: Bool = false,
+        isMediaPickerPresented: Bool = false
+    ) {
+        self.init(
+            isPeopleSheetPresented: isPeopleSheetPresented,
+            isAppInfoPresented: appChromeModel.isAppInfoPresented,
+            isFingerprintPresented:
+                appChromeModel.showingFingerprintFor != nil,
+            isLocationChannelsSheetPresented:
+                appChromeModel.isLocationChannelsSheetPresented,
+            isNoticesSheetPresented:
+                appChromeModel.isNoticesSheetPresented,
+            isImagePreviewPresented: isImagePreviewPresented,
+            isVerificationSheetPresented: isVerificationSheetPresented,
+            isVoiceAlertPresented: isVoiceAlertPresented,
+            isScreenshotPrivacyAlertPresented:
+                appChromeModel.showScreenshotPrivacyWarning,
+            isMediaPickerPresented: isMediaPickerPresented
+        )
+    }
+}
+
 /// On macOS 14+, disables the default system focus ring on TextFields.
 /// On earlier macOS versions and on iOS this is a no-op.
 struct FocusEffectDisabledModifier: ViewModifier {
@@ -36,13 +91,13 @@ struct ContentView: View {
     @EnvironmentObject private var verificationModel: VerificationModel
     @EnvironmentObject private var conversationUIModel: ConversationUIModel
     @EnvironmentObject private var locationChannelsModel: LocationChannelsModel
-    @EnvironmentObject private var sharedContentImportModel: SharedContentImportModel
 
     @StateObject private var voiceRecordingVM = VoiceRecordingViewModel()
     @State private var messageText = ""
     @FocusState private var isTextFieldFocused: Bool
     @Environment(\.colorScheme) var colorScheme
     @Environment(\.appTheme) private var appTheme
+    @Environment(\.scenePhase) private var scenePhase
     @State private var showSidebar = false
     @State private var selectedMessageSender: String?
     @State private var selectedMessageSenderID: PeerID?
@@ -70,15 +125,46 @@ struct ContentView: View {
         privateConversationModel.selectedPeerID
     }
 
-    private var sharedContentDestination: SharedContentDestination {
-        SharedContentDestination.resolve(
-            selectedPrivatePeerID: selectedPrivatePeerID,
-            privateDisplayName: privateConversationModel.selectedHeaderState?.displayName,
-            activeChannel: locationChannelsModel.selectedChannel
-        )
+    private var usesGlassLayout: Bool { appTheme.usesGlassChrome }
+
+    private var isPeopleSheetPresented: Bool {
+        showSidebar || selectedPrivatePeerID != nil
     }
 
-    private var usesGlassLayout: Bool { appTheme.usesGlassChrome }
+    private var hasRootModalPresentation: Bool {
+        #if os(iOS)
+        let isMediaPickerPresented = showImagePicker
+        #else
+        let isMediaPickerPresented = showMacImagePicker
+        #endif
+
+        return ContentRootModalPresentationState(
+            appChromeModel: appChromeModel,
+            isPeopleSheetPresented: isPeopleSheetPresented,
+            isImagePreviewPresented: imagePreviewURL != nil,
+            isVerificationSheetPresented: showVerifySheet,
+            isVoiceAlertPresented: voiceRecordingVM.showAlert,
+            isMediaPickerPresented: isMediaPickerPresented
+        ).hasPresentation
+    }
+
+    private var rootBluetoothAlertBinding: Binding<Bool> {
+        Binding(
+            get: {
+                scenePhase == .active
+                    && appChromeModel.showBluetoothAlert
+                    && !hasRootModalPresentation
+            },
+            set: { isPresented in
+                guard !isPresented,
+                      scenePhase == .active,
+                      !hasRootModalPresentation else {
+                    return
+                }
+                appChromeModel.showBluetoothAlert = false
+            }
+        )
+    }
 
     var body: some View {
         mainContent
@@ -88,13 +174,15 @@ struct ContentView: View {
                 voiceRecordingVM.sessionProvider = { [weak conversationUIModel] in
                     conversationUIModel?.makeVoiceCaptureSession() ?? VoiceNoteCaptureSession()
                 }
+                appChromeModel.setPanicPreparation { [weak voiceRecordingVM] in
+                    voiceRecordingVM?.panicWipe()
+                }
                 #if os(macOS)
                 DispatchQueue.main.async {
                     isNicknameFieldFocused = false
                     isTextFieldFocused = true
                 }
                 #endif
-                sharedContentImportModel.updateDestination(sharedContentDestination)
             }
             .onChange(of: colorScheme) { newValue in
                 conversationUIModel.setCurrentColorScheme(newValue)
@@ -111,18 +199,21 @@ struct ContentView: View {
             if newValue != nil {
                 showSidebar = true
             }
-            sharedContentImportModel.updateDestination(sharedContentDestination)
-        }
-        .onChange(of: locationChannelsModel.selectedChannel) { _ in
-            sharedContentImportModel.updateDestination(sharedContentDestination)
         }
         .sheet(
             isPresented: Binding(
-                get: { showSidebar || selectedPrivatePeerID != nil },
+                get: { isPeopleSheetPresented },
                 set: { isPresented in
                     if !isPresented {
                         showSidebar = false
-                        privateConversationModel.endConversation()
+                        // Scene/background and Bluetooth-alert presentation
+                        // reconciliation are not user requests to leave the
+                        // conversation. Keep the selected DM so the sheet
+                        // remains live when the app returns from Settings.
+                        if scenePhase == .active,
+                           !appChromeModel.showBluetoothAlert {
+                            privateConversationModel.endConversation()
+                        }
                     }
                 }
             )
@@ -233,7 +324,7 @@ struct ContentView: View {
         }, message: {
             Text(voiceRecordingVM.state.alertMessage)
         })
-        .alert("content.alert.bluetooth_required.title", isPresented: $appChromeModel.showBluetoothAlert) {
+        .alert("content.alert.bluetooth_required.title", isPresented: rootBluetoothAlertBinding) {
             Button("content.alert.bluetooth_required.settings") {
                 SystemSettings.bluetooth.open()
             }
@@ -241,36 +332,9 @@ struct ContentView: View {
         } message: {
             Text(appChromeModel.bluetoothAlertMessage)
         }
-        .alert(
-            String(localized: "share_import.review.title", comment: "Title for reviewing content received from the share extension"),
-            isPresented: Binding(
-                get: { sharedContentImportModel.offer != nil },
-                set: { _ in }
-            ),
-            presenting: sharedContentImportModel.offer
-        ) { _ in
-            Button("common.cancel", role: .cancel) {
-                sharedContentImportModel.cancel(destination: sharedContentDestination)
-            }
-            Button("share_import.review.use_in_composer") {
-                guard let importedText = sharedContentImportModel.confirm(
-                    destination: sharedContentDestination
-                ) else { return }
-                // Replacing is deliberate and called out in the prompt. It
-                // avoids combining a stale draft from another conversation
-                // with newly shared content.
-                messageText = importedText
-                isTextFieldFocused = true
-            }
-        } message: { offer in
-            let format = String(
-                localized: "share_import.review.message",
-                comment: "Explains that shared content will replace the named destination's composer and will not be sent automatically"
-            )
-            Text(String(format: format, offer.destination.displayName) + "\n\n" + offer.payload.preview)
-        }
         .onDisappear {
             autocompleteDebounceTimer?.invalidate()
+            appChromeModel.setPanicPreparation(nil)
         }
     }
 

bitchat/Views/MessageTextHelpers.swift

@@ -21,6 +21,26 @@ extension String {
         return current >= threshold
     }
 
+    /// True when the message should collapse behind Show more in the UI.
+    /// Length alone decides this — embedding a Cashu-looking token must not
+    /// disable the guard (remote DoS via unbounded layout).
+    func isLongForDisplay(
+        lengthThreshold: Int = TransportConfig.uiLongMessageLengthThreshold,
+        tokenThreshold: Int = TransportConfig.uiVeryLongTokenThreshold
+    ) -> Bool {
+        count > lengthThreshold || hasVeryLongToken(threshold: tokenThreshold)
+    }
+
+    /// True when rich formatting (regex / link detectors) should be skipped.
+    /// Cashu presence used to exempt oversized content from the plain path;
+    /// that let untrusted input force expensive formatting work.
+    func isOversizedForRichFormatting(
+        lengthThreshold: Int = 4000,
+        tokenThreshold: Int = 1024
+    ) -> Bool {
+        count > lengthThreshold || hasVeryLongToken(threshold: tokenThreshold)
+    }
+
     // Extract up to `max` distinct Cashu tokens (cashuA/cashuB), as the bare
     // bearer strings. Allow dot '.' and shorter lengths. The `cashu:` URI
     // form matches too — the token embedded after the scheme is the match.

bitchat/_PreviewHelpers/PreviewKeychainManager.swift

@@ -14,11 +14,25 @@ final class PreviewKeychainManager: KeychainManagerProtocol {
     // every default-constructed component under test, which access it from
     // arbitrary threads.
     private let lock = NSLock()
+    private let installAccessGate: KeychainInstallAccessGate
+    private let reconcileInstallAccess: () -> Bool
     private var storage: [String: Data] = [:]
     private var serviceStorage: [String: [String: Data]] = [:]
-    init() {}
+
+    init(
+        installAccessGate: KeychainInstallAccessGate = KeychainInstallAccessGate(),
+        reconcileInstallAccess: @escaping () -> Bool = { true }
+    ) {
+        self.installAccessGate = installAccessGate
+        self.reconcileInstallAccess = reconcileInstallAccess
+    }
+
+    private func installAccessAllowed() -> Bool {
+        installAccessGate.allowsAccess(reconcile: reconcileInstallAccess)
+    }
 
     func saveIdentityKey(_ keyData: Data, forKey key: String) -> Bool {
+        guard installAccessAllowed() else { return false }
         lock.lock()
         defer { lock.unlock() }
         storage[key] = keyData
@@ -26,12 +40,14 @@ final class PreviewKeychainManager: KeychainManagerProtocol {
     }
 
     func getIdentityKey(forKey key: String) -> Data? {
+        guard installAccessAllowed() else { return nil }
         lock.lock()
         defer { lock.unlock() }
         return storage[key]
     }
 
     func deleteIdentityKey(forKey key: String) -> Bool {
+        guard installAccessAllowed() else { return false }
         lock.lock()
         defer { lock.unlock() }
         storage.removeValue(forKey: key)
@@ -51,6 +67,7 @@ final class PreviewKeychainManager: KeychainManagerProtocol {
     func secureClear(_ string: inout String) {}
 
     func verifyIdentityKeyExists() -> Bool {
+        guard installAccessAllowed() else { return false }
         lock.lock()
         defer { lock.unlock() }
         return storage["identity_noiseStaticKey"] != nil
@@ -58,6 +75,7 @@ final class PreviewKeychainManager: KeychainManagerProtocol {
 
     // BCH-01-009: New methods with proper error classification
     func getIdentityKeyWithResult(forKey key: String) -> KeychainReadResult {
+        guard installAccessAllowed() else { return .accessDenied }
         lock.lock()
         defer { lock.unlock() }
         if let data = storage[key] {
@@ -67,6 +85,7 @@ final class PreviewKeychainManager: KeychainManagerProtocol {
     }
 
     func saveIdentityKeyWithResult(_ keyData: Data, forKey key: String) -> KeychainSaveResult {
+        guard installAccessAllowed() else { return .accessDenied }
         lock.lock()
         defer { lock.unlock() }
         storage[key] = keyData
@@ -76,24 +95,38 @@ final class PreviewKeychainManager: KeychainManagerProtocol {
     // MARK: - Generic Data Storage (consolidated from KeychainHelper)
 
     func save(key: String, data: Data, service: String, accessible: CFString?) {
+        guard installAccessAllowed() else { return }
         lock.lock()
         defer { lock.unlock() }
         serviceStorage[service, default: [:]][key] = data
     }
 
     func load(key: String, service: String) -> Data? {
+        guard case .success(let data) = loadWithResult(key: key, service: service) else {
+            return nil
+        }
+        return data
+    }
+
+    func loadWithResult(key: String, service: String) -> KeychainReadResult {
+        guard installAccessAllowed() else { return .accessDenied }
         lock.lock()
         defer { lock.unlock() }
-        return serviceStorage[service]?[key]
+        guard let data = serviceStorage[service]?[key] else {
+            return .itemNotFound
+        }
+        return .success(data)
     }
 
     func delete(key: String, service: String) {
+        guard installAccessAllowed() else { return }
         lock.lock()
         defer { lock.unlock() }
         serviceStorage[service]?.removeValue(forKey: key)
     }
 
     func deleteAll(service: String) {
+        guard installAccessAllowed() else { return }
         lock.lock()
         defer { lock.unlock() }
         serviceStorage.removeValue(forKey: service)

bitchatShareExtension/Localization/Localizable.xcstrings

@@ -38,6 +38,12 @@
             "comment" : "Fallback title when saving a shared link"
           }
         },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "پیوند اشتراک‌گذاری‌شده"
+          }
+        },
         "fil" : {
           "stringUnit" : {
             "state" : "needs_review",
@@ -197,7 +203,7 @@
       }
     },
     "share.status.failed_to_encode" : {
-      "extractionState" : "stale",
+      "extractionState" : "manual",
       "localizations" : {
         "ar" : {
           "stringUnit" : {
@@ -233,6 +239,12 @@
             "comment" : "Shown when the share payload cannot be encoded"
           }
         },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "کدگذاری پیوند ناموفق بود"
+          }
+        },
         "fil" : {
           "stringUnit" : {
             "state" : "needs_review",
@@ -428,6 +440,12 @@
             "comment" : "Shown when provided content cannot be shared"
           }
         },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "محتوای قابل اشتراک‌گذاری وجود ندارد"
+          }
+        },
         "fil" : {
           "stringUnit" : {
             "state" : "needs_review",
@@ -623,6 +641,12 @@
             "comment" : "Shown when the share extension receives no content"
           }
         },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "چیزی برای اشتراک‌گذاری نیست"
+          }
+        },
         "fil" : {
           "stringUnit" : {
             "state" : "needs_review",
@@ -782,7 +806,7 @@
       }
     },
     "share.status.shared_link" : {
-      "extractionState" : "stale",
+      "extractionState" : "manual",
       "localizations" : {
         "ar" : {
           "stringUnit" : {
@@ -818,6 +842,12 @@
             "comment" : "Confirmation after successfully sharing a link"
           }
         },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "✓ پیوند در bitchat به اشتراک گذاشته شد"
+          }
+        },
         "fil" : {
           "stringUnit" : {
             "state" : "needs_review",
@@ -977,7 +1007,7 @@
       }
     },
     "share.status.shared_text" : {
-      "extractionState" : "stale",
+      "extractionState" : "manual",
       "localizations" : {
         "ar" : {
           "stringUnit" : {
@@ -1013,6 +1043,12 @@
             "comment" : "Confirmation after successfully sharing text"
           }
         },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "✓ متن در bitchat به اشتراک گذاشته شد"
+          }
+        },
         "fil" : {
           "stringUnit" : {
             "state" : "needs_review",
@@ -1170,76 +1206,6 @@
           }
         }
       }
-    },
-    "share.status.failed_to_save" : {
-      "comment" : "Shown when content cannot be staged for the main app",
-      "extractionState" : "manual",
-      "localizations" : {
-        "ar" : { "stringUnit" : { "state" : "needs_review", "value" : "تعذر الحفظ في bitchat" } },
-        "bn" : { "stringUnit" : { "state" : "needs_review", "value" : "bitchat-এ সংরক্ষণ করা যায়নি" } },
-        "de" : { "stringUnit" : { "state" : "needs_review", "value" : "Konnte nicht in bitchat gespeichert werden" } },
-        "en" : { "stringUnit" : { "state" : "translated", "value" : "Could not save to bitchat" } },
-        "es" : { "stringUnit" : { "state" : "needs_review", "value" : "No se pudo guardar en bitchat" } },
-        "fil" : { "stringUnit" : { "state" : "needs_review", "value" : "Hindi ma-save sa bitchat" } },
-        "fr" : { "stringUnit" : { "state" : "needs_review", "value" : "Impossible d’enregistrer dans bitchat" } },
-        "he" : { "stringUnit" : { "state" : "needs_review", "value" : "לא ניתן לשמור ב-bitchat" } },
-        "hi" : { "stringUnit" : { "state" : "needs_review", "value" : "bitchat में सेव नहीं किया जा सका" } },
-        "id" : { "stringUnit" : { "state" : "needs_review", "value" : "Tidak dapat menyimpan ke bitchat" } },
-        "it" : { "stringUnit" : { "state" : "needs_review", "value" : "Impossibile salvare in bitchat" } },
-        "ja" : { "stringUnit" : { "state" : "needs_review", "value" : "bitchat に保存できませんでした" } },
-        "ko" : { "stringUnit" : { "state" : "needs_review", "value" : "bitchat에 저장할 수 없습니다" } },
-        "ms" : { "stringUnit" : { "state" : "needs_review", "value" : "Tidak dapat menyimpan ke bitchat" } },
-        "ne" : { "stringUnit" : { "state" : "needs_review", "value" : "bitchat मा सुरक्षित गर्न सकिएन" } },
-        "nl" : { "stringUnit" : { "state" : "needs_review", "value" : "Kon niet opslaan in bitchat" } },
-        "pl" : { "stringUnit" : { "state" : "needs_review", "value" : "Nie udało się zapisać w bitchat" } },
-        "pt" : { "stringUnit" : { "state" : "needs_review", "value" : "Não foi possível guardar no bitchat" } },
-        "pt-BR" : { "stringUnit" : { "state" : "needs_review", "value" : "Não foi possível salvar no bitchat" } },
-        "ru" : { "stringUnit" : { "state" : "needs_review", "value" : "Не удалось сохранить в bitchat" } },
-        "sv" : { "stringUnit" : { "state" : "needs_review", "value" : "Kunde inte spara i bitchat" } },
-        "ta" : { "stringUnit" : { "state" : "needs_review", "value" : "bitchat-இல் சேமிக்க முடியவில்லை" } },
-        "th" : { "stringUnit" : { "state" : "needs_review", "value" : "บันทึกไปยัง bitchat ไม่ได้" } },
-        "tr" : { "stringUnit" : { "state" : "needs_review", "value" : "bitchat’e kaydedilemedi" } },
-        "uk" : { "stringUnit" : { "state" : "needs_review", "value" : "Не вдалося зберегти в bitchat" } },
-        "ur" : { "stringUnit" : { "state" : "needs_review", "value" : "bitchat میں محفوظ نہیں ہو سکا" } },
-        "vi" : { "stringUnit" : { "state" : "needs_review", "value" : "Không thể lưu vào bitchat" } },
-        "zh-Hans" : { "stringUnit" : { "state" : "needs_review", "value" : "无法保存到 bitchat" } },
-        "zh-Hant" : { "stringUnit" : { "state" : "needs_review", "value" : "無法儲存到 bitchat" } }
-      }
-    },
-    "share.status.saved_for_review" : {
-      "comment" : "Shown after content is staged for review in the main app",
-      "extractionState" : "manual",
-      "localizations" : {
-        "ar" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ حُفظ في bitchat — افتح التطبيق للمراجعة" } },
-        "bn" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ bitchat-এ সংরক্ষিত — পর্যালোচনার জন্য অ্যাপটি খুলুন" } },
-        "de" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ In bitchat gespeichert — App zum Prüfen öffnen" } },
-        "en" : { "stringUnit" : { "state" : "translated", "value" : "✓ Saved in bitchat — open the app to review" } },
-        "es" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Guardado en bitchat — abre la app para revisarlo" } },
-        "fil" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Na-save sa bitchat — buksan ang app para suriin" } },
-        "fr" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Enregistré dans bitchat — ouvrez l’app pour vérifier" } },
-        "he" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ נשמר ב-bitchat — יש לפתוח את האפליקציה לבדיקה" } },
-        "hi" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ bitchat में सेव किया गया — समीक्षा के लिए ऐप खोलें" } },
-        "id" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Disimpan di bitchat — buka aplikasi untuk meninjau" } },
-        "it" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Salvato in bitchat — apri l’app per controllare" } },
-        "ja" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ bitchat に保存しました — アプリを開いて確認してください" } },
-        "ko" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ bitchat에 저장됨 — 앱을 열어 검토하세요" } },
-        "ms" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Disimpan dalam bitchat — buka aplikasi untuk menyemak" } },
-        "ne" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ bitchat मा सुरक्षित गरियो — समीक्षा गर्न एप खोल्नुहोस्" } },
-        "nl" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Opgeslagen in bitchat — open de app om te bekijken" } },
-        "pl" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Zapisano w bitchat — otwórz aplikację, aby sprawdzić" } },
-        "pt" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Guardado no bitchat — abra a app para rever" } },
-        "pt-BR" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Salvo no bitchat — abra o app para revisar" } },
-        "ru" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Сохранено в bitchat — откройте приложение для проверки" } },
-        "sv" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Sparat i bitchat — öppna appen för att granska" } },
-        "ta" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ bitchat-இல் சேமிக்கப்பட்டது — மதிப்பாய்வு செய்ய செயலியைத் திறக்கவும்" } },
-        "th" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ บันทึกใน bitchat แล้ว — เปิดแอปเพื่อตรวจสอบ" } },
-        "tr" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ bitchat’e kaydedildi — incelemek için uygulamayı açın" } },
-        "uk" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Збережено в bitchat — відкрийте застосунок для перегляду" } },
-        "ur" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ bitchat میں محفوظ ہو گیا — جائزے کے لیے ایپ کھولیں" } },
-        "vi" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ Đã lưu trong bitchat — mở ứng dụng để xem lại" } },
-        "zh-Hans" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ 已保存在 bitchat 中 — 打开应用查看" } },
-        "zh-Hant" : { "stringUnit" : { "state" : "needs_review", "value" : "✓ 已儲存在 bitchat 中 — 開啟 App 查看" } }
-      }
     }
   },
   "version" : "1.0"

bitchatShareExtension/ShareViewController.swift

@@ -19,8 +19,9 @@ final class ShareViewController: UIViewController {
         static let nothingToShare = String(localized: "share.status.nothing_to_share", comment: "Shown when the share extension receives no content")
         static let noShareableContent = String(localized: "share.status.no_shareable_content", comment: "Shown when provided content cannot be shared")
         static let sharedLinkTitleFallback = String(localized: "share.fallback.shared_link_title", comment: "Fallback title when saving a shared link")
-        static let savedForReview = String(localized: "share.status.saved_for_review", comment: "Shown after content is staged for review in the main app")
-        static let failedToSave = String(localized: "share.status.failed_to_save", comment: "Shown when content cannot be staged for the main app")
+        static let sharedLinkConfirmation = String(localized: "share.status.shared_link", comment: "Confirmation after successfully sharing a link")
+        static let sharedTextConfirmation = String(localized: "share.status.shared_text", comment: "Confirmation after successfully sharing text")
+        static let failedToEncode = String(localized: "share.status.failed_to_encode", comment: "Shown when the share payload cannot be encoded")
     }
     
     private let statusLabel: UILabel = {
@@ -43,7 +44,9 @@ final class ShareViewController: UIViewController {
             statusLabel.leadingAnchor.constraint(greaterThanOrEqualTo: view.layoutMarginsGuide.leadingAnchor),
             statusLabel.trailingAnchor.constraint(lessThanOrEqualTo: view.layoutMarginsGuide.trailingAnchor)
         ])
-        processShare()
+        DispatchQueue.global().async {
+            self.processShare()
+        }
     }
 
     // MARK: - Processing
@@ -148,33 +151,30 @@ final class ShareViewController: UIViewController {
 
     // MARK: - Save + Finish
     private func saveAndFinish(url: URL, title: String?) {
-        let payload = SharedContentPayload(
-            kind: .url,
-            content: url.absoluteString,
-            title: title ?? url.host ?? Strings.sharedLinkTitleFallback
-        )
-        stageAndFinish(payload)
+        let payload: [String: String] = [
+            "url": url.absoluteString,
+            "title": title ?? url.host ?? Strings.sharedLinkTitleFallback
+        ]
+        if let json = try? JSONSerialization.data(withJSONObject: payload),
+           let s = String(data: json, encoding: .utf8) {
+            saveToSharedDefaults(content: s, type: "url")
+            finishWithMessage(Strings.sharedLinkConfirmation)
+        } else {
+            finishWithMessage(Strings.failedToEncode)
+        }
     }
 
     private func saveAndFinish(text: String) {
-        stageAndFinish(.text(text))
+        saveToSharedDefaults(content: text, type: "text")
+        finishWithMessage(Strings.sharedTextConfirmation)
     }
 
-    private func stageAndFinish(_ payload: SharedContentPayload) {
-        guard let defaults = UserDefaults(suiteName: Self.groupID) else {
-            finishWithMessage(Strings.failedToSave)
-            return
-        }
-        let store = SharedContentStore(defaults: defaults)
-
-        do {
-            try store.stage(payload)
-            // Staging is not sending. The main app will require a second,
-            // destination-labelled confirmation before filling its composer.
-            finishWithMessage(Strings.savedForReview)
-        } catch {
-            finishWithMessage(Strings.failedToSave)
-        }
+    private func saveToSharedDefaults(content: String, type: String) {
+        guard let userDefaults = UserDefaults(suiteName: Self.groupID) else { return }
+        userDefaults.set(content, forKey: "sharedContent")
+        userDefaults.set(type, forKey: "sharedContentType")
+        userDefaults.set(Date(), forKey: "sharedContentDate")
+        // No need to force synchronize; the system persists changes
     }
 
     private func finishWithMessage(_ msg: String) {

bitchatTests/AppArchitectureTests.swift

@@ -147,6 +147,44 @@ struct AppArchitectureTests {
         #expect(store.teleportedGeo.isEmpty)
     }
 
+    @Test("LocationPresenceStore bounds and prunes teleported geohash participants")
+    @MainActor
+    func locationPresenceStoreBoundsTeleportedParticipants() {
+        let store = LocationPresenceStore(teleportedGeoCapacity: 2)
+
+        store.setCurrentGeohash("u4pruy")
+        store.markTeleported("AAAAAA")
+        store.markTeleported("BBBBBB")
+        store.markTeleported("CCCCCC")
+
+        #expect(store.teleportedGeo == Set(["bbbbbb", "cccccc"]))
+
+        store.retainTeleportedGeo(keeping: Set(["CCCCCC"]))
+        #expect(store.teleportedGeo == Set(["cccccc"]))
+
+        store.setCurrentGeohash("u4pruz")
+        #expect(store.teleportedGeo.isEmpty)
+    }
+
+    @Test("LocationPresenceStore bounds geohash nicknames and clears on channel switch")
+    @MainActor
+    func locationPresenceStoreBoundsGeoNicknames() {
+        let store = LocationPresenceStore(geoNicknameCapacity: 2)
+
+        store.setCurrentGeohash("u4pruy")
+        store.setNickname("alice", for: "AAAAAA")
+        store.setNickname("bob", for: "BBBBBB")
+        store.setNickname("carol", for: "CCCCCC")
+
+        #expect(store.geoNicknames == ["bbbbbb": "bob", "cccccc": "carol"])
+
+        store.retainGeoNicknames(keeping: Set(["CCCCCC"]))
+        #expect(store.geoNicknames == ["cccccc": "carol"])
+
+        store.setCurrentGeohash("u4pruz")
+        #expect(store.geoNicknames.isEmpty)
+    }
+
     @Test("PeerHandle equality and hashing use the canonical identity only")
     func peerHandleEqualityUsesCanonicalIdentity() {
         let first = PeerHandle(id: "noise:abc123", routingPeerID: PeerID(str: "peer-a"))

bitchatTests/BLEServiceCoreTests.swift

@@ -99,6 +99,95 @@ struct BLEServiceCoreTests {
         #expect(ble.currentPeerSnapshots().isEmpty)
     }
 
+    @Test
+    func unsignedAndBadSignatureLeaveDoNotEvictOrRelayClaimedPeer() async throws {
+        let ble = makeService()
+        let alice = NoiseEncryptionService(keychain: MockKeychain())
+        let mallory = NoiseEncryptionService(keychain: MockKeychain())
+        let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
+        let outbound = OutboundPacketTap()
+        ble._test_onOutboundPacket = outbound.record
+
+        let unsigned = makeLeavePacket(sender: alicePeerID, marker: "unsigned")
+        ble._test_handlePacket(
+            unsigned,
+            fromPeerID: alicePeerID,
+            signingPublicKey: alice.getSigningPublicKeyData()
+        )
+
+        let unsignedRelayed = await TestHelpers.waitUntil(
+            { outbound.count(ofType: .leave) > 0 },
+            timeout: TestConstants.shortTimeout
+        )
+        #expect(!unsignedRelayed)
+        #expect(ble.currentPeerSnapshots().contains { $0.peerID == alicePeerID })
+
+        let badSignature = try #require(
+            mallory.signPacket(makeLeavePacket(sender: alicePeerID, marker: "bad-signature"))
+        )
+        ble._test_handlePacket(
+            badSignature,
+            fromPeerID: alicePeerID,
+            signingPublicKey: alice.getSigningPublicKeyData()
+        )
+
+        let badSignatureRelayed = await TestHelpers.waitUntil(
+            { outbound.count(ofType: .leave) > 0 },
+            timeout: TestConstants.shortTimeout
+        )
+        #expect(!badSignatureRelayed)
+        #expect(ble.currentPeerSnapshots().contains { $0.peerID == alicePeerID })
+    }
+
+    @Test
+    func validSignedLeaveEvictsSessionAndRelays() async throws {
+        let ble = makeService()
+        let alice = NoiseEncryptionService(keychain: MockKeychain())
+        let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
+
+        // Establish a real session so the leave regression also verifies that
+        // stale secure-delivery state is retired, not just the peer-list row.
+        let message1 = try ble._test_noiseInitiateHandshake(with: alicePeerID)
+        let message2 = try #require(
+            try alice.processHandshakeMessage(from: ble.myPeerID, message: message1)
+        )
+        let message3 = try #require(
+            try ble._test_noiseProcessHandshakeMessage(from: alicePeerID, message: message2)
+        )
+        _ = try alice.processHandshakeMessage(from: ble.myPeerID, message: message3)
+        #expect(ble.canDeliverSecurely(to: alicePeerID))
+        let centralUUID = "central-valid-leave"
+        ble._test_bindCentral(centralUUID, to: alicePeerID)
+        ble._test_markNoiseAuthenticatedCentral(centralUUID, to: alicePeerID)
+        #expect(ble._test_isNoiseAuthenticatedCentral(centralUUID, for: alicePeerID))
+
+        let outbound = OutboundPacketTap()
+        ble._test_onOutboundPacket = outbound.record
+        let signedLeave = try #require(
+            alice.signPacket(makeLeavePacket(sender: alicePeerID, marker: "valid"))
+        )
+        ble._test_handlePacket(
+            signedLeave,
+            fromPeerID: alicePeerID,
+            signingPublicKey: alice.getSigningPublicKeyData()
+        )
+
+        let evicted = await TestHelpers.waitUntil(
+            {
+                !ble.currentPeerSnapshots().contains { $0.peerID == alicePeerID }
+                    && !ble.canDeliverSecurely(to: alicePeerID)
+                    && !ble._test_isNoiseAuthenticatedCentral(centralUUID, for: alicePeerID)
+            },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(evicted)
+        let relayed = await TestHelpers.waitUntil(
+            { outbound.count(ofType: .leave) == 1 },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(relayed)
+    }
+
     @Test
     func ingressAllowsRelayedSenderOnBoundLink() async throws {
         let ble = makeService()
@@ -413,14 +502,26 @@ struct BLEServiceCoreTests {
         )
         let replay = try #require(victim.signPacket(unsigned), "Failed to sign replayed announce")
         #expect(ble._test_recordIngressIfNew(packet: replay, linkID: attackerLink))
+        let rebindGate = VerifiedDirectRebindGate()
+        ble._test_afterVerifiedDirectRebindEnqueued = rebindGate.pause
+        defer {
+            rebindGate.release()
+            ble._test_afterVerifiedDirectRebindEnqueued = nil
+        }
         ble._test_handlePacket(replay, fromPeerID: victimPeerID, preseedPeer: false)
 
-        let rebound = await TestHelpers.waitUntil(
-            { ble._test_centralBinding(attackerLink) == victimPeerID },
+        let announcePaused = await TestHelpers.waitUntil(
+            { rebindGate.hasPaused },
             timeout: TestConstants.longTimeout
         )
-        #expect(rebound)
-        #expect(ble.canDeliverSecurely(to: victimPeerID))
+        try #require(announcePaused)
+
+        // Rebind and ordinary reconnect preparation are one bleQueue
+        // critical section. Once the binding is visible, stale sending keys
+        // must already be unavailable.
+        #expect(ble._test_centralBinding(attackerLink) == victimPeerID)
+        #expect(!ble.canDeliverSecurely(to: victimPeerID))
+        rebindGate.release()
 
         let outbound = OutboundPacketTap()
         ble._test_onOutboundPacket = { outbound.record($0) }
@@ -440,6 +541,261 @@ struct BLEServiceCoreTests {
         #expect(outbound.count(ofType: .courierEnvelope) == 0)
     }
 
+    @Test
+    func replacementXXMessageOneWithPayloadCannotAuthenticateIngressLink() async throws {
+        let ble = makeService()
+        let victim = NoiseEncryptionService(keychain: MockKeychain())
+        let victimPeerID = PeerID(publicKey: victim.getStaticPublicKeyData())
+
+        // Preserve a working victim session while an unauthenticated
+        // replacement candidate arrives on a newly bound physical link.
+        // Establish BLE as responder so the replacement candidate below is
+        // not coalesced by the initiator-completion grace path.
+        let message1 = try victim.initiateHandshake(with: ble.myPeerID)
+        let message2 = try #require(
+            try ble._test_noiseProcessHandshakeMessage(
+                from: victimPeerID,
+                message: message1
+            )
+        )
+        let message3 = try #require(
+            try victim.processHandshakeMessage(
+                from: ble.myPeerID,
+                message: message2
+            )
+        )
+        _ = try ble._test_noiseProcessHandshakeMessage(
+            from: victimPeerID,
+            message: message3
+        )
+        await ble._test_drainNoiseMessagePipeline()
+        #expect(ble.canDeliverSecurely(to: victimPeerID))
+
+        let centralUUID = "central-replacement-xx-message-one"
+        ble._test_bindCentral(centralUUID, to: victimPeerID)
+        #expect(
+            !ble._test_isNoiseAuthenticatedCentral(
+                centralUUID,
+                for: victimPeerID
+            )
+        )
+
+        // XX message one may legally carry a payload, so its length is not a
+        // reliable signal that the replacement handshake completed.
+        let unauthenticatedInitiator = NoiseHandshakeState(
+            role: .initiator,
+            pattern: .XX,
+            keychain: MockKeychain()
+        )
+        let replacementMessage1 = try unauthenticatedInitiator.writeMessage(
+            payload: Data([0xA5])
+        )
+        #expect(
+            replacementMessage1.count
+                > NoiseSecurityConstants.xxInitialMessageSize
+        )
+
+        let packet = BitchatPacket(
+            type: MessageType.noiseHandshake.rawValue,
+            senderID: Data(hexString: victimPeerID.id) ?? Data(),
+            recipientID: Data(hexString: ble.myPeerID.id),
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
+            payload: replacementMessage1,
+            signature: nil,
+            ttl: TransportConfig.messageTTLDefault
+        )
+        #expect(
+            ble._test_recordIngressIfNew(
+                packet: packet,
+                linkID: centralUUID
+            )
+        )
+
+        let outbound = OutboundPacketTap()
+        ble._test_onOutboundPacket = outbound.record
+        ble._test_handlePacket(
+            packet,
+            fromPeerID: victimPeerID,
+            preseedPeer: false
+        )
+
+        // Waiting for the responder's message two proves the candidate was
+        // processed before checking its exact authentication result.
+        let candidateProcessed = await TestHelpers.waitUntil(
+            { outbound.count(ofType: .noiseHandshake) == 1 },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(candidateProcessed)
+        #expect(
+            !ble._test_isNoiseAuthenticatedCentral(
+                centralUUID,
+                for: victimPeerID
+            )
+        )
+        // Ordinary reconnect hardening quarantines the cached transport while
+        // this candidate proves the claimed identity. It must be unavailable
+        // for sending as well as unable to authenticate this ingress link.
+        #expect(!ble.canDeliverSecurely(to: victimPeerID))
+    }
+
+    @Test
+    func failedInboundReconnectRestoresAndDrainsWaitingWorkOnce() async throws {
+        let ble = makeService()
+        let alice = NoiseEncryptionService(keychain: MockKeychain())
+        let mallory = NoiseEncryptionService(keychain: MockKeychain())
+        let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
+
+        // Establish BLE as responder so the following inbound reconnect is
+        // not intentionally coalesced by the initiator-completion grace path.
+        let message1 = try alice.initiateHandshake(with: ble.myPeerID)
+        let message2 = try #require(
+            try ble._test_noiseProcessHandshakeMessage(
+                from: alicePeerID,
+                message: message1
+            )
+        )
+        let message3 = try #require(
+            try alice.processHandshakeMessage(
+                from: ble.myPeerID,
+                message: message2
+            )
+        )
+        _ = try ble._test_noiseProcessHandshakeMessage(
+            from: alicePeerID,
+            message: message3
+        )
+        await ble._test_drainNoiseMessagePipeline()
+        #expect(ble.canDeliverSecurely(to: alicePeerID))
+
+        let outbound = OutboundPacketTap()
+        ble._test_onOutboundPacket = outbound.record
+        let forgedMessage1 = try mallory.initiateHandshake(with: ble.myPeerID)
+        let firstPacket = BitchatPacket(
+            type: MessageType.noiseHandshake.rawValue,
+            senderID: Data(hexString: alicePeerID.id) ?? Data(),
+            recipientID: Data(hexString: ble.myPeerID.id),
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1_000),
+            payload: forgedMessage1,
+            signature: nil,
+            ttl: 7
+        )
+        ble._test_handlePacket(firstPacket, fromPeerID: alicePeerID)
+
+        let responseReady = await TestHelpers.waitUntil(
+            {
+                outbound.snapshot().contains {
+                    $0.type == MessageType.noiseHandshake.rawValue
+                        && PeerID(hexData: $0.senderID) == ble.myPeerID
+                        && $0.payload.count
+                            != NoiseSecurityConstants.xxInitialMessageSize
+                }
+            },
+            timeout: TestConstants.longTimeout
+        )
+        try #require(responseReady)
+        let forgedMessage2 = try #require(
+            outbound.snapshot().first {
+                $0.type == MessageType.noiseHandshake.rawValue
+                    && PeerID(hexData: $0.senderID) == ble.myPeerID
+                    && $0.payload.count
+                        != NoiseSecurityConstants.xxInitialMessageSize
+            }?.payload
+        )
+        #expect(!ble.canDeliverSecurely(to: alicePeerID))
+
+        // Typed control traffic must queue behind the ordinary responder,
+        // rather than attempting encryption and disappearing.
+        let privateMessageID = "quarantine-pm-\(UUID().uuidString)"
+        ble.sendPrivateMessage(
+            "queued private message",
+            to: alicePeerID,
+            recipientNickname: "Alice",
+            messageID: privateMessageID
+        )
+        ble.sendGroupInvite(Data("queued-during-quarantine".utf8), to: alicePeerID)
+        await ble._test_drainNoiseMessagePipeline()
+        #expect(outbound.count(ofType: .noiseEncrypted) == 0)
+
+        let forgedMessage3 = try #require(
+            try mallory.processHandshakeMessage(
+                from: ble.myPeerID,
+                message: forgedMessage2
+            )
+        )
+        let forgedEarlyPayload = try #require(
+            BLENoisePayloadFactory.privateMessage(
+                content: "forged early message",
+                messageID: "forged-early"
+            )
+        )
+        try #require(
+            mallory.hasEstablishedSession(with: ble.myPeerID),
+            "forged initiator did not establish after producing message three"
+        )
+        let forgedEarlyCiphertext = try mallory.encrypt(
+            forgedEarlyPayload,
+            for: ble.myPeerID
+        )
+        let earlyPacket = BitchatPacket(
+            type: MessageType.noiseEncrypted.rawValue,
+            senderID: Data(hexString: alicePeerID.id) ?? Data(),
+            recipientID: Data(hexString: ble.myPeerID.id),
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1_000) + 1,
+            payload: forgedEarlyCiphertext,
+            signature: nil,
+            ttl: 7
+        )
+        ble._test_handlePacket(earlyPacket, fromPeerID: alicePeerID)
+        await ble._test_drainNoiseMessagePipeline()
+
+        let thirdPacket = BitchatPacket(
+            type: MessageType.noiseHandshake.rawValue,
+            senderID: Data(hexString: alicePeerID.id) ?? Data(),
+            recipientID: Data(hexString: ble.myPeerID.id),
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1_000) + 2,
+            payload: forgedMessage3,
+            signature: nil,
+            ttl: 7
+        )
+        ble._test_handlePacket(thirdPacket, fromPeerID: alicePeerID)
+
+        // Rollback restores the same generation. It retries the bounded early
+        // ciphertext and drains both outbound queues, but must not repeat a
+        // new-generation capability proof or forced announce.
+        let drained = await TestHelpers.waitUntil(
+            { outbound.count(ofType: .noiseEncrypted) >= 2 },
+            timeout: TestConstants.longTimeout
+        )
+        try #require(drained)
+        await ble._test_drainNoiseMessagePipeline()
+        let plaintexts = try outbound.snapshot()
+            .filter { $0.type == MessageType.noiseEncrypted.rawValue }
+            .map { try alice.decrypt($0.payload, from: ble.myPeerID) }
+        #expect(plaintexts.count == 2)
+        #expect(
+            plaintexts.filter {
+                $0.first == NoisePayloadType.authenticatedPeerState.rawValue
+            }.isEmpty
+        )
+        #expect(
+            plaintexts.filter {
+                $0.first == NoisePayloadType.privateMessage.rawValue
+            }.count == 1
+        )
+        #expect(
+            plaintexts.filter {
+                $0.first == NoisePayloadType.groupInvite.rawValue
+            }.count == 1
+        )
+        #expect(outbound.count(ofType: .announce) == 0)
+
+        // A duplicate ready callback cannot replay either buffer.
+        ble._test_reconcileCurrentNoiseSession(for: alicePeerID)
+        await ble._test_drainNoiseMessagePipeline()
+        #expect(outbound.count(ofType: .noiseEncrypted) == 2)
+        #expect(outbound.count(ofType: .announce) == 0)
+    }
+
     /// A legitimate rotation announce necessarily arrives on a link still
     /// bound to the OLD ID, so its registry upsert stores the new peer
     /// disconnected. The successful rebind must promote it: a healed
@@ -572,6 +928,146 @@ struct BLEServiceCoreTests {
         #expect(ble.myPeerID == PeerID(str: newFingerprint.prefix(16)))
     }
 
+    @Test
+    func panicSuspension_dropsLateOutboundWorkUntilCommit() async {
+        let ble = makeService()
+        let outbound = OutboundPacketTap()
+        ble._test_onOutboundPacket = outbound.record
+        let packet = makePublicPacket(
+            content: "late callback",
+            sender: ble.myPeerID,
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1000)
+        )
+
+        ble.suspendForPanicReset()
+        ble.sendPacket(packet)
+        #expect(outbound.count(ofType: .message) == 0)
+
+        ble.completePanicReset(restartServices: false)
+        ble.sendPacket(packet)
+        #expect(outbound.count(ofType: .message) == 1)
+    }
+
+    @Test @MainActor
+    func panicSuspension_invalidatesQueuedMainActorIngress() async {
+        let ble = makeService()
+        let delegate = TransportEventCaptureDelegate()
+        ble.eventDelegate = delegate
+        let message = BitchatMessage(
+            id: "pre-panic-ingress",
+            sender: "Peer",
+            content: "must not survive panic",
+            timestamp: Date(),
+            isRelay: false,
+            isPrivate: true,
+            recipientNickname: "Me",
+            senderPeerID: PeerID(str: "1122334455667788")
+        )
+
+        // The test already owns MainActor, so this task cannot run until the
+        // synchronous panic boundary below has invalidated its generation.
+        ble._test_emitTransportEvent(.messageReceived(message))
+        ble.suspendForPanicReset()
+        await Task.yield()
+        #expect(delegate.messageIDs.isEmpty)
+
+        ble.completePanicReset(restartServices: false)
+        ble._test_emitTransportEvent(.messageReceived(message))
+        await Task.yield()
+        #expect(delegate.messageIDs == [message.id])
+    }
+
+    @Test @MainActor
+    func panicSuspension_rejectsPausedBLEReceiveBeforeMessageQueueHandoff() async {
+        let ble = makeService()
+        let gate = ReceivePacketHandoffGate()
+        ble._test_beforeReceivePacketHandoff = gate.pause
+        ble._test_onReceivePacketHandoff = gate.recordHandoff
+        defer {
+            gate.release()
+            ble._test_beforeReceivePacketHandoff = nil
+            ble._test_onReceivePacketHandoff = nil
+        }
+
+        let sender = PeerID(str: "1122334455667788")
+        let packet = makePublicPacket(
+            content: "must not cross panic",
+            sender: sender,
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1000)
+        )
+        ble._test_handlePacketFromBLEQueue(packet, fromPeerID: sender)
+        #expect(await TestHelpers.waitUntil(
+            { gate.hasPaused },
+            timeout: TestConstants.longTimeout
+        ))
+
+        // Panic closes the lifecycle before waiting for the paused bleQueue
+        // callback. Releasing it afterward lets the callback enqueue its
+        // messageQueue handoff, where the captured generation must be rejected
+        // before packet processing starts.
+        let panicIngressObserver = PanicIngressObserver(service: ble)
+        let didObservePanicClosure = await withCheckedContinuation { continuation in
+            DispatchQueue.global(qos: .userInitiated).async {
+                let didObserveClosure = panicIngressObserver.waitUntilClosed(
+                    timeout: TestConstants.defaultTimeout
+                )
+                gate.release()
+                continuation.resume(returning: didObserveClosure)
+            }
+            ble.suspendForPanicReset()
+        }
+
+        #expect(didObservePanicClosure)
+        #expect(gate.handoffCount == 0)
+
+        // A packet captured under the reopened lifecycle still crosses the
+        // same handoff, proving the test did not merely disable the hook.
+        ble.completePanicReset(restartServices: false)
+        ble._test_handlePacketFromBLEQueue(packet, fromPeerID: sender)
+        #expect(await TestHelpers.waitUntil(
+            { gate.handoffCount == 1 },
+            timeout: TestConstants.longTimeout
+        ))
+    }
+
+    @Test @MainActor
+    func panicSuspension_finalizesStaleTransportEventsAsRejected() async {
+        let ble = makeService()
+        let delegate = TransportEventCaptureDelegate()
+        ble.eventDelegate = delegate
+        let message = BitchatMessage(
+            id: "pre-panic-finalization",
+            sender: "Peer",
+            content: "must be rejected",
+            timestamp: Date(),
+            isRelay: false,
+            isPrivate: true,
+            recipientNickname: "Me",
+            senderPeerID: PeerID(str: "1122334455667788")
+        )
+        var completions = 0
+        var outcomes: [TransportEventDeliveryOutcome] = []
+
+        ble._test_emitTransportEvent(
+            .messageReceived(message),
+            completion: { completions += 1 },
+            finalization: { outcomes.append($0) }
+        )
+        ble.suspendForPanicReset()
+        ble._test_emitTransportEvent(
+            .messageReceived(message),
+            completion: { completions += 1 },
+            finalization: { outcomes.append($0) }
+        )
+        for _ in 0..<4 {
+            await Task.yield()
+        }
+
+        #expect(delegate.messageIDs.isEmpty)
+        #expect(completions == 0)
+        #expect(outcomes == [.rejected, .rejected])
+    }
+
     @Test
     func modifiedServices_rediscoverWhenBitChatServiceIsInvalidated() async throws {
         let otherService = CBUUID(string: "0000180F-0000-1000-8000-00805F9B34FB")
@@ -664,6 +1160,102 @@ private final class OutboundPacketTap {
         lock.lock(); defer { lock.unlock() }
         return packets.filter { $0.type == type.rawValue }.count
     }
+
+    func snapshot() -> [BitchatPacket] {
+        lock.lock(); defer { lock.unlock() }
+        return packets
+    }
+}
+
+private final class VerifiedDirectRebindGate: @unchecked Sendable {
+    private let condition = NSCondition()
+    private var paused = false
+    private var released = false
+
+    var hasPaused: Bool {
+        condition.lock()
+        defer { condition.unlock() }
+        return paused
+    }
+
+    func pause() {
+        condition.lock()
+        paused = true
+        condition.broadcast()
+        while !released {
+            condition.wait()
+        }
+        condition.unlock()
+    }
+
+    func release() {
+        condition.lock()
+        released = true
+        condition.broadcast()
+        condition.unlock()
+    }
+}
+
+private final class ReceivePacketHandoffGate: @unchecked Sendable {
+    private let condition = NSCondition()
+    private var paused = false
+    private var released = false
+    private var recordedHandoffCount = 0
+
+    var hasPaused: Bool {
+        condition.lock()
+        defer { condition.unlock() }
+        return paused
+    }
+
+    var handoffCount: Int {
+        condition.lock()
+        defer { condition.unlock() }
+        return recordedHandoffCount
+    }
+
+    func pause() {
+        condition.lock()
+        paused = true
+        condition.broadcast()
+        while !released {
+            condition.wait()
+        }
+        condition.unlock()
+    }
+
+    func release() {
+        condition.lock()
+        released = true
+        condition.broadcast()
+        condition.unlock()
+    }
+
+    func recordHandoff() {
+        condition.lock()
+        recordedHandoffCount += 1
+        condition.unlock()
+    }
+}
+
+/// Lets a dedicated dispatch worker observe the lock-protected panic gate
+/// without treating the full BLE service as generally Sendable.
+private final class PanicIngressObserver: @unchecked Sendable {
+    private let service: BLEService
+
+    init(service: BLEService) {
+        self.service = service
+    }
+
+    func waitUntilClosed(timeout: TimeInterval) -> Bool {
+        let deadline = DispatchTime.now().uptimeNanoseconds
+            + UInt64(timeout * 1_000_000_000)
+        while service._test_isPanicIngressOpen,
+              DispatchTime.now().uptimeNanoseconds < deadline {
+            Thread.sleep(forTimeInterval: 0.001)
+        }
+        return !service._test_isPanicIngressOpen
+    }
 }
 
 private func makeService() -> BLEService {
@@ -690,6 +1282,18 @@ private func makePublicPacket(content: String, sender: PeerID, timestamp: UInt64
     )
 }
 
+private func makeLeavePacket(sender: PeerID, marker: String) -> BitchatPacket {
+    BitchatPacket(
+        type: MessageType.leave.rawValue,
+        senderID: Data(hexString: sender.id) ?? Data(),
+        recipientID: nil,
+        timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
+        payload: Data(marker.utf8),
+        signature: nil,
+        ttl: TransportConfig.messageTTLDefault
+    )
+}
+
 private final class PublicCaptureDelegate: BitchatDelegate {
     private let lock = NSLock()
     private(set) var publicMessages: [BitchatMessage] = []
@@ -723,4 +1327,15 @@ private final class PublicCaptureDelegate: BitchatDelegate {
         defer { lock.unlock() }
         return publicMessages
     }
+
+}
+
+@MainActor
+private final class TransportEventCaptureDelegate: TransportEventDelegate {
+    private(set) var messageIDs: [String] = []
+
+    func didReceiveTransportEvent(_ event: TransportEvent) {
+        guard case .messageReceived(let message) = event else { return }
+        messageIDs.append(message.id)
+    }
 }

bitchatTests/ChatLiveVoiceCoordinatorTests.swift

@@ -14,6 +14,7 @@ import BitFoundation
 @MainActor
 private final class MockChatLiveVoiceContext: ChatLiveVoiceContext {
     var nickname = "me"
+    var myPeerID = PeerID(str: "0102030405060708")
     var selectedPrivateChatPeer: PeerID?
     var isViewingPublicMeshTimeline = false
     var blockedPeers: Set<PeerID> = []
@@ -23,7 +24,10 @@ private final class MockChatLiveVoiceContext: ChatLiveVoiceContext {
     private(set) var upsertedMessages: [(message: BitchatMessage, peerID: PeerID)] = []
     private(set) var upsertedPublicMessages: [BitchatMessage] = []
     private(set) var removedMessageIDs: [String] = []
+    private(set) var sentReadReceipts: [(receipt: ReadReceipt, peerID: PeerID)] = []
     private(set) var talkerUpdates: [String?] = []
+    private(set) var privateMutationLog: [String] = []
+    private var readReceiptMessageIDs: Set<String> = []
 
     func isPeerBlocked(_ peerID: PeerID) -> Bool { blockedPeers.contains(peerID) }
     func resolveNickname(for peerID: PeerID) -> String { "alice" }
@@ -31,6 +35,7 @@ private final class MockChatLiveVoiceContext: ChatLiveVoiceContext {
     func appendPublicMeshMessage(_ message: BitchatMessage) { appendedPublicMessages.append(message) }
     func upsertPrivateMessage(_ message: BitchatMessage, in peerID: PeerID) {
         upsertedMessages.append((message, peerID))
+        privateMutationLog.append("upsert:\(message.id)")
     }
     func upsertPublicMeshMessage(_ message: BitchatMessage) {
         upsertedPublicMessages.append(message)
@@ -38,8 +43,18 @@ private final class MockChatLiveVoiceContext: ChatLiveVoiceContext {
     @discardableResult
     func removePrivateMessage(withID messageID: String) -> BitchatMessage? {
         removedMessageIDs.append(messageID)
+        privateMutationLog.append("remove:\(messageID)")
         return nil
     }
+    func hasSentReadReceipt(_ messageID: String) -> Bool {
+        readReceiptMessageIDs.contains(messageID)
+    }
+    func markReadReceiptSent(_ messageID: String) -> Bool {
+        readReceiptMessageIDs.insert(messageID).inserted
+    }
+    func sendMeshReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
+        sentReadReceipts.append((receipt, peerID))
+    }
     func removeMessage(withID messageID: String, cleanupFile: Bool) {
         removedMessageIDs.append(messageID)
     }
@@ -151,17 +166,29 @@ struct ChatLiveVoiceCoordinatorTests {
 
     @Test func absorbsFinalizedNoteIntoLiveBubble() throws {
         let context = MockChatLiveVoiceContext()
+        context.selectedPrivateChatPeer = peer
         let coordinator = ChatLiveVoiceCoordinator(context: context, sweepsOnInit: false)
         let burstID = makeBurstID(0xB2)
         let hex = burstID.hexEncodedString()
+        let fileName = "voice_\(hex).m4a"
+        let stableMessageID = try #require(PrivateMediaMessageIdentity.stableID(
+            senderPeerID: peer,
+            recipientPeerID: context.myPeerID,
+            fileName: fileName
+        ))
 
         send(try #require(VoiceBurstPacket(burstID: burstID, seq: 1, kind: .frames([Data(repeating: 7, count: 50)]))), to: coordinator, from: peer)
         send(try #require(VoiceBurstPacket(burstID: burstID, seq: 2, kind: .end(totalDataPackets: 1, durationMs: 64))), to: coordinator, from: peer)
         let bubble = try #require(context.handledPrivateMessages.first)
+        // The user read the live bubble, then left before the finalized file
+        // arrived. Stable-ID adoption must preserve that read state.
+        #expect(context.markReadReceiptSent(bubble.id))
+        context.selectedPrivateChatPeer = nil
 
         let note = BitchatMessage(
+            id: stableMessageID,
             sender: "alice",
-            content: "[voice] voice_\(hex).m4a",
+            content: "[voice] \(fileName)",
             timestamp: Date(),
             isRelay: false,
             isPrivate: true,
@@ -170,12 +197,21 @@ struct ChatLiveVoiceCoordinatorTests {
         )
         #expect(coordinator.absorbFinalizedVoiceNote(note))
 
-        // The note replaced the live bubble in place: same message ID, new
-        // content, partial capture deleted.
+        // The finalized note adopts the sender-correlatable ID, removes the
+        // receiver-local live ID, and emits a fresh READ now that the sender
+        // has created its finalized media row.
         let replacement = try #require(context.upsertedMessages.last)
-        #expect(replacement.message.id == bubble.id)
+        #expect(replacement.message.id == stableMessageID)
         #expect(replacement.message.content == note.content)
         #expect(replacement.peerID == peer)
+        #expect(context.removedMessageIDs.contains(bubble.id))
+        #expect(Array(context.privateMutationLog.suffix(2)) == [
+            "upsert:\(stableMessageID)",
+            "remove:\(bubble.id)"
+        ])
+        #expect(context.sentReadReceipts.count == 1)
+        #expect(context.sentReadReceipts.first?.receipt.originalMessageID == stableMessageID)
+        #expect(context.sentReadReceipts.first?.peerID == peer)
         // The promoted partial capture is deleted in favor of the note.
         let url = try #require(fallbackFileURL(burstID: burstID, peerID: peer))
         #expect(!FileManager.default.fileExists(atPath: url.path))
@@ -449,7 +485,8 @@ struct ChatLiveVoiceCoordinatorTests {
             isRelay: false, isPrivate: true, recipientNickname: "me", senderPeerID: peer
         )
         #expect(coordinator.absorbFinalizedVoiceNote(dmNote))
-        #expect(try #require(context.upsertedMessages.last).message.id == dmBubble.id)
+        #expect(try #require(context.upsertedMessages.last).message.id == dmNote.id)
+        #expect(context.removedMessageIDs.contains(dmBubble.id))
     }
 
     @Test func finalizedNoteBindsToItsAuthenticatedSender() throws {
@@ -479,8 +516,9 @@ struct ChatLiveVoiceCoordinatorTests {
         )
         #expect(coordinator.absorbFinalizedVoiceNote(note))
         let replacement = try #require(context.upsertedMessages.last)
-        #expect(replacement.message.id == victimBubble.id)
+        #expect(replacement.message.id == note.id)
         #expect(replacement.peerID == peer)
+        #expect(context.removedMessageIDs.contains(victimBubble.id))
 
         // The attacker's note can only ever claim the attacker's own bubble.
         let attackerNote = BitchatMessage(
@@ -489,8 +527,9 @@ struct ChatLiveVoiceCoordinatorTests {
         )
         #expect(coordinator.absorbFinalizedVoiceNote(attackerNote))
         let attackerReplacement = try #require(context.upsertedMessages.last)
-        #expect(attackerReplacement.message.id == attackerBubble.id)
+        #expect(attackerReplacement.message.id == attackerNote.id)
         #expect(attackerReplacement.peerID == attacker)
+        #expect(context.removedMessageIDs.contains(attackerBubble.id))
 
         // Both registry entries are consumed — nothing left to hijack.
         #expect(!coordinator.absorbFinalizedVoiceNote(note))

bitchatTests/ChatNostrCoordinatorContextTests.swift

@@ -243,7 +243,7 @@ private func drainMainQueue() async {
 
 /// Exercises `ChatNostrCoordinator` against `MockChatNostrContext` with no
 /// `ChatViewModel`. Scoped to the inbound event pipeline (dedup, presence,
-/// public-message ingest), gift-wrap DM ingest, key mapping, channel-switch
+/// public-message ingest), private-envelope ingest, key mapping, channel-switch
 /// teardown, embedded ack flows, and — now that favorites and notifications
 /// are injected through the context — the favorite-notification ingest and
 /// the sampled-geohash notification cooldown. Flows that hit live singletons
@@ -335,7 +335,7 @@ struct ChatNostrCoordinatorContextTests {
     }
 
     @Test @MainActor
-    func handleGiftWrap_routesEmbeddedPrivateMessageAndDeduplicates() async throws {
+    func handlePrivateEnvelope_routesEmbeddedPrivateMessageAndDeduplicates() async throws {
         let context = MockChatNostrContext()
         let coordinator = ChatNostrCoordinator(context: context)
 
@@ -346,17 +346,21 @@ struct ChatNostrCoordinatorContextTests {
             messageID: "gm-1",
             senderPeerID: PeerID(str: "aabbccddeeff0011")
         ))
-        let giftWrap = try NostrProtocol.createPrivateMessage(
+        let envelopes = try NostrProtocol.createPrivateEnvelopePublicationBatch(
             content: embedded,
             recipientPubkey: recipient.publicKeyHex,
             senderIdentity: sender
         )
 
-        coordinator.inbound.handleGiftWrap(giftWrap, id: recipient)
+        for envelope in envelopes {
+            coordinator.inbound.handlePrivateEnvelope(envelope, id: recipient)
+        }
 
         let convKey = PeerID(nostr_: sender.publicKeyHex)
-        #expect(context.recordedNostrEventIDs == [giftWrap.id])
+        #expect(context.recordedNostrEventIDs == envelopes.map(\.id))
         #expect(context.nostrKeyMapping[convKey] == sender.publicKeyHex)
+        // The primary and compatibility envelopes carry the same authenticated
+        // embedded payload and must invoke message side effects only once.
         #expect(context.handledPrivateMessages.count == 1)
         #expect(context.handledPrivateMessages.first?.senderPubkey == sender.publicKeyHex)
         #expect(context.handledPrivateMessages.first?.convKey == convKey)
@@ -368,34 +372,84 @@ struct ChatNostrCoordinatorContextTests {
         #expect(pm.messageID == "gm-1")
         #expect(pm.content == "psst")
 
-        // The same gift wrap is dropped on replay.
-        coordinator.inbound.handleGiftWrap(giftWrap, id: recipient)
-        #expect(context.recordedNostrEventIDs == [giftWrap.id])
+        // The same private envelope is dropped on replay.
+        coordinator.inbound.handlePrivateEnvelope(envelopes[0], id: recipient)
+        #expect(context.recordedNostrEventIDs == envelopes.map(\.id))
         #expect(context.handledPrivateMessages.count == 1)
     }
 
     @Test @MainActor
-    func processNostrMessage_invalidSignatureDoesNotPoisonDedup() async throws {
+    func migrationEnvelopePairs_processEachMessageAndAckOnlyOnce() throws {
+        let context = MockChatNostrContext()
+        let coordinator = ChatNostrCoordinator(context: context)
+        let recipient = try NostrIdentity.generate()
+        let sender = try NostrIdentity.generate()
+        let messageContent = try #require(NostrEmbeddedBitChat.encodePMForNostrNoRecipient(
+            content: "migration message",
+            messageID: "migration-message-id",
+            senderPeerID: PeerID(str: "aabbccddeeff0011")
+        ))
+        let deliveredContent = try #require(NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(
+            type: .delivered,
+            messageID: "migration-ack-id",
+            senderPeerID: PeerID(str: "aabbccddeeff0011")
+        ))
+        let readContent = try #require(NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(
+            type: .readReceipt,
+            messageID: "migration-ack-id",
+            senderPeerID: PeerID(str: "aabbccddeeff0011")
+        ))
+
+        for content in [messageContent, deliveredContent, readContent] {
+            let envelopes = try NostrProtocol.createPrivateEnvelopePublicationBatch(
+                content: content,
+                recipientPubkey: recipient.publicKeyHex,
+                senderIdentity: sender
+            )
+            #expect(envelopes.count == 2)
+            for envelope in envelopes {
+                coordinator.inbound.handlePrivateEnvelope(envelope, id: recipient)
+            }
+        }
+
+        #expect(context.handledPrivateMessages.count == 1)
+        #expect(context.handledDelivered.count == 1)
+        #expect(context.handledReadReceipts.count == 1)
+
+        // A later same-format re-envelope is a delivery retry, not the
+        // migration twin, so it must still reach downstream message-ID dedup
+        // and acknowledgement resend logic.
+        let primaryRetry = try NostrProtocol.createPrivateEnvelope(
+            content: messageContent,
+            recipientPubkey: recipient.publicKeyHex,
+            senderIdentity: sender
+        )
+        coordinator.inbound.handlePrivateEnvelope(primaryRetry, id: recipient)
+        #expect(context.handledPrivateMessages.count == 2)
+    }
+
+    @Test @MainActor
+    func processAccountPrivateEnvelope_invalidSignatureDoesNotPoisonDedup() async throws {
         let context = MockChatNostrContext()
         let coordinator = ChatNostrCoordinator(context: context)
 
         let recipient = try NostrIdentity.generate()
         let sender = try NostrIdentity.generate()
-        let giftWrap = try NostrProtocol.createPrivateMessage(
+        let envelope = try NostrProtocol.createPrivateEnvelope(
             content: "verify:noop",
             recipientPubkey: recipient.publicKeyHex,
             senderIdentity: sender
         )
-        var invalidGiftWrap = giftWrap
-        invalidGiftWrap.sig = String(repeating: "0", count: 128)
+        var invalidEnvelope = envelope
+        invalidEnvelope.sig = String(repeating: "0", count: 128)
 
         // A forged-signature copy is rejected WITHOUT entering the dedup set...
-        await coordinator.inbound.processNostrMessage(invalidGiftWrap)
+        await coordinator.inbound.processAccountPrivateEnvelope(invalidEnvelope)
         #expect(context.recordedNostrEventIDs.isEmpty)
 
         // ...so the genuine event with the same ID still processes and records.
-        await coordinator.inbound.processNostrMessage(giftWrap)
-        #expect(context.recordedNostrEventIDs == [giftWrap.id])
+        await coordinator.inbound.processAccountPrivateEnvelope(envelope)
+        #expect(context.recordedNostrEventIDs == [envelope.id])
     }
 
     @Test @MainActor

bitchatTests/ChatPeerListCoordinatorContextTests.swift

@@ -104,6 +104,20 @@ private func makeMessage(id: String, senderPeerID: PeerID? = nil) -> BitchatMess
 /// no `ChatViewModel`.
 struct ChatPeerListCoordinatorContextTests {
 
+    @Test @MainActor
+    func synchronousPeerListUpdate_appliesBeforeReturning() {
+        let context = MockChatPeerListContext()
+        let coordinator = ChatPeerListCoordinator(context: context)
+        let peerID = PeerID(str: "0011223344556677")
+
+        coordinator.didUpdatePeerListSynchronously([peerID])
+
+        #expect(context.isConnected)
+        #expect(context.registeredEphemeralSessions == [peerID])
+        #expect(context.updateEncryptionStatusForPeersCount == 1)
+        #expect(context.cleanupOldReadReceiptsCount == 1)
+    }
+
     @Test @MainActor
     func didUpdatePeerList_updatesConnectionSessionsAndEncryptionStatus() async {
         let context = MockChatPeerListContext()

bitchatTests/ChatPrivateConversationCoordinatorContextTests.swift

@@ -176,6 +176,10 @@ private final class MockChatPrivateConversationContext: ChatPrivateConversationC
     private(set) var geoPrivateMessages: [(content: String, recipientHex: String, messageID: String)] = []
     private(set) var geoDeliveryAcks: [(messageID: String, recipientHex: String)] = []
     private(set) var geoReadReceipts: [(messageID: String, recipientHex: String)] = []
+    var geohashPrivateMessageAccepted = true
+    var queuedMessageIDsByPeerID: [PeerID: Set<String>] = [:]
+    private(set) var deliveryAckAttempts: [(messageID: String, peerIDs: [PeerID])] = []
+    private(set) var deliveredMessageIDs: [String] = []
 
     func routePrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
         routedPrivateMessages.append((content, peerID, messageID))
@@ -187,12 +191,34 @@ private final class MockChatPrivateConversationContext: ChatPrivateConversationC
         return routeReadReceiptResult
     }
 
+    @discardableResult
+    func markMessageDelivered(_ messageID: String, for peerIDs: [PeerID]) -> Bool {
+        deliveryAckAttempts.append((messageID, peerIDs))
+        var cleared = false
+        for peerID in Set(peerIDs) {
+            guard var queued = queuedMessageIDsByPeerID[peerID],
+                  queued.remove(messageID) != nil else { continue }
+            queuedMessageIDsByPeerID[peerID] = queued.isEmpty ? nil : queued
+            cleared = true
+        }
+        if cleared {
+            deliveredMessageIDs.append(messageID)
+        }
+        return cleared
+    }
+
     func sendMeshReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
         meshReadReceipts.append((receipt.originalMessageID, peerID))
     }
 
-    func sendGeohashPrivateMessage(_ content: String, toRecipientHex recipientHex: String, from identity: NostrIdentity, messageID: String) {
+    func sendGeohashPrivateMessage(
+        _ content: String,
+        toRecipientHex recipientHex: String,
+        from identity: NostrIdentity,
+        messageID: String
+    ) -> Bool {
         geoPrivateMessages.append((content, recipientHex, messageID))
+        return geohashPrivateMessageAccepted
     }
 
     func sendGeohashDeliveryAck(for messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity) {
@@ -279,6 +305,11 @@ private func isRead(_ status: DeliveryStatus?, by expected: String) -> Bool {
     return false
 }
 
+private func isFailed(_ status: DeliveryStatus?) -> Bool {
+    if case .failed = status { return true }
+    return false
+}
+
 private func makeFavoriteRelationship(
     noiseKey: Data,
     nostrPublicKey: String? = nil,
@@ -370,6 +401,66 @@ struct ChatPrivateConversationCoordinatorContextTests {
             convKey: convKey
         )
         #expect(context.notifyUIChangedCount == 2)
+        #expect(context.deliveryAckAttempts.isEmpty)
+        #expect(context.deliveredMessageIDs.isEmpty)
+    }
+
+    @Test @MainActor
+    func accountDMAcks_findShortIDMessageAndHandConversationToStable() async {
+        let context = MockChatPrivateConversationContext()
+        let coordinator = ChatPrivateConversationCoordinator(context: context)
+        let noiseKey = Data(repeating: 0xD5, count: 32)
+        let stablePeerID = PeerID(hexData: noiseKey)
+        let shortPeerID = stablePeerID.toShort()
+        let senderPubkey = "feedface00112233"
+        context.displayNamesByPubkey[senderPubkey] = "alice"
+        context.selectedPrivateChatPeer = shortPeerID
+        context.privateChats[shortPeerID] = [
+            makeIncomingMessage(id: "mine-short-1", sender: "me"),
+            makeIncomingMessage(id: "mine-short-2", sender: "me")
+        ]
+        context.queuedMessageIDsByPeerID[shortPeerID] = ["mine-short-1", "mine-short-2"]
+
+        coordinator.handleDelivered(
+            NoisePayload(type: .delivered, data: Data("mine-short-1".utf8)),
+            senderPubkey: senderPubkey,
+            convKey: stablePeerID
+        )
+        coordinator.handleReadReceipt(
+            NoisePayload(type: .readReceipt, data: Data("mine-short-2".utf8)),
+            senderPubkey: senderPubkey,
+            convKey: stablePeerID
+        )
+
+        #expect(context.privateChats[shortPeerID] == nil)
+        #expect(isDelivered(context.privateChats[stablePeerID]?.first?.deliveryStatus, to: "alice"))
+        #expect(isRead(context.privateChats[stablePeerID]?.last?.deliveryStatus, by: "alice"))
+        #expect(context.selectedPrivateChatPeer == stablePeerID)
+        #expect(context.deliveredMessageIDs == ["mine-short-1", "mine-short-2"])
+        #expect(context.notifyUIChangedCount == 2)
+    }
+
+    @Test @MainActor
+    func accountDMAck_doesNotTouchAnUnrelatedConversationWithTheSameMessageID() async {
+        let context = MockChatPrivateConversationContext()
+        let coordinator = ChatPrivateConversationCoordinator(context: context)
+        let stablePeerID = PeerID(hexData: Data(repeating: 0xC1, count: 32))
+        let unrelatedPeerID = PeerID(str: "1111222233334444")
+        context.privateChats[unrelatedPeerID] = [
+            makeIncomingMessage(id: "collision", sender: "me")
+        ]
+        context.queuedMessageIDsByPeerID[unrelatedPeerID] = ["collision"]
+
+        coordinator.handleDelivered(
+            NoisePayload(type: .delivered, data: Data("collision".utf8)),
+            senderPubkey: "feedface00112233",
+            convKey: stablePeerID
+        )
+
+        #expect(isDelivered(context.privateChats[unrelatedPeerID]?.first?.deliveryStatus, to: "me"))
+        #expect(context.deliveredMessageIDs.isEmpty)
+        #expect(context.queuedMessageIDsByPeerID[unrelatedPeerID] == ["collision"])
+        #expect(context.notifyUIChangedCount == 0)
     }
 
     @Test @MainActor
@@ -412,6 +503,199 @@ struct ChatPrivateConversationCoordinatorContextTests {
         #expect(context.privateChats[convKey]?.count == 1)
     }
 
+    @Test @MainActor
+    func sendGeohashDM_rejectedAdmissionNeverBecomesSent() async {
+        let context = MockChatPrivateConversationContext()
+        let coordinator = ChatPrivateConversationCoordinator(context: context)
+        let recipientHex = String(repeating: "33", count: 32)
+        let peerID = PeerID(nostr_: recipientHex)
+        context.activeChannel = .location(
+            GeohashChannel(level: .city, geohash: "u4pruy")
+        )
+        context.nostrKeyMapping[peerID] = recipientHex
+        context.geohashPrivateMessageAccepted = false
+
+        coordinator.sendGeohashDM("rejected", to: peerID)
+
+        #expect(context.geoPrivateMessages.map(\.content) == ["rejected"])
+        #expect(context.privateChats[peerID]?.count == 1)
+        #expect(isFailed(context.privateChats[peerID]?.first?.deliveryStatus))
+    }
+
+    @Test @MainActor
+    func accountDM_handsOpenShortIDConversationToStableWhenOffline() async {
+        let context = MockChatPrivateConversationContext()
+        let coordinator = ChatPrivateConversationCoordinator(context: context)
+        let noiseKey = Data(repeating: 0xA7, count: 32)
+        let stablePeerID = PeerID(hexData: noiseKey)
+        let shortPeerID = stablePeerID.toShort()
+        let senderPubkey = "feedface00112233"
+        let now = Date()
+        context.displayNamesByPubkey[senderPubkey] = "bob"
+        context.selectedPrivateChatPeer = shortPeerID
+        context.privateChats[shortPeerID] = [
+            makeIncomingMessage(
+                id: "short-history",
+                sender: "me",
+                timestamp: now.addingTimeInterval(-30),
+                senderPeerID: context.myPeerID
+            ),
+            makeIncomingMessage(
+                id: "short-inbound",
+                sender: "bob",
+                timestamp: now.addingTimeInterval(-25),
+                senderPeerID: shortPeerID
+            )
+        ]
+        context.privateChats[stablePeerID] = [
+            makeIncomingMessage(
+                id: "stable-history",
+                sender: "bob",
+                timestamp: now.addingTimeInterval(-20),
+                senderPeerID: stablePeerID
+            )
+        ]
+        let payloadData = PrivateMessagePacket(messageID: "account-live-1", content: "live reply").encode()!
+
+        coordinator.handlePrivateMessage(
+            NoisePayload(type: .privateMessage, data: payloadData),
+            senderPubkey: senderPubkey,
+            convKey: stablePeerID,
+            id: MockChatPrivateConversationContext.dummyIdentity,
+            messageTimestamp: now
+        )
+
+        #expect(context.privateChats[shortPeerID] == nil)
+        #expect(context.privateChats[stablePeerID]?.map(\.id) == [
+            "short-history",
+            "short-inbound",
+            "stable-history",
+            "account-live-1"
+        ])
+        #expect(context.privateChats[stablePeerID]?[1].senderPeerID == stablePeerID)
+        #expect(context.privateChats[stablePeerID]?.last?.senderPeerID == stablePeerID)
+        #expect(context.migratedChats.contains(where: { $0.from == shortPeerID && $0.to == stablePeerID }))
+        #expect(context.selectedPrivateChatPeer == stablePeerID)
+        #expect(context.geoReadReceipts.map(\.messageID) == ["account-live-1"])
+        #expect(context.unreadPrivateMessages.isEmpty)
+        #expect(context.notifyUIChangedCount == 1)
+    }
+
+    @Test @MainActor
+    func accountDM_aliasMergePreservesTheCanonicalDestinationCopy() async {
+        let context = MockChatPrivateConversationContext()
+        let coordinator = ChatPrivateConversationCoordinator(context: context)
+        let noiseKey = Data(repeating: 0xA8, count: 32)
+        let stablePeerID = PeerID(hexData: noiseKey)
+        let shortPeerID = stablePeerID.toShort()
+        let senderPubkey = "feedface00112233"
+        let olderSource = makeIncomingMessage(
+            id: "duplicate-history",
+            sender: "bob",
+            content: "older source copy",
+            senderPeerID: shortPeerID
+        )
+        olderSource.deliveryStatus = .delivered(to: "me", at: Date(timeIntervalSince1970: 10))
+        let newerDestination = makeIncomingMessage(
+            id: "duplicate-history",
+            sender: "bob",
+            content: "newer destination copy",
+            senderPeerID: shortPeerID
+        )
+        newerDestination.deliveryStatus = .read(by: "me", at: Date(timeIntervalSince1970: 20))
+        context.privateChats[shortPeerID] = [olderSource]
+        context.privateChats[stablePeerID] = [newerDestination]
+        context.displayNamesByPubkey[senderPubkey] = "bob"
+        let payloadData = PrivateMessagePacket(messageID: "after-merge", content: "new reply").encode()!
+
+        coordinator.handlePrivateMessage(
+            NoisePayload(type: .privateMessage, data: payloadData),
+            senderPubkey: senderPubkey,
+            convKey: stablePeerID,
+            id: MockChatPrivateConversationContext.dummyIdentity,
+            messageTimestamp: Date()
+        )
+
+        let merged = context.privateChats[stablePeerID]?.first
+        #expect(context.privateChats[shortPeerID] == nil)
+        #expect(merged?.content == "newer destination copy")
+        #expect(isRead(merged?.deliveryStatus, by: "me"))
+        #expect(merged?.senderPeerID == stablePeerID)
+    }
+
+    @Test @MainActor
+    func accountDM_keepsTheConnectedShortIDConversationCanonical() async {
+        let context = MockChatPrivateConversationContext()
+        let coordinator = ChatPrivateConversationCoordinator(context: context)
+        let noiseKey = Data(repeating: 0xB8, count: 32)
+        let stablePeerID = PeerID(hexData: noiseKey)
+        let shortPeerID = stablePeerID.toShort()
+        let senderPubkey = "feedface00112233"
+        context.connectedPeers = [shortPeerID]
+        context.selectedPrivateChatPeer = stablePeerID
+        context.displayNamesByPubkey[senderPubkey] = "bob"
+        context.privateChats[stablePeerID] = [
+            makeIncomingMessage(id: "stable-history", senderPeerID: stablePeerID)
+        ]
+        let payloadData = PrivateMessagePacket(messageID: "connected-live-1", content: "still nearby").encode()!
+
+        coordinator.handlePrivateMessage(
+            NoisePayload(type: .privateMessage, data: payloadData),
+            senderPubkey: senderPubkey,
+            convKey: stablePeerID,
+            id: MockChatPrivateConversationContext.dummyIdentity,
+            messageTimestamp: Date()
+        )
+
+        #expect(context.privateChats[stablePeerID] == nil)
+        #expect(context.privateChats[shortPeerID]?.map(\.id) == ["stable-history", "connected-live-1"])
+        #expect(context.privateChats[shortPeerID]?.first?.senderPeerID == shortPeerID)
+        #expect(context.privateChats[shortPeerID]?.last?.senderPeerID == shortPeerID)
+        #expect(context.selectedPrivateChatPeer == shortPeerID)
+        #expect(context.geoReadReceipts.map(\.messageID) == ["connected-live-1"])
+    }
+
+    @Test @MainActor
+    func accountDM_duplicateDowngradeAckStillClearsTheRetainedOutbox() async {
+        let context = MockChatPrivateConversationContext()
+        let coordinator = ChatPrivateConversationCoordinator(context: context)
+        let stablePeerID = PeerID(hexData: Data(repeating: 0xE2, count: 32))
+        let message = makeIncomingMessage(id: "already-read", sender: "me")
+        message.deliveryStatus = .read(by: "bob", at: Date())
+        context.privateChats[stablePeerID] = [message]
+        context.queuedMessageIDsByPeerID[stablePeerID] = ["already-read"]
+
+        coordinator.handleDelivered(
+            NoisePayload(type: .delivered, data: Data("already-read".utf8)),
+            senderPubkey: "feedface00112233",
+            convKey: stablePeerID
+        )
+
+        #expect(isRead(context.privateChats[stablePeerID]?.first?.deliveryStatus, by: "bob"))
+        #expect(context.deliveredMessageIDs == ["already-read"])
+        #expect(context.notifyUIChangedCount == 0)
+    }
+
+    @Test @MainActor
+    func accountDMAck_clearsRetainedMessageAfterConversationWasRemoved() async {
+        let context = MockChatPrivateConversationContext()
+        let coordinator = ChatPrivateConversationCoordinator(context: context)
+        let stablePeerID = PeerID(hexData: Data(repeating: 0xE3, count: 32))
+        let shortPeerID = stablePeerID.toShort()
+        context.queuedMessageIDsByPeerID[shortPeerID] = ["cleared-bubble"]
+
+        coordinator.handleDelivered(
+            NoisePayload(type: .delivered, data: Data("cleared-bubble".utf8)),
+            senderPubkey: "feedface00112233",
+            convKey: stablePeerID
+        )
+
+        #expect(context.privateChats.isEmpty)
+        #expect(context.queuedMessageIDsByPeerID[shortPeerID] == nil)
+        #expect(context.deliveredMessageIDs == ["cleared-bubble"])
+        #expect(context.notifyUIChangedCount == 0)
+    }
+
     @Test @MainActor
     func handleViewingThisChat_clearsUnreadAndSendsRoutedReadReceiptOnce() async {
         let context = MockChatPrivateConversationContext()

bitchatTests/ChatTransportEventCoordinatorContextTests.swift

@@ -133,11 +133,17 @@ private final class MockChatTransportEventContext: ChatTransportEventContext {
     // Delivery status
     var applyMessageDeliveryStatusResult = true
     var deliveryStatusesByMessageID: [String: DeliveryStatus] = [:]
-    private(set) var appliedDeliveryStatuses: [(messageID: String, status: DeliveryStatus)] = []
+    private(set) var appliedDeliveryStatuses: [
+        (messageID: String, status: DeliveryStatus, peerIDAliases: Set<PeerID>)
+    ] = []
 
     @discardableResult
-    func applyMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool {
-        appliedDeliveryStatuses.append((messageID, status))
+    func applyAcknowledgedMessageDeliveryStatus(
+        _ messageID: String,
+        status: DeliveryStatus,
+        from peerIDAliases: Set<PeerID>
+    ) -> Bool {
+        appliedDeliveryStatuses.append((messageID, status, peerIDAliases))
         return applyMessageDeliveryStatusResult
     }
 
@@ -220,26 +226,85 @@ struct ChatTransportEventCoordinatorContextTests {
     func didReceiveMessage_routesPrivateAndPublic_skipsBlockedAndEmpty() async {
         let context = MockChatTransportEventContext()
         let coordinator = ChatTransportEventCoordinator(context: context)
+        let peerID = PeerID(str: "1122334455667788")
 
         // Blocked messages are dropped before any handling.
-        context.blockedMessageIDs = ["blocked"]
+        context.blockedMessageIDs = ["blocked", "blocked-private"]
         coordinator.didReceiveMessage(makeMessage(id: "blocked"))
+        coordinator.didReceiveMessage(makeMessage(
+            id: "blocked-private",
+            isPrivate: true,
+            senderPeerID: peerID
+        ))
         // Empty public content is dropped too.
         coordinator.didReceiveMessage(makeMessage(id: "empty", content: "   "))
         await drainMainActorTasks()
         #expect(context.handledPublicMessages.isEmpty)
         #expect(context.handledPrivateMessages.isEmpty)
         #expect(context.mentionCheckedMessageIDs.isEmpty)
+        #expect(context.meshDeliveryAcks.isEmpty)
 
         // Private goes to the private handler, public to the public handler;
-        // both get mention checks and haptics.
-        coordinator.didReceiveMessage(makeMessage(id: "pm", isPrivate: true))
+        // both get mention checks and haptics. Stable-media ACK authorization
+        // belongs to BLEFileTransferHandler after its durable commit and this
+        // synchronous acceptance result, not to the generic UI coordinator.
+        let stableMediaID = "media-\(String(repeating: "a", count: 32))"
+        coordinator.didReceiveMessage(makeMessage(
+            id: stableMediaID,
+            isPrivate: true,
+            senderPeerID: peerID
+        ))
+        coordinator.didReceiveMessage(makeMessage(
+            id: "legacy-media",
+            isPrivate: true,
+            senderPeerID: peerID
+        ))
+        coordinator.didReceiveMessage(makeMessage(id: "pm-missing-sender", isPrivate: true))
         coordinator.didReceiveMessage(makeMessage(id: "pub"))
         await drainMainActorTasks()
-        #expect(context.handledPrivateMessages.map(\.id) == ["pm"])
+        #expect(context.handledPrivateMessages.map(\.id) == [
+            stableMediaID,
+            "legacy-media",
+            "pm-missing-sender"
+        ])
         #expect(context.handledPublicMessages.map(\.id) == ["pub"])
-        #expect(context.mentionCheckedMessageIDs == ["pm", "pub"])
-        #expect(context.hapticMessageIDs == ["pm", "pub"])
+        #expect(context.mentionCheckedMessageIDs == [
+            stableMediaID,
+            "legacy-media",
+            "pm-missing-sender",
+            "pub"
+        ])
+        #expect(context.hapticMessageIDs == [
+            stableMediaID,
+            "legacy-media",
+            "pm-missing-sender",
+            "pub"
+        ])
+        #expect(context.meshDeliveryAcks.isEmpty)
+    }
+
+    @Test @MainActor
+    func synchronousMessageDeliveryReportsAcceptanceForAckGating() {
+        let context = MockChatTransportEventContext()
+        let coordinator = ChatTransportEventCoordinator(context: context)
+        let peerID = PeerID(str: "1122334455667788")
+        let blocked = makeMessage(
+            id: "blocked-private-media",
+            isPrivate: true,
+            senderPeerID: peerID
+        )
+        context.blockedMessageIDs = [blocked.id]
+
+        #expect(coordinator.didReceiveMessageSynchronously(blocked) == false)
+        #expect(context.handledPrivateMessages.isEmpty)
+
+        let accepted = makeMessage(
+            id: "accepted-private-media",
+            isPrivate: true,
+            senderPeerID: peerID
+        )
+        #expect(coordinator.didReceiveMessageSynchronously(accepted) == true)
+        #expect(context.handledPrivateMessages.map(\.id) == [accepted.id])
     }
 
     @Test @MainActor
@@ -295,6 +360,32 @@ struct ChatTransportEventCoordinatorContextTests {
         #expect(context.notifyUIChangedCount == 2)
     }
 
+    @Test @MainActor
+    func synchronousConnectAndDisconnect_applyBeforeReturning() {
+        let context = MockChatTransportEventContext()
+        let coordinator = ChatTransportEventCoordinator(context: context)
+        let peerID = PeerID(str: "2233445566778899")
+        let incoming = makeMessage(
+            id: "incoming-receipt",
+            isPrivate: true,
+            senderPeerID: peerID
+        )
+        context.privateChats[peerID] = [incoming]
+
+        coordinator.didConnectToPeerSynchronously(peerID)
+
+        #expect(context.isConnected)
+        #expect(context.registeredEphemeralSessions == [peerID])
+        #expect(context.flushedOutboxPeerIDs == [peerID])
+        #expect(context.courierRetryPeerIDs == [peerID])
+
+        coordinator.didDisconnectFromPeerSynchronously(peerID)
+
+        #expect(context.removedEphemeralSessions == [peerID])
+        #expect(context.unmarkedReadReceiptBatches == [[incoming.id]])
+        #expect(context.notifyUIChangedCount == 2)
+    }
+
     @Test @MainActor
     func didDisconnect_whileViewingChat_migratesConversationToStablePeerID() async {
         let context = MockChatTransportEventContext()
@@ -332,6 +423,10 @@ struct ChatTransportEventCoordinatorContextTests {
         let peerID = PeerID(str: "99aabbccddeeff00")
         let noiseKey = Data(repeating: 0x44, count: 32)
         context.peersByID[peerID] = BitchatPeer(peerID: peerID, noisePublicKey: noiseKey, nickname: "alice")
+        let stablePeerID = PeerID(hexData: noiseKey)
+        let staleStablePeerID = PeerID(hexData: Data(repeating: 0x55, count: 32))
+        context.cacheStablePeerID(staleStablePeerID, for: peerID)
+        context.noiseSessionKeysByPeerID[peerID] = noiseKey
 
         // Inbound private message: decoded, handled, and delivery-acked.
         let packet = PrivateMessagePacket(messageID: "pm-1", content: "hi there")
@@ -353,6 +448,8 @@ struct ChatTransportEventCoordinatorContextTests {
         await drainMainActorTasks()
         #expect(context.appliedDeliveryStatuses.count == 2)
         #expect(context.appliedDeliveryStatuses[0].messageID == "m-1")
+        #expect(context.appliedDeliveryStatuses[0].peerIDAliases == [peerID, stablePeerID])
+        #expect(!context.appliedDeliveryStatuses[0].peerIDAliases.contains(staleStablePeerID))
         if case .delivered(let to, _) = context.appliedDeliveryStatuses[0].status {
             #expect(to == "alice")
         } else {

bitchatTests/ChatVerificationCoordinatorContextTests.swift

@@ -97,6 +97,8 @@ private final class MockChatVerificationContext: ChatVerificationContext {
     var noiseSessionKeysByPeerID: [PeerID: Data] = [:]
     private(set) var installedCallbacks: (onPeerAuthenticated: (PeerID, String) -> Void, onHandshakeRequired: (PeerID) -> Void)?
     private(set) var triggeredHandshakes: [PeerID] = []
+    private(set) var privateMediaAuthenticatedPeers: [PeerID] = []
+    private(set) var securePrivateMessageRetryAliases: [[PeerID]] = []
     private(set) var sentChallenges: [(peerID: PeerID, noiseKeyHex: String, nonceA: Data)] = []
     private(set) var sentResponses: [(peerID: PeerID, noiseKeyHex: String, nonceA: Data)] = []
 
@@ -113,6 +115,13 @@ private final class MockChatVerificationContext: ChatVerificationContext {
         establishedNoiseSessions.contains(peerID)
     }
     func triggerHandshake(with peerID: PeerID) { triggeredHandshakes.append(peerID) }
+    func privateMediaPeerDidAuthenticate(_ peerID: PeerID) {
+        privateMediaAuthenticatedPeers.append(peerID)
+    }
+
+    func retrySecurePrivateMessagesAfterAuthentication(for peerIDAliases: [PeerID]) {
+        securePrivateMessageRetryAliases.append(peerIDAliases)
+    }
 
     func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {
         sentChallenges.append((peerID, noiseKeyHex, nonceA))
@@ -265,6 +274,10 @@ struct ChatVerificationCoordinatorContextTests {
         let peerID = PeerID(str: "1122334455667788")
         let noiseKey = Data(repeating: 0x33, count: 32)
         context.noiseSessionKeysByPeerID[peerID] = noiseKey
+        context.cacheStablePeerID(
+            PeerID(hexData: Data(repeating: 0x44, count: 32)),
+            for: peerID
+        )
         context.verifiedFingerprints = ["fp-verified"]
 
         coordinator.setupNoiseCallbacks()
@@ -275,8 +288,11 @@ struct ChatVerificationCoordinatorContextTests {
         callbacks?.onPeerAuthenticated(peerID, "fp-verified")
         await waitForMainQueue()
         #expect(context.encryptionStatuses[peerID] == .noiseVerified)
-        #expect(context.stablePeerIDCache[peerID] == PeerID(hexData: noiseKey))
+        let stablePeerID = PeerID(hexData: noiseKey)
+        #expect(context.stablePeerIDCache[peerID] == stablePeerID)
         #expect(context.invalidatedEncryptionCachePeers.contains(peerID))
+        #expect(context.privateMediaAuthenticatedPeers == [peerID])
+        #expect(context.securePrivateMessageRetryAliases == [[peerID, stablePeerID]])
 
         // Handshake required -> handshaking status.
         callbacks?.onHandshakeRequired(peerID)

bitchatTests/ChatViewModelDeliveryStatusTests.swift

@@ -298,6 +298,137 @@ struct ChatViewModelDeliveryStatusTests {
         }())
     }
 
+    @Test @MainActor
+    func authenticatedNoiseAckCannotClearAnotherPeersRetryState() async {
+        let (viewModel, transport) = makeTestableViewModel()
+        let intendedPeer = PeerID(str: "0102030405060708")
+        let otherPeer = PeerID(str: "1112131415161718")
+        let messageID = "noise-peer-bound-ack"
+
+        viewModel.seedPrivateChat(
+            [
+                BitchatMessage(
+                    id: messageID,
+                    sender: viewModel.nickname,
+                    content: "Keep retrying",
+                    timestamp: Date(),
+                    isRelay: false,
+                    isPrivate: true,
+                    recipientNickname: "Intended",
+                    senderPeerID: viewModel.myPeerID,
+                    deliveryStatus: .sent
+                )
+            ],
+            for: intendedPeer
+        )
+        transport.reachablePeers.insert(intendedPeer)
+        viewModel.messageRouter.sendPrivate(
+            "Keep retrying",
+            to: intendedPeer,
+            recipientNickname: "Intended",
+            messageID: messageID
+        )
+        #expect(transport.sentPrivateMessages.count == 1)
+
+        // This models a decrypted Noise receipt: the transport-authenticated
+        // peer is authoritative, not the attacker-controlled message ID.
+        viewModel.didReceiveNoisePayload(
+            from: otherPeer,
+            type: .delivered,
+            payload: Data(messageID.utf8),
+            timestamp: Date()
+        )
+        for _ in 0..<10 { await Task.yield() }
+
+        #expect(isSent(viewModel.conversations.deliveryStatus(forMessageID: messageID)))
+        viewModel.messageRouter.flushOutbox(for: intendedPeer)
+        #expect(transport.sentPrivateMessages.count == 2)
+
+        viewModel.didReceiveNoisePayload(
+            from: intendedPeer,
+            type: .delivered,
+            payload: Data(messageID.utf8),
+            timestamp: Date()
+        )
+        for _ in 0..<10 { await Task.yield() }
+
+        #expect(isDelivered(viewModel.conversations.deliveryStatus(forMessageID: messageID)))
+        viewModel.messageRouter.flushOutbox(for: intendedPeer)
+        #expect(transport.sentPrivateMessages.count == 2)
+    }
+
+    @Test @MainActor
+    func authenticatedNoiseAckClearsOnlyIntendedPeersPrivateMediaRetry() async throws {
+        let (viewModel, transport) = makeTestableViewModel()
+        let intendedPeer = PeerID(str: "0102030405060708")
+        let otherPeer = PeerID(str: "1112131415161718")
+        let fileName = "voice_0011223344556677.m4a"
+        let content = Data("voice".utf8)
+
+        transport.privateMediaPolicies[intendedPeer] = .encrypted
+        transport.privateMediaReceiptSessionGenerations[intendedPeer] = UUID()
+        viewModel.selectedPrivateChatPeer = intendedPeer
+        let coordinator = ChatMediaTransferCoordinator(
+            context: viewModel,
+            prepareVoiceNotePacket: { _ in
+                BitchatFilePacket(
+                    fileName: fileName,
+                    fileSize: UInt64(content.count),
+                    mimeType: "audio/mp4",
+                    content: content
+                )
+            },
+            transferIDFactory: { "\($0)-receipt-ack" }
+        )
+        viewModel.mediaTransferCoordinator = coordinator
+
+        let directory = FileManager.default.temporaryDirectory
+            .appendingPathComponent(
+                "scoped-media-ack-\(UUID().uuidString)",
+                isDirectory: true
+            )
+        try FileManager.default.createDirectory(
+            at: directory,
+            withIntermediateDirectories: true
+        )
+        let sourceURL = directory.appendingPathComponent(fileName)
+        try content.write(to: sourceURL)
+        defer { try? FileManager.default.removeItem(at: directory) }
+
+        coordinator.sendVoiceNote(at: sourceURL)
+        #expect(await TestHelpers.waitUntil(
+            {
+                transport.sentPrivateFiles.count == 1
+                    && coordinator.retainedReconnectRetryCount == 1
+            },
+            timeout: TestConstants.longTimeout
+        ))
+        let messageID = try #require(
+            viewModel.privateChats[intendedPeer]?.first?.id
+        )
+        let transferID = try #require(
+            transport.sentPrivateFiles.first?.transferID
+        )
+
+        #expect(!viewModel.deliveryCoordinator
+            .updateAcknowledgedMessageDeliveryStatus(
+                messageID,
+                status: .delivered(to: "Other", at: Date()),
+                from: [otherPeer]
+            ))
+        #expect(coordinator.retainedReconnectRetryCount == 1)
+        #expect(transport.cancelledTransfers.isEmpty)
+
+        #expect(viewModel.deliveryCoordinator
+            .updateAcknowledgedMessageDeliveryStatus(
+                messageID,
+                status: .delivered(to: "Intended", at: Date()),
+                from: [intendedPeer]
+            ))
+        #expect(coordinator.retainedReconnectRetryCount == 0)
+        #expect(transport.cancelledTransfers == [transferID])
+    }
+
     @Test @MainActor
     func cleanupOldReadReceipts_removesReceiptIDsWithoutMessages() async {
         let (viewModel, transport) = makeTestableViewModel()
@@ -577,12 +708,26 @@ private final class MockChatDeliveryContext: ChatDeliveryContext {
     var isStartupPhase = false
     private(set) var notifyUIChangedCount = 0
     private(set) var markedDeliveredMessageIDs: [String] = []
+    private(set) var peerBoundDeliveredMessages: [(messageID: String, peerIDs: Set<PeerID>)] = []
 
     @discardableResult
     func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool {
         store.setDeliveryStatus(status, forMessageID: messageID)
     }
 
+    @discardableResult
+    func setDeliveryStatus(
+        _ status: DeliveryStatus,
+        forMessageID messageID: String,
+        inDirectPeerAliases peerIDs: Set<PeerID>
+    ) -> Bool {
+        store.setDeliveryStatus(
+            status,
+            forMessageID: messageID,
+            inDirectPeerAliases: peerIDs
+        )
+    }
+
     func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus? {
         store.deliveryStatus(forMessageID: messageID)
     }
@@ -604,6 +749,24 @@ private final class MockChatDeliveryContext: ChatDeliveryContext {
     func markMessageDelivered(_ messageID: String) {
         markedDeliveredMessageIDs.append(messageID)
     }
+
+    func markMessageDelivered(_ messageID: String, from peerIDs: Set<PeerID>) {
+        peerBoundDeliveredMessages.append((messageID, peerIDs))
+    }
+
+    func isOutgoingPrivateMessage(_ messageID: String, toAny peerIDs: Set<PeerID>) -> Bool {
+        peerIDs.contains { peerID in
+            contextMessages(for: peerID).contains { message in
+                message.id == messageID && message.senderPeerID == localPeerID
+            }
+        }
+    }
+
+    private let localPeerID = PeerID(str: "aabbccddeeff0011")
+
+    private func contextMessages(for peerID: PeerID) -> [BitchatMessage] {
+        store.conversationsByID[.directPeer(peerID)]?.messages ?? []
+    }
 }
 
 @MainActor
@@ -685,7 +848,151 @@ struct ChatDeliveryCoordinatorContextTests {
 
         #expect(isRead(coordinator.deliveryStatus(for: messageID)))
         #expect(context.notifyUIChangedCount == 1)
-        #expect(context.markedDeliveredMessageIDs == [messageID])
+        #expect(context.markedDeliveredMessageIDs.isEmpty)
+        #expect(context.peerBoundDeliveredMessages.count == 1)
+        #expect(context.peerBoundDeliveredMessages[0].messageID == messageID)
+        #expect(context.peerBoundDeliveredMessages[0].peerIDs == [peerID])
+    }
+
+    @Test @MainActor
+    func authenticatedReceiptWithCollidingIDUpdatesOnlyAuthenticatedAliases() async {
+        let context = MockChatDeliveryContext()
+        let coordinator = ChatDeliveryCoordinator(context: context)
+        let ephemeralPeerID = PeerID(str: "0102030405060708")
+        let stablePeerID = PeerID(hexData: Data(repeating: 0x08, count: 32))
+        let otherPeerID = PeerID(str: "1112131415161718")
+        let messageID = "authenticated-receipt-collision"
+        let mirroredMessage = makePrivateMessage(id: messageID, status: .sent)
+
+        context.store.append(mirroredMessage, to: .directPeer(ephemeralPeerID))
+        context.store.append(mirroredMessage, to: .directPeer(stablePeerID))
+        context.store.append(
+            makePrivateMessage(id: messageID, status: .sent),
+            to: .directPeer(otherPeerID)
+        )
+        context.store.append(makePublicMessage(id: messageID, status: .sent), to: .mesh)
+
+        let aliases: Set<PeerID> = [ephemeralPeerID, stablePeerID]
+        let didUpdate = coordinator.updateAcknowledgedMessageDeliveryStatus(
+            messageID,
+            status: .delivered(to: "Peer", at: Date()),
+            from: aliases
+        )
+
+        #expect(didUpdate)
+        #expect(isDelivered(
+            context.store.conversation(for: .directPeer(ephemeralPeerID))
+                .message(withID: messageID)?.deliveryStatus
+        ))
+        #expect(isDelivered(
+            context.store.conversation(for: .directPeer(stablePeerID))
+                .message(withID: messageID)?.deliveryStatus
+        ))
+        #expect(isSent(
+            context.store.conversation(for: .directPeer(otherPeerID))
+                .message(withID: messageID)?.deliveryStatus
+        ))
+        #expect(isSent(
+            context.store.conversation(for: .mesh)
+                .message(withID: messageID)?.deliveryStatus
+        ))
+        #expect(context.peerBoundDeliveredMessages.count == 1)
+        #expect(context.peerBoundDeliveredMessages[0].messageID == messageID)
+        #expect(context.peerBoundDeliveredMessages[0].peerIDs == aliases)
+        #expect(context.notifyUIChangedCount == 1)
+    }
+
+    @Test @MainActor
+    func authenticatedReceiptRemainsScopedAfterPeerAliasMigration() async {
+        let context = MockChatDeliveryContext()
+        let coordinator = ChatDeliveryCoordinator(context: context)
+        let ephemeralPeerID = PeerID(str: "2122232425262728")
+        let stablePeerID = PeerID(hexData: Data(repeating: 0x28, count: 32))
+        let otherPeerID = PeerID(str: "3132333435363738")
+        let messageID = "authenticated-receipt-after-migration"
+
+        context.store.append(
+            makePrivateMessage(id: messageID, status: .sent),
+            to: .directPeer(ephemeralPeerID)
+        )
+        context.store.append(
+            makePrivateMessage(id: messageID, status: .sent),
+            to: .directPeer(otherPeerID)
+        )
+        context.store.migrateConversation(
+            from: .directPeer(ephemeralPeerID),
+            to: .directPeer(stablePeerID)
+        )
+
+        let didUpdate = coordinator.updateAcknowledgedMessageDeliveryStatus(
+            messageID,
+            status: .read(by: "Peer", at: Date()),
+            from: [ephemeralPeerID, stablePeerID]
+        )
+
+        #expect(didUpdate)
+        #expect(context.store.conversationsByID[.directPeer(ephemeralPeerID)] == nil)
+        #expect(isRead(
+            context.store.conversation(for: .directPeer(stablePeerID))
+                .message(withID: messageID)?.deliveryStatus
+        ))
+        #expect(isSent(
+            context.store.conversation(for: .directPeer(otherPeerID))
+                .message(withID: messageID)?.deliveryStatus
+        ))
+    }
+
+    @Test @MainActor
+    func receiptFromWrongPeerDoesNotUpdateOrTerminalizeOutgoingMessage() async {
+        let context = MockChatDeliveryContext()
+        let coordinator = ChatDeliveryCoordinator(context: context)
+        let intendedPeer = PeerID(str: "0102030405060708")
+        let otherPeer = PeerID(str: "1112131415161718")
+        let messageID = "wrong-peer-receipt"
+        context.store.append(
+            makePrivateMessage(id: messageID, status: .sent),
+            to: .directPeer(intendedPeer)
+        )
+
+        coordinator.didReceiveReadReceipt(
+            ReadReceipt(
+                originalMessageID: messageID,
+                readerID: otherPeer,
+                readerNickname: "Other"
+            )
+        )
+
+        #expect(isSent(coordinator.deliveryStatus(for: messageID)))
+        #expect(context.peerBoundDeliveredMessages.isEmpty)
+        #expect(context.markedDeliveredMessageIDs.isEmpty)
+        #expect(context.notifyUIChangedCount == 0)
+    }
+
+    @Test @MainActor
+    func rejectedStaleReceiptDoesNotTerminalizeRetryState() async {
+        let context = MockChatDeliveryContext()
+        let coordinator = ChatDeliveryCoordinator(context: context)
+        let peerID = PeerID(str: "0102030405060708")
+        let messageID = "stale-receipt"
+        context.store.append(
+            makePrivateMessage(
+                id: messageID,
+                status: .read(by: "Peer", at: Date())
+            ),
+            to: .directPeer(peerID)
+        )
+
+        let didUpdate = coordinator.updateAcknowledgedMessageDeliveryStatus(
+            messageID,
+            status: .delivered(to: "Peer", at: Date()),
+            from: [peerID]
+        )
+
+        #expect(!didUpdate)
+        #expect(isRead(coordinator.deliveryStatus(for: messageID)))
+        #expect(context.peerBoundDeliveredMessages.isEmpty)
+        #expect(context.markedDeliveredMessageIDs.isEmpty)
+        #expect(context.notifyUIChangedCount == 0)
     }
 
     @Test @MainActor

bitchatTests/ChatViewModelExtensionsTests.swift

@@ -393,20 +393,25 @@ struct ChatViewModelNostrExtensionTests {
     }
 
     @Test @MainActor
-    func subscribeGiftWrap_rejectsOversizedEmbeddedPacket() async throws {
+    func privateEnvelope_rejectsOversizedEmbeddedPacketBeforePublication() async throws {
         let (viewModel, _) = makeTestableViewModel()
         let sender = try NostrIdentity.generate()
         let recipient = try NostrIdentity.generate()
 
         let oversized = Data(repeating: 0x41, count: FileTransferLimits.maxFramedFileBytes + 1)
         let content = "bitchat1:" + base64URLEncode(oversized)
-        let giftWrap = try NostrProtocol.createPrivateMessage(
-            content: content,
-            recipientPubkey: recipient.publicKeyHex,
-            senderIdentity: sender
-        )
-
-        viewModel.subscribeGiftWrap(giftWrap, id: recipient)
+        do {
+            _ = try NostrProtocol.createPrivateEnvelope(
+                content: content,
+                recipientPubkey: recipient.publicKeyHex,
+                senderIdentity: sender
+            )
+            Issue.record("Expected oversized private-envelope plaintext to be rejected")
+        } catch NostrError.invalidCiphertext {
+            // Rejected before encryption/publication, as intended.
+        } catch {
+            Issue.record("Expected NostrError.invalidCiphertext, got \(error)")
+        }
 
         try? await Task.sleep(nanoseconds: 100_000_000)
         #expect(viewModel.privateChats.isEmpty)
@@ -451,7 +456,7 @@ struct ChatViewModelNostrExtensionTests {
     }
 
     @Test @MainActor
-    func subscribeGiftWrap_deliveredAckUpdatesExistingMessage() async throws {
+    func subscribePrivateEnvelope_deliveredAckUpdatesExistingMessage() async throws {
         let (viewModel, _) = makeTestableViewModel()
         let sender = try NostrIdentity.generate()
         let recipient = try NostrIdentity.generate()
@@ -473,13 +478,13 @@ struct ChatViewModelNostrExtensionTests {
         ], for: convKey)
 
         let content = try ackContent(type: .delivered, messageID: messageID, senderPeerID: PeerID(str: "0123456789abcdef"))
-        let giftWrap = try NostrProtocol.createPrivateMessage(
+        let envelope = try NostrProtocol.createPrivateEnvelope(
             content: content,
             recipientPubkey: recipient.publicKeyHex,
             senderIdentity: sender
         )
 
-        viewModel.subscribeGiftWrap(giftWrap, id: recipient)
+        viewModel.subscribePrivateEnvelope(envelope, id: recipient)
 
         let didUpdate = await TestHelpers.waitUntil(
             { isDelivered(status: deliveryStatus(in: viewModel, peerID: convKey, messageID: messageID)) },
@@ -489,7 +494,7 @@ struct ChatViewModelNostrExtensionTests {
     }
 
     @Test @MainActor
-    func subscribeGiftWrap_readAckUpdatesExistingMessage() async throws {
+    func subscribePrivateEnvelope_readAckUpdatesExistingMessage() async throws {
         let (viewModel, _) = makeTestableViewModel()
         let sender = try NostrIdentity.generate()
         let recipient = try NostrIdentity.generate()
@@ -511,13 +516,13 @@ struct ChatViewModelNostrExtensionTests {
         ], for: convKey)
 
         let content = try ackContent(type: .readReceipt, messageID: messageID, senderPeerID: PeerID(str: "0123456789abcdef"))
-        let giftWrap = try NostrProtocol.createPrivateMessage(
+        let envelope = try NostrProtocol.createPrivateEnvelope(
             content: content,
             recipientPubkey: recipient.publicKeyHex,
             senderIdentity: sender
         )
 
-        viewModel.subscribeGiftWrap(giftWrap, id: recipient)
+        viewModel.subscribePrivateEnvelope(envelope, id: recipient)
 
         let didUpdate = await TestHelpers.waitUntil(
             { isRead(status: deliveryStatus(in: viewModel, peerID: convKey, messageID: messageID)) },
@@ -527,28 +532,28 @@ struct ChatViewModelNostrExtensionTests {
     }
 
     @Test @MainActor
-    func handleGiftWrap_privateMessageStoresConversationAndMapping() async throws {
+    func handlePrivateEnvelope_privateMessageStoresConversationAndMapping() async throws {
         let (viewModel, _) = makeTestableViewModel()
         let sender = try NostrIdentity.generate()
         let recipient = try NostrIdentity.generate()
-        let messageID = "gift-private"
+        let messageID = "envelope-private"
         let convKey = PeerID(nostr_: sender.publicKeyHex)
 
         let content = try privateMessageContent(
-            text: "Hello from gift wrap",
+            text: "Hello from private envelope",
             messageID: messageID,
             senderPeerID: PeerID(str: "0123456789abcdef")
         )
-        let giftWrap = try NostrProtocol.createPrivateMessage(
+        let envelope = try NostrProtocol.createPrivateEnvelope(
             content: content,
             recipientPubkey: recipient.publicKeyHex,
             senderIdentity: sender
         )
 
-        viewModel.handleGiftWrap(giftWrap, id: recipient)
+        viewModel.handlePrivateEnvelope(envelope, id: recipient)
 
         let didStore = await TestHelpers.waitUntil(
-            { viewModel.privateChats[convKey]?.first?.content == "Hello from gift wrap" },
+            { viewModel.privateChats[convKey]?.first?.content == "Hello from private envelope" },
             timeout: 5.0
         )
         #expect(didStore)
@@ -557,11 +562,11 @@ struct ChatViewModelNostrExtensionTests {
     }
 
     @Test @MainActor
-    func handleGiftWrap_blockedSenderSkipsMessageStorage() async throws {
+    func handlePrivateEnvelope_blockedSenderSkipsMessageStorage() async throws {
         let (viewModel, _) = makeTestableViewModel()
         let sender = try NostrIdentity.generate()
         let recipient = try NostrIdentity.generate()
-        let messageID = "gift-blocked"
+        let messageID = "envelope-blocked"
         let convKey = PeerID(nostr_: sender.publicKeyHex)
 
         viewModel.identityManager.setNostrBlocked(sender.publicKeyHex, isBlocked: true)
@@ -571,13 +576,13 @@ struct ChatViewModelNostrExtensionTests {
             messageID: messageID,
             senderPeerID: PeerID(str: "0123456789abcdef")
         )
-        let giftWrap = try NostrProtocol.createPrivateMessage(
+        let envelope = try NostrProtocol.createPrivateEnvelope(
             content: content,
             recipientPubkey: recipient.publicKeyHex,
             senderIdentity: sender
         )
 
-        viewModel.handleGiftWrap(giftWrap, id: recipient)
+        viewModel.handlePrivateEnvelope(envelope, id: recipient)
 
         try? await Task.sleep(nanoseconds: 50_000_000)
         #expect(viewModel.privateChats[convKey] == nil)
@@ -585,12 +590,12 @@ struct ChatViewModelNostrExtensionTests {
     }
 
     @Test @MainActor
-    func handleGiftWrap_deliveredAckUpdatesExistingMessage() async throws {
+    func handlePrivateEnvelope_deliveredAckUpdatesExistingMessage() async throws {
         let (viewModel, _) = makeTestableViewModel()
         let sender = try NostrIdentity.generate()
         let recipient = try NostrIdentity.generate()
         let convKey = PeerID(nostr_: sender.publicKeyHex)
-        let messageID = "gift-delivered"
+        let messageID = "envelope-delivered"
 
         viewModel.seedPrivateChat([
             BitchatMessage(
@@ -607,13 +612,13 @@ struct ChatViewModelNostrExtensionTests {
         ], for: convKey)
 
         let content = try ackContent(type: .delivered, messageID: messageID, senderPeerID: PeerID(str: "0123456789abcdef"))
-        let giftWrap = try NostrProtocol.createPrivateMessage(
+        let envelope = try NostrProtocol.createPrivateEnvelope(
             content: content,
             recipientPubkey: recipient.publicKeyHex,
             senderIdentity: sender
         )
 
-        viewModel.handleGiftWrap(giftWrap, id: recipient)
+        viewModel.handlePrivateEnvelope(envelope, id: recipient)
 
         let didUpdate = await TestHelpers.waitUntil(
             { isDelivered(status: deliveryStatus(in: viewModel, peerID: convKey, messageID: messageID)) },
@@ -781,6 +786,63 @@ struct ChatViewModelGeoDMTests {
         #expect(isFailed(status: viewModel.privateChats[convKey]?.last?.deliveryStatus))
     }
 
+    @Test @MainActor
+    func geohashTerminalRelayFailure_transitionsSentMessageToFailed() async throws {
+        let (viewModel, _) = makeTestableViewModel()
+        let sender = try NostrIdentity.generate()
+        let recipient = try NostrIdentity.generate()
+        let messageID = "geo-terminal-failure"
+        let convKey = PeerID(nostr_: recipient.publicKeyHex)
+        let message = BitchatMessage(
+            id: messageID,
+            sender: viewModel.nickname,
+            content: "queued geohash message",
+            timestamp: Date(),
+            isRelay: false,
+            isPrivate: true,
+            recipientNickname: "recipient",
+            senderPeerID: viewModel.myPeerID,
+            deliveryStatus: .sent
+        )
+        viewModel.seedPrivateChat([message], for: convKey)
+
+        var terminalFailure: (@MainActor () -> Void)?
+        let dependencies = NostrTransport.Dependencies(
+            notificationCenter: NotificationCenter(),
+            loadFavorites: { [:] },
+            favoriteStatusForNoiseKey: { _ in nil },
+            favoriteStatusForPeerID: { _ in nil },
+            currentIdentity: { sender },
+            registerPendingPrivateEnvelope: { _ in },
+            sendPrivateEnvelopeBatch: { _, failure in
+                terminalFailure = failure
+                return true
+            },
+            scheduleAfter: { _, _ in },
+            relayConnectivity: {
+                Just(false).eraseToAnyPublisher()
+            }
+        )
+        let transport = viewModel.makeGeohashNostrTransport(
+            dependencies: dependencies
+        )
+
+        let accepted = transport.sendPrivateMessageGeohash(
+            content: message.content,
+            toRecipientHex: recipient.publicKeyHex,
+            from: sender,
+            messageID: messageID
+        )
+
+        #expect(accepted)
+        #expect(viewModel.privateChats[convKey]?.first?.deliveryStatus == .sent)
+        let fail = try #require(terminalFailure)
+        fail()
+        #expect(isFailed(
+            status: viewModel.privateChats[convKey]?.first?.deliveryStatus
+        ))
+    }
+
     /// The blocked notice belongs in the DM thread the person is typing in,
     /// not on the active location-channel timeline.
     @Test @MainActor
@@ -1048,6 +1110,89 @@ struct ChatViewModelMediaTransferTests {
         #expect(viewModel.transferIdToMessageIDs.count == 1)
     }
 
+    @Test @MainActor
+    func legacyPrivateMediaConsentRequestsArePerSendAndQueued() async throws {
+        let (viewModel, _) = makeTestableViewModel()
+        let firstPeer = PeerID(str: "1111111111111111")
+        let secondPeer = PeerID(str: "2222222222222222")
+        var decisions: [Bool] = []
+
+        viewModel.enqueueLegacyPrivateMediaConsent(
+            for: firstPeer,
+            transferId: "transfer-1",
+            messageID: "message-1"
+        ) { decisions.append($0) }
+        viewModel.enqueueLegacyPrivateMediaConsent(
+            for: secondPeer,
+            transferId: "transfer-2",
+            messageID: "message-2"
+        ) { decisions.append($0) }
+
+        #expect(viewModel.legacyPrivateMediaConsentRequest?.peerID == firstPeer)
+        let firstRequestID = try #require(viewModel.legacyPrivateMediaConsentRequest?.id)
+        viewModel.resolveLegacyPrivateMediaConsent(requestID: firstRequestID, approved: true)
+        let showedSecond = await TestHelpers.waitUntil(
+            { viewModel.legacyPrivateMediaConsentRequest?.peerID == secondPeer },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(showedSecond)
+        let secondRequestID = try #require(viewModel.legacyPrivateMediaConsentRequest?.id)
+
+        // A button action and the dialog binding may both resolve the first
+        // ID. The stale second callback must not consume the queued request.
+        viewModel.resolveLegacyPrivateMediaConsent(requestID: firstRequestID, approved: false)
+        #expect(decisions == [true])
+        #expect(viewModel.legacyPrivateMediaConsentRequest?.id == secondRequestID)
+
+        viewModel.resolveLegacyPrivateMediaConsent(requestID: secondRequestID, approved: false)
+
+        #expect(decisions == [true, false])
+        #expect(viewModel.legacyPrivateMediaConsentRequest == nil)
+    }
+
+    @Test @MainActor
+    func invalidatingPresentedLegacyConsentAdvancesQueueAndStaleResolutionNoops() async throws {
+        let (viewModel, _) = makeTestableViewModel()
+        let firstPeer = PeerID(str: "3333333333333333")
+        let secondPeer = PeerID(str: "4444444444444444")
+        var decisions: [String] = []
+
+        viewModel.enqueueLegacyPrivateMediaConsent(
+            for: firstPeer,
+            transferId: "transfer-cancelled",
+            messageID: "message-cancelled"
+        ) { decisions.append("first:\($0)") }
+        viewModel.enqueueLegacyPrivateMediaConsent(
+            for: secondPeer,
+            transferId: "transfer-kept",
+            messageID: "message-kept"
+        ) { decisions.append("second:\($0)") }
+
+        let cancelledRequestID = try #require(viewModel.legacyPrivateMediaConsentRequest?.id)
+        viewModel.invalidateLegacyPrivateMediaConsent(
+            transferId: "transfer-cancelled",
+            messageID: "message-cancelled"
+        )
+        let advanced = await TestHelpers.waitUntil(
+            { viewModel.legacyPrivateMediaConsentRequest?.peerID == secondPeer },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(advanced)
+        #expect(decisions.isEmpty, "Invalidation drops the request rather than resolving its send")
+
+        viewModel.resolveLegacyPrivateMediaConsent(
+            requestID: cancelledRequestID,
+            approved: true
+        )
+        #expect(viewModel.legacyPrivateMediaConsentRequest?.peerID == secondPeer)
+        #expect(decisions.isEmpty)
+
+        let keptRequestID = try #require(viewModel.legacyPrivateMediaConsentRequest?.id)
+        viewModel.resolveLegacyPrivateMediaConsent(requestID: keptRequestID, approved: true)
+        #expect(decisions == ["second:true"])
+        #expect(viewModel.legacyPrivateMediaConsentRequest == nil)
+    }
+
     @Test @MainActor
     func sendVoiceNote_oversizedFileFailsAndDeletesTempFile() async throws {
         let (viewModel, transport) = makeTestableViewModel()