Wi-Fi bulk: raise image-prep budget so real photos clear the 64 KiB AWDL threshold

Image prep downscaled every photo to 448 px and force-compressed to a
45 KB byte budget, so a typical camera photo landed ~40 KB — below
TransportConfig.wifiBulkMinPayloadBytes (64 KiB). WifiBulkPolicy.shouldOffer
requires payloadBytes > 64 KiB, so the Wi-Fi bulk (AWDL) data plane never
triggered in production even when it worked on-device: real photos always
fell back to BLE fragmentation.

Raise the prep budget so genuinely detailed photos land well above 64 KiB
while staying under the 512 KiB FileTransferLimits.maxImageBytes hard cap:
  - defaultMaxDimension 448 -> 1024 px
  - compressionQuality 0.82 -> 0.85
  - targetImageBytes 45 KB -> 200 KB (a ceiling, not a target to hit)

Measured on a representative photo-like image: ~40 KB before -> ~190 KB
after, crossing the 64 KiB offer threshold while remaining ~2.6x under the
hard cap.

Because the raised dimension makes near-incompressible inputs (e.g. full-
frame noise) able to exceed maxImageBytes at the quality floor, prep now
downscales-and-retries until the payload fits the hard cap, so a send can
never fail with imageTooLarge on pathological input (it couldn't at 448 px).
Also de-dupes the previously copy-pasted per-platform encodeJPEG into one
shared helper.

Residual limitation: prep is not recipient-capability-aware. Images are
prepared at this fidelity regardless of whether the recipient supports
Wi-Fi bulk, so BLE-only peers and public broadcasts now carry ~190 KB
images too (still within the existing 512 KiB image cap). Making prep
choose fidelity per-recipient would need capability plumbing into the prep
pipeline and doesn't help public broadcasts, so it's deferred.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/arti-provenance.yml

@@ -0,0 +1,85 @@
+name: Arti Binary Provenance
+
+# The Arti xcframework is a vendored binary; these checks turn the policy in
+# docs/ARTI-BINARY-PROVENANCE.md into an enforced gate:
+#  1. The checked-in binary must match the hash manifest in the provenance doc.
+#  2. A PR that changes the binary must also change at least one provenance
+#     input (Rust source, lockfile, build script, or the doc itself).
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "localPackages/Arti/**"
+      - "docs/ARTI-BINARY-PROVENANCE.md"
+  pull_request:
+    paths:
+      - "localPackages/Arti/**"
+      - "docs/ARTI-BINARY-PROVENANCE.md"
+
+jobs:
+  verify-hashes:
+    name: Verify xcframework hashes against provenance doc
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Compare artifact hashes with manifest
+        run: |
+          set -euo pipefail
+          doc="docs/ARTI-BINARY-PROVENANCE.md"
+
+          # Extract the manifest: lines of "<sha256>  <path>" from the doc.
+          grep -E '^[0-9a-f]{64}  localPackages/Arti/Frameworks/arti\.xcframework/' "$doc" \
+            | sort -k2 > expected.txt
+
+          if [ ! -s expected.txt ]; then
+            echo "::error::No hash manifest found in $doc"
+            exit 1
+          fi
+
+          # Hash the same file set the doc documents.
+          find localPackages/Arti/Frameworks/arti.xcframework -maxdepth 3 -type f -print0 \
+            | sort -z | xargs -0 sha256sum | sed 's/  \.\//  /' | sort -k2 > actual.txt
+
+          if ! diff -u expected.txt actual.txt; then
+            echo "::error::Checked-in arti.xcframework does not match the manifest in $doc. If the binary change is intentional, rebuild per the doc and update the manifest in the same PR."
+            exit 1
+          fi
+          echo "All $(wc -l < actual.txt) artifact hashes match the provenance manifest."
+
+  require-provenance-evidence:
+    name: Binary changes must ship with provenance inputs
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Check changed files
+        run: |
+          set -euo pipefail
+          base="origin/${{ github.base_ref }}"
+          git fetch --no-tags --depth=1 origin "${{ github.base_ref }}"
+          changed=$(git diff --name-only "$base"...HEAD)
+          echo "Changed files:"
+          echo "$changed"
+
+          if ! echo "$changed" | grep -q '^localPackages/Arti/Frameworks/arti\.xcframework/'; then
+            echo "No binary artifact changes; nothing to verify."
+            exit 0
+          fi
+
+          if echo "$changed" | grep -Eq '^(localPackages/Arti/(Cargo\.(toml|lock)|build-ios\.sh|arti-bitchat/)|docs/ARTI-BINARY-PROVENANCE\.md)'; then
+            echo "Binary change is accompanied by provenance inputs."
+            exit 0
+          fi
+
+          echo "::error::arti.xcframework changed without matching source, lockfile, build-script, or provenance-doc changes. See docs/ARTI-BINARY-PROVENANCE.md (\"Do not accept an xcframework-only update\")."
+          exit 1

.github/workflows/swift-tests.yml

@@ -10,6 +10,12 @@ jobs:
   test:
     name: Run Swift Tests (${{ matrix.name }})
     runs-on: macos-latest
+    # A hung test must fail fast, not hold a runner for GitHub's 360-minute
+    # default (observed: intermittent app-suite hangs starving the queue).
+    # The long steps carry tighter individual bounds (5-minute test watchdog,
+    # 6-minute benchmark step, 10-minute floor gate that may re-run the
+    # benchmarks up to twice on a noisy runner); this is the backstop.
+    timeout-minutes: 25
 
     strategy:
       fail-fast: false # Don't cancel other matrix jobs when one fails
@@ -26,17 +32,148 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Set up Swift
-        uses: swift-actions/setup-swift@v2
+      # Use the Xcode-bundled Swift toolchain: it always matches the SDK on
+      # the runner image. A standalone swift.org toolchain (setup-swift) broke
+      # whenever the image's Xcode moved ahead of it ("this SDK is not
+      # supported by the compiler").
+      - name: Note toolchain version (cache key)
+        id: swift-version
+        run: echo "version=$(swift --version 2>/dev/null | head -1 | shasum | cut -c1-12)" >> "$GITHUB_OUTPUT"
 
       - name: Cache build artifacts
         uses: actions/cache@v4
         with:
           path: ${{ matrix.path }}/.build
-          key: ${{ runner.os }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/*.swift', matrix.path), format('{0}/**/Package.resolved', matrix.path)) }}
+          key: ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/*.swift', matrix.path), format('{0}/**/Package.resolved', matrix.path)) }}
           restore-keys: |
-            ${{ runner.os }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/Package.resolved', matrix.path)) }}
-            ${{ runner.os }}-${{ matrix.name }}-
+            ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/Package.resolved', matrix.path)) }}
+            ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-
+
+      - name: Build tests
+        # Built separately so the hang watchdog below times only test
+        # execution: a cold-cache coverage build on a slow runner can
+        # legitimately take several minutes, and is already bounded by the
+        # 15-minute job timeout.
+        run: swift build --build-tests --enable-code-coverage --package-path ${{ matrix.path }}
 
       - name: Run Tests
-        run: swift test --parallel --quiet --package-path ${{ matrix.path }}
+        # Perf benchmarks are excluded here and run in their own serial step
+        # below: measuring while parallel test processes contend for cores
+        # produces noisy numbers, and the XCTest measure machinery has hung
+        # intermittently under parallel workers on loaded runners. Excluded
+        # via --skip (not just the env guard): every app run since the
+        # baselines landed timed out at the 15-minute job limit with the
+        # baseline tests dispatched into the parallel phase.
+        #
+        # The watchdog samples any still-running test processes after 5
+        # minutes (the suite passes in seconds when healthy; the build is
+        # done by this step) and kills the run, so a hang fails fast with
+        # stacks in the log instead of a silent timeout.
+        env:
+          BITCHAT_SKIP_PERF_BASELINES: "1"
+        run: |
+          swift test --skip-build --parallel --quiet --enable-code-coverage \
+            --skip PerformanceBaselineTests \
+            --package-path ${{ matrix.path }} &
+          test_pid=$!
+          (
+            sleep 300
+            if kill -0 "$test_pid" 2>/dev/null; then
+              echo "::group::Tests still running after 5 minutes — sampling before kill"
+              for pid in $(pgrep -if 'swiftpm-testing|xctest|PackageTests' || true); do
+                echo "--- sample of pid $pid ---"
+                sample "$pid" 5 2>/dev/null || true
+              done
+              echo "::endgroup::"
+              pkill -KILL -P "$test_pid" 2>/dev/null || true
+              kill -KILL "$test_pid" 2>/dev/null || true
+            fi
+          ) &
+          watchdog_pid=$!
+          wait "$test_pid" && status=0 || status=$?
+          kill "$watchdog_pid" 2>/dev/null || true
+          exit "$status"
+
+      # Benchmarks run serially on an otherwise idle runner for stable
+      # numbers; BITCHAT_PERF_LOG captures the PERF[...] lines for the gate.
+      - name: Run performance benchmarks (serial)
+        if: matrix.name == 'app'
+        timeout-minutes: 6
+        env:
+          BITCHAT_PERF_LOG: ${{ github.workspace }}/perf-output.log
+        run: swift test --quiet --filter PerformanceBaselineTests
+
+      # Order-of-magnitude performance regression gate. Floors are deliberately
+      # generous (see bitchatTests/Performance/perf-floors.json) so this
+      # catches algorithmic regressions, never runner variance. If a metric
+      # still lands below floor (a saturated runner can dip one), the script
+      # re-runs the benchmarks — appending to the same log and keeping each
+      # benchmark's best value per metric — so noise clears on retry while a
+      # real regression fails every attempt. Floors are never lowered by this.
+      - name: Performance floor gate
+        if: matrix.name == 'app'
+        timeout-minutes: 10
+        run: ./scripts/check-perf-floors.sh perf-output.log
+
+      # Informational only: surfaces per-file and total line coverage in the
+      # job log so coverage trends are visible on every PR. No thresholds —
+      # this must never be the reason a build goes red.
+      - name: Coverage summary
+        run: |
+          BIN_PATH=$(swift build --show-bin-path --package-path ${{ matrix.path }})
+          PROF="$BIN_PATH/codecov/default.profdata"
+          XCTEST=$(find "$BIN_PATH" -maxdepth 1 -name '*.xctest' | head -1)
+          BINARY="$XCTEST/Contents/MacOS/$(basename "$XCTEST" .xctest)"
+          if [ -f "$PROF" ] && [ -f "$BINARY" ]; then
+            xcrun llvm-cov report "$BINARY" -instr-profile "$PROF" \
+              -ignore-filename-regex='(Tests|\.build|checkouts|Mocks|_PreviewHelpers)' || true
+          else
+            echo "No coverage data found; skipping summary."
+          fi
+
+  # SPM tests above only compile the macOS slice; this job covers the
+  # iOS-conditional code paths (UIKit, CoreBluetooth restoration, etc.).
+  ios-build:
+    name: Build iOS app (simulator)
+    runs-on: macos-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Build iOS (simulator, no signing)
+        # arm64 only: the vendored arti.xcframework has no x86_64 simulator slice.
+        run: |
+          set -o pipefail
+          xcodebuild -project bitchat.xcodeproj \
+            -scheme "bitchat (iOS)" \
+            -sdk iphonesimulator \
+            -destination 'generic/platform=iOS Simulator' \
+            ARCHS=arm64 \
+            CODE_SIGNING_ALLOWED=NO \
+            build
+
+  # Advisory only: SwiftLint reports style violations without ever failing the
+  # build. Runs in a pinned container (no Xcode plugin, no pbxproj changes) so
+  # it can never break the documented xcodebuild path or block a merge.
+  lint:
+    name: SwiftLint (advisory)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # This job runs a third-party container image, so give it the least
+    # privilege we can: a read-only token, and no credentials left in the
+    # checkout for the container to find.
+    permissions:
+      contents: read
+    container:
+      # Tag for readability, digest for immutability (tags can be repointed).
+      # Bump both together, deliberately — never a floating tag.
+      image: ghcr.io/realm/swiftlint:0.65.0@sha256:a482729f4b58741875af1566f23397f3f6db300372756fc31606d0a4527fab9e
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Run SwiftLint
+        run: swiftlint lint --reporter github-actions-logging

.swiftlint.yml

@@ -0,0 +1,33 @@
+# Build artifacts and generated sources; keeps local `swiftlint` runs clean
+# (CI checkouts are fresh, so this only matters in a working tree).
+excluded:
+  - .build
+  - .swiftpm
+  - .DerivedData
+  - DerivedData
+  - build
+  - localPackages/*/.build
+
+disabled_rules:
+  - line_length
+  - type_name
+  - identifier_name
+  - statement_position
+  - implicit_optional_initialization
+  - force_try
+  - vertical_whitespace
+  - for_where
+  - control_statement
+  - void_function_in_ternary
+  - redundant_discardable_let  # SwiftUI breaks without it
+  # To be enabled as we fix the issues
+  - trailing_whitespace
+  - cyclomatic_complexity
+  - function_body_length
+  - function_parameter_count
+  - type_body_length
+  - file_length
+  - large_tuple
+  - force_cast
+  - multiple_closures_with_trailing_closure
+  - nesting

Configs/Release.xcconfig

@@ -1,4 +1,4 @@
-MARKETING_VERSION = 1.5.1
+MARKETING_VERSION = 1.5.4
 CURRENT_PROJECT_VERSION = 1
 
 IPHONEOS_DEPLOYMENT_TARGET = 16.0

PRIVACY_POLICY.md

@@ -1,6 +1,6 @@
 # bitchat Privacy Policy
 
-*Last updated: January 2025*
+*Last updated: June 2026*
 
 ## Our Commitment
 
@@ -9,7 +9,7 @@ bitchat is designed with privacy as its foundation. We believe private communica
 ## Summary
 
 - **No personal data collection** - We don't collect names, emails, or phone numbers
-- **No servers** - Everything happens on your device and through peer-to-peer connections
+- **No accounts or company servers** - Mesh chat works peer-to-peer; optional Nostr features use public or user-selected relays
 - **No tracking** - We have no analytics, telemetry, or user tracking
 - **Open source** - You can verify these claims by reading our code
 
@@ -17,11 +17,11 @@ bitchat is designed with privacy as its foundation. We believe private communica
 
 ### On Your Device Only
 
-1. **Identity Key** 
-   - A cryptographic key generated on first launch
+1. **Identity Keys**
+   - Cryptographic private keys generated on first launch or when optional Nostr identities are created
    - Stored locally in your device's secure storage
    - Allows you to maintain "favorite" relationships across app restarts
-   - Never leaves your device
+   - Private keys never leave your device; public keys are shared when needed for messaging
 
 2. **Nickname**
    - The display name you choose (or auto-generated)
@@ -38,12 +38,19 @@ bitchat is designed with privacy as its foundation. We believe private communica
    - Stored only on your device
    - Allows you to recognize these peers in future sessions
 
+5. **Optional Location Channel State**
+   - Your selected geohash channel, bookmarked geohashes, teleport flags, and bookmark display names
+   - Stored locally on your device so the location-channel UI can restore your choices
+   - Per-geohash Nostr identities are derived locally from a device seed stored in secure storage
+   - Exact latitude and longitude are not persisted by bitchat
+
 ### Temporary Session Data
 
 During each session, bitchat temporarily maintains:
 - Active peer connections (forgotten when app closes)
 - Routing information for message delivery
 - Cached messages for offline peers (12 hours max)
+- Your current location while optional location channels are enabled, used locally to compute geohash channels and friendly place names
 
 ## What Information is Shared
 
@@ -62,13 +69,21 @@ When you join a password-protected room:
 - Your nickname appears in the member list
 - Room owners can see you've joined
 
+### With Nostr Relays (Optional Features)
+
+If you enable Nostr-backed features:
+- Private fallback messages to mutual favorites are sent as encrypted NIP-17 gift wraps. Relays can see event metadata, but not message content.
+- Public location-channel messages, location notes, and presence are scoped with geohash tags. Relays and other participants can see the geohash tag, event kind, timestamp, and public key used for that geohash.
+- Exact GPS coordinates are not included in Nostr events by bitchat. The geohash precision you choose can still reveal an approximate area, from region-level to building-level.
+- Automatic presence heartbeats are limited to low-precision geohashes (region, province, and city). More precise geohash posts happen only when you use those channels or location notes.
+
 ## What We DON'T Do
 
 bitchat **never**:
 - Collects personal information
-- Tracks your location
-- Stores data on servers
-- Shares data with third parties
+- Sells or shares your exact GPS location
+- Stores data on servers we operate
+- Sells your data to advertisers or data brokers
 - Uses analytics or telemetry
 - Creates user profiles
 - Requires registration
@@ -84,19 +99,27 @@ All private messages use end-to-end encryption:
 ## Your Rights
 
 You have complete control:
-- **Delete Everything**: Triple-tap the logo to instantly wipe all data
-- **Leave Anytime**: Close the app and your presence disappears
-- **No Account**: Nothing to delete from servers because there are none
-- **Portability**: Your data never leaves your device unless you export it
+- **Delete Local State**: Triple-tap the logo to instantly wipe local keys, sessions, caches, and preferences
+- **Leave Anytime**: Close the app and local presence stops; relay-backed presence ages out
+- **No Account**: No account record exists for you to delete from us
+- **Portability**: Your local state stays on your device unless you send messages, use optional relay-backed features, or export it
 
 ## Bluetooth & Permissions
 
 bitchat requires Bluetooth permission to function:
 - Used only for peer-to-peer communication
-- No location data is accessed or stored
 - Bluetooth is not used for tracking
 - You can revoke this permission at any time in system settings
 
+## Location Permission
+
+Location permission is optional and is used only for location channels:
+- Used to compute local geohash channels and display names
+- Requested as when-in-use permission
+- Exact coordinates are not shared in messages or stored by bitchat
+- Selected and bookmarked geohashes may persist locally until you remove them, use panic wipe, or delete the app
+- You can revoke this permission at any time in system settings
+
 ## Children's Privacy
 
 bitchat does not knowingly collect information from children. The app has no age verification because it collects no personal information from anyone.
@@ -106,12 +129,15 @@ bitchat does not knowingly collect information from children. The app has no age
 - **Messages**: Deleted from memory when app closes (unless room retention is enabled)
 - **Identity Key**: Persists until you delete the app
 - **Favorites**: Persist until you remove them or delete the app
+- **Location channel choices**: Selected/bookmarked geohashes persist locally until removed, panic-wiped, or the app is deleted
+- **Nostr relay data**: Public geohash events and encrypted gift wraps may be retained by relays according to each relay's policy
 - **Everything Else**: Exists only during active sessions
 
 ## Security Measures
 
 - All communication is encrypted
-- No data transmitted to servers (there are none)
+- No accounts or company servers
+- Optional Nostr relays receive only the events needed for Nostr-backed private fallback or public location channels
 - Open source code for public audit
 - Regular security updates
 - Cryptographic signatures prevent tampering
@@ -121,7 +147,7 @@ bitchat does not knowingly collect information from children. The app has no age
 If we update this policy:
 - The "Last updated" date will change
 - The updated policy will be included in the app
-- No retroactive changes can affect data (since we don't collect any)
+- No retroactive changes can make us collect data already held only in your app
 
 ## Contact
 
@@ -132,7 +158,7 @@ bitchat is an open source project. For privacy questions:
 
 ## Philosophy
 
-Privacy isn't just a feature—it's the entire point. bitchat proves that modern communication doesn't require surrendering your privacy. No accounts, no servers, no surveillance. Just people talking freely.
+Privacy isn't just a feature—it's the entire point. bitchat proves that modern communication doesn't require surrendering your privacy. No accounts, no company servers, no analytics. Just people talking freely.
 
 ---
 

Package.swift

@@ -13,9 +13,9 @@ let package = Package(
         .executable(
             name: "bitchat",
             targets: ["bitchat"]
-        ),
+        )
     ],
-    dependencies:[
+    dependencies: [
         .package(path: "localPackages/Arti"),
         .package(path: "localPackages/BitFoundation"),
         .package(path: "localPackages/BitLogger"),
@@ -53,11 +53,17 @@ let package = Package(
             path: "bitchatTests",
             exclude: [
                 "Info.plist",
-                "README.md"
+                "README.md",
+                // CI perf gate data (read by scripts/check-perf-floors.sh),
+                // not a test resource.
+                "Performance/perf-floors.json"
             ],
             resources: [
                 .process("Localization"),
-                .process("Noise")
+                // Only the vector fixture: declaring the whole "Noise"
+                // directory would claim its .swift test files as resources
+                // and silently drop them from compilation.
+                .process("Noise/NoiseTestVectors.json")
             ]
         )
     ]

WHITEPAPER.md

@@ -1,309 +1,141 @@
-# BitChat Protocol Whitepaper
+# bitchat Protocol Whitepaper
 
-**Version 1.1**
+**Version 2.0**
 
-**Date: July 25, 2025**
+**Date: July 6, 2026**
 
 ---
 
 ## Abstract
 
-BitChat is a decentralized, peer-to-peer messaging application designed for secure, private, and censorship-resistant communication over ephemeral, ad-hoc networks. This whitepaper details the BitChat Protocol Stack, a layered architecture that combines a modern cryptographic foundation with a flexible application protocol. At its core, BitChat leverages the Noise Protocol Framework (specifically, the `XX` pattern) to establish mutually authenticated, end-to-end encrypted sessions between peers. This document provides a technical specification of the identity management, session lifecycle, message framing, and security considerations that underpin the BitChat network.
+bitchat is a decentralized, peer-to-peer messaging application for secure, private, censorship-resistant communication that works with or without the internet. Nearby devices form an ad-hoc Bluetooth Low Energy (BLE) mesh; distant peers are reached over the Nostr protocol when a connection exists. A layered store-and-forward stack — a persistent sender outbox, opportunistic couriers with a spray-and-wait copy budget, gossip-synced public history, and Nostr relay mailboxes — delivers messages to peers who are out of range at send time. This document describes the protocol and its delivery guarantees as implemented.
 
 ---
 
-## 1. Introduction
+## 1. Design Goals
 
-In an era of centralized communication platforms, BitChat offers a resilient alternative by operating without central servers. It is designed for scenarios where internet connectivity is unavailable or untrustworthy, such as protests, natural disasters, or remote areas. Communication occurs directly between devices over transports like Bluetooth Low Energy (BLE).
+* **Confidentiality:** all private communication is end-to-end encrypted; intermediate nodes and couriers carry only opaque ciphertext.
+* **Authentication:** peers are identified by cryptographic keys; announcements are signed and verified.
+* **Resilience:** the network functions in lossy, low-bandwidth, partitioned environments with churning membership.
+* **Eventual delivery:** a message to an out-of-range peer should still arrive — relayed by the mesh, carried by a moving person, or resting on an internet relay — within a bounded retention window.
+* **Ephemerality by default:** no plaintext message content is ever written to disk. Everything the store-and-forward stack persists is either sealed ciphertext or already-public broadcast traffic, and all of it dies with the panic wipe.
 
-The design goals of the BitChat Protocol are:
+## 2. Architecture Overview
 
-*   **Confidentiality:** All communication must be unreadable to third parties.
-*   **Authentication:** Users must be able to verify the identity of their correspondents.
-*   **Integrity:** Messages cannot be tampered with in transit.
-*   **Forward Secrecy:** The compromise of long-term identity keys must not compromise past session keys.
-*   **Deniability:** It should be difficult to cryptographically prove that a specific user sent a particular message.
-*   **Resilience:** The protocol must function reliably in lossy, low-bandwidth environments.
+Two transports implement a common `Transport` interface and are coordinated by a `MessageRouter`:
 
-This paper specifies the technical details of the protocol designed to meet these goals.
+* **BLE mesh** — every device is simultaneously a GATT central and peripheral, relaying packets in a controlled flood. No infrastructure, pairing, or accounts.
+* **Nostr** — private messages to mutual favorites travel as NIP-17 gift-wrapped events over public relays (over Tor where enabled), bridging separate meshes through the internet.
 
----
+The router prefers a live mesh link, falls back to Nostr, and engages the courier system when neither can deliver promptly.
 
-## 2. Protocol Stack
+## 3. Identity
 
-The BitChat Protocol is a four-layer stack. This layered approach separates concerns, allowing for modularity and future extensibility.
+Each device holds two long-term key pairs in the Keychain:
 
-```mermaid
-graph TD
-    A[Application Layer] --> B[Session Layer];
-    B --> C[Encryption Layer];
-    C --> D[Transport Layer];
+* a **Curve25519 static key** for Noise key agreement — its SHA-256 fingerprint is the peer's stable identity, and
+* an **Ed25519 signing key** for packet signatures.
 
-    subgraph "BitChat Application"
-        A
-    end
+On the mesh, peers appear under short ephemeral IDs derived per session; favoriting pins the full Noise public key so identity survives across sessions. Mutual favorites also exchange Nostr public keys for the internet path. Optional QR verification binds a nickname to a fingerprint in person.
 
-    subgraph "Message Framing & State"
-        B
-    end
+## 4. BLE Mesh Layer
 
-    subgraph "Noise Protocol Framework"
-        C
-    end
+### 4.1 Packet Format
 
-    subgraph "BLE, Wi-Fi Direct, etc."
-        D
-    end
+A compact binary header (version, type, TTL, timestamp, flags) is followed by an 8-byte sender ID, an optional 8-byte recipient ID, the payload, and an optional Ed25519 signature. Version 2 packets may carry an explicit source route. Signatures exclude the TTL byte so relays can decrement it without invalidating them. Packets other than fragments are padded toward uniform sizes.
 
-    style A fill:#cde4ff
-    style B fill:#b5d8ff
-    style C fill:#9ac2ff
-    style D fill:#7eadff
-```
+### 4.2 Flood Control
 
-*   **Application Layer:** Defines the structure of user-facing messages (`BitchatMessage`), acknowledgments (`DeliveryAck`), and other application-level data.
-*   **Session Layer:** Manages the overall communication packet (`BitchatPacket`). This includes routing information (TTL), message typing, fragmentation, and serialization into a compact binary format.
-*   **Encryption Layer:** Establishes and manages secure channels using the Noise Protocol Framework. It is responsible for the cryptographic handshake, session management, and transport message encryption/decryption.
-*   **Transport Layer:** The underlying physical medium used for data transmission, such as Bluetooth Low Energy (BLE). This layer is abstracted away from the core protocol.
+Relaying is a deterministic controlled flood tuned by local connection degree:
 
----
+* **TTL:** packets originate with TTL 7. Relays clamp: dense graphs (≥ 6 links) cap broadcast TTL at 5; thin chains (≤ 2 links) relay at full incoming depth.
+* **Deduplication:** an LRU seen-set (1000 entries, 5-minute expiry) keyed by sender, timestamp, type, and a payload digest drops duplicates. A scheduled relay is cancelled when a duplicate arrives first from another relay.
+* **Jitter:** relays wait a random 10–220 ms (wider when dense) so duplicate suppression wins often.
+* **Fanout subsetting:** broadcast messages are re-sent to a deterministic, message-ID-seeded subset of links (~log₂ of degree) rather than all of them; announces, fragments, and sync packets use full fanout. The ingress link is always excluded (split horizon).
+* **Directed traffic** (handshakes, private messages, courier envelopes) relays deterministically with TTL − 1 and tight jitter, and is never subset.
 
-## 3. Identity and Key Management
+### 4.3 Routing
 
-A peer's identity in BitChat is defined by two persistent cryptographic key pairs, which are generated on first launch and stored securely in the device's Keychain.
+Announcements carry up to 10 direct-neighbor IDs, giving each node a shallow topology map (60 s freshness). When a bidirectionally-confirmed path exists, packets are source-routed along it; otherwise — and whenever a route fails — delivery falls back to flooding.
 
-1.  **Noise Static Key Pair (`Curve25519`):** This is the long-term identity key used for the Noise Protocol handshake. The public part of this key is shared with peers to establish secure sessions.
-2.  **Signing Key Pair (`Ed25519`):** This key is used to sign announcements and other protocol messages where non-repudiation is required, such as binding a public key to a nickname.
+### 4.4 Fragmentation
 
-### 3.1. Fingerprint
+Packets exceeding the link MTU split into ~469-byte fragments (8-byte fragment ID, index/total header) that relay independently and reassemble at each receiving node (128 concurrent assemblies, 30 s timeout, 1 MiB cap).
 
-A user's unique, verifiable fingerprint is the **SHA-256 hash** of their **Noise static public key**. This provides a user-friendly and secure way to verify an identity out-of-band (e.g., by reading it aloud or scanning a QR code).
+### 4.5 Presence
 
-`Fingerprint = SHA256(StaticPublicKey_Curve25519)`
+Signed announcements propagate multi-hop: every 4 s while isolated, backing off to ~15–30 s (jittered) when connected. A verified announce retains a peer as *reachable* for 60 s after last contact. Connection scheduling is RSSI-gated with duty-cycled scanning to bound battery drain.
 
-### 3.2. Identity Management
+## 5. Encryption
 
-The `SecureIdentityStateManager` class is responsible for managing all cryptographic identity material and social metadata (petnames, trust levels, etc.). It uses an in-memory cache for performance and persists this cache to the Keychain after encrypting it with a separate AES-GCM key.
+### 5.1 Live Sessions: Noise XX
 
----
+Connected peers establish sessions with the Noise `XX` pattern (Curve25519 / ChaCha20-Poly1305 / SHA-256), providing mutual authentication and forward secrecy. All private payloads — messages, delivery acks, read receipts — ride inside the session as typed ciphertext. Intermediate relays see only opaque `noiseEncrypted` packets.
 
-## 4. The Social Trust Layer
+### 5.2 Offline Seals: Noise X
 
-Beyond cryptographic identity, BitChat incorporates a social trust layer, allowing users to manage their relationships with peers. This functionality is handled by the `SecureIdentityStateManager`.
+Courier envelopes are sealed to the recipient's *static* key with the one-way Noise `X` pattern; the sender's identity is authenticated inside the ciphertext. **This path has no forward secrecy** — compromise of the recipient's static key exposes sealed-but-undelivered mail. A prekey scheme is future work.
 
-### 4.1. Peer Verification
+### 5.3 Nostr Path
 
-While the Noise handshake cryptographically authenticates a peer's key, it doesn't confirm the real-world identity of the person holding the device. To solve this, users can perform out-of-band (OOB) verification by comparing fingerprints. Once a user confirms that a peer's fingerprint matches the one they expect, they can mark that peer as "verified". This status is stored locally and displayed in the UI, providing a strong assurance of identity for future conversations.
+Private messages to mutual favorites are wrapped per NIP-17/NIP-59: a rumor (kind 14) sealed (kind 13) and gift-wrapped (kind 1059) under a throwaway ephemeral key, so relays learn neither sender nor content.
 
-### 4.2. Favorites and Blocking
+## 6. Store and Forward
 
-To improve the user experience and provide control over interactions, the protocol supports:
-*   **Favorites:** Users can mark trusted or frequently contacted peers as "favorites". This is a local designation that can be used by the application to prioritize notifications or display peers more prominently.
-*   **Blocking:** Users can block peers. When a peer is blocked, the application will discard any incoming packets from that peer's fingerprint at the earliest possible stage, effectively silencing them without notifying the blocked peer.
+Four mechanisms cover the "recipient is not here right now" problem. All persisted state is wiped by panic mode.
 
----
+### 6.1 Sender Outbox
 
-## 5. The Noise Protocol Layer
+Private messages without a prompt route are retained per peer (100 messages/peer, 24 h TTL) and re-sent on reconnect events until a delivery or read ack clears them, or a resend cap (8 attempts) drops them with visible failure. The outbox persists to disk sealed under a ChaChaPoly key held only in the Keychain, so queued mail survives an app kill without ever storing plaintext.
 
-BitChat implements the Noise Protocol Framework to provide strong, authenticated end-to-end encryption.
+### 6.2 Couriers
 
-### 5.1. Protocol Name
+When no transport can deliver promptly, the message is sealed (§5.2) into a **courier envelope** and handed to up to 3 connected peers who may physically encounter the recipient:
 
-The specific Noise protocol implemented is:
+* **Opaque addressing.** The only routing information is a 16-byte rotating recipient tag — an HMAC of the recipient's static key and the UTC day — computable solely by parties who already know that key. Couriers learn neither sender, recipient, nor content, and tags do not correlate across days.
+* **Trust tiers.** Mutual favorites may deposit 5 envelopes each; any peer with a signature-verified announce may deposit 2, into a bounded pool (20 of 40 slots) that can never crowd out favorites' mail. Envelopes are capped at 16 KiB and 24 h; overflow evicts oldest verified-tier mail first.
+* **Deposit retry.** Queued messages are re-deposited whenever a new eligible courier connects, until 3 distinct couriers carry the message or it expires.
+* **Spray and wait.** Envelopes carry a copy budget (initially 4, capped at 8). A courier meeting another eligible courier hands over half its remaining budget, so mail diffuses through a moving crowd instead of riding one person. Budgets, spray history, and carried mail persist across app restarts (iOS file protection).
+* **Handover.** On a verified *direct* announce from the recipient, matching envelopes are delivered over the live link and removed. On a verified *relayed* announce, a copy floods toward the recipient as a directed packet while the carried original stays put, throttled to one attempt per envelope per 10 minutes.
+* Receivers dedup by message ID, so redundant copies and the retained outbox original are harmless. Couriered mail from blocked senders is dropped at decryption time.
 
-**`Noise_XX_25519_ChaChaPoly_SHA256`**
+### 6.3 Public History (Gossip Sync)
 
-*   **`XX` Pattern:** This handshake pattern provides mutual authentication and forward secrecy. It does not require either party to know the other's static public key before the handshake begins. The keys are exchanged and authenticated during the three-part handshake. This is ideal for a decentralized P2P environment.
-*   **`25519`:** The Diffie-Hellman function used is Curve25519.
-*   **`ChaChaPoly`:** The AEAD (Authenticated Encryption with Associated Data) cipher is ChaCha20-Poly1305.
-*   **`SHA256`:** The hash function used for all cryptographic hashing operations is SHA-256.
+Public broadcast messages are cached (1000 packets) and reconciled between peers every ~15 s using compact GCS filters: each side advertises what it holds, the other returns what is missing. Messages stay sync-able for **6 hours** and the cache persists to disk, so a device that walks between two partitions — or relaunches later — serves the room's recent history to whoever missed it. Fragments and file transfers keep a short 15-minute window.
 
-### 5.2. The `XX` Handshake
+### 6.4 Nostr Mailboxes
 
-The `XX` handshake consists of three messages exchanged between an Initiator and a Responder to establish a shared secret and derive transport encryption keys.
+Gift-wrapped messages rest on Nostr relays; clients re-subscribe with a 24-hour lookback on reconnect, covering the both-devices-offline case for mutual favorites whenever either side touches the internet.
 
-```mermaid
-sequenceDiagram
-    participant I as Initiator
-    participant R as Responder
+### 6.5 Delivery Metrics
 
-    Note over I, R: Pre-computation: h = SHA256(protocol_name)
+Bare local counters (deposits, handovers, sprays, opens, outbox flushes and drops — no identities, message IDs, or timestamps) let delivery behavior be measured on-device. They never leave the device and are cleared by the panic wipe.
 
-    I->>R: -> e
-    Note right of I: I generates ephemeral key `e_i`.<br/>h = SHA256(h + e_i.pub)
+## 7. Application Layer
 
-    R->>I: <- e, ee, s, es
-    Note left of R: R generates ephemeral key `e_r`.<br/>h = SHA256(h + e_r.pub)<br/>MixKey(DH(e_i, e_r))<br/>R sends static key `s_r`, encrypted.<br/>h = SHA256(h + ciphertext)<br/>MixKey(DH(e_i, s_r))
-
-    I->>R: -> s, se
-    Note right of I: I decrypts and verifies `s_r`.<br/>I sends static key `s_i`, encrypted.<br/>h = SHA256(h + ciphertext)<br/>MixKey(DH(s_i, e_r))
-
-    Note over I, R: Handshake complete. Transport keys derived.
-```
-
-**Handshake Flow:**
-
-1.  **Initiator -> Responder:** The initiator generates a new ephemeral key pair (`e_i`) and sends the public part to the responder.
-2.  **Responder -> Initiator:** The responder receives the initiator's ephemeral public key. It then generates its own ephemeral key pair (`e_r`), performs a DH exchange with the initiator's ephemeral key (`ee`), sends its own static public key (`s_r`) encrypted with the resulting symmetric key, and performs another DH exchange between the initiator's ephemeral key and its own static key (`es`).
-3.  **Initiator -> Responder:** The initiator receives the responder's message, decrypts the responder's static key, and authenticates it. The initiator then sends its own static key (`s_i`) encrypted and performs a final DH exchange between its static key and the responder's ephemeral key (`se`).
-
-Upon completion, both parties share a set of symmetric keys for bidirectional transport message encryption. The final handshake hash is used for channel binding.
-
-### 5.3. Session Management
-
-The `NoiseSessionManager` class manages all active Noise sessions. It handles:
-*   Creating sessions for new peers.
-*   Coordinating the handshake process to prevent race conditions.
-*   Storing the resulting transport ciphers (`sendCipher`, `receiveCipher`).
-*   Periodically checking if sessions need to be re-keyed for enhanced security.
-
----
-
-## 6. The BitChat Session and Application Protocol
-
-Once a Noise session is established, peers exchange `BitchatPacket` structures, which are encrypted as the payload of Noise transport messages.
-
-### 6.1. Binary Packet Format (`BitchatPacket`)
-
-To minimize bandwidth, `BitchatPacket`s are serialized into a compact binary format. The structure is designed to be fixed-size where possible to resist traffic analysis.
-
-| Field           | Size (bytes) | Description                                                                                             |
-|-----------------|--------------|---------------------------------------------------------------------------------------------------------|
-| **Header**      | **13**       | **Fixed-size header**                                                                                   |
-| Version         | 1            | Protocol version (currently `1`).                                                                       |
-| Type            | 1            | Message type (e.g., `message`, `deliveryAck`, `noiseHandshakeInit`). See `MessageType` enum.            |
-| TTL             | 1            | Time-To-Live for mesh network routing. Decremented at each hop.                                         |
-| Timestamp       | 8            | `UInt64` millisecond timestamp of packet creation.                                                      |
-| Flags           | 1            | Bitmask for optional fields (`hasRecipient`, `hasSignature`, `isCompressed`).                           |
-| Payload Length  | 2            | `UInt16` length of the payload field.                                                                   |
-| **Variable**    | **...**      | **Variable-size fields**                                                                                |
-| Sender ID       | 8            | 8-byte truncated peer ID of the sender.                                                                 |
-| Recipient ID    | 8 (optional) | 8-byte truncated peer ID of the recipient. Present if `hasRecipient` flag is set. Broadcast if `0xFF..FF`. |
-| Payload         | Variable     | The actual content of the packet, as defined by the `Type` field.                                       |
-| Signature       | 64 (optional)| `Ed25519` signature of the packet. Present if `hasSignature` flag is set.                               |
-
-**Padding:** All packets are padded to the next standard block size (256, 512, 1024, or 2048 bytes) using a PKCS#7-style scheme to obscure the true message length from network observers.
-
-```mermaid
----
-config:
-  theme: dark
----
----
-title: "BitchatPacket"
----
-packet
-+8: "Version"
-+8: "Type"
-+8: "TTL"
-+64: "Timestamp"
-+8: "Flags"
-+16: "Payload Length"
-+64: "Sender ID"
-+64: "Recipient ID (optional)"
-+48: "Payload (variable)"
-+64: "Signature (optional)"
-```
-_A representation of the sizes of the fields in `BitchatPacket`_
-
-### 6.2. Application Message Format (`BitchatMessage`)
-
-For packets of type `message`, the payload is a binary-serialized `BitchatMessage` containing the chat content.
-
-| Field               | Size (bytes) | Description                                                              |
-|---------------------|--------------|--------------------------------------------------------------------------|
-| Flags               | 1            | Bitmask for optional fields (`isRelay`, `isPrivate`, `hasOriginalSender`). |
-| Timestamp           | 8            | `UInt64` millisecond timestamp of message creation.                      |
-| ID                  | 1 + len      | `UUID` string for the message.                                           |
-| Sender              | 1 + len      | Nickname of the sender.                                                  |
-| Content             | 2 + len      | The UTF-8 encoded message content.                                       |
-| Original Sender     | 1 + len (opt)| Nickname of the original sender if the message is a relay.               |
-| Recipient Nickname  | 1 + len (opt)| Nickname of the recipient for private messages.                          |
-
-```mermaid
----
-config:
-  theme: dark
----
----
-title: "BitchatMessage"
----
-packet
-+8: "Flags"
-+64: "Timestamp"
-+24: "ID (variable)"
-+32: "Sender (variable)"
-+32: "Content (variable)"
-+32: "Original Sender (variable) (optional)"
-+32: "Recipient Nickname (variable) (optional)"
-```
-_A representation of the sizes of the fields in `BitchatMessage`_
-
----
-
-## 7. Message Routing and Propagation
-
-BitChat operates as a decentralized mesh network, meaning there are no central servers to route messages. Packets are propagated through the network from peer to peer. The protocol supports several modes of message delivery.
-
-### 7.1. Direct Connection
-
-This is the simplest case. If Peer A and Peer B are directly connected, they can exchange packets after establishing a mutually authenticated Noise session. All packets are encrypted using the transport ciphers derived from the handshake.
-
-### 7.2. Efficient Gossip with Bloom Filters
-
-To send messages to peers that are not directly connected, BitChat employs a "flooding" or "gossip" protocol. When a peer receives a packet that is not destined for it, it acts as a relay. To prevent infinite routing loops and minimize memory usage, the protocol uses an `OptimizedBloomFilter` to track recently seen packet IDs.
-
-The logic is as follows:
-
-1.  A peer receives a packet.
-2.  It checks the Bloom filter to see if the packet's ID has likely been seen before. If so, the packet is discarded. Bloom filters can have false positives (though they are rare), but they guarantee no false negatives. This means that while some packets may be incorrectly discarded due to false positives, the gossip protocol's redundancy ensures these packets will eventually be received through subsequent exchanges with other peers.
-3.  If the packet is new, its ID is added to the Bloom filter.
-4.  The peer decrements the packet's Time-To-Live (TTL) field.
-5.  If the TTL is greater than zero, the peer re-broadcasts the packet to all of its connected peers, *except* for the peer from which it received the packet.
-
-This mechanism allows packets to "flood" through the network efficiently, maximizing the chance of reaching their destination while using minimal resources to prevent loops.
-
-### 7.3. Time-To-Live (TTL)
-
-Every `BitchatPacket` contains an 8-bit TTL field. This value is set by the originating peer and is decremented by one at each relay hop. If a peer receives a packet and decrements its TTL to 0, it will process the packet (if it is the recipient) but will not relay it further. This is a crucial mechanism to prevent packets from circulating endlessly in the mesh.
-
-### 7.4. Private vs. Broadcast Messages
-
-The routing logic respects the confidentiality of private messages:
-
-*   **Private Messages:** A packet with a specific `recipientID` is a private message. Relay nodes forward the entire, encrypted Noise message without being able to access the inner `BitchatPacket` or its payload. Only the final recipient, who shares the correct Noise session keys with the sender, can decrypt the packet.
-*   **Broadcast Messages:** A packet with the special broadcast `recipientID` (`0xFFFFFFFFFFFFFFFF`) is intended for all peers. Any peer that receives and decrypts a broadcast message will process its content. It will still be relayed according to the flooding algorithm to ensure it reaches the entire network.
-
-### 7.5. Message Reliability and Lifecycle
-
-To function in unreliable, lossy networks, the protocol includes features to track the lifecycle of a message and ensure its delivery.
-
-*   **Delivery Acknowledgments (`DeliveryAck`):** When a private message reaches its final destination, the recipient's device sends a `DeliveryAck` packet back to the original sender. This acknowledgment contains the ID of the original message.
-*   **Read Receipts (`ReadReceipt`):** After a message is displayed on the recipient's screen, the application can send a `ReadReceipt`, also containing the original message ID, to inform the sender that the message has been seen.
-*   **Message Retry Service:** Senders maintain a `MessageRetryService` which tracks outgoing messages. If a `DeliveryAck` is not received for a message within a certain time window, the service will automatically re-send the message, creating a more resilient user experience.
-
-### 7.6. Fragmentation
-
-Transport layers like BLE have a Maximum Transmission Unit (MTU) that limits the size of a single packet. To handle messages larger than this limit, BitChat implements a fragmentation protocol.
-
-*   **`fragmentStart`:** A packet with this type marks the beginning of a fragmented message. It contains metadata about the total size and number of fragments.
-*   **`fragmentContinue`:** These packets carry the intermediate chunks of the message data.
-*   **`fragmentEnd`:** This packet carries the final chunk of the message and signals the receiver to begin reassembly.
-
-Receiving peers collect all fragments and reassemble them in the correct order before passing the complete message up to the application layer.
-
----
+* **Public chat** — signed broadcast messages within the mesh, backed by the gossip-synced history above.
+* **Private chat** — end-to-end encrypted messages with delivery and read receipts, over mesh, courier, or Nostr.
+* **Location channels** — geohash-scoped public rooms carried over Nostr relays for regional chat beyond radio range.
+* **Favorites** — the mutual-trust relationship that unlocks Nostr delivery and the larger courier quota.
+* **Media** — files and images fragment over the mesh (1 MiB cap, explicit accept before anything touches disk); couriers carry text only.
+* **Panic wipe** — clears identity keys, favorites, carried courier mail, the sealed outbox, archived public history, and metrics.
 
 ## 8. Security Considerations
 
-*   **Replay Attacks:** The Noise transport messages include a nonce that is incremented for each message. The `NoiseCipherState` implements a sliding window replay protection mechanism to detect and discard replayed or out-of-order messages.
-*   **Denial of Service:** The `NoiseRateLimiter` is implemented to prevent resource exhaustion from rapid, repeated handshake attempts from a single peer.
-*   **Key-Compromise Impersonation:** The `XX` pattern authenticates both parties, preventing an attacker from impersonating one party to the other.
-*   **Identity Binding:** While the Noise handshake authenticates the cryptographic keys, binding those keys to a human-readable nickname is handled at the application layer. Users must verify fingerprints out-of-band to prevent man-in-the-middle attacks.
-*   **Traffic Analysis:** The use of fixed-size padding for all packets helps to obscure the exact nature and content of the communication, making it harder for a network-level adversary to infer information based on message size.
+* **Relay nodes** cannot read private traffic; they forward padded, opaque ciphertext.
+* **Couriers** are quota-bounded mailbags. A malicious courier can drop mail (redundant copies and deposit retry mitigate this) but cannot read it, link it across days, or amplify it — copy budgets are capped and every envelope is validated against size and lifetime policy on deposit.
+* **Flooding abuse** is bounded by TTL clamps, deduplication, per-depositor quotas, connect-rate limits, and announce-rate limiting.
+* **Replay** of public broadcasts is bounded by the 6-hour acceptance window plus deduplication; private payloads are protected by Noise nonces.
+* **Metadata.** BLE proximity is inherently observable; ephemeral IDs and daily-rotating courier tags limit long-term correlation. Nostr traffic can ride Tor.
+* **No forward secrecy for sealed mail** (§5.2) is the main cryptographic trade-off of the offline path.
+
+## 9. Future Work
+
+* Prekey-based forward secrecy for courier envelopes.
+* Couriered media beyond the 16 KiB text cap.
+* Probabilistic relay and edge-of-network TTL boosting for very dense and very sparse graphs.
+* Multi-hop courier routing informed by encounter history.
 
 ---
 
-## 9. Conclusion
-
-The BitChat Protocol provides a robust and secure foundation for decentralized, peer-to-peer communication. By layering a flexible application protocol on top of the well-regarded Noise Protocol Framework, it achieves strong confidentiality, authentication, and forward secrecy. The use of a compact binary format and thoughtful security considerations like rate limiting and traffic analysis resistance make it suitable for use in challenging network environments.
+*This document describes the protocol as implemented in the current release. The implementation is free and unencumbered software released into the public domain.*

bitchat.xcodeproj/project.pbxproj

@@ -321,7 +321,7 @@
 			isa = PBXProject;
 			attributes = {
 				BuildIndependentTargetsInParallel = YES;
-				LastUpgradeCheck = 1640;
+				LastUpgradeCheck = 2650;
 			};
 			buildConfigurationList = 3EA424CBD51200895D361189 /* Build configuration list for PBXProject "bitchat" */;
 			developmentRegion = en;
@@ -446,7 +446,6 @@
 				CODE_SIGNING_ALLOWED = YES;
 				CODE_SIGNING_REQUIRED = YES;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
 				LD_RUNPATH_SEARCH_PATHS = (
@@ -471,7 +470,6 @@
 				CODE_SIGNING_ALLOWED = YES;
 				CODE_SIGNING_REQUIRED = YES;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
 				LD_RUNPATH_SEARCH_PATHS = (
@@ -498,7 +496,6 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -523,7 +520,6 @@
 				CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION = YES;
 				CODE_SIGN_ENTITLEMENTS = bitchatShareExtension/bitchatShareExtension.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatShareExtension/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
@@ -532,7 +528,6 @@
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
-				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER).ShareExtension";
 				SDKROOT = iphoneos;
 				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
@@ -556,7 +551,6 @@
 				CODE_SIGN_ENTITLEMENTS = bitchat/bitchat.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				DEVELOPMENT_ASSET_PATHS = bitchat/_PreviewHelpers;
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = NO;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -566,7 +560,6 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				SDKROOT = iphoneos;
@@ -590,7 +583,6 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -617,7 +609,6 @@
 				CODE_SIGN_ENTITLEMENTS = bitchat/bitchat.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				DEVELOPMENT_ASSET_PATHS = bitchat/_PreviewHelpers;
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -627,7 +618,6 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				SDKROOT = iphoneos;
@@ -653,7 +643,6 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -663,7 +652,6 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
-				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				REGISTER_APP_GROUPS = YES;
@@ -676,6 +664,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
@@ -709,6 +698,7 @@
 				CURRENT_PROJECT_VERSION = "$(CURRENT_PROJECT_VERSION)";
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -722,10 +712,10 @@
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
-				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				MTL_ENABLE_DEBUG_INFO = NO;
 				MTL_FAST_MATH = YES;
 				PRODUCT_NAME = "$(TARGET_NAME)";
+				STRING_CATALOG_GENERATE_SYMBOLS = NO;
 				SWIFT_COMPILATION_MODE = wholemodule;
 				SWIFT_OPTIMIZATION_LEVEL = "-O";
 				SWIFT_VERSION = "$(SWIFT_VERSION)";
@@ -745,7 +735,6 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = NO;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -755,7 +744,6 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
-				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				REGISTER_APP_GROUPS = YES;
@@ -768,6 +756,7 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
@@ -801,6 +790,7 @@
 				CURRENT_PROJECT_VERSION = "$(CURRENT_PROJECT_VERSION)";
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -820,11 +810,11 @@
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
-				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
 				PRODUCT_NAME = "$(TARGET_NAME)";
+				STRING_CATALOG_GENERATE_SYMBOLS = NO;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
 				SWIFT_VERSION = "$(SWIFT_VERSION)";
@@ -841,7 +831,6 @@
 				CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION = YES;
 				CODE_SIGN_ENTITLEMENTS = bitchatShareExtension/bitchatShareExtension.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatShareExtension/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
@@ -850,7 +839,6 @@
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
-				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER).ShareExtension";
 				SDKROOT = iphoneos;
 				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";

bitchat.xcodeproj/xcshareddata/xcschemes/bitchat (iOS).xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1640"
+   LastUpgradeVersion = "2650"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"

bitchat.xcodeproj/xcshareddata/xcschemes/bitchat (macOS).xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1640"
+   LastUpgradeVersion = "2650"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"

bitchat/App/AppArchitecture.swift

@@ -66,12 +66,12 @@ actor AppEventStream {
     }
 }
 
+/// Identity key for a direct conversation. Equality and hashing use the
+/// canonical `id` only; `routingPeerID` carries the transport-level peer ID
+/// the conversation is keyed under (see `ConversationID.directPeer`).
 struct PeerHandle: Sendable, Identifiable {
     let id: String
     let routingPeerID: PeerID
-    let displayName: String?
-    let noisePublicKeyHex: String?
-    let nostrPublicKey: String?
 }
 
 extension PeerHandle: Equatable {
@@ -100,264 +100,3 @@ enum ConversationID: Hashable, Sendable {
         }
     }
 }
-
-@MainActor
-final class IdentityResolver {
-    private var handlesByRoutingPeerID: [PeerID: PeerHandle] = [:]
-    private var handlesByNoiseKey: [String: PeerHandle] = [:]
-    private var handlesByNostrKey: [String: PeerHandle] = [:]
-
-    func register(peers: [BitchatPeer]) {
-        for peer in peers {
-            _ = register(peer: peer)
-        }
-    }
-
-    @discardableResult
-    func register(peer: BitchatPeer) -> PeerHandle {
-        let handle = buildHandle(
-            routingPeerID: peer.peerID,
-            displayName: peer.displayName,
-            noisePublicKeyHex: peer.noisePublicKey.isEmpty ? nil : peer.noisePublicKey.hexEncodedString().lowercased(),
-            nostrPublicKey: normalizedNostrKey(peer.nostrPublicKey)
-        )
-        cache(handle)
-        return handle
-    }
-
-    func canonicalHandle(for peerID: PeerID, displayName: String? = nil) -> PeerHandle {
-        if let handle = handlesByRoutingPeerID[peerID] {
-            return handle
-        }
-
-        if peerID.isNoiseKeyHex, let handle = handlesByNoiseKey[peerID.bare] {
-            return handle
-        }
-
-        if (peerID.isGeoDM || peerID.isGeoChat), let handle = handlesByNostrKey[peerID.bare] {
-            return handle
-        }
-
-        let handle = buildHandle(
-            routingPeerID: peerID,
-            displayName: displayName,
-            noisePublicKeyHex: peerID.isNoiseKeyHex ? peerID.bare : nil,
-            nostrPublicKey: (peerID.isGeoDM || peerID.isGeoChat) ? peerID.bare : nil
-        )
-        cache(handle)
-        return handle
-    }
-
-    private func buildHandle(
-        routingPeerID: PeerID,
-        displayName: String?,
-        noisePublicKeyHex: String?,
-        nostrPublicKey: String?
-    ) -> PeerHandle {
-        let canonicalID: String
-        if let noisePublicKeyHex {
-            canonicalID = "noise:\(noisePublicKeyHex)"
-        } else if let nostrPublicKey {
-            canonicalID = "nostr:\(nostrPublicKey)"
-        } else {
-            canonicalID = "mesh:\(routingPeerID.id)"
-        }
-
-        let normalizedDisplayName: String?
-        if let displayName, !displayName.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
-            normalizedDisplayName = displayName
-        } else {
-            normalizedDisplayName = nil
-        }
-
-        return PeerHandle(
-            id: canonicalID,
-            routingPeerID: routingPeerID,
-            displayName: normalizedDisplayName,
-            noisePublicKeyHex: noisePublicKeyHex,
-            nostrPublicKey: nostrPublicKey
-        )
-    }
-
-    private func normalizedNostrKey(_ nostrPublicKey: String?) -> String? {
-        guard let nostrPublicKey else { return nil }
-        let trimmed = nostrPublicKey.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
-        return trimmed.isEmpty ? nil : trimmed
-    }
-
-    private func cache(_ handle: PeerHandle) {
-        handlesByRoutingPeerID[handle.routingPeerID] = handle
-        if let noisePublicKeyHex = handle.noisePublicKeyHex {
-            handlesByNoiseKey[noisePublicKeyHex] = handle
-        }
-        if let nostrPublicKey = handle.nostrPublicKey {
-            handlesByNostrKey[nostrPublicKey] = handle
-        }
-    }
-}
-
-@MainActor
-final class ConversationStore: ObservableObject {
-    @Published private(set) var activeChannel: ChannelID = .mesh
-    @Published private(set) var selectedPrivatePeerID: PeerID?
-    @Published private(set) var selectedConversationID: ConversationID = .mesh
-    @Published private(set) var unreadConversations: Set<ConversationID> = []
-    @Published private(set) var messagesByConversation: [ConversationID: [BitchatMessage]] = [:]
-
-    private var directHandlesByConversation: [ConversationID: PeerHandle] = [:]
-
-    func setActiveChannel(_ channelID: ChannelID) {
-        activeChannel = channelID
-        if selectedPrivatePeerID == nil {
-            selectedConversationID = ConversationID(channelID: channelID)
-        }
-    }
-
-    func setSelectedPeerID(
-        _ peerID: PeerID?,
-        activeChannel: ChannelID,
-        identityResolver: IdentityResolver
-    ) {
-        self.activeChannel = activeChannel
-        selectedPrivatePeerID = peerID
-
-        if let peerID {
-            selectedConversationID = directConversationID(
-                for: peerID,
-                identityResolver: identityResolver
-            )
-        } else {
-            selectedConversationID = ConversationID(channelID: activeChannel)
-        }
-    }
-
-    func replaceMessages(_ messages: [BitchatMessage], for conversationID: ConversationID) {
-        messagesByConversation[conversationID] = normalized(messages)
-    }
-
-    func replaceMessages(_ messages: [BitchatMessage], for channelID: ChannelID) {
-        replaceMessages(messages, for: ConversationID(channelID: channelID))
-    }
-
-    func synchronizePublicConversation(_ messages: [BitchatMessage], activeChannel: ChannelID) {
-        setActiveChannel(activeChannel)
-        replaceMessages(messages, for: activeChannel)
-    }
-
-    func messages(for conversationID: ConversationID) -> [BitchatMessage] {
-        messagesByConversation[conversationID] ?? []
-    }
-
-    func directMessages(
-        for peerID: PeerID,
-        identityResolver: IdentityResolver
-    ) -> [BitchatMessage] {
-        messages(for: directConversationID(for: peerID, identityResolver: identityResolver))
-    }
-
-    func directMessagesByPeerID() -> [PeerID: [BitchatMessage]] {
-        var messagesByPeerID: [PeerID: [BitchatMessage]] = [:]
-
-        for (conversationID, handle) in directHandlesByConversation {
-            messagesByPeerID[handle.routingPeerID] = messages(for: conversationID)
-        }
-
-        return messagesByPeerID
-    }
-
-    func unreadDirectPeerIDs() -> Set<PeerID> {
-        unreadConversations.reduce(into: Set<PeerID>()) { result, conversationID in
-            guard case .direct(let handle) = conversationID else { return }
-            result.insert(directHandlesByConversation[conversationID]?.routingPeerID ?? handle.routingPeerID)
-        }
-    }
-
-    func synchronizeSelection(
-        activeChannel: ChannelID,
-        selectedPeerID: PeerID?,
-        identityResolver: IdentityResolver
-    ) {
-        setSelectedPeerID(
-            selectedPeerID,
-            activeChannel: activeChannel,
-            identityResolver: identityResolver
-        )
-    }
-
-    func synchronizePrivateChats(
-        _ privateChats: [PeerID: [BitchatMessage]],
-        unreadPeerIDs: Set<PeerID>,
-        identityResolver: IdentityResolver
-    ) {
-        var liveConversations = Set<ConversationID>()
-
-        for (peerID, messages) in privateChats {
-            let handle = identityResolver.canonicalHandle(for: peerID, displayName: messages.last?.sender)
-            let conversationID = ConversationID.direct(handle)
-            liveConversations.insert(conversationID)
-            directHandlesByConversation[conversationID] = handle
-            messagesByConversation[conversationID] = normalized(messages)
-        }
-
-        let staleDirectConversations = messagesByConversation.keys.filter { conversationID in
-            guard case .direct = conversationID else { return false }
-            return !liveConversations.contains(conversationID)
-        }
-
-        for conversationID in staleDirectConversations {
-            messagesByConversation.removeValue(forKey: conversationID)
-            unreadConversations.remove(conversationID)
-            directHandlesByConversation.removeValue(forKey: conversationID)
-        }
-
-        let publicUnread = unreadConversations.filter { conversationID in
-            switch conversationID {
-            case .mesh, .geohash:
-                return true
-            case .direct:
-                return false
-            }
-        }
-
-        unreadConversations = unreadPeerIDs.reduce(into: publicUnread) { result, peerID in
-            let handle = identityResolver.canonicalHandle(for: peerID)
-            result.insert(.direct(handle))
-        }
-    }
-
-    func markRead(_ conversationID: ConversationID) {
-        unreadConversations.remove(conversationID)
-    }
-
-    func markRead(
-        peerID: PeerID,
-        identityResolver: IdentityResolver
-    ) {
-        markRead(directConversationID(for: peerID, identityResolver: identityResolver))
-    }
-
-    private func normalized(_ messages: [BitchatMessage]) -> [BitchatMessage] {
-        var uniqueMessages: [String: BitchatMessage] = [:]
-
-        for message in messages {
-            uniqueMessages[message.id] = message
-        }
-
-        return uniqueMessages.values.sorted { lhs, rhs in
-            if lhs.timestamp != rhs.timestamp {
-                return lhs.timestamp < rhs.timestamp
-            }
-            return lhs.id < rhs.id
-        }
-    }
-
-    private func directConversationID(
-        for peerID: PeerID,
-        identityResolver: IdentityResolver
-    ) -> ConversationID {
-        let handle = identityResolver.canonicalHandle(for: peerID)
-        let conversationID = ConversationID.direct(handle)
-        directHandlesByConversation[conversationID] = handle
-        return conversationID
-    }
-}

bitchat/App/AppRuntime.swift

@@ -14,7 +14,10 @@ import AppKit
 final class AppRuntime: ObservableObject {
     let chatViewModel: ChatViewModel
     let events = AppEventStream()
-    let conversationStore: ConversationStore
+    /// Single source of truth for conversation message state and selection
+    /// (docs/CONVERSATION-STORE-DESIGN.md). Owned here; the feature models
+    /// and `ChatViewModel` observe and mutate it through its intent API.
+    let conversations: ConversationStore
     let peerIdentityStore: PeerIdentityStore
     let locationPresenceStore: LocationPresenceStore
     let publicChatModel: PublicChatModel
@@ -42,30 +45,28 @@ final class AppRuntime: ObservableObject {
         idBridge: NostrIdentityBridge = NostrIdentityBridge()
     ) {
         self.idBridge = idBridge
-        let identityResolver = IdentityResolver()
-        let conversationStore = ConversationStore()
+        let conversations = ConversationStore()
         let peerIdentityStore = PeerIdentityStore()
         let locationPresenceStore = LocationPresenceStore()
         let locationManager = LocationChannelManager.shared
-        self.conversationStore = conversationStore
+        self.conversations = conversations
         self.peerIdentityStore = peerIdentityStore
         self.locationPresenceStore = locationPresenceStore
         self.chatViewModel = ChatViewModel(
             keychain: keychain,
             idBridge: idBridge,
             identityManager: SecureIdentityStateManager(keychain),
-            conversationStore: conversationStore,
-            identityResolver: identityResolver,
+            conversations: conversations,
             peerIdentityStore: peerIdentityStore,
             locationPresenceStore: locationPresenceStore,
             locationManager: locationManager
         )
-        self.publicChatModel = PublicChatModel(conversationStore: conversationStore)
-        self.privateInboxModel = PrivateInboxModel(conversationStore: conversationStore)
+        self.publicChatModel = PublicChatModel(conversations: conversations)
+        self.privateInboxModel = PrivateInboxModel(conversations: conversations)
         self.locationChannelsModel = LocationChannelsModel(manager: locationManager)
         self.privateConversationModel = PrivateConversationModel(
             chatViewModel: self.chatViewModel,
-            conversationStore: conversationStore,
+            conversations: conversations,
             locationChannelsModel: self.locationChannelsModel,
             peerIdentityStore: peerIdentityStore
         )
@@ -77,11 +78,11 @@ final class AppRuntime: ObservableObject {
         self.conversationUIModel = ConversationUIModel(
             chatViewModel: self.chatViewModel,
             privateConversationModel: self.privateConversationModel,
-            conversationStore: conversationStore
+            conversations: conversations
         )
         self.peerListModel = PeerListModel(
             chatViewModel: self.chatViewModel,
-            conversationStore: conversationStore,
+            conversations: conversations,
             locationChannelsModel: self.locationChannelsModel,
             peerIdentityStore: peerIdentityStore,
             locationPresenceStore: locationPresenceStore
@@ -104,7 +105,7 @@ final class AppRuntime: ObservableObject {
 
         started = true
         NotificationDelegate.shared.runtime = self
-        VerificationService.shared.configure(with: chatViewModel.meshService.getNoiseService())
+        VerificationService.shared.configure(with: chatViewModel.meshService)
         announceInitialTorStatusIfNeeded()
 
         Task(priority: .utility) { [weak self] in
@@ -218,7 +219,7 @@ final class AppRuntime: ObservableObject {
         userInfo: [AnyHashable: Any]
     ) async -> UNNotificationPresentationOptions {
         if identifier.hasPrefix("private-"), let peerID = PeerID(str: userInfo["peerID"] as? String) {
-            if conversationStore.selectedPrivatePeerID == peerID {
+            if conversations.selectedPrivatePeerID == peerID {
                 return []
             }
             return [.banner, .sound]

bitchat/App/ConversationStore.swift

@@ -0,0 +1,918 @@
+//
+// ConversationStore.swift
+// bitchat
+//
+// Single source of truth for conversation message state (see
+// docs/CONVERSATION-STORE-DESIGN.md). One `Conversation` object per
+// `ConversationID`; all mutations flow through the store's intent API and
+// every mutation emits a `ConversationChange` after state is consistent.
+//
+// The store also owns conversation selection: the active public channel and
+// the selected private peer (the two UI selection axes) plus the derived
+// `selectedConversationID`.
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import BitFoundation
+import BitLogger
+import Combine
+import Foundation
+
+// MARK: - Conversation
+
+/// A single conversation timeline (`.mesh`, `.geohash`, or `.direct`).
+///
+/// Publishing granularity is per conversation: views observe ONE
+/// `Conversation` object, so an append to chat A never invalidates observers
+/// of chat B.
+///
+/// Mutations are `fileprivate` by design — only `ConversationStore`'s intent
+/// API may mutate a conversation, keeping the store the sole writer.
+@MainActor
+final class Conversation: ObservableObject, Identifiable {
+    let id: ConversationID
+    /// Maximum retained messages; oldest are trimmed on overflow.
+    let cap: Int
+
+    @Published private(set) var messages: [BitchatMessage] = []
+    @Published private(set) var isUnread: Bool = false
+
+    /// Incrementally-maintained message-ID → index map for O(1) dedup and
+    /// delivery-status lookup. Kept in sync on every mutation:
+    /// - tail append: single insert
+    /// - out-of-order insert: suffix reindex from the insertion point
+    /// - trim: full rebuild — `removeFirst(k)` is already O(n), so the
+    ///   rebuild does not change the asymptotics, and trim only happens once
+    ///   the cap (1337) is reached. Simple and correct beats the
+    ///   offset-tracking alternative here.
+    private var indexByMessageID: [String: Int] = [:]
+
+    fileprivate init(id: ConversationID, cap: Int) {
+        self.id = id
+        self.cap = max(1, cap)
+    }
+
+    // MARK: Reads
+
+    func containsMessage(withID messageID: String) -> Bool {
+        indexByMessageID[messageID] != nil
+    }
+
+    func message(withID messageID: String) -> BitchatMessage? {
+        guard let index = indexByMessageID[messageID] else { return nil }
+        return messages[index]
+    }
+
+    /// All message IDs currently in this conversation (unordered).
+    var messageIDs: Dictionary<String, Int>.Keys {
+        indexByMessageID.keys
+    }
+
+    // MARK: Store-internal mutations
+
+    /// Result of an ordered insert. `trimmedMessageIDs` reports messages
+    /// evicted by the cap so the store can keep its message-ID →
+    /// conversation map exact.
+    fileprivate struct InsertResult {
+        let inserted: Bool
+        let trimmedMessageIDs: [String]
+
+        static let duplicate = InsertResult(inserted: false, trimmedMessageIDs: [])
+    }
+
+    fileprivate enum UpsertOutcome {
+        case appended(trimmedMessageIDs: [String])
+        case updated
+    }
+
+    /// Inserts a message in timestamp order, deduplicating by message ID.
+    /// Fast path appends when the timestamp is >= the current tail;
+    /// otherwise a binary search finds the upper-bound insertion point so
+    /// arrival order is preserved among equal timestamps.
+    /// Reports `inserted: false` if a message with the same ID already exists.
+    fileprivate func insert(_ message: BitchatMessage) -> InsertResult {
+        guard indexByMessageID[message.id] == nil else { return .duplicate }
+
+        if let last = messages.last, message.timestamp < last.timestamp {
+            let index = insertionIndex(for: message.timestamp)
+            messages.insert(message, at: index)
+            reindex(from: index)
+        } else {
+            messages.append(message)
+            indexByMessageID[message.id] = messages.count - 1
+        }
+
+        return InsertResult(inserted: true, trimmedMessageIDs: trimIfNeeded())
+    }
+
+    /// Replace-or-append by message ID. An existing message keeps its
+    /// timeline position (in-place updates like media progress reuse the
+    /// original timestamp); a new message goes through ordered insertion.
+    fileprivate func upsert(_ message: BitchatMessage) -> UpsertOutcome {
+        if let index = indexByMessageID[message.id] {
+            messages[index] = message
+            return .updated
+        }
+        let result = insert(message)
+        return .appended(trimmedMessageIDs: result.trimmedMessageIDs)
+    }
+
+    /// Applies a delivery status keyed by message ID, honoring the
+    /// no-downgrade rule (the SOLE enforcement point — every delivery
+    /// update flows through the store): equal statuses are skipped, and
+    /// `.read` is never downgraded to `.delivered` or `.sent`.
+    /// Returns `true` when the status was applied.
+    fileprivate func applyDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool {
+        guard let index = indexByMessageID[messageID] else { return false }
+        let message = messages[index]
+        guard !Self.shouldSkipStatusUpdate(current: message.deliveryStatus, new: status) else { return false }
+
+        message.deliveryStatus = status
+        // BitchatMessage is a reference type; write back through the
+        // subscript so the @Published wrapper emits.
+        messages[index] = message
+        return true
+    }
+
+    /// Republishes a message without changing state. Used for mirrored
+    /// copies that share a BitchatMessage instance: the first conversation's
+    /// status apply mutated the shared object, so this conversation's
+    /// observers still need an @Published emission to re-render.
+    @discardableResult
+    fileprivate func republishMessage(withID messageID: String) -> Bool {
+        guard let index = indexByMessageID[messageID] else { return false }
+        messages[index] = messages[index]
+        return true
+    }
+
+    @discardableResult
+    fileprivate func setUnread(_ unread: Bool) -> Bool {
+        guard isUnread != unread else { return false }
+        isUnread = unread
+        return true
+    }
+
+    /// Removes a single message by ID. Returns the removed message, or
+    /// `nil` when no message with that ID exists.
+    fileprivate func remove(messageID: String) -> BitchatMessage? {
+        guard let index = indexByMessageID[messageID] else { return nil }
+        let removed = messages.remove(at: index)
+        indexByMessageID.removeValue(forKey: messageID)
+        reindex(from: index)
+        return removed
+    }
+
+    /// Removes every message matching `predicate`. Returns the removed
+    /// message IDs (empty when nothing matched).
+    fileprivate func removeAll(where predicate: (BitchatMessage) -> Bool) -> [String] {
+        var removedIDs: [String] = []
+        messages.removeAll { message in
+            guard predicate(message) else { return false }
+            removedIDs.append(message.id)
+            return true
+        }
+        guard !removedIDs.isEmpty else { return [] }
+        for id in removedIDs {
+            indexByMessageID.removeValue(forKey: id)
+        }
+        reindex(from: 0)
+        return removedIDs
+    }
+
+    fileprivate func clearMessages() {
+        messages.removeAll()
+        indexByMessageID.removeAll()
+    }
+
+    // MARK: Diagnostics
+
+    /// Appends human-readable invariant violations for this conversation
+    /// (empty when healthy): the ID index must be the exact inverse of the
+    /// messages array, the cap must hold, and timestamps must be
+    /// non-decreasing (equal timestamps keep arrival order, so only strict
+    /// inversions are violations). O(messages); allocates only on violation.
+    fileprivate func collectInvariantViolations(into violations: inout [String], label: String) {
+        if indexByMessageID.count != messages.count {
+            violations.append("\(label): index has \(indexByMessageID.count) entries for \(messages.count) messages")
+        }
+        if messages.count > cap {
+            violations.append("\(label): \(messages.count) messages exceeds cap \(cap)")
+        }
+        var previousTimestamp: Date?
+        for position in messages.indices {
+            let message = messages[position]
+            // Count equality + every message resolving to its own position
+            // proves the index is exactly the inverse map (no stale extras).
+            if let index = indexByMessageID[message.id] {
+                if index != position {
+                    violations.append("\(label): message \(message.id.prefix(8))… at \(position) indexed at \(index)")
+                }
+            } else {
+                violations.append("\(label): message \(message.id.prefix(8))… at \(position) missing from index")
+            }
+            if let previousTimestamp, message.timestamp < previousTimestamp {
+                violations.append("\(label): timestamp order violated at \(position)")
+            }
+            previousTimestamp = message.timestamp
+        }
+    }
+
+    // MARK: Internals
+
+    static func shouldSkipStatusUpdate(current: DeliveryStatus?, new: DeliveryStatus) -> Bool {
+        guard let current else { return false }
+        if current == new { return true }
+
+        switch (current, new) {
+        case (.read, .delivered), (.read, .sent):
+            return true
+        default:
+            return false
+        }
+    }
+
+    /// Upper-bound binary search: first index whose timestamp is strictly
+    /// greater than `timestamp`, so equal-timestamp messages keep arrival
+    /// order.
+    private func insertionIndex(for timestamp: Date) -> Int {
+        var low = 0
+        var high = messages.count
+        while low < high {
+            let mid = (low + high) / 2
+            if messages[mid].timestamp <= timestamp {
+                low = mid + 1
+            } else {
+                high = mid
+            }
+        }
+        return low
+    }
+
+    private func reindex(from start: Int) {
+        for index in start..<messages.count {
+            indexByMessageID[messages[index].id] = index
+        }
+    }
+
+    /// Trims oldest messages over the cap; returns the trimmed message IDs.
+    private func trimIfNeeded() -> [String] {
+        guard messages.count > cap else { return [] }
+        let overflow = messages.count - cap
+        let trimmedIDs = messages.prefix(overflow).map(\.id)
+        for id in trimmedIDs {
+            indexByMessageID.removeValue(forKey: id)
+        }
+        messages.removeFirst(overflow)
+        reindex(from: 0)
+        return trimmedIDs
+    }
+}
+
+// MARK: - ConversationChange
+
+/// Typed mutation events for non-UI consumers (delivery tracking,
+/// notifications, sync) that need "something changed in conversation X"
+/// without subscribing to whole message arrays. Emitted on the store's
+/// `changes` subject AFTER the corresponding state is consistent.
+enum ConversationChange {
+    case appended(ConversationID, BitchatMessage)
+    case updated(ConversationID, messageID: String)
+    case statusChanged(ConversationID, messageID: String, DeliveryStatus)
+    case messageRemoved(ConversationID, messageID: String)
+    case cleared(ConversationID)
+    case removed(ConversationID)
+    case migrated(from: ConversationID, to: ConversationID)
+    case unreadChanged(ConversationID, isUnread: Bool)
+}
+
+// MARK: - ConversationStore
+
+/// Sole writer and sole holder of conversation message state. All mutations
+/// go through the intent API below; backing collections are `private(set)`.
+/// Reads are synchronous — writers and readers share the main actor, so
+/// after an intent returns every observer sees the result.
+@MainActor
+final class ConversationStore: ObservableObject {
+    /// Conversation creation order; published so list-style consumers can
+    /// observe conversations appearing/disappearing without rebuilding from
+    /// the dictionary.
+    @Published private(set) var conversationIDs: [ConversationID] = []
+    @Published private(set) var selectedConversationID: ConversationID?
+    @Published private(set) var unreadConversations: Set<ConversationID> = []
+
+    // MARK: Selection state
+    // The two UI selection axes: which public channel is active, and which
+    // private chat (if any) is open on top of it. `selectedConversationID`
+    // is derived: the open private chat wins, otherwise the active public
+    // channel's conversation. Mutate via `setActiveChannel` /
+    // `setSelectedPrivatePeer` only.
+
+    @Published private(set) var activeChannel: ChannelID = .mesh
+    @Published private(set) var selectedPrivatePeerID: PeerID?
+
+    private(set) var conversationsByID: [ConversationID: Conversation] = [:]
+
+    /// Store-level message-ID → conversation-membership map for ID-only
+    /// lookups (delivery receipts arrive with a message ID, not a
+    /// conversation). Maintained incrementally at every mutation point —
+    /// all mutation is centralized in the intent API below, so the map is
+    /// exact, never scanned or rebuilt.
+    ///
+    /// The value is a `Set` because a private message can legitimately live
+    /// in TWO direct conversations: step 2's raw per-peer keying mirrors a
+    /// message into both the stable-key and ephemeral-peer chats
+    /// (`mirrorToEphemeralIfNeeded`). A delivery update must reach both
+    /// copies.
+    private var conversationIDsByMessageID: [String: Set<ConversationID>] = [:]
+
+    /// Monotonic count of messages inserted into any conversation (appends,
+    /// upsert-appends, migration inserts). Field-observability only: the
+    /// periodic store audit folds the delta into its heartbeat line so logs
+    /// carry throughput context. Never read on a hot path.
+    private(set) var appendCount: Int = 0
+
+    /// Sample counter for the mirrored-republish debug log in the ID-only
+    /// `setDeliveryStatus` fan-out (first + every Nth occurrence).
+    private var mirroredRepublishLogCount = 0
+
+    let changes = PassthroughSubject<ConversationChange, Never>()
+
+    // MARK: Intent API
+
+    /// Returns the conversation for `id`, creating it (with the cap policy
+    /// for its kind) on first access.
+    @discardableResult
+    func conversation(for id: ConversationID) -> Conversation {
+        if let existing = conversationsByID[id] {
+            return existing
+        }
+        let conversation = Conversation(id: id, cap: Self.cap(for: id))
+        conversationsByID[id] = conversation
+        conversationIDs.append(id)
+        return conversation
+    }
+
+    /// Appends a message in timestamp order. Returns `false` (and emits
+    /// nothing) if a message with the same ID is already present.
+    @discardableResult
+    func append(_ message: BitchatMessage, to id: ConversationID) -> Bool {
+        let conversation = conversation(for: id)
+        let result = conversation.insert(message)
+        guard result.inserted else { return false }
+        registerMessageID(message.id, in: id)
+        unregisterMessageIDs(result.trimmedMessageIDs, from: id)
+        changes.send(.appended(id, message))
+        return true
+    }
+
+    /// Replace-or-append by message ID (media progress, edits).
+    func upsertByID(_ message: BitchatMessage, in id: ConversationID) {
+        let conversation = conversation(for: id)
+        switch conversation.upsert(message) {
+        case .appended(let trimmedMessageIDs):
+            registerMessageID(message.id, in: id)
+            unregisterMessageIDs(trimmedMessageIDs, from: id)
+            changes.send(.appended(id, message))
+        case .updated:
+            changes.send(.updated(id, messageID: message.id))
+        }
+    }
+
+    /// Applies a delivery status keyed by message ID. Returns `false` when
+    /// the message is unknown or the update would downgrade the status
+    /// (read beats delivered beats sent).
+    @discardableResult
+    func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String, in id: ConversationID) -> Bool {
+        guard let conversation = conversationsByID[id],
+              conversation.applyDeliveryStatus(status, forMessageID: messageID) else {
+            return false
+        }
+        changes.send(.statusChanged(id, messageID: messageID, status))
+        return true
+    }
+
+    /// Applies a delivery status to EVERY conversation containing
+    /// `messageID` (ID-only — delivery receipts don't know conversations;
+    /// mirrored private copies live in two direct chats). Returns `false`
+    /// when the message is unknown or no copy changed (equal status or
+    /// downgrade — read beats delivered beats sent).
+    ///
+    /// `BitchatMessage` is a reference type, so mirrored copies sharing one
+    /// instance are mutated by the first conversation's apply. The skipped
+    /// conversations still hold the changed message, so they get an explicit
+    /// republish and `.statusChanged` event - otherwise a view observing the
+    /// mirrored conversation would render stale status. Distinct copies whose
+    /// update was genuinely rejected (downgrade) are left untouched, guarded
+    /// by status equality.
+    @discardableResult
+    func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool {
+        guard let ids = conversationIDsByMessageID[messageID] else { return false }
+        var applied = false
+        var skipped: [ConversationID] = []
+        for id in ids {
+            if setDeliveryStatus(status, forMessageID: messageID, in: id) {
+                applied = true
+            } else {
+                skipped.append(id)
+            }
+        }
+        guard applied else { return false }
+        for id in skipped {
+            guard let conversation = conversationsByID[id],
+                  conversation.message(withID: messageID)?.deliveryStatus == status,
+                  conversation.republishMessage(withID: messageID) else { continue }
+            // Field proof the mirrored-copy republish path actually fires;
+            // sampled (first + every Nth) so mirrored chats can't spam logs.
+            mirroredRepublishLogCount += 1
+            if mirroredRepublishLogCount == 1
+                || mirroredRepublishLogCount.isMultiple(of: TransportConfig.conversationStoreMirroredRepublishLogInterval) {
+                SecureLogger.debug(
+                    "mirrored republish #\(mirroredRepublishLogCount) for \(messageID.prefix(8))… in \(id.auditDescription)",
+                    category: .session
+                )
+            }
+            changes.send(.statusChanged(id, messageID: messageID, status))
+        }
+        return true
+    }
+
+    /// Current delivery status of `messageID` in whichever conversation
+    /// holds it (mirrored copies share status — see `setDeliveryStatus`).
+    func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus? {
+        guard let ids = conversationIDsByMessageID[messageID] else { return nil }
+        for id in ids {
+            if let status = conversationsByID[id]?.message(withID: messageID)?.deliveryStatus {
+                return status
+            }
+        }
+        return nil
+    }
+
+    /// Every conversation currently containing `messageID` (empty when the
+    /// message is unknown).
+    func conversationIDs(forMessageID messageID: String) -> Set<ConversationID> {
+        conversationIDsByMessageID[messageID] ?? []
+    }
+
+    func markRead(_ id: ConversationID) {
+        guard unreadConversations.contains(id) else { return }
+        unreadConversations.remove(id)
+        conversationsByID[id]?.setUnread(false)
+        changes.send(.unreadChanged(id, isUnread: false))
+    }
+
+    func markUnread(_ id: ConversationID) {
+        guard !unreadConversations.contains(id) else { return }
+        let conversation = conversation(for: id)
+        unreadConversations.insert(id)
+        conversation.setUnread(true)
+        changes.send(.unreadChanged(id, isUnread: true))
+    }
+
+    /// Selects a conversation (creating it if needed) or clears the
+    /// selection with `nil`.
+    func select(_ id: ConversationID?) {
+        if let id {
+            conversation(for: id)
+        }
+        guard selectedConversationID != id else { return }
+        selectedConversationID = id
+    }
+
+    /// Switches the active public channel. While no private chat is open
+    /// the selection follows the channel.
+    func setActiveChannel(_ channelID: ChannelID) {
+        if activeChannel != channelID {
+            activeChannel = channelID
+        }
+        refreshDerivedSelection()
+    }
+
+    /// Opens a private chat (`nil` closes it, returning the selection to the
+    /// active public channel's conversation).
+    func setSelectedPrivatePeer(_ peerID: PeerID?) {
+        if selectedPrivatePeerID != peerID {
+            selectedPrivatePeerID = peerID
+        }
+        refreshDerivedSelection()
+    }
+
+    private func refreshDerivedSelection() {
+        if let peerID = selectedPrivatePeerID {
+            select(.directPeer(peerID))
+        } else {
+            select(ConversationID(channelID: activeChannel))
+        }
+    }
+
+    /// Moves all messages from `source` into `destination` (the
+    /// ephemeral↔stable peer-ID handoff): dedups by message ID, preserves
+    /// timestamp order, carries unread state over, and hands off the
+    /// selection — mirroring `ChatPrivateConversationCoordinator`'s
+    /// migration semantics. The source conversation is removed. Emits a
+    /// single `.migrated(from:to:)` once the whole move is consistent.
+    func migrateConversation(from source: ConversationID, to destination: ConversationID) {
+        guard source != destination, let sourceConversation = conversationsByID[source] else { return }
+
+        let destinationConversation = conversation(for: destination)
+        for message in sourceConversation.messages {
+            let result = destinationConversation.insert(message)
+            guard result.inserted else { continue }
+            registerMessageID(message.id, in: destination)
+            unregisterMessageIDs(result.trimmedMessageIDs, from: destination)
+        }
+        for messageID in sourceConversation.messageIDs {
+            unregisterMessageID(messageID, from: source)
+        }
+
+        let wasUnread = unreadConversations.contains(source)
+        let wasSelected = selectedConversationID == source
+
+        conversationsByID.removeValue(forKey: source)
+        conversationIDs.removeAll { $0 == source }
+        unreadConversations.remove(source)
+
+        if wasUnread, !unreadConversations.contains(destination) {
+            unreadConversations.insert(destination)
+            destinationConversation.setUnread(true)
+        }
+        if wasSelected {
+            selectedConversationID = destination
+            // Keep the private-peer selection axis consistent with the
+            // handed-off selection.
+            if let peerID = selectedPrivatePeerID,
+               source == .directPeer(peerID),
+               case .direct(let destinationHandle) = destination {
+                selectedPrivatePeerID = destinationHandle.routingPeerID
+            }
+        }
+
+        changes.send(.migrated(from: source, to: destination))
+    }
+
+    /// Removes a single message by ID from a conversation. Returns the
+    /// removed message, or `nil` (emitting nothing) when the conversation or
+    /// message is unknown.
+    @discardableResult
+    func removeMessage(withID messageID: String, from id: ConversationID) -> BitchatMessage? {
+        guard let conversation = conversationsByID[id],
+              let removed = conversation.remove(messageID: messageID) else {
+            return nil
+        }
+        unregisterMessageID(messageID, from: id)
+        changes.send(.messageRemoved(id, messageID: messageID))
+        return removed
+    }
+
+    /// Removes every message matching `predicate` from a conversation,
+    /// emitting one `.messageRemoved` per removed message after the
+    /// conversation is consistent. No-op for unknown conversations.
+    func removeMessages(from id: ConversationID, where predicate: (BitchatMessage) -> Bool) {
+        guard let conversation = conversationsByID[id] else { return }
+        let removedIDs = conversation.removeAll(where: predicate)
+        unregisterMessageIDs(removedIDs, from: id)
+        for messageID in removedIDs {
+            changes.send(.messageRemoved(id, messageID: messageID))
+        }
+    }
+
+    /// Empties a conversation's timeline but keeps the conversation (and
+    /// its unread/selection state) alive.
+    func clear(_ id: ConversationID) {
+        guard let conversation = conversationsByID[id] else { return }
+        for messageID in conversation.messageIDs {
+            unregisterMessageID(messageID, from: id)
+        }
+        conversation.clearMessages()
+        changes.send(.cleared(id))
+    }
+
+    /// Removes a conversation entirely, including unread state; clears the
+    /// selection if it pointed at the removed conversation.
+    func removeConversation(_ id: ConversationID) {
+        guard let conversation = conversationsByID.removeValue(forKey: id) else { return }
+        for messageID in conversation.messageIDs {
+            unregisterMessageID(messageID, from: id)
+        }
+        conversationIDs.removeAll { $0 == id }
+        unreadConversations.remove(id)
+        if selectedConversationID == id {
+            selectedConversationID = nil
+        }
+        changes.send(.removed(id))
+    }
+
+    func clearAll() {
+        let removedIDs = conversationIDs
+        guard !removedIDs.isEmpty || selectedConversationID != nil else { return }
+
+        conversationsByID.removeAll()
+        conversationIDs.removeAll()
+        unreadConversations.removeAll()
+        conversationIDsByMessageID.removeAll()
+        if selectedConversationID != nil {
+            selectedConversationID = nil
+        }
+
+        for id in removedIDs {
+            changes.send(.removed(id))
+        }
+    }
+
+    // MARK: Diagnostics
+
+    /// Total messages across all conversations. O(#conversations) — heartbeat
+    /// logging only, never a hot path.
+    var totalMessageCount: Int {
+        conversationsByID.values.reduce(0) { $0 + $1.messages.count }
+    }
+
+    /// Number of distinct message IDs in the store-level membership map.
+    var messageIDMapCount: Int {
+        conversationIDsByMessageID.count
+    }
+
+    /// Verifies the store's correctness invariants and returns human-readable
+    /// violations (empty = healthy). Intended for a periodic field audit:
+    /// O(total messages) and allocation-free while healthy. Checks:
+    /// - the `conversationIDs` ordering array matches `conversationsByID`
+    /// - per conversation: ID index exact, cap held, timestamp order
+    ///   (see `Conversation.collectInvariantViolations`)
+    /// - the message-ID → conversation map matches reality exactly: every
+    ///   mapped membership points at a live conversation actually holding
+    ///   the message, and total memberships equal total messages (with the
+    ///   forward check, equality proves no conversation message is missing
+    ///   from the map)
+    /// - `unreadConversations` only references existing conversations
+    /// - `selectedConversationID`, when set, references an existing
+    ///   conversation (`select(_:)` creates on selection and
+    ///   `removeConversation`/`clearAll` clear it, so existence is the
+    ///   invariant for both the channel-derived and direct-peer cases)
+    func auditInvariants() -> [String] {
+        var violations: [String] = []
+
+        if conversationIDs.count != conversationsByID.count {
+            violations.append("conversationIDs lists \(conversationIDs.count) conversations but dictionary holds \(conversationsByID.count)")
+        }
+        for id in conversationIDs where conversationsByID[id] == nil {
+            violations.append("conversationIDs lists \(id.auditDescription) but no conversation exists")
+        }
+
+        var totalMessages = 0
+        for (id, conversation) in conversationsByID {
+            totalMessages += conversation.messages.count
+            conversation.collectInvariantViolations(into: &violations, label: id.auditDescription)
+        }
+
+        var totalMappedMemberships = 0
+        for (messageID, ids) in conversationIDsByMessageID {
+            totalMappedMemberships += ids.count
+            if ids.isEmpty {
+                violations.append("message map: \(messageID.prefix(8))… has an empty membership set")
+            }
+            for id in ids {
+                guard let conversation = conversationsByID[id] else {
+                    violations.append("message map: \(messageID.prefix(8))… claims unknown conversation \(id.auditDescription)")
+                    continue
+                }
+                if !conversation.containsMessage(withID: messageID) {
+                    violations.append("message map: \(messageID.prefix(8))… not present in claimed conversation \(id.auditDescription)")
+                }
+            }
+        }
+        if totalMappedMemberships != totalMessages {
+            violations.append("message map holds \(totalMappedMemberships) memberships but conversations hold \(totalMessages) messages")
+        }
+
+        for id in unreadConversations where conversationsByID[id] == nil {
+            violations.append("unreadConversations contains unknown conversation \(id.auditDescription)")
+        }
+
+        if let selected = selectedConversationID, conversationsByID[selected] == nil {
+            violations.append("selectedConversationID \(selected.auditDescription) has no conversation")
+        }
+
+        return violations
+    }
+
+    // MARK: Internals
+
+    private func registerMessageID(_ messageID: String, in id: ConversationID) {
+        conversationIDsByMessageID[messageID, default: []].insert(id)
+        // Single choke point for every successful insertion (append, upsert
+        // append, migration insert) — the audit heartbeat's throughput delta.
+        appendCount += 1
+    }
+
+    private func unregisterMessageID(_ messageID: String, from id: ConversationID) {
+        guard var ids = conversationIDsByMessageID[messageID] else { return }
+        ids.remove(id)
+        if ids.isEmpty {
+            conversationIDsByMessageID.removeValue(forKey: messageID)
+        } else {
+            conversationIDsByMessageID[messageID] = ids
+        }
+    }
+
+    private func unregisterMessageIDs(_ messageIDs: [String], from id: ConversationID) {
+        for messageID in messageIDs {
+            unregisterMessageID(messageID, from: id)
+        }
+    }
+
+    private static func cap(for id: ConversationID) -> Int {
+        switch id {
+        case .mesh:
+            return TransportConfig.meshTimelineCap
+        case .geohash:
+            return TransportConfig.geoTimelineCap
+        case .direct:
+            return TransportConfig.privateChatCap
+        }
+    }
+}
+
+// MARK: - Direct-conversation keying + derived views
+
+extension ConversationID {
+    /// Direct-conversation ID keyed by the *raw* routing peer ID.
+    ///
+    /// Direct conversations are deliberately keyed per `PeerID`, not per
+    /// resolved identity: the private-chat coordinators mirror messages into
+    /// both the ephemeral and stable peer's conversations
+    /// (`mirrorToEphemeralIfNeeded`) and consolidate/migrate between them
+    /// explicitly, so a raw lookup by whichever peer ID is selected always
+    /// finds the right timeline without an identity-resolution layer.
+    static func directPeer(_ peerID: PeerID) -> ConversationID {
+        .direct(PeerHandle(id: "peer:\(peerID.id)", routingPeerID: peerID))
+    }
+}
+
+extension ConversationStore {
+    /// All direct conversations' messages keyed by routing peer ID — the
+    /// shape `ChatViewModel.privateChats` exposes to the coordinators.
+    /// Values are the conversations' backing arrays (COW), so building this
+    /// is O(#conversations), not O(#messages).
+    func directMessagesByRoutingPeerID() -> [PeerID: [BitchatMessage]] {
+        var messagesByPeerID: [PeerID: [BitchatMessage]] = [:]
+        messagesByPeerID.reserveCapacity(conversationsByID.count)
+        for (id, conversation) in conversationsByID {
+            guard case .direct(let handle) = id else { continue }
+            messagesByPeerID[handle.routingPeerID] = conversation.messages
+        }
+        return messagesByPeerID
+    }
+
+    /// Unread direct conversations as routing peer IDs — the shape
+    /// `ChatViewModel.unreadPrivateMessages` exposes to the coordinators.
+    func unreadDirectRoutingPeerIDs() -> Set<PeerID> {
+        var peerIDs = Set<PeerID>()
+        for id in unreadConversations {
+            guard case .direct(let handle) = id else { continue }
+            peerIDs.insert(handle.routingPeerID)
+        }
+        return peerIDs
+    }
+
+    /// `true` when any direct conversation contains a message with `messageID`
+    /// (O(1) via the store-level message-ID → conversation map).
+    func directConversationsContainMessage(withID messageID: String) -> Bool {
+        conversationIDs(forMessageID: messageID).contains { id in
+            if case .direct = id { return true }
+            return false
+        }
+    }
+
+    /// Message IDs across all direct conversations (read-receipt pruning
+    /// keeps only receipts whose messages still exist).
+    func directMessageIDs() -> Set<String> {
+        var messageIDs = Set<String>()
+        for (id, conversation) in conversationsByID {
+            guard case .direct = id else { continue }
+            messageIDs.formUnion(conversation.messageIDs)
+        }
+        return messageIDs
+    }
+
+    /// Removes every direct conversation (panic clear).
+    func removeAllDirectConversations() {
+        let directIDs = conversationIDs.filter { id in
+            if case .direct = id { return true }
+            return false
+        }
+        for id in directIDs {
+            removeConversation(id)
+        }
+    }
+}
+
+// MARK: - Diagnostics support
+
+extension ConversationID {
+    /// Short, log-safe description for audit/diagnostic lines. Direct
+    /// conversations truncate the handle so full peer keys never hit logs.
+    fileprivate var auditDescription: String {
+        switch self {
+        case .mesh:
+            return "mesh"
+        case .geohash(let geohash):
+            return "geo:\(geohash)"
+        case .direct(let handle):
+            return "direct:\(handle.id.prefix(13))…"
+        }
+    }
+}
+
+#if DEBUG
+// Test-only corruption hooks for `auditInvariants()` tests. The store is the
+// sole writer by design — `Conversation`'s mutators are fileprivate and the
+// store's backing collections are private — so the inconsistent states the
+// audit exists to catch CANNOT be manufactured through the intent API. These
+// DEBUG-only hooks deliberately bypass that lockdown to inject exactly those
+// impossible states. Never call them outside tests.
+extension Conversation {
+    /// Points an existing message's index entry at the wrong position
+    /// (positions 0 and 1 swap their index entries). Requires >= 2 messages.
+    func _testCorruptIndexEntries() {
+        guard messages.count >= 2 else { return }
+        indexByMessageID[messages[0].id] = 1
+        indexByMessageID[messages[1].id] = 0
+    }
+
+    /// Drops a message's index entry entirely (count mismatch + missing).
+    func _testRemoveIndexEntry(forMessageID messageID: String) {
+        indexByMessageID.removeValue(forKey: messageID)
+    }
+
+    /// Swaps the first and last messages while keeping the index consistent,
+    /// so ONLY the timestamp-order invariant is violated (requires the two
+    /// messages to have distinct timestamps).
+    func _testCorruptOrderingPreservingIndex() {
+        guard messages.count >= 2 else { return }
+        messages.swapAt(0, messages.count - 1)
+        indexByMessageID[messages[0].id] = 0
+        indexByMessageID[messages[messages.count - 1].id] = messages.count - 1
+    }
+}
+
+extension ConversationStore {
+    /// Adds a map membership that the conversation does not actually hold.
+    func _testRegisterPhantomMessageID(_ messageID: String, in id: ConversationID) {
+        conversationIDsByMessageID[messageID, default: []].insert(id)
+    }
+
+    /// Drops a real map membership (conversation message missing from map).
+    func _testUnregisterMessageID(_ messageID: String, from id: ConversationID) {
+        conversationIDsByMessageID[messageID]?.remove(id)
+        if conversationIDsByMessageID[messageID]?.isEmpty == true {
+            conversationIDsByMessageID.removeValue(forKey: messageID)
+        }
+    }
+
+    /// Appends past the conversation cap, bypassing trim (map kept exact so
+    /// only the cap invariant is violated).
+    func _testAppendBypassingCap(_ message: BitchatMessage, to id: ConversationID) {
+        let conversation = conversation(for: id)
+        conversation._testAppendBypassingTrim(message)
+        conversationIDsByMessageID[message.id, default: []].insert(id)
+    }
+
+    /// Marks a nonexistent conversation unread without creating it.
+    func _testInsertUnreadConversationID(_ id: ConversationID) {
+        unreadConversations.insert(id)
+    }
+
+    /// Sets the selection directly, without `select(_:)`'s create-on-select.
+    func _testSetSelectedConversationID(_ id: ConversationID?) {
+        selectedConversationID = id
+    }
+}
+
+extension Conversation {
+    fileprivate func _testAppendBypassingTrim(_ message: BitchatMessage) {
+        messages.append(message)
+        indexByMessageID[message.id] = messages.count - 1
+    }
+}
+#endif
+
+// MARK: - Public timeline derived views
+
+extension ConversationStore {
+    /// Removes a message by ID from whichever public (mesh/geohash)
+    /// conversation contains it. Returns the removed message, if any.
+    @discardableResult
+    func removePublicMessage(withID messageID: String) -> BitchatMessage? {
+        for id in conversationIDs(forMessageID: messageID) {
+            switch id {
+            case .mesh, .geohash:
+                return removeMessage(withID: messageID, from: id)
+            case .direct:
+                continue
+            }
+        }
+        return nil
+    }
+}

bitchat/App/ConversationUIModel.swift

@@ -15,19 +15,19 @@ final class ConversationUIModel: ObservableObject {
 
     private let chatViewModel: ChatViewModel
     private let privateConversationModel: PrivateConversationModel
-    private let conversationStore: ConversationStore
+    private let conversations: ConversationStore
     private var activeChannel: ChannelID
     private var cancellables = Set<AnyCancellable>()
 
     init(
         chatViewModel: ChatViewModel,
         privateConversationModel: PrivateConversationModel,
-        conversationStore: ConversationStore
+        conversations: ConversationStore
     ) {
         self.chatViewModel = chatViewModel
         self.privateConversationModel = privateConversationModel
-        self.conversationStore = conversationStore
-        self.activeChannel = conversationStore.activeChannel
+        self.conversations = conversations
+        self.activeChannel = conversations.activeChannel
         self.currentNickname = chatViewModel.nickname
         self.isBatchingPublic = chatViewModel.isBatchingPublic
         self.showAutocomplete = chatViewModel.showAutocomplete
@@ -41,10 +41,22 @@ final class ConversationUIModel: ObservableObject {
         chatViewModel.currentColorScheme = colorScheme
     }
 
+    func setCurrentTheme(_ theme: AppTheme) {
+        chatViewModel.currentTheme = theme
+    }
+
     func sendMessage(_ message: String) {
         chatViewModel.sendMessage(message)
     }
 
+    /// Resends a failed private message through the normal send path,
+    /// removing the failed original so the re-submission replaces it
+    /// instead of stacking a duplicate under the red bubble.
+    func resendFailedPrivateMessage(_ message: BitchatMessage) {
+        chatViewModel.removePrivateMessage(withID: message.id)
+        chatViewModel.sendMessage(message.content)
+    }
+
     func clearCurrentConversation() {
         chatViewModel.sendMessage("/clear")
     }
@@ -63,11 +75,23 @@ final class ConversationUIModel: ObservableObject {
         if let peerID, peerID.isGeoChat,
            let full = chatViewModel.fullNostrHex(forSenderPeerID: peerID) {
             chatViewModel.blockGeohashUser(pubkeyHexLowercased: full, displayName: displayName)
+        } else if let peerID, !peerID.isGeoDM, !peerID.isGeoChat {
+            // Mesh: block the peer's stable Noise identity resolved from the
+            // tapped peerID rather than re-resolving a display-name string.
+            chatViewModel.blockMeshPeer(peerID: peerID, displayName: displayName)
         } else {
             chatViewModel.sendMessage("/block \(displayName)")
         }
     }
 
+    /// Mesh counterpart of `block(peerID:displayName:)`. Resolves the unblock by
+    /// the tapped peer's stable identity so the exact row is unblocked — this
+    /// also works for offline peers, which the `/unblock <displayName>` command
+    /// cannot resolve.
+    func unblock(peerID: PeerID, displayName: String) {
+        chatViewModel.unblockMeshPeer(peerID: peerID, displayName: displayName)
+    }
+
     func updateAutocomplete(for text: String, cursorPosition: Int) {
         chatViewModel.updateAutocomplete(for: text, cursorPosition: cursorPosition)
     }
@@ -76,12 +100,12 @@ final class ConversationUIModel: ObservableObject {
         chatViewModel.completeNickname(nickname, in: &text)
     }
 
-    func formatMessage(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
-        chatViewModel.formatMessageAsText(message, colorScheme: colorScheme)
+    func formatMessage(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme? = nil) -> AttributedString {
+        chatViewModel.formatMessageAsText(message, colorScheme: colorScheme, theme: theme)
     }
 
-    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
-        chatViewModel.formatMessageHeader(message, colorScheme: colorScheme)
+    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme? = nil) -> AttributedString {
+        chatViewModel.formatMessageHeader(message, colorScheme: colorScheme, theme: theme)
     }
 
     func mediaAttachment(for message: BitchatMessage) -> BitchatMessage.Media? {
@@ -151,7 +175,7 @@ final class ConversationUIModel: ObservableObject {
             .receive(on: DispatchQueue.main)
             .assign(to: &$isBatchingPublic)
 
-        conversationStore.$activeChannel
+        conversations.$activeChannel
             .receive(on: DispatchQueue.main)
             .sink { [weak self] channel in
                 self?.activeChannel = channel

bitchat/App/PeerListModel.swift

@@ -37,7 +37,7 @@ final class PeerListModel: ObservableObject {
     @Published private(set) var renderID = ""
 
     private let chatViewModel: ChatViewModel
-    private let conversationStore: ConversationStore
+    private let conversations: ConversationStore
     private let locationChannelsModel: LocationChannelsModel
     private let peerIdentityStore: PeerIdentityStore
     private let locationPresenceStore: LocationPresenceStore
@@ -45,13 +45,13 @@ final class PeerListModel: ObservableObject {
 
     init(
         chatViewModel: ChatViewModel,
-        conversationStore: ConversationStore,
+        conversations: ConversationStore,
         locationChannelsModel: LocationChannelsModel? = nil,
         peerIdentityStore: PeerIdentityStore? = nil,
         locationPresenceStore: LocationPresenceStore? = nil
     ) {
         self.chatViewModel = chatViewModel
-        self.conversationStore = conversationStore
+        self.conversations = conversations
         self.locationChannelsModel = locationChannelsModel ?? LocationChannelsModel()
         self.peerIdentityStore = peerIdentityStore ?? chatViewModel.peerIdentityStore
         self.locationPresenceStore = locationPresenceStore ?? chatViewModel.locationPresenceStore
@@ -122,7 +122,7 @@ final class PeerListModel: ObservableObject {
             }
             .store(in: &cancellables)
 
-        conversationStore.$unreadConversations
+        conversations.$unreadConversations
             .receive(on: DispatchQueue.main)
             .sink { [weak self] _ in
                 self?.refresh()

bitchat/App/PrivateConversationModels.swift

@@ -2,68 +2,93 @@ import BitFoundation
 import Combine
 import Foundation
 
+/// Feature model for private (direct) conversations.
+///
+/// Reads the single-writer `ConversationStore` directly: `messages(for:)`
+/// returns the peer's conversation backing array (no mirror dictionary), and
+/// the store's typed `changes` subject drives invalidation — a change in the
+/// SELECTED peer's conversation republishes this model, while appends to
+/// other private chats only surface through the unread set. Direct
+/// conversations are keyed by raw routing peer ID; the coordinators'
+/// ephemeral/stable mirroring guarantees the selected peer's key always
+/// holds the full timeline (see `ConversationID.directPeer`).
 @MainActor
 final class PrivateInboxModel: ObservableObject {
     @Published private(set) var selectedPeerID: PeerID?
     @Published private(set) var unreadPeerIDs: Set<PeerID> = []
-    @Published private(set) var messagesByPeerID: [PeerID: [BitchatMessage]] = [:]
 
-    private let conversationStore: ConversationStore
+    private let conversations: ConversationStore
     private var cancellables = Set<AnyCancellable>()
 
-    init(conversationStore: ConversationStore) {
-        self.conversationStore = conversationStore
+    init(conversations: ConversationStore) {
+        self.conversations = conversations
+        self.selectedPeerID = conversations.selectedPrivatePeerID
+        self.unreadPeerIDs = conversations.unreadDirectRoutingPeerIDs()
 
         bind()
-        refreshMessages()
     }
 
     func messages(for peerID: PeerID?) -> [BitchatMessage] {
         guard let peerID else { return [] }
-        return messagesByPeerID[peerID] ?? []
+        return conversations.conversationsByID[.directPeer(peerID)]?.messages ?? []
     }
 
     private func bind() {
-        conversationStore.$selectedPrivatePeerID
-            .receive(on: DispatchQueue.main)
+        conversations.$selectedPrivatePeerID
+            .dropFirst()
             .sink { [weak self] peerID in
-                self?.selectedPeerID = peerID
-                self?.refreshMessages()
+                guard let self, self.selectedPeerID != peerID else { return }
+                self.selectedPeerID = peerID
             }
             .store(in: &cancellables)
 
-        conversationStore.$unreadConversations
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.unreadPeerIDs = self?.conversationStore.unreadDirectPeerIDs() ?? []
-                self?.refreshMessages()
+        conversations.changes
+            .sink { [weak self] change in
+                self?.apply(change)
             }
             .store(in: &cancellables)
-
-        conversationStore.$messagesByConversation
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refreshMessages()
-            }
-            .store(in: &cancellables)
-
-        selectedPeerID = conversationStore.selectedPrivatePeerID
-        unreadPeerIDs = conversationStore.unreadDirectPeerIDs()
     }
 
-    private func refreshMessages() {
-        var nextMessagesByPeerID = conversationStore.directMessagesByPeerID()
-        var peerIDs = Set(nextMessagesByPeerID.keys)
-        peerIDs.formUnion(conversationStore.unreadDirectPeerIDs())
-        if let selectedPeerID = conversationStore.selectedPrivatePeerID {
-            peerIDs.insert(selectedPeerID)
-        }
+    private func apply(_ change: ConversationChange) {
+        switch change {
+        case .appended(let id, _),
+             .updated(let id, _),
+             .statusChanged(let id, _, _),
+             .messageRemoved(let id, _),
+             .cleared(let id):
+            republishIfSelected(id)
 
-        for peerID in peerIDs where nextMessagesByPeerID[peerID] == nil {
-            nextMessagesByPeerID[peerID] = []
-        }
+        case .unreadChanged(let id, _):
+            guard isDirect(id) else { return }
+            refreshUnreadPeerIDs()
 
-        messagesByPeerID = nextMessagesByPeerID
+        case .removed(let id):
+            guard isDirect(id) else { return }
+            refreshUnreadPeerIDs()
+            republishIfSelected(id)
+
+        case .migrated(let source, let destination):
+            guard isDirect(source) || isDirect(destination) else { return }
+            refreshUnreadPeerIDs()
+            republishIfSelected(source)
+            republishIfSelected(destination)
+        }
+    }
+
+    private func republishIfSelected(_ id: ConversationID) {
+        guard let selectedPeerID, id == .directPeer(selectedPeerID) else { return }
+        objectWillChange.send()
+    }
+
+    private func refreshUnreadPeerIDs() {
+        let next = conversations.unreadDirectRoutingPeerIDs()
+        guard unreadPeerIDs != next else { return }
+        unreadPeerIDs = next
+    }
+
+    private func isDirect(_ id: ConversationID) -> Bool {
+        if case .direct = id { return true }
+        return false
     }
 }
 
@@ -93,22 +118,22 @@ final class PrivateConversationModel: ObservableObject {
     @Published private(set) var selectedHeaderState: PrivateConversationHeaderState?
 
     private let chatViewModel: ChatViewModel
-    private let conversationStore: ConversationStore
+    private let conversations: ConversationStore
     private let locationChannelsModel: LocationChannelsModel
     private let peerIdentityStore: PeerIdentityStore
     private var cancellables = Set<AnyCancellable>()
 
     init(
         chatViewModel: ChatViewModel,
-        conversationStore: ConversationStore,
+        conversations: ConversationStore,
         locationChannelsModel: LocationChannelsModel? = nil,
         peerIdentityStore: PeerIdentityStore? = nil
     ) {
         self.chatViewModel = chatViewModel
-        self.conversationStore = conversationStore
+        self.conversations = conversations
         self.locationChannelsModel = locationChannelsModel ?? LocationChannelsModel()
         self.peerIdentityStore = peerIdentityStore ?? chatViewModel.peerIdentityStore
-        let initialPeerID = conversationStore.selectedPrivatePeerID
+        let initialPeerID = conversations.selectedPrivatePeerID
         self.selectedPeerID = initialPeerID
         self.selectedHeaderState = initialPeerID.flatMap { peerID in
             makeHeaderState(for: peerID)
@@ -153,7 +178,7 @@ final class PrivateConversationModel: ObservableObject {
     }
 
     private func bind() {
-        conversationStore.$selectedPrivatePeerID
+        conversations.$selectedPrivatePeerID
             .receive(on: DispatchQueue.main)
             .sink { [weak self] _ in
                 self?.refreshSelectedConversation()
@@ -197,7 +222,7 @@ final class PrivateConversationModel: ObservableObject {
     }
 
     private func refreshSelectedConversation() {
-        selectedPeerID = conversationStore.selectedPrivatePeerID
+        selectedPeerID = conversations.selectedPrivatePeerID
         selectedHeaderState = selectedPeerID.flatMap { peerID in
             makeHeaderState(for: peerID)
         }
@@ -207,7 +232,13 @@ final class PrivateConversationModel: ObservableObject {
         let headerPeerID = chatViewModel.getShortIDForNoiseKey(conversationPeerID)
         let peer = chatViewModel.getPeer(byID: headerPeerID)
         let displayName = resolveDisplayName(for: conversationPeerID, headerPeerID: headerPeerID, peer: peer)
-        let availability = resolveAvailability(for: headerPeerID, peer: peer)
+        // Geo DMs are always routed over Nostr (NIP-17); their nostr_ keys
+        // never resolve to a reachable mesh peer, so resolveAvailability would
+        // report .offline. Report .nostrAvailable so the header shows the
+        // globe instead of a misleading "offline" tag.
+        let availability = conversationPeerID.isGeoDM
+            ? .nostrAvailable
+            : resolveAvailability(for: headerPeerID, peer: peer)
         let encryptionStatus: EncryptionStatus? = conversationPeerID.isGeoDM
             ? nil
             : chatViewModel.getEncryptionStatus(for: headerPeerID)

bitchat/App/PublicChatModel.swift

@@ -2,40 +2,76 @@ import BitFoundation
 import Combine
 import SwiftUI
 
+/// Feature model for the active public (mesh/geohash) timeline.
+///
+/// Observes ONE `Conversation` object in the single-writer
+/// `ConversationStore` — the active channel's — so appends to background
+/// conversations (other geohashes, private chats) never invalidate it.
+/// `messages` reads the observed conversation's backing array directly;
+/// there is no mirror copy.
 @MainActor
 final class PublicChatModel: ObservableObject {
     @Published private(set) var activeChannel: ChannelID
-    @Published private(set) var messages: [BitchatMessage] = []
 
-    private let conversationStore: ConversationStore
+    /// The active public conversation's timeline.
+    var messages: [BitchatMessage] { activeConversation.messages }
+
+    private let conversations: ConversationStore
+    private var activeConversation: Conversation
+    private var activeConversationCancellable: AnyCancellable?
     private var cancellables = Set<AnyCancellable>()
 
-    init(conversationStore: ConversationStore) {
-        self.activeChannel = conversationStore.activeChannel
-        self.conversationStore = conversationStore
+    init(conversations: ConversationStore) {
+        let channel = conversations.activeChannel
+        self.conversations = conversations
+        self.activeChannel = channel
+        self.activeConversation = conversations.conversation(for: ConversationID(channelID: channel))
 
+        observeActiveConversation()
         bind()
-        refreshMessages()
     }
 
     private func bind() {
-        conversationStore.$activeChannel
-            .receive(on: DispatchQueue.main)
+        conversations.$activeChannel
+            .dropFirst()
             .sink { [weak self] channel in
-                self?.activeChannel = channel
-                self?.refreshMessages()
+                guard let self else { return }
+                self.activeChannel = channel
+                self.retargetActiveConversation(to: channel)
             }
             .store(in: &cancellables)
 
-        conversationStore.$messagesByConversation
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refreshMessages()
+        // The store replaces a conversation's object when it is removed
+        // (panic clear); retarget to the fresh instance so the observation
+        // never goes stale.
+        conversations.changes
+            .sink { [weak self] change in
+                guard let self,
+                      case .removed(let id) = change,
+                      id == self.activeConversation.id else { return }
+                self.retargetActiveConversation(to: self.activeChannel)
             }
             .store(in: &cancellables)
     }
 
-    private func refreshMessages() {
-        messages = conversationStore.messages(for: ConversationID(channelID: activeChannel))
+    private func retargetActiveConversation(to channel: ChannelID) {
+        let conversation = conversations.conversation(for: ConversationID(channelID: channel))
+        guard conversation !== activeConversation else {
+            // Same object (e.g. re-selected channel): keep the existing
+            // observation, but `messages` may still differ from what views
+            // last rendered, so republish.
+            objectWillChange.send()
+            return
+        }
+        objectWillChange.send()
+        activeConversation = conversation
+        observeActiveConversation()
+    }
+
+    private func observeActiveConversation() {
+        activeConversationCancellable = activeConversation.objectWillChange
+            .sink { [weak self] _ in
+                self?.objectWillChange.send()
+            }
     }
 }

bitchat/BitchatApp.swift

@@ -15,6 +15,7 @@ struct BitchatApp: App {
     static let groupID = "group.\(bundleID)"
 
     @StateObject private var runtime: AppRuntime
+    @AppStorage(AppTheme.storageKey) private var appThemeRawValue = AppTheme.matrix.rawValue
     #if os(iOS)
     @Environment(\.scenePhase) var scenePhase
     @UIApplicationDelegateAdaptor(AppDelegate.self) var appDelegate
@@ -30,6 +31,7 @@ struct BitchatApp: App {
     var body: some Scene {
         WindowGroup {
             ContentView()
+                .environment(\.appTheme, AppTheme(rawValue: appThemeRawValue) ?? .matrix)
                 .environmentObject(runtime.publicChatModel)
                 .environmentObject(runtime.privateInboxModel)
                 .environmentObject(runtime.privateConversationModel)
@@ -69,7 +71,7 @@ struct BitchatApp: App {
 final class AppDelegate: NSObject, UIApplicationDelegate {
     weak var runtime: AppRuntime?
 
-    func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey : Any]? = nil) -> Bool {
+    func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]? = nil) -> Bool {
         true
     }
 

bitchat/Features/media/ImageUtils.swift

@@ -1,3 +1,4 @@
+import BitFoundation
 import Foundation
 import ImageIO
 import UniformTypeIdentifiers
@@ -13,11 +14,28 @@ enum ImageUtilsError: Error {
 }
 
 enum ImageUtils {
-    private static let compressionQuality: CGFloat = 0.82
-    private static let targetImageBytes: Int = 45_000
+    private static let compressionQuality: CGFloat = 0.85
+    // Upper bound for the compressed JPEG. This is only a ceiling: the encoder
+    // keeps whatever a photo naturally weighs at `defaultMaxDimension` and
+    // `compressionQuality`, and only steps quality down when a payload would
+    // exceed this budget. It stays well under `FileTransferLimits.maxImageBytes`
+    // (512 KiB) so the BLE path never overruns its cap.
+    //
+    // Wi-Fi bulk relevance: the old 45 KB / 448 px budget crushed every photo
+    // to ~40 KB — below `TransportConfig.wifiBulkMinPayloadBytes` (64 KiB) — so
+    // `WifiBulkPolicy.shouldOffer` never fired and the AWDL data plane was dead
+    // in production. A genuinely detailed photo at `defaultMaxDimension` now
+    // weighs well over 64 KiB, so it becomes Wi-Fi-bulk eligible to a capable
+    // direct peer while still riding BLE fragmentation for everyone else.
+    private static let targetImageBytes: Int = 200_000
     private static let maxSourceImageBytes: Int = 10 * 1024 * 1024
+    // Longest-side ceiling for shared photos. 448 px was thumbnail-tier and
+    // (together with the tiny byte budget) forced every photo below the Wi-Fi
+    // bulk threshold. 1024 px keeps a shared photo legible and lets detailed
+    // images clear 64 KiB, without approaching the 512 KiB hard cap.
+    static let defaultMaxDimension: CGFloat = 1024
 
-    static func processImage(at url: URL, maxDimension: CGFloat = 448, outputDirectory: URL? = nil) throws -> URL {
+    static func processImage(at url: URL, maxDimension: CGFloat = defaultMaxDimension, outputDirectory: URL? = nil) throws -> URL {
         try validateImageSource(at: url)
 
         let data = try Data(contentsOf: url)
@@ -47,34 +65,33 @@ enum ImageUtils {
     }
 
     #if os(iOS)
-    static func processImage(_ image: UIImage, maxDimension: CGFloat = 448, outputDirectory: URL? = nil) throws -> URL {
+    static func processImage(_ image: UIImage, maxDimension: CGFloat = defaultMaxDimension, outputDirectory: URL? = nil) throws -> URL {
         return try autoreleasepool {
-            // Scale the image first
-            let scaled = scaledImage(image, maxDimension: maxDimension)
-
-            // Get CGImage from UIImage - this is the key to stripping metadata
-            guard let cgImage = scaled.cgImage else {
-                throw ImageUtilsError.encodingFailed
-            }
-
-            // Use CGImageDestination to encode without metadata (same as macOS)
-            var quality = compressionQuality
-            guard var jpegData = encodeJPEG(from: cgImage, quality: quality) else {
-                throw ImageUtilsError.encodingFailed
-            }
-
-            // Compress to target size
-            while jpegData.count > targetImageBytes && quality > 0.3 {
-                quality -= 0.1
-                autoreleasepool {
-                    if let next = encodeJPEG(from: cgImage, quality: quality) {
-                        jpegData = next
-                    }
+            var dimension = maxDimension
+            var jpegData: Data?
+            // Downscale-and-compress until the payload fits the hard image cap.
+            // A normal photo converges on the first pass; this loop only kicks
+            // in for near-incompressible inputs (e.g. full-frame noise) that
+            // would otherwise overrun `maxImageBytes` at the raised dimension.
+            while true {
+                let scaled = scaledImage(image, maxDimension: dimension)
+                // Get CGImage from UIImage - this is the key to stripping metadata
+                guard let cgImage = scaled.cgImage else {
+                    throw ImageUtilsError.encodingFailed
                 }
+                guard let data = compressToBudget(cgImage) else {
+                    throw ImageUtilsError.encodingFailed
+                }
+                jpegData = data
+                if data.count <= FileTransferLimits.maxImageBytes || dimension <= minRetryDimension {
+                    break
+                }
+                dimension = (dimension * dimensionRetryFactor).rounded(.down)
             }
+            guard let finalData = jpegData else { throw ImageUtilsError.encodingFailed }
 
             let outputURL = try makeOutputURL(outputDirectory: outputDirectory)
-            try jpegData.write(to: outputURL, options: .atomic)
+            try finalData.write(to: outputURL, options: .atomic)
             return outputURL
         }
     }
@@ -93,66 +110,49 @@ enum ImageUtils {
         UIGraphicsEndImageContext()
         return rendered ?? image
     }
-
-    // Shared EXIF-stripping JPEG encoder for both iOS and macOS
-    private static func encodeJPEG(from cgImage: CGImage, quality: CGFloat) -> Data? {
-        guard let data = CFDataCreateMutable(nil, 0) else {
-            return nil
-        }
-        guard let destination = CGImageDestinationCreateWithData(data, UTType.jpeg.identifier as CFString, 1, nil) else {
-            return nil
-        }
-        // Security: Strip ALL metadata (EXIF, GPS, TIFF, IPTC, XMP)
-        // By only specifying compression quality and no metadata keys,
-        // we ensure a clean JPEG with no privacy-leaking information
-        let options: [CFString: Any] = [
-            kCGImageDestinationLossyCompressionQuality: quality
-        ]
-        CGImageDestinationAddImage(destination, cgImage, options as CFDictionary)
-        guard CGImageDestinationFinalize(destination) else {
-            return nil
-        }
-        return data as Data
-    }
     #else
-    static func processImage(_ image: NSImage, maxDimension: CGFloat = 448, outputDirectory: URL? = nil) throws -> URL {
+    static func processImage(_ image: NSImage, maxDimension: CGFloat = defaultMaxDimension, outputDirectory: URL? = nil) throws -> URL {
         return try autoreleasepool {
-            let scaled = scaledImage(image, maxDimension: maxDimension)
-            guard let inputCG = scaled.cgImage(forProposedRect: nil, context: nil, hints: nil) else {
-                throw ImageUtilsError.encodingFailed
-            }
-            let width = inputCG.width
-            let height = inputCG.height
-            let colorSpace = CGColorSpace(name: CGColorSpace.sRGB) ?? CGColorSpaceCreateDeviceRGB()
-            guard let context = CGContext(
-                data: nil,
-                width: width,
-                height: height,
-                bitsPerComponent: 8,
-                bytesPerRow: 0,
-                space: colorSpace,
-                bitmapInfo: CGImageAlphaInfo.premultipliedLast.rawValue
-            ) else {
-                throw ImageUtilsError.encodingFailed
-            }
-            context.draw(inputCG, in: CGRect(x: 0, y: 0, width: width, height: height))
-            guard let cgImage = context.makeImage() else {
-                throw ImageUtilsError.encodingFailed
-            }
-            var quality = compressionQuality
-            guard var jpegData = encodeJPEG(from: cgImage, quality: quality) else {
-                throw ImageUtilsError.encodingFailed
-            }
-            while jpegData.count > targetImageBytes && quality > 0.3 {
-                quality -= 0.1
-                autoreleasepool {
-                    if let next = encodeJPEG(from: cgImage, quality: quality) {
-                        jpegData = next
-                    }
+            var dimension = maxDimension
+            var jpegData: Data?
+            // See the iOS path: normal photos converge immediately; the loop
+            // only shrinks further for near-incompressible inputs so the
+            // output never overruns `maxImageBytes`.
+            while true {
+                let scaled = scaledImage(image, maxDimension: dimension)
+                guard let inputCG = scaled.cgImage(forProposedRect: nil, context: nil, hints: nil) else {
+                    throw ImageUtilsError.encodingFailed
                 }
+                let width = inputCG.width
+                let height = inputCG.height
+                let colorSpace = CGColorSpace(name: CGColorSpace.sRGB) ?? CGColorSpaceCreateDeviceRGB()
+                guard let context = CGContext(
+                    data: nil,
+                    width: width,
+                    height: height,
+                    bitsPerComponent: 8,
+                    bytesPerRow: 0,
+                    space: colorSpace,
+                    bitmapInfo: CGImageAlphaInfo.premultipliedLast.rawValue
+                ) else {
+                    throw ImageUtilsError.encodingFailed
+                }
+                context.draw(inputCG, in: CGRect(x: 0, y: 0, width: width, height: height))
+                guard let cgImage = context.makeImage() else {
+                    throw ImageUtilsError.encodingFailed
+                }
+                guard let data = compressToBudget(cgImage) else {
+                    throw ImageUtilsError.encodingFailed
+                }
+                jpegData = data
+                if data.count <= FileTransferLimits.maxImageBytes || dimension <= minRetryDimension {
+                    break
+                }
+                dimension = (dimension * dimensionRetryFactor).rounded(.down)
             }
+            guard let finalData = jpegData else { throw ImageUtilsError.encodingFailed }
             let outputURL = try makeOutputURL(outputDirectory: outputDirectory)
-            try jpegData.write(to: outputURL, options: .atomic)
+            try finalData.write(to: outputURL, options: .atomic)
             return outputURL
         }
     }
@@ -172,6 +172,31 @@ enum ImageUtils {
         scaledImage.unlockFocus()
         return scaledImage
     }
+    #endif
+
+    // When even the quality floor can't get an image under the byte budget,
+    // shrink the longest side by this factor and re-encode. Bounded below so
+    // the retry loop always terminates.
+    private static let dimensionRetryFactor: CGFloat = 0.75
+    private static let minRetryDimension: CGFloat = 256
+
+    /// Encodes `cgImage` to JPEG, stepping quality down toward
+    /// `targetImageBytes`. Shared by both platforms.
+    private static func compressToBudget(_ cgImage: CGImage) -> Data? {
+        var quality = compressionQuality
+        guard var jpegData = encodeJPEG(from: cgImage, quality: quality) else {
+            return nil
+        }
+        while jpegData.count > targetImageBytes && quality > 0.3 {
+            quality -= 0.1
+            autoreleasepool {
+                if let next = encodeJPEG(from: cgImage, quality: quality) {
+                    jpegData = next
+                }
+            }
+        }
+        return jpegData
+    }
 
     // Shared EXIF-stripping JPEG encoder for both iOS and macOS
     private static func encodeJPEG(from cgImage: CGImage, quality: CGFloat) -> Data? {
@@ -193,7 +218,6 @@ enum ImageUtils {
         }
         return data as Data
     }
-    #endif
 
     private static func makeOutputURL(outputDirectory: URL? = nil) throws -> URL {
         let formatter = DateFormatter()

bitchat/Identity/IdentityModels.swift

@@ -127,10 +127,10 @@ struct SocialIdentity: Codable {
 }
 
 enum TrustLevel: String, Codable {
-    case unknown = "unknown"
-    case casual = "casual"
-    case trusted = "trusted"
-    case verified = "verified"
+    case unknown
+    case casual
+    case trusted
+    case verified
 }
 
 // MARK: - Identity Cache

bitchat/Identity/SecureIdentityStateManager.swift

@@ -151,38 +151,68 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     // Thread safety
     private let queue = DispatchQueue(label: "bitchat.identity.state", attributes: .concurrent)
     
-    // Debouncing for keychain saves
-    private var saveTimer: Timer?
-    private let saveDebounceInterval: TimeInterval = 2.0  // Save at most once every 2 seconds
+    // Pending-save coalescing flag. Reads/writes are serialized on `queue`.
+    // Persistence is done with a fire-and-forget `queue.async(.barrier)` rather
+    // than a retained DispatchSourceTimer: a lingering, never-cancelled timer
+    // keeps the dispatch machinery alive and prevents the unit-test process from
+    // exiting. (The original code used Timer.scheduledTimer on a GCD queue with
+    // no run loop, so saves never actually fired.)
     private var pendingSave = false
-    
+
     // Encryption key
     private let encryptionKey: SymmetricKey
+    /// True when `encryptionKey` is a throwaway generated this session because the
+    /// persisted key could not be read (device locked / access denied). In that
+    /// state we must NOT persist (it would overwrite the real cache with data the
+    /// next launch can't decrypt) and must NOT delete the existing cache.
+    private let encryptionKeyIsEphemeral: Bool
     
     init(_ keychain: KeychainManagerProtocol) {
         self.keychain = keychain
-        
-        // Generate or retrieve encryption key from keychain
+
+        // Retrieve (or, only on genuine first run, generate) the cache
+        // encryption key. We MUST distinguish "key doesn't exist yet" from a
+        // transient failure (device locked / access denied): the legacy
+        // getIdentityKey(forKey:) collapses both to nil, and generating+saving a
+        // new key deletes the existing one first — permanently orphaning the
+        // encrypted cache on a launch that merely couldn't read the key.
         let loadedKey: SymmetricKey
-        
-        // Try to load from keychain
-        if let keyData = keychain.getIdentityKey(forKey: encryptionKeyName) {
+        let keyIsEphemeral: Bool
+
+        switch keychain.getIdentityKeyWithResult(forKey: encryptionKeyName) {
+        case .success(let keyData):
             loadedKey = SymmetricKey(data: keyData)
+            keyIsEphemeral = false
             SecureLogger.logKeyOperation(.load, keyType: "identity cache encryption key", success: true)
-        }
-        // Generate new key if needed
-        else {
-            loadedKey = SymmetricKey(size: .bits256)
-            let keyData = loadedKey.withUnsafeBytes { Data($0) }
-            // Save to keychain
+
+        case .itemNotFound:
+            // Genuine first run: generate and persist a new key.
+            let newKey = SymmetricKey(size: .bits256)
+            let keyData = newKey.withUnsafeBytes { Data($0) }
             let saved = keychain.saveIdentityKey(keyData, forKey: encryptionKeyName)
+            loadedKey = newKey
+            // If even the save failed, treat the key as ephemeral so we don't
+            // later try to persist a cache the next launch can't read.
+            keyIsEphemeral = !saved
             SecureLogger.logKeyOperation(.generate, keyType: "identity cache encryption key", success: saved)
+
+        case .deviceLocked, .authenticationFailed, .accessDenied, .otherError:
+            // Transient/critical read failure. Do NOT overwrite the persisted
+            // key. Use a session-only ephemeral key; the real key and cache are
+            // left intact for a healthy launch.
+            SecureLogger.warning("Identity cache key unavailable; using ephemeral key for this session (not persisting)", category: .security)
+            loadedKey = SymmetricKey(size: .bits256)
+            keyIsEphemeral = true
         }
-        
+
         self.encryptionKey = loadedKey
-        
-        // Load identity cache on init
-        loadIdentityCache()
+        self.encryptionKeyIsEphemeral = keyIsEphemeral
+
+        // Only read the persisted cache when we hold the real key; with an
+        // ephemeral key the decrypt would fail and discard the real cache.
+        if !keyIsEphemeral {
+            loadIdentityCache()
+        }
     }
     
     deinit {
@@ -211,23 +241,28 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
         }
     }
     
+    /// Persists the cache. Always invoked on `queue` under a barrier (its callers
+    /// run inside `queue.async(.barrier)`), so it simply marks the cache dirty
+    /// and persists it on the same serialized context — no timer, nothing left
+    /// scheduled to keep the process alive.
     private func saveIdentityCache() {
-        // Mark that we need to save
         pendingSave = true
-        
-        // Cancel any existing timer
-        saveTimer?.invalidate()
-        
-        // Schedule a new save after the debounce interval
-        saveTimer = Timer.scheduledTimer(withTimeInterval: saveDebounceInterval, repeats: false) { [weak self] _ in
-            self?.performSave()
-        }
+        performSave()
     }
-    
+
+    /// Writes the cache to the keychain. Must run on `queue` with exclusive
+    /// (barrier) access.
     private func performSave() {
         guard pendingSave else { return }
         pendingSave = false
-        
+
+        // Never persist under an ephemeral key — it would overwrite the real
+        // cache with data the next launch cannot decrypt.
+        guard !encryptionKeyIsEphemeral else {
+            SecureLogger.debug("Skipping identity cache save (ephemeral key this session)", category: .security)
+            return
+        }
+
         do {
             let data = try JSONEncoder().encode(cache)
             let sealedBox = try AES.GCM.seal(data, using: encryptionKey)
@@ -239,10 +274,14 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
             SecureLogger.error(error, context: "Failed to save identity cache", category: .security)
         }
     }
-    
-    // Force immediate save (for app termination)
+
+    // Force immediate save (for app termination / lifecycle events). Mutations
+    // already persist synchronously via saveIdentityCache, so this is normally a
+    // no-op (performSave early-returns when nothing is pending). Runs directly on
+    // the caller's thread — deliberately NOT a `queue.sync(barrier)`, which is
+    // reachable from `deinit` and from async tests on the swift-concurrency
+    // cooperative pool where a blocking barrier-sync can starve/deadlock it.
     func forceSave() {
-        saveTimer?.invalidate()
         performSave()
     }
     

bitchat/Info.plist

@@ -33,12 +33,18 @@
 	<string>$(CURRENT_PROJECT_VERSION)</string>
 	<key>LSMinimumSystemVersion</key>
 	<string>$(MACOSX_DEPLOYMENT_TARGET)</string>
+	<key>NSBonjourServices</key>
+	<array>
+		<string>_bitchat-bulk._tcp</string>
+	</array>
 	<key>NSBluetoothAlwaysUsageDescription</key>
 	<string>bitchat uses Bluetooth to create a secure mesh network for chatting with nearby users.</string>
 	<key>NSBluetoothPeripheralUsageDescription</key>
 	<string>bitchat uses Bluetooth to discover and connect with other bitchat users nearby.</string>
 	<key>NSCameraUsageDescription</key>
 	<string>bitchat uses the camera to scan QR codes to verify peers.</string>
+	<key>NSLocalNetworkUsageDescription</key>
+	<string>bitchat uses peer-to-peer Wi-Fi to transfer large photos and voice notes directly between nearby devices.</string>
 	<key>NSLocationWhenInUseUsageDescription</key>
 	<string>bitchat uses your approximate location to compute local geohash channels for optional public chats. Exact GPS is never shared.</string>
 	<key>NSMicrophoneUsageDescription</key>

bitchat/Models/CommandInfo.swift

@@ -11,33 +11,38 @@ import Foundation
 // MARK: - CommandInfo Enum
 
 enum CommandInfo: String, Identifiable {
+    // Raw values must match the aliases CommandProcessor actually accepts —
+    // the suggestion panel is the app's only command-discovery surface, and
+    // suggesting a spelling the processor rejects teaches users dead ends.
     case block
     case clear
+    case help
     case hug
-    case message = "dm"
+    case message = "msg"
     case slap
     case unblock
     case who
-    case favorite
-    case unfavorite
-    
+    case favorite = "fav"
+    case unfavorite = "unfav"
+
     var id: String { rawValue }
-    
+
     var alias: String { "/" + rawValue }
-    
+
     var placeholder: String? {
         switch self {
         case .block, .hug, .message, .slap, .unblock, .favorite, .unfavorite:
             return "<" + String(localized: "content.input.nickname_placeholder") + ">"
-        case .clear, .who:
+        case .clear, .help, .who:
             return nil
         }
     }
-    
+
     var description: String {
         switch self {
         case .block:        String(localized: "content.commands.block")
         case .clear:        String(localized: "content.commands.clear")
+        case .help:         String(localized: "content.commands.help")
         case .hug:          String(localized: "content.commands.hug")
         case .message:      String(localized: "content.commands.message")
         case .slap:         String(localized: "content.commands.slap")
@@ -47,12 +52,14 @@ enum CommandInfo: String, Identifiable {
         case .unfavorite:   String(localized: "content.commands.unfavorite")
         }
     }
-    
+
     static func all(isGeoPublic: Bool, isGeoDM: Bool) -> [CommandInfo] {
-        let baseCommands: [CommandInfo] = [.block, .unblock, .clear, .hug, .message, .slap, .who]
+        let baseCommands: [CommandInfo] = [.block, .unblock, .clear, .help, .hug, .message, .slap, .who]
+        // The processor rejects favorites in geohash contexts, so only
+        // suggest them where they actually work: mesh.
         if isGeoPublic || isGeoDM {
-            return baseCommands + [.favorite, .unfavorite]
+            return baseCommands
         }
-        return baseCommands
+        return baseCommands + [.favorite, .unfavorite]
     }
 }

bitchat/Models/RequestSyncPacket.swift

@@ -96,7 +96,7 @@ struct RequestSyncPacket {
             }
         }
 
-        guard let pp = p, let mm = m, let dd = payload, pp >= 1, mm > 0 else { return nil }
+        guard let pp = p, let mm = m, let dd = payload, pp >= 1, pp <= GCSFilter.maxP, mm > 0 else { return nil }
         return RequestSyncPacket(p: pp, m: mm, data: dd, types: types, sinceTimestamp: sinceTimestamp, fragmentIdFilter: fragmentIdFilter)
     }
 }

bitchat/Noise/NoiseProtocol.swift

@@ -93,6 +93,7 @@ enum NoisePattern {
     case XX  // Most versatile, mutual authentication
     case IK  // Initiator knows responder's static key
     case NK  // Anonymous initiator
+    case X   // One-way: single message to a known static key (no response)
 }
 
 enum NoiseRole {
@@ -322,6 +323,13 @@ final class NoiseCipherState {
                 throw NoiseError.replayDetected
             }
             
+            // The 4-byte nonce prefix has been stripped, so the remaining bytes
+            // must still hold at least the 16-byte Poly1305 tag. The up-front
+            // `ciphertext.count >= 16` guard is not sufficient here (it counts
+            // the nonce), and `prefix(count - 16)` would trap on a short payload.
+            guard actualCiphertext.count >= 16 else {
+                throw NoiseError.invalidCiphertext
+            }
             // Split ciphertext and tag
             encryptedData = actualCiphertext.prefix(actualCiphertext.count - 16)
             tag = actualCiphertext.suffix(16)
@@ -594,7 +602,7 @@ final class NoiseHandshakeState {
         switch pattern {
         case .XX:
             break // No pre-message keys
-        case .IK, .NK:
+        case .IK, .NK, .X:
             if role == .initiator, let remoteStatic = remoteStaticPublic {
                 symmetricState.mixHash(remoteStatic.rawRepresentation)
             } else if role == .responder, let localStatic = localStaticPublic {
@@ -897,6 +905,7 @@ extension NoisePattern {
         case .XX: return "XX"
         case .IK: return "IK"
         case .NK: return "NK"
+        case .X: return "X"
         }
     }
     
@@ -918,6 +927,10 @@ extension NoisePattern {
                 [.e, .es],      // -> e, es
                 [.e, .ee]       // <- e, ee
             ]
+        case .X:
+            return [
+                [.e, .es, .s, .ss] // -> e, es, s, ss (single one-way message)
+            ]
         }
     }
 }

bitchat/Nostr/GeoRelayDirectory.swift

@@ -7,6 +7,11 @@ import UIKit
 import AppKit
 #endif
 
+extension Notification.Name {
+    /// Posted after the geo relay directory successfully refreshes its entries.
+    static let geoRelayDirectoryDidRefresh = Notification.Name("bitchat.geoRelayDirectoryDidRefresh")
+}
+
 /// Directory of online Nostr relays with approximate GPS locations, used for geohash routing.
 struct GeoRelayDirectoryDependencies {
     var userDefaults: UserDefaults
@@ -165,33 +170,16 @@ final class GeoRelayDirectory {
     }
 
     /// Returns up to `count` relay URLs (wss://) closest to the given coordinate.
+    /// Ties break by host so every device with the same directory picks the
+    /// same relay set — publishers and subscribers must agree on relays.
     func closestRelays(toLat lat: Double, lon: Double, count: Int = 5) -> [String] {
         guard !entries.isEmpty, count > 0 else { return [] }
 
-        if entries.count <= count {
-            return entries
-                .sorted { a, b in
-                    haversineKm(lat, lon, a.lat, a.lon) < haversineKm(lat, lon, b.lat, b.lon)
-                }
-                .map { "wss://\($0.host)" }
-        }
-
-        var best: [(entry: Entry, distance: Double)] = []
-        best.reserveCapacity(count)
-
-        for entry in entries {
-            let distance = haversineKm(lat, lon, entry.lat, entry.lon)
-            if best.count < count {
-                let idx = best.firstIndex { $0.distance > distance } ?? best.count
-                best.insert((entry, distance), at: idx)
-            } else if let worstDistance = best.last?.distance, distance < worstDistance {
-                let idx = best.firstIndex { $0.distance > distance } ?? best.count
-                best.insert((entry, distance), at: idx)
-                best.removeLast()
-            }
-        }
-
-        return best.map { "wss://\($0.entry.host)" }
+        return entries
+            .map { (entry: $0, distance: haversineKm(lat, lon, $0.lat, $0.lon)) }
+            .sorted { ($0.distance, $0.entry.host) < ($1.distance, $1.entry.host) }
+            .prefix(count)
+            .map { "wss://\($0.entry.host)" }
     }
 
     // MARK: - Remote Fetch
@@ -289,6 +277,8 @@ final class GeoRelayDirectory {
         isFetching = false
         retryAttempt = 0
         cancelRetry()
+        // Let waiters (e.g. location notes stuck in a "no relays" state) retry.
+        dependencies.notificationCenter.post(name: .geoRelayDirectoryDidRefresh, object: nil)
     }
 
     @MainActor

bitchat/Nostr/NostrIdentityBridge.swift

@@ -82,6 +82,13 @@ final class NostrIdentityBridge {
         }
 
         deviceSeedCache = nil
+        // Also drop the in-memory derived per-geohash identities. These hold the
+        // actual secp256k1 private keys; if left cached, post-panic geohash
+        // messages would still be signed with pre-panic keys (linkable across the
+        // wipe) until the app is force-quit.
+        cacheLock.lock()
+        derivedIdentityCache.removeAll()
+        cacheLock.unlock()
     }
 
     // MARK: - Per-Geohash Identities (Location Channels)

bitchat/Nostr/NostrProtocol.swift

@@ -39,22 +39,23 @@ struct NostrProtocol {
             content: content
         )
         
-        // 2. Create ephemeral key for this message
-        let ephemeralKey = try P256K.Schnorr.PrivateKey()
-        // Created ephemeral key for seal
-        
-        // 3. Seal the rumor (encrypt to recipient)
+        // 2. Seal the rumor (encrypt to recipient) and sign it with the SENDER'S
+        //    real identity key. NIP-17 requires the seal be signed by the sender
+        //    so the recipient can authenticate who sent the message; signing with
+        //    a throwaway key leaves DMs forgeable/impersonatable.
+        let senderKey = try senderIdentity.schnorrSigningKey()
         let sealedEvent = try createSeal(
             rumor: rumor,
             recipientPubkey: recipientPubkey,
-            senderKey: ephemeralKey
+            senderKey: senderKey
         )
-        
-        // 4. Gift wrap the sealed event (encrypt to recipient again)
+
+        // 3. Gift wrap the sealed event with a throwaway ephemeral key (the wrap
+        //    layer hides the sender's identity from relays; createGiftWrap mints
+        //    its own ephemeral key internally).
         let giftWrap = try createGiftWrap(
             seal: sealedEvent,
-            recipientPubkey: recipientPubkey,
-            senderKey: ephemeralKey
+            recipientPubkey: recipientPubkey
         )
         
         // Created gift wrap
@@ -84,7 +85,15 @@ struct NostrProtocol {
             throw error
         }
         
-        // 2. Open the seal
+        // 2. Authenticate the seal. The seal MUST be signed by the sender's real
+        //    identity key (NIP-17); without this check a DM is forgeable by anyone
+        //    who knows the recipient's npub. Verify the seal's own signature.
+        guard seal.isValidSignature() else {
+            SecureLogger.error("❌ Rejecting DM: seal signature is missing or invalid", category: .session)
+            throw NostrError.invalidEvent
+        }
+
+        // 3. Open the seal
         let rumor: NostrEvent
         do {
             rumor = try openSeal(
@@ -96,10 +105,63 @@ struct NostrProtocol {
             SecureLogger.error("❌ Failed to open seal: \(error)", category: .session)
             throw error
         }
-        
-        return (content: rumor.content, senderPubkey: rumor.pubkey, timestamp: rumor.created_at)
+
+        // 4. The sender claimed inside the rumor must match the key that actually
+        //    signed the seal, otherwise the sender field is unauthenticated and
+        //    spoofable.
+        guard seal.pubkey == rumor.pubkey else {
+            SecureLogger.error("❌ Rejecting DM: rumor pubkey does not match seal signer", category: .session)
+            throw NostrError.invalidEvent
+        }
+
+        // Return the seal signer's pubkey as the authenticated sender.
+        return (content: rumor.content, senderPubkey: seal.pubkey, timestamp: rumor.created_at)
     }
 
+    #if DEBUG
+    static func createPrivateMessageWithInvalidSealSignatureForTesting(
+        content: String,
+        recipientPubkey: String,
+        senderIdentity: NostrIdentity
+    ) throws -> NostrEvent {
+        let rumor = NostrEvent(
+            pubkey: senderIdentity.publicKeyHex,
+            createdAt: Date(),
+            kind: .dm,
+            tags: [],
+            content: content
+        )
+        var seal = try createSeal(
+            rumor: rumor,
+            recipientPubkey: recipientPubkey,
+            senderKey: senderIdentity.schnorrSigningKey()
+        )
+        seal.sig = String(repeating: "0", count: 128)
+        return try createGiftWrap(seal: seal, recipientPubkey: recipientPubkey)
+    }
+
+    static func createPrivateMessageWithMismatchedSealRumorPubkeyForTesting(
+        content: String,
+        recipientPubkey: String,
+        rumorIdentity: NostrIdentity,
+        sealSignerIdentity: NostrIdentity
+    ) throws -> NostrEvent {
+        let rumor = NostrEvent(
+            pubkey: rumorIdentity.publicKeyHex,
+            createdAt: Date(),
+            kind: .dm,
+            tags: [],
+            content: content
+        )
+        let seal = try createSeal(
+            rumor: rumor,
+            recipientPubkey: recipientPubkey,
+            senderKey: sealSignerIdentity.schnorrSigningKey()
+        )
+        return try createGiftWrap(seal: seal, recipientPubkey: recipientPubkey)
+    }
+    #endif
+
     /// Create a geohash-scoped ephemeral public message (kind 20000)
     static func createEphemeralGeohashEvent(
         content: String,
@@ -195,10 +257,9 @@ struct NostrProtocol {
     
     private static func createGiftWrap(
         seal: NostrEvent,
-        recipientPubkey: String,
-        senderKey: P256K.Schnorr.PrivateKey  // This is the ephemeral key used for the seal
+        recipientPubkey: String
     ) throws -> NostrEvent {
-        
+
         let sealJSON = try seal.jsonString()
         
         // Create new ephemeral key for gift wrap
@@ -587,7 +648,7 @@ private extension NostrProtocol {
         let derivedKey = HKDF<CryptoKit.SHA256>.deriveKey(
             inputKeyMaterial: SymmetricKey(data: sharedSecretData),
             salt: Data(),
-            info: "nip44-v2".data(using: .utf8)!,
+            info: Data("nip44-v2".utf8),
             outputByteCount: 32
         )
         return derivedKey.withUnsafeBytes { Data($0) }

bitchat/Nostr/NostrRelayManager.swift

@@ -66,6 +66,9 @@ struct NostrRelayManagerDependencies {
     var makeSession: () -> NostrRelaySessionProtocol
     var scheduleAfter: @Sendable (TimeInterval, @escaping @Sendable () -> Void) -> Void
     var now: () -> Date
+    /// Uniform random value in [0, 1) used to jitter reconnect backoff.
+    /// Injectable so tests can pin or sweep the jitter deterministically.
+    var jitterUnit: () -> Double
 }
 
 private extension NostrRelayManagerDependencies {
@@ -93,7 +96,8 @@ private extension NostrRelayManagerDependencies {
             scheduleAfter: { delay, action in
                 DispatchQueue.main.asyncAfter(deadline: .now() + delay, execute: action)
             },
-            now: Date.init
+            now: Date.init,
+            jitterUnit: { Double.random(in: 0..<1) }
         )
     }
 }
@@ -133,6 +137,10 @@ final class NostrRelayManager: ObservableObject {
     
     @Published private(set) var relays: [Relay] = []
     @Published private(set) var isConnected = false
+    /// Whether a relay that carries private messages is connected. DMs
+    /// target the default (gift-wrap-capable) relay set, so a connected
+    /// geohash/custom relay alone must not count — sends would still queue.
+    @Published private(set) var isDMRelayConnected = false
     
     private let dependencies: NostrRelayManagerDependencies
     private var allowDefaultRelays: Bool = false
@@ -140,13 +148,34 @@ final class NostrRelayManager: ObservableObject {
     private var hasLocationPermission: Bool = false
     private var connections: [String: NostrRelayConnectionProtocol] = [:]
     private var subscriptions: [String: Set<String>] = [:] // relay URL -> active subscription IDs
-    private var pendingSubscriptions: [String: [String: String]] = [:] // relay URL -> (subscription id -> encoded REQ JSON)
+    // Not-yet-flushed REQs per relay, bounded by a per-relay cap (oldest by
+    // insertion order evicted) and an age sweep on connect attempts. Dicts are
+    // unordered, so each entry carries an insertion sequence and queue time.
+    private struct PendingSubscription {
+        let messageString: String // encoded REQ JSON
+        let queuedAt: Date
+        let sequence: UInt64
+    }
+    private var pendingSubscriptions: [String: [String: PendingSubscription]] = [:] // relay URL -> (subscription id -> pending REQ)
+    private var pendingSubscriptionSequence: UInt64 = 0
     private var messageHandlers: [String: (NostrEvent) -> Void] = [:]
+    private struct InboundEventKey: Hashable {
+        let subscriptionID: String
+        let eventID: String
+    }
+    private let recentInboundEventKeyLimit = TransportConfig.nostrInboundEventDedupCap
+    private let recentInboundEventKeyTrimTarget = TransportConfig.nostrInboundEventDedupTrimTarget
+    private var recentInboundEventKeys = Set<InboundEventKey>()
+    private var recentInboundEventKeyOrder: [InboundEventKey] = []
+    private var duplicateInboundEventDropCount = 0
+    private var duplicateInboundEventDropCountBySubscription: [String: Int] = [:]
+    private var inboundEventLogCount = 0
     // Coalesce duplicate subscribe requests for the same id within a short window.
     private let subscribeCoalesceInterval: TimeInterval = 1.0
     private var subscribeCoalesce: [String: Date] = [:]
     private var pendingTorConnectionURLs = Set<String>()
     private var awaitingTorForConnections = false
+    private var torReadyWaitAttempts = 0
     private var cancellables = Set<AnyCancellable>()
 
     private struct SubscriptionRequestState: Equatable {
@@ -159,9 +188,10 @@ final class NostrRelayManager: ObservableObject {
     private struct EOSETracker {
         var pendingRelays: Set<String>
         var callback: () -> Void
-        var timer: Timer?
+        let epoch: Int
     }
     private var eoseTrackers: [String: EOSETracker] = [:]
+    private var eoseTrackerEpoch = 0
     private var pendingEOSECallbacks: [String: () -> Void] = [:]
     
     // Message queue for reliability
@@ -172,6 +202,9 @@ final class NostrRelayManager: ObservableObject {
     }
     private var messageQueue: [PendingSend] = []
     private let messageQueueLock = NSLock()
+    // Total pending sends dropped at the queue cap; drives the sampled
+    // overflow warning (first + every Nth drop).
+    private var pendingSendDropCount = 0
     private let encoder = JSONEncoder()
     private var shouldUseTor: Bool { dependencies.userTorEnabled() }
     
@@ -252,19 +285,78 @@ final class NostrRelayManager: ObservableObject {
             task.cancel(with: .goingAway, reason: nil)
         }
         connections.removeAll()
-        // Clear known subscriptions and any queued subs since connections are gone
+        markRelaySocketsClosed(resetState: false)
+        // Sockets are gone, so per-relay subscription state is cleared — but
+        // durable intent (subscriptionRequestState, messageHandlers, parked
+        // EOSE callbacks) is kept so REQs replay when relays reconnect
+        // (e.g. background → foreground).
         subscriptions.removeAll()
         pendingSubscriptions.removeAll()
-        subscriptionRequestState.removeAll()
-        pendingEOSECallbacks.removeAll()
-        for (_, tracker) in eoseTrackers {
-            tracker.timer?.invalidate()
-        }
+        // Settle in-flight initial loads instead of leaving callers hanging.
+        let trackers = eoseTrackers
         eoseTrackers.removeAll()
+        for (_, tracker) in trackers {
+            tracker.callback()
+        }
         pendingTorConnectionURLs.removeAll()
         awaitingTorForConnections = false
+        torReadyWaitAttempts = 0
         updateConnectionStatus()
     }
+
+    /// Panic wipe reset: close sockets and drop every user/session-specific
+    /// relay intent without invoking old callbacks. Unlike `disconnect()`, this
+    /// must not preserve subscription replay state because geohash DM handlers
+    /// can capture pre-wipe Nostr private keys.
+    func resetForPanicWipe() {
+        connectionGeneration &+= 1
+        for (_, task) in connections {
+            task.cancel(with: .goingAway, reason: nil)
+        }
+        connections.removeAll()
+        markRelaySocketsClosed(resetState: true)
+        subscriptions.removeAll()
+        pendingSubscriptions.removeAll()
+        messageHandlers.removeAll()
+        subscriptionRequestState.removeAll()
+        subscribeCoalesce.removeAll()
+        eoseTrackers.removeAll()
+        pendingEOSECallbacks.removeAll()
+        pendingTorConnectionURLs.removeAll()
+        awaitingTorForConnections = false
+        torReadyWaitAttempts = 0
+        recentInboundEventKeys.removeAll()
+        recentInboundEventKeyOrder.removeAll()
+        duplicateInboundEventDropCount = 0
+        duplicateInboundEventDropCountBySubscription.removeAll()
+        inboundEventLogCount = 0
+        Self.pendingGiftWrapIDs.removeAll()
+
+        messageQueueLock.lock()
+        messageQueue.removeAll()
+        pendingSendDropCount = 0
+        messageQueueLock.unlock()
+
+        updateConnectionStatus()
+    }
+
+    private func markRelaySocketsClosed(resetState: Bool) {
+        let now = dependencies.now()
+        for index in relays.indices {
+            relays[index].isConnected = false
+            relays[index].nextReconnectTime = nil
+            if resetState {
+                relays[index].lastError = nil
+                relays[index].lastConnectedAt = nil
+                relays[index].lastDisconnectedAt = nil
+                relays[index].messagesSent = 0
+                relays[index].messagesReceived = 0
+                relays[index].reconnectAttempts = 0
+            } else {
+                relays[index].lastDisconnectedAt = now
+            }
+        }
+    }
     
     /// Ensure connections exist to the given relay URLs (idempotent).
     func ensureConnections(to relayUrls: [String]) {
@@ -285,11 +377,14 @@ final class NostrRelayManager: ObservableObject {
         // Global network policy gate
         guard dependencies.activationAllowed() else { return }
         if shouldUseTor && dependencies.torEnforced() && !dependencies.torIsReady() {
-            // Defer sends until Tor is ready to avoid premature queueing
-            dependencies.awaitTorReady { [weak self] ready in
-                guard let self = self else { return }
-                if ready { self.sendEvent(event, to: relayUrls) }
-            }
+            // Fail-closed: nothing touches the network until Tor is up. Queue the
+            // event locally so it survives a slow bootstrap (queued sends flush
+            // when relays connect), then kick off connection setup, which itself
+            // waits for Tor readiness.
+            let targetRelays = allowedRelayList(from: relayUrls ?? Self.defaultRelays)
+            guard !targetRelays.isEmpty else { return }
+            enqueuePendingSend(event, pendingRelays: Set(targetRelays))
+            ensureConnections(to: targetRelays)
             return
         }
         let requestedRelays = relayUrls ?? Self.defaultRelays
@@ -307,9 +402,29 @@ final class NostrRelayManager: ObservableObject {
             }
         }
         if !stillPending.isEmpty {
-            messageQueueLock.lock()
-            messageQueue.append(PendingSend(event: event, pendingRelays: stillPending))
-            messageQueueLock.unlock()
+            enqueuePendingSend(event, pendingRelays: stillPending)
+        }
+    }
+
+    private func enqueuePendingSend(_ event: NostrEvent, pendingRelays: Set<String>) {
+        messageQueueLock.lock()
+        messageQueue.append(PendingSend(event: event, pendingRelays: pendingRelays))
+        let overflow = messageQueue.count - TransportConfig.nostrPendingSendQueueCap
+        if overflow > 0 {
+            messageQueue.removeFirst(overflow)
+        }
+        messageQueueLock.unlock()
+        guard overflow > 0 else { return }
+        // Dropped events are ephemeral (presence/geo), so no status surfacing
+        // is needed — but the drops should be visible. Sampled so a sustained
+        // relay stall can't flood the log.
+        pendingSendDropCount += overflow
+        if pendingSendDropCount == 1 ||
+            pendingSendDropCount.isMultiple(of: TransportConfig.nostrPendingSendDropLogInterval) {
+            SecureLogger.warning(
+                "📤 Relay send queue full — dropped \(pendingSendDropCount) oldest event(s)",
+                category: .session
+            )
         }
     }
 
@@ -404,16 +519,14 @@ final class NostrRelayManager: ObservableObject {
                 existingSet.insert(url)
             }
             for url in urls {
-                var map = self.pendingSubscriptions[url] ?? [:]
-                map[id] = messageString
-                self.pendingSubscriptions[url] = map
+                queuePendingSubscription(id: id, messageString: messageString, for: url)
             }
             // Initialize EOSE tracking if requested
             if let onEOSE = onEOSE {
                 if urls.isEmpty {
                     onEOSE()
                 } else if shouldWaitForTorBeforeConnecting {
-                    pendingEOSECallbacks[id] = onEOSE
+                    parkEOSECallbackUntilTorReady(id: id, callback: onEOSE)
                 } else {
                     startEOSETracking(id: id, relayURLs: Set(urls), callback: onEOSE)
                 }
@@ -486,11 +599,12 @@ final class NostrRelayManager: ObservableObject {
     /// Unsubscribe from a subscription
     func unsubscribe(id: String) {
         messageHandlers.removeValue(forKey: id)
+        removeRecentInboundEvents(forSubscriptionID: id)
+        duplicateInboundEventDropCountBySubscription.removeValue(forKey: id)
         // Allow immediate re-subscription by clearing coalescer timestamp
         subscribeCoalesce.removeValue(forKey: id)
         subscriptionRequestState.removeValue(forKey: id)
         pendingEOSECallbacks.removeValue(forKey: id)
-        eoseTrackers[id]?.timer?.invalidate()
         eoseTrackers.removeValue(forKey: id)
         for url in Array(pendingSubscriptions.keys) {
             pendingSubscriptions[url]?.removeValue(forKey: id)
@@ -521,6 +635,7 @@ final class NostrRelayManager: ObservableObject {
 
     private func connectToRelays(_ relayUrls: [String], shouldLog: Bool = false) {
         guard dependencies.activationAllowed() else { return }
+        sweepStalePendingSubscriptions()
         let targets = allowedRelayList(from: relayUrls).filter {
             connections[$0] == nil && !isPermanentlyFailed($0)
         }
@@ -561,37 +676,135 @@ final class NostrRelayManager: ObservableObject {
             self.awaitingTorForConnections = false
 
             guard ready else {
-                SecureLogger.error("❌ Tor not ready; aborting relay connections (fail-closed)", category: .session)
+                self.torReadyWaitAttempts += 1
+                if self.torReadyWaitAttempts < TransportConfig.nostrTorReadyMaxWaitAttempts {
+                    SecureLogger.warning("Tor not ready; re-queueing \(pending.count) relay connection(s) (attempt \(self.torReadyWaitAttempts))", category: .session)
+                    self.queueConnectionsUntilTorReady(pending)
+                } else {
+                    // Still fail-closed (no network), but unblock any callers
+                    // waiting on EOSE so the UI doesn't hang indefinitely.
+                    // Queued subscriptions/sends are kept and flush if a later
+                    // trigger (e.g. app foreground) brings Tor up.
+                    SecureLogger.error("❌ Tor not ready after \(self.torReadyWaitAttempts) wait(s); aborting relay connections (fail-closed)", category: .session)
+                    self.torReadyWaitAttempts = 0
+                    self.unblockPendingEOSECallbacks(reason: "tor-unavailable")
+                }
                 return
             }
 
+            self.torReadyWaitAttempts = 0
             self.connectToRelays(pending, shouldLog: true)
         }
     }
 
+    /// Park an EOSE callback while Tor is not yet ready, and schedule the same
+    /// fallback timeout `startEOSETracking` uses. Without it, a parked callback
+    /// would only be unblocked by Tor-readiness retry exhaustion (several
+    /// awaitReady timeouts, i.e. minutes), leaving callers hanging far past the
+    /// normal EOSE fallback. If Tor recovers first the callback is promoted to
+    /// a real EOSE tracker (`startPendingEOSETrackingIfNeeded`), and if retry
+    /// exhaustion fires first it is drained by `unblockPendingEOSECallbacks`;
+    /// either way it leaves `pendingEOSECallbacks` and this timer is a no-op.
+    private func parkEOSECallbackUntilTorReady(id: String, callback: @escaping () -> Void) {
+        pendingEOSECallbacks[id] = callback
+        let generation = connectionGeneration
+        dependencies.scheduleAfter(TransportConfig.nostrSubscriptionEOSEFallbackSeconds) { [weak self] in
+            Task { @MainActor [weak self] in
+                guard let self else { return }
+                // Stale timers from a previous connection generation are void.
+                guard generation == self.connectionGeneration else { return }
+                // Already fired (unsubscribe, retry-exhaustion unblock) or
+                // promoted to a real EOSE tracker: nothing to do.
+                guard let callback = self.pendingEOSECallbacks.removeValue(forKey: id) else { return }
+                SecureLogger.warning("Unblocking Tor-parked EOSE callback for \(id) after fallback timeout", category: .session)
+                callback()
+            }
+        }
+    }
+
+    /// Fire and clear all EOSE callbacks that are parked waiting for Tor.
+    /// Callers treat EOSE as "initial fetch finished"; firing with no data is
+    /// safe and prevents indefinite hangs when Tor cannot bootstrap.
+    private func unblockPendingEOSECallbacks(reason: String) {
+        guard !pendingEOSECallbacks.isEmpty else { return }
+        let callbacks = pendingEOSECallbacks
+        pendingEOSECallbacks.removeAll()
+        SecureLogger.warning("Unblocking \(callbacks.count) pending EOSE callback(s) without data (\(reason))", category: .session)
+        for (_, callback) in callbacks {
+            callback()
+        }
+    }
+
     private func subscriptionStateExists(id: String, requestState: SubscriptionRequestState) -> Bool {
         guard !requestState.relayURLs.isEmpty else { return true }
         return requestState.relayURLs.allSatisfy { url in
-            pendingSubscriptions[url]?[id] == requestState.messageString ||
+            pendingSubscriptions[url]?[id]?.messageString == requestState.messageString ||
                 subscriptions[url]?.contains(id) == true
         }
     }
 
+    private func queuePendingSubscription(id: String, messageString: String, for url: String) {
+        var map = pendingSubscriptions[url] ?? [:]
+        pendingSubscriptionSequence &+= 1
+        map[id] = PendingSubscription(
+            messageString: messageString,
+            queuedAt: dependencies.now(),
+            sequence: pendingSubscriptionSequence
+        )
+        // Bound per-relay pending REQs; evict oldest by insertion order. The
+        // durable intent stays in subscriptionRequestState, so an evicted REQ
+        // is still replayed if its subscription is active when the relay
+        // (re)connects.
+        var evictedCount = 0
+        while map.count > TransportConfig.nostrPendingSubscriptionsPerRelayCap,
+              let oldest = map.min(by: { $0.value.sequence < $1.value.sequence }) {
+            map.removeValue(forKey: oldest.key)
+            evictedCount += 1
+        }
+        if evictedCount > 0 {
+            // Bounds proof: the cap eviction actually removed entries.
+            SecureLogger.warning(
+                "📋 Evicted \(evictedCount) pending sub(s) over cap for \(url)",
+                category: .session
+            )
+        }
+        pendingSubscriptions[url] = map
+    }
+
+    /// Drop pending REQs older than the TTL. Runs on connect attempts (the
+    /// natural maintenance path: connect/ensureConnections/reconnects all
+    /// funnel through connectToRelays) so stale entries for relays that never
+    /// come up cannot accumulate without bound.
+    private func sweepStalePendingSubscriptions() {
+        let now = dependencies.now()
+        for (url, map) in pendingSubscriptions {
+            let fresh = map.filter {
+                now.timeIntervalSince($0.value.queuedAt) <= TransportConfig.nostrPendingSubscriptionTTLSeconds
+            }
+            guard fresh.count != map.count else { continue }
+            // Bounds proof: the age sweep actually removed entries. Warning
+            // (not debug) — stale pending REQs mean a relay never came up.
+            SecureLogger.warning(
+                "📋 Swept \(map.count - fresh.count) stale pending sub(s) for \(url)",
+                category: .session
+            )
+            pendingSubscriptions[url] = fresh.isEmpty ? nil : fresh
+        }
+    }
+
     private func startEOSETracking(id: String, relayURLs: Set<String>, callback: @escaping () -> Void) {
-        eoseTrackers[id]?.timer?.invalidate()
-        var tracker = EOSETracker(pendingRelays: relayURLs, callback: callback, timer: nil)
+        eoseTrackerEpoch += 1
+        let epoch = eoseTrackerEpoch
+        eoseTrackers[id] = EOSETracker(pendingRelays: relayURLs, callback: callback, epoch: epoch)
         // Fallback timeout to avoid hanging if a relay never sends EOSE.
-        tracker.timer = Timer.scheduledTimer(withTimeInterval: 2.0, repeats: false) { [weak self] _ in
-            Task { @MainActor in
+        dependencies.scheduleAfter(TransportConfig.nostrSubscriptionEOSEFallbackSeconds) { [weak self] in
+            Task { @MainActor [weak self] in
                 guard let self else { return }
-                if let tracker = self.eoseTrackers[id] {
-                    tracker.timer?.invalidate()
-                    self.eoseTrackers.removeValue(forKey: id)
-                    callback()
-                }
+                guard let tracker = self.eoseTrackers[id], tracker.epoch == epoch else { return }
+                self.eoseTrackers.removeValue(forKey: id)
+                tracker.callback()
             }
         }
-        eoseTrackers[id] = tracker
     }
 
     private func startPendingEOSETrackingIfNeeded(id: String) {
@@ -608,6 +821,53 @@ final class NostrRelayManager: ObservableObject {
             startEOSETracking(id: id, relayURLs: requestState.relayURLs, callback: callback)
         }
     }
+
+    private func shouldDeliverInboundEvent(subscriptionID: String, eventID: String) -> Bool {
+        guard !eventID.isEmpty else { return true }
+        let key = InboundEventKey(subscriptionID: subscriptionID, eventID: eventID)
+        guard recentInboundEventKeys.insert(key).inserted else {
+            recordDuplicateInboundEventDrop(subscriptionID: subscriptionID)
+            return false
+        }
+        recentInboundEventKeyOrder.append(key)
+
+        if recentInboundEventKeyOrder.count > recentInboundEventKeyLimit {
+            let removeCount = recentInboundEventKeyOrder.count - recentInboundEventKeyTrimTarget
+            for staleKey in recentInboundEventKeyOrder.prefix(removeCount) {
+                recentInboundEventKeys.remove(staleKey)
+            }
+            recentInboundEventKeyOrder.removeFirst(removeCount)
+        }
+        return true
+    }
+
+    private func recordDuplicateInboundEventDrop(subscriptionID: String) {
+        duplicateInboundEventDropCount += 1
+        let subscriptionCount = (duplicateInboundEventDropCountBySubscription[subscriptionID] ?? 0) + 1
+        duplicateInboundEventDropCountBySubscription[subscriptionID] = subscriptionCount
+
+        if duplicateInboundEventDropCount == 1 ||
+            duplicateInboundEventDropCount.isMultiple(of: TransportConfig.nostrDuplicateEventLogInterval) {
+            SecureLogger.debug(
+                "Dropped duplicate Nostr event deliveries total=\(duplicateInboundEventDropCount) sub=\(subscriptionID) sub_total=\(subscriptionCount)",
+                category: .session
+            )
+        }
+    }
+
+    private func removeRecentInboundEvents(forSubscriptionID subscriptionID: String) {
+        guard !recentInboundEventKeyOrder.isEmpty else { return }
+        var retainedKeys: [InboundEventKey] = []
+        retainedKeys.reserveCapacity(recentInboundEventKeyOrder.count)
+        for key in recentInboundEventKeyOrder {
+            if key.subscriptionID == subscriptionID {
+                recentInboundEventKeys.remove(key)
+            } else {
+                retainedKeys.append(key)
+            }
+        }
+        recentInboundEventKeyOrder = retainedKeys
+    }
     
     private func connectToRelay(_ urlString: String) {
         // Global network policy gate
@@ -665,26 +925,35 @@ final class NostrRelayManager: ObservableObject {
         }
     }
 
-    /// Send any queued subscriptions for a relay that just connected.
+    /// Send queued subscriptions and replay durable ones for a relay that just
+    /// (re)connected. Relays drop subscriptions with the socket, so every
+    /// active subscription targeting this relay must be re-sent.
     private func flushPendingSubscriptions(for relayUrl: String) {
-        guard let map = pendingSubscriptions[relayUrl], !map.isEmpty else { return }
         guard let connection = connections[relayUrl] else { return }
-        for (id, messageString) in map {
+        var toSend = (pendingSubscriptions[relayUrl] ?? [:]).mapValues(\.messageString)
+        for (id, state) in subscriptionRequestState where state.relayURLs.contains(relayUrl) && toSend[id] == nil {
+            toSend[id] = state.messageString
+        }
+        for (id, messageString) in toSend {
             if self.subscriptions[relayUrl]?.contains(id) == true { continue }
             startPendingEOSETrackingIfNeeded(id: id)
-            connection.send(.string(messageString)) { error in
-                if let error = error {
-                    SecureLogger.error("❌ Failed to send pending subscription to \(relayUrl): \(error)", category: .session)
-                } else {
-                    Task { @MainActor in
-                        var subs = self.subscriptions[relayUrl] ?? Set<String>()
-                        subs.insert(id)
-                        self.subscriptions[relayUrl] = subs
+            connection.send(.string(messageString)) { [weak self, weak connection] error in
+                Task { @MainActor [weak self] in
+                    guard let self else { return }
+                    if let error = error {
+                        // Keep the pending entry; the next (re)connect retries it.
+                        SecureLogger.error("❌ Failed to send pending subscription to \(relayUrl): \(error)", category: .session)
+                    } else {
+                        // A stale completion from a socket that has since been
+                        // replaced must not mark the subscription active, or
+                        // the next connection would skip replaying it.
+                        guard let connection, self.connections[relayUrl] === connection else { return }
+                        self.subscriptions[relayUrl, default: []].insert(id)
+                        self.pendingSubscriptions[relayUrl]?.removeValue(forKey: id)
                     }
                 }
             }
         }
-        pendingSubscriptions[relayUrl] = nil
     }
     
     private func receiveMessage(from task: NostrRelayConnectionProtocol, relayUrl: String) {
@@ -722,12 +991,26 @@ final class NostrRelayManager: ObservableObject {
     private func handleParsedMessage(_ parsed: ParsedInbound, from relayUrl: String) {
         switch parsed {
         case .event(let subId, let event):
-            if event.kind != 1059 {
-                SecureLogger.debug("📥 Event kind=\(event.kind) id=\(event.id.prefix(16))… relay=\(relayUrl)", category: .session)
-            }
             if let index = self.relays.firstIndex(where: { $0.url == relayUrl }) {
                 self.relays[index].messagesReceived += 1
             }
+            guard event.isValidSignature() else {
+                SecureLogger.warning(
+                    "⚠️ Dropped invalid Nostr event id=\(event.id.prefix(16))… sub=\(subId) relay=\(relayUrl)",
+                    category: .session
+                )
+                return
+            }
+            guard shouldDeliverInboundEvent(subscriptionID: subId, eventID: event.id) else {
+                return
+            }
+            if event.kind != 1059 {
+                // Per-event logging floods dev builds in busy geohashes; sample it.
+                inboundEventLogCount += 1
+                if inboundEventLogCount == 1 || inboundEventLogCount.isMultiple(of: TransportConfig.nostrInboundEventLogInterval) {
+                    SecureLogger.debug("📥 Event #\(inboundEventLogCount) kind=\(event.kind) id=\(event.id.prefix(16))… relay=\(relayUrl)", category: .session)
+                }
+            }
             if let handler = self.messageHandlers[subId] {
                 handler(event)
             } else {
@@ -737,7 +1020,6 @@ final class NostrRelayManager: ObservableObject {
             if var tracker = eoseTrackers[subId] {
                 tracker.pendingRelays.remove(relayUrl)
                 if tracker.pendingRelays.isEmpty {
-                    tracker.timer?.invalidate()
                     eoseTrackers.removeValue(forKey: subId)
                     tracker.callback()
                 } else {
@@ -809,19 +1091,35 @@ final class NostrRelayManager: ObservableObject {
     
     private func updateConnectionStatus() {
         isConnected = relays.contains { $0.isConnected }
+        // Relay URLs are normalized before entries are created, so direct
+        // set membership is sound.
+        isDMRelayConnected = relays.contains { $0.isConnected && Self.defaultRelaySet.contains($0.url) }
     }
     
-    private func handleDisconnection(relayUrl: String, error: Error) {
-        // If networking is disallowed, do not schedule reconnection
-        if !dependencies.activationAllowed() {
-            connections.removeValue(forKey: relayUrl)
-            subscriptions.removeValue(forKey: relayUrl)
-            updateRelayStatus(relayUrl, isConnected: false, error: error)
-            return
+    /// A relay that drops before sending EOSE must not stall initial-load
+    /// callbacks; treat it as done and let the remaining relays (or the
+    /// fallback timeout) drive completion.
+    private func settleEOSETrackers(droppingRelay relayUrl: String) {
+        for (id, var tracker) in eoseTrackers where tracker.pendingRelays.contains(relayUrl) {
+            tracker.pendingRelays.remove(relayUrl)
+            if tracker.pendingRelays.isEmpty {
+                eoseTrackers.removeValue(forKey: id)
+                tracker.callback()
+            } else {
+                eoseTrackers[id] = tracker
+            }
         }
+    }
+
+    private func handleDisconnection(relayUrl: String, error: Error) {
         connections.removeValue(forKey: relayUrl)
         subscriptions.removeValue(forKey: relayUrl)
         updateRelayStatus(relayUrl, isConnected: false, error: error)
+        settleEOSETrackers(droppingRelay: relayUrl)
+        // If networking is disallowed, do not schedule reconnection
+        if !dependencies.activationAllowed() {
+            return
+        }
         
         // Check if this is a DNS or handshake error; treat as permanent
         let errorDescription = error.localizedDescription.lowercased()
@@ -852,16 +1150,26 @@ final class NostrRelayManager: ObservableObject {
             return
         }
         
-        // Calculate backoff interval
-        let backoffInterval = min(
+        // Calculate backoff interval with ±jitterRatio random jitter so relays
+        // that dropped together don't all reconnect at the same instant.
+        let baseBackoffInterval = min(
             initialBackoffInterval * pow(backoffMultiplier, Double(relays[index].reconnectAttempts - 1)),
             maxBackoffInterval
         )
-        
+        let jitterRatio = TransportConfig.nostrRelayBackoffJitterRatio
+        let jitterFactor = 1.0 + (dependencies.jitterUnit() * 2.0 - 1.0) * jitterRatio
+        let backoffInterval = baseBackoffInterval * jitterFactor
+
         let nextReconnectTime = dependencies.now().addingTimeInterval(backoffInterval)
         relays[index].nextReconnectTime = nextReconnectTime
-        
-        
+
+        // Reconnects are bounded by maxReconnectAttempts and exponentially
+        // backed off, so this is low-frequency: plain debug, no sampling.
+        SecureLogger.debug(
+            "🔄 Reconnect \(relayUrl) in \(String(format: "%.1f", backoffInterval))s (base \(String(format: "%.1f", baseBackoffInterval))s, attempt \(relays[index].reconnectAttempts)/\(maxReconnectAttempts))",
+            category: .session
+        )
+
         // Schedule reconnection with exponential backoff
         let gen = connectionGeneration
         dependencies.scheduleAfter(backoffInterval) { [weak self] in
@@ -919,6 +1227,31 @@ final class NostrRelayManager: ObservableObject {
         pendingSubscriptions[relayUrl]?.count ?? 0
     }
 
+    func debugPendingSubscriptionIDs(for relayUrl: String) -> Set<String> {
+        guard let map = pendingSubscriptions[relayUrl] else { return [] }
+        return Set(map.keys)
+    }
+
+    var debugMessageHandlerCount: Int {
+        messageHandlers.count
+    }
+
+    var debugSubscriptionRequestCount: Int {
+        subscriptionRequestState.count
+    }
+
+    var debugPendingEOSECallbackCount: Int {
+        pendingEOSECallbacks.count
+    }
+
+    var debugDuplicateInboundEventDropCount: Int {
+        duplicateInboundEventDropCount
+    }
+
+    func debugDuplicateInboundEventDropCount(forSubscriptionID subscriptionID: String) -> Int {
+        duplicateInboundEventDropCountBySubscription[subscriptionID] ?? 0
+    }
+
     func debugFlushMessageQueue() {
         flushMessageQueue(for: nil)
     }
@@ -943,6 +1276,13 @@ final class NostrRelayManager: ObservableObject {
     // MARK: - Failure classification
     private func isPermanentlyFailed(_ url: String) -> Bool {
         guard let r = relays.first(where: { $0.url == url }) else { return false }
+        // Failures decay: after a cooldown the relay gets another chance, so a
+        // long network outage or transient relay trouble can't blacklist it
+        // for the rest of the process lifetime.
+        if let lastDisconnect = r.lastDisconnectedAt,
+           dependencies.now().timeIntervalSince(lastDisconnect) >= TransportConfig.nostrRelayFailureCooldownSeconds {
+            return false
+        }
         if r.reconnectAttempts >= maxReconnectAttempts { return true }
         if let ns = r.lastError as NSError?, ns.domain == NSURLErrorDomain {
             if ns.code == NSURLErrorBadServerResponse || ns.code == NSURLErrorCannotFindHost {
@@ -974,8 +1314,7 @@ private enum ParsedInbound {
             if array.count >= 3,
                let subId = array[1] as? String,
                let eventDict = array[2] as? [String: Any],
-               let event = try? NostrEvent(from: eventDict),
-               event.isValidSignature() {
+               let event = try? NostrEvent(from: eventDict) {
                 self = .event(subId: subId, event: event)
                 return
             }

bitchat/Nostr/XChaCha20Poly1305Compat.swift

@@ -132,4 +132,3 @@ private extension Data {
         replaceSubrange(offset..<(offset+4), with: bytes)
     }
 }
-

bitchat/Protocols/BitchatFilePacket.swift

@@ -28,12 +28,14 @@ struct BitchatFilePacket {
 
     /// Encodes the packet using v2 canonical TLVs (4-byte FILE_SIZE, 4-byte CONTENT length).
     /// Returns `nil` when fields exceed protocol limits (e.g., content > UInt32.max).
-    func encode() -> Data? {
+    /// `limit` defaults to the Bluetooth payload cap; Wi-Fi bulk transfers pass
+    /// `FileTransferLimits.maxWifiBulkPayloadBytes`.
+    func encode(limit: Int = FileTransferLimits.maxPayloadBytes) -> Data? {
         let resolvedSize = fileSize ?? UInt64(content.count)
         guard resolvedSize <= UInt64(UInt32.max) else { return nil }
-        guard resolvedSize <= UInt64(FileTransferLimits.maxPayloadBytes) else { return nil }
+        guard resolvedSize <= UInt64(limit) else { return nil }
         guard content.count <= Int(UInt32.max) else { return nil }
-        guard FileTransferLimits.isValidPayload(content.count) else { return nil }
+        guard FileTransferLimits.isValidPayload(content.count, limit: limit) else { return nil }
 
         func appendBE<T: FixedWidthInteger>(_ value: T, into data: inout Data) {
             var big = value.bigEndian
@@ -66,7 +68,9 @@ struct BitchatFilePacket {
     }
 
     /// Decodes TLV payloads, tolerating legacy encodings (FILE_SIZE len=8, CONTENT len=2) when possible.
-    static func decode(_ data: Data) -> BitchatFilePacket? {
+    /// `limit` defaults to the Bluetooth payload cap; Wi-Fi bulk transfers pass
+    /// the (smaller of the) accepted-offer size and the Wi-Fi bulk ceiling.
+    static func decode(_ data: Data, limit: Int = FileTransferLimits.maxPayloadBytes) -> BitchatFilePacket? {
         var cursor = data.startIndex
         let end = data.endIndex
 
@@ -126,7 +130,7 @@ struct BitchatFilePacket {
                     for byte in value {
                         size = (size << 8) | UInt64(byte)
                     }
-                    if size > UInt64(FileTransferLimits.maxPayloadBytes) {
+                    if size > UInt64(limit) {
                         return nil
                     }
                     fileSize = size
@@ -135,7 +139,7 @@ struct BitchatFilePacket {
                 mimeType = String(data: Data(value), encoding: .utf8)
             case .content:
                 let proposedSize = content.count + value.count
-                if proposedSize > FileTransferLimits.maxPayloadBytes {
+                if proposedSize > limit {
                     return nil
                 }
                 content.append(contentsOf: value)
@@ -145,7 +149,7 @@ struct BitchatFilePacket {
         }
 
         guard !content.isEmpty else { return nil }
-        guard FileTransferLimits.isValidPayload(content.count) else { return nil }
+        guard FileTransferLimits.isValidPayload(content.count, limit: limit) else { return nil }
         return BitchatFilePacket(
             fileName: fileName,
             fileSize: fileSize ?? UInt64(content.count),

bitchat/Protocols/BitchatProtocol.swift

@@ -72,15 +72,20 @@ enum NoisePayloadType: UInt8 {
     case privateMessage = 0x01      // Private chat message
     case readReceipt = 0x02         // Message was read
     case delivered = 0x03           // Message was delivered
+    // Wi-Fi bulk transport negotiation (AWDL data plane for large media)
+    case bulkTransferOffer = 0x04    // Offer to move a large file over peer-to-peer Wi-Fi
+    case bulkTransferResponse = 0x05 // Accept/decline reply to a bulk transfer offer
     // Verification (QR-based OOB binding)
     case verifyChallenge = 0x10     // Verification challenge
     case verifyResponse  = 0x11     // Verification response
-    
+
     var description: String {
         switch self {
         case .privateMessage: return "privateMessage"
         case .readReceipt: return "readReceipt"
         case .delivered: return "delivered"
+        case .bulkTransferOffer: return "bulkTransferOffer"
+        case .bulkTransferResponse: return "bulkTransferResponse"
         case .verifyChallenge: return "verifyChallenge"
         case .verifyResponse: return "verifyResponse"
         }

bitchat/Protocols/LocationChannel.swift

@@ -18,7 +18,7 @@ enum GeohashChannelLevel: CaseIterable, Codable, Equatable {
         case .city: return 5
         case .province: return 4
         case .region: return 2
-    }
+        }
     }
 
     var displayName: String {

bitchat/Protocols/Packets.swift

@@ -1,3 +1,4 @@
+import BitFoundation
 import Foundation
 
 // MARK: - Protocol TLV Packets
@@ -7,12 +8,28 @@ struct AnnouncementPacket {
     let noisePublicKey: Data            // Noise static public key (Curve25519.KeyAgreement)
     let signingPublicKey: Data          // Ed25519 public key for signing
     let directNeighbors: [Data]?        // 8-byte peer IDs
+    let capabilities: PeerCapabilities? // advertised feature bits; nil when absent (old clients)
+
+    init(
+        nickname: String,
+        noisePublicKey: Data,
+        signingPublicKey: Data,
+        directNeighbors: [Data]?,
+        capabilities: PeerCapabilities? = nil
+    ) {
+        self.nickname = nickname
+        self.noisePublicKey = noisePublicKey
+        self.signingPublicKey = signingPublicKey
+        self.directNeighbors = directNeighbors
+        self.capabilities = capabilities
+    }
 
     private enum TLVType: UInt8 {
         case nickname = 0x01
         case noisePublicKey = 0x02
         case signingPublicKey = 0x03
         case directNeighbors = 0x04
+        case capabilities = 0x05
     }
 
     func encode() -> Data? {
@@ -48,6 +65,15 @@ struct AnnouncementPacket {
             }
         }
 
+        // TLV for capabilities (optional)
+        if let capabilities = capabilities {
+            let capabilityBytes = capabilities.encoded()
+            guard capabilityBytes.count <= 255 else { return nil }
+            data.append(TLVType.capabilities.rawValue)
+            data.append(UInt8(capabilityBytes.count))
+            data.append(capabilityBytes)
+        }
+
         return data
     }
 
@@ -57,6 +83,7 @@ struct AnnouncementPacket {
         var noisePublicKey: Data?
         var signingPublicKey: Data?
         var directNeighbors: [Data]?
+        var capabilities: PeerCapabilities?
 
         while offset + 2 <= data.count {
             let typeRaw = data[offset]
@@ -87,6 +114,8 @@ struct AnnouncementPacket {
                         }
                         directNeighbors = neighbors
                     }
+                case .capabilities:
+                    capabilities = PeerCapabilities(encoded: Data(value))
                 }
             } else {
                 // Unknown TLV; skip (tolerant decoder for forward compatibility)
@@ -99,7 +128,8 @@ struct AnnouncementPacket {
             nickname: nickname,
             noisePublicKey: noisePublicKey,
             signingPublicKey: signingPublicKey,
-            directNeighbors: directNeighbors
+            directNeighbors: directNeighbors,
+            capabilities: capabilities
         )
     }
 }

bitchat/Protocols/PeerCapabilities+Local.swift

@@ -0,0 +1,7 @@
+import BitFoundation
+
+extension PeerCapabilities {
+    /// Capabilities this build advertises in its announce packets.
+    /// Each feature adds its bit here when it ships.
+    static let localSupported: PeerCapabilities = TransportConfig.wifiBulkEnabled ? [.wifiBulk] : []
+}

bitchat/Services/BLE/BLEAnnounceHandler.swift

@@ -0,0 +1,231 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+/// Narrow environment for `BLEAnnounceHandler`.
+///
+/// All queue hops (collections barrier, BLE-queue link-state reads, main-actor
+/// UI notification, delayed re-announce) live inside the closures supplied by
+/// `BLEService`, keeping the handler queue-agnostic and synchronously testable.
+struct BLEAnnounceHandlerEnvironment {
+    /// Local peer identity at the time the announce is handled.
+    let localPeerID: () -> PeerID
+    /// TTL value used for direct (non-relayed) packets.
+    let messageTTL: UInt8
+    /// Current time source.
+    let now: () -> Date
+    /// Noise public key already recorded for the peer, if any (registry read).
+    let existingNoisePublicKey: (PeerID) -> Data?
+    /// Verifies the packet signature against the announced signing key.
+    let verifySignature: (_ packet: BitchatPacket, _ signingPublicKey: Data) -> Bool
+    /// Direct link state for the peer (BLE-queue read).
+    let linkState: (PeerID) -> (hasPeripheral: Bool, hasCentral: Bool)
+    /// Runs the registry mutation phase under the collections barrier.
+    let withRegistryBarrier: (() -> Void) -> Void
+    /// Upserts the verified announce into the peer registry.
+    /// Must only be called from inside `withRegistryBarrier`.
+    let upsertVerifiedAnnounce: (
+        _ peerID: PeerID,
+        _ announcement: AnnouncementPacket,
+        _ isConnected: Bool,
+        _ now: Date
+    ) -> BLEPeerAnnounceUpdate
+    /// Debounced reconnect-log decision.
+    /// Must only be called from inside `withRegistryBarrier`.
+    let shouldEmitReconnectLog: (_ peerID: PeerID, _ now: Date) -> Bool
+    /// Records verified direct-neighbor claims in the mesh topology.
+    let updateTopology: (_ peerID: PeerID, _ neighbors: [Data]) -> Void
+    /// Persists the announced cryptographic identity for offline verification.
+    let persistIdentity: (AnnouncementPacket) -> Void
+    /// Announce-back dedup check.
+    let dedupContains: (String) -> Bool
+    /// Announce-back dedup marking.
+    let dedupMarkProcessed: (String) -> Void
+    /// Delivers the announce UI events as one ordered main-actor hop:
+    /// `.peerConnected` (if flagged) → initial gossip sync scheduling (if
+    /// flagged) → peer-ID snapshot + data publish + `.peerListUpdated`.
+    /// A single closure keeps the original in-order delivery guarantee that
+    /// separate unstructured tasks would not provide.
+    let deliverAnnounceUIEvents: (
+        _ peerID: PeerID,
+        _ notifyPeerConnected: Bool,
+        _ scheduleInitialSync: Bool
+    ) -> Void
+    /// Tracks the announce packet for gossip sync.
+    let trackPacketSeen: (BitchatPacket) -> Void
+    /// Reciprocates the announce for bidirectional discovery.
+    let sendAnnounceBack: () -> Void
+    /// Schedules a delayed re-announce (afterglow) after the given delay.
+    let scheduleAfterglow: (TimeInterval) -> Void
+}
+
+/// Outcome of an accepted announce, surfaced so the service can run
+/// follow-up work (e.g. courier handover) that keys off the announce.
+struct BLEAnnounceHandlingResult {
+    let peerID: PeerID
+    let announcement: AnnouncementPacket
+    let isDirectAnnounce: Bool
+    let isVerified: Bool
+}
+
+/// Orchestrates inbound announce packets: preflight validation, signature
+/// trust, registry/topology updates, identity persistence, UI notification,
+/// gossip tracking, and the reciprocal announce response.
+final class BLEAnnounceHandler {
+    private let environment: BLEAnnounceHandlerEnvironment
+
+    init(environment: BLEAnnounceHandlerEnvironment) {
+        self.environment = environment
+    }
+
+    @discardableResult
+    func handle(_ packet: BitchatPacket, from peerID: PeerID) -> BLEAnnounceHandlingResult? {
+        let env = environment
+        let now = env.now()
+        let preflight = BLEAnnouncePreflightPolicy.evaluate(
+            packet: packet,
+            from: peerID,
+            localPeerID: env.localPeerID(),
+            now: now
+        )
+
+        let announcement: AnnouncementPacket
+        switch preflight {
+        case .accept(let acceptance):
+            announcement = acceptance.announcement
+        case .reject(.malformed):
+            SecureLogger.error("❌ Failed to decode announce packet from \(peerID.id.prefix(8))…", category: .session)
+            return nil
+        case .reject(.senderMismatch(let derivedFromKey)):
+            SecureLogger.warning("⚠️ Announce sender mismatch: derived \(derivedFromKey.id.prefix(8))… vs packet \(peerID.id.prefix(8))…", category: .security)
+            return nil
+        case .reject(.selfAnnounce):
+            return nil
+        case .reject(.stale(let ageSeconds)):
+            SecureLogger.debug("⏰ Ignoring stale announce from \(peerID.id.prefix(8))… (age: \(ageSeconds)s)", category: .session)
+            return nil
+        }
+
+        // Suppress announce logs to reduce noise
+
+        // Precompute signature verification outside barrier to reduce contention
+        let existingNoisePublicKey = env.existingNoisePublicKey(peerID)
+        let hasSignature = packet.signature != nil
+        let signatureValid: Bool
+        if hasSignature {
+            signatureValid = env.verifySignature(packet, announcement.signingPublicKey)
+            if !signatureValid {
+                SecureLogger.warning("⚠️ Signature verification for announce failed \(peerID.id.prefix(8))", category: .security)
+            }
+        } else {
+            signatureValid = false
+        }
+        let trustDecision = BLEAnnounceTrustPolicy.evaluate(
+            hasSignature: hasSignature,
+            signatureValid: signatureValid,
+            existingNoisePublicKey: existingNoisePublicKey,
+            announcedNoisePublicKey: announcement.noisePublicKey
+        )
+        if case .reject(.keyMismatch) = trustDecision {
+            SecureLogger.warning("⚠️ Announce key mismatch for \(peerID.id.prefix(8))… — keeping unverified", category: .security)
+        }
+        let verifiedAnnounce = trustDecision.isVerified
+
+        var isNewPeer = false
+        var isReconnectedPeer = false
+        let directLinkState = env.linkState(peerID)
+        let isDirectAnnounce = packet.ttl == env.messageTTL
+
+        env.withRegistryBarrier {
+            let hasPeripheralConnection = directLinkState.hasPeripheral
+            let hasCentralSubscription = directLinkState.hasCentral
+
+            // Require verified announce; ignore otherwise (no backward compatibility)
+            if !verifiedAnnounce {
+                SecureLogger.warning("❌ Ignoring unverified announce from \(peerID.id.prefix(8))…", category: .security)
+                // Reset flags to prevent post-barrier code from acting on unverified announces
+                isNewPeer = false
+                isReconnectedPeer = false
+                return
+            }
+
+            let update = env.upsertVerifiedAnnounce(
+                peerID,
+                announcement,
+                isDirectAnnounce || hasPeripheralConnection || hasCentralSubscription,
+                now
+            )
+            isNewPeer = update.isNewPeer
+            isReconnectedPeer = update.wasDisconnected
+
+            // Log connection status only for direct connectivity changes; debounce to reduce spam
+            if isDirectAnnounce || hasPeripheralConnection || hasCentralSubscription {
+                let now = env.now()
+                if update.isNewPeer {
+                    SecureLogger.debug("🆕 New peer: \(announcement.nickname)", category: .session)
+                } else if update.wasDisconnected {
+                    if env.shouldEmitReconnectLog(peerID, now) {
+                        SecureLogger.debug("🔄 Peer \(announcement.nickname) reconnected", category: .session)
+                    }
+                } else if let previousNickname = update.previousNickname, previousNickname != announcement.nickname {
+                    SecureLogger.debug("🔄 Peer \(peerID.id.prefix(8))… changed nickname: \(previousNickname) -> \(announcement.nickname)", category: .session)
+                }
+            }
+        }
+
+        // Update topology with verified neighbor claims (only for authenticated announces)
+        if verifiedAnnounce, let neighbors = announcement.directNeighbors {
+            env.updateTopology(peerID, neighbors)
+        }
+
+        // Persist cryptographic identity and signing key for robust offline
+        // verification — only for verified announces. Persisting unverified
+        // announces would let an attacker who replays a victim's noisePublicKey
+        // overwrite the victim's stored signing key/nickname (identity poisoning).
+        if verifiedAnnounce {
+            env.persistIdentity(announcement)
+        }
+
+        let announceBackID = "announce-back-\(peerID)"
+        let shouldSendBack = !env.dedupContains(announceBackID)
+        if shouldSendBack {
+            env.dedupMarkProcessed(announceBackID)
+        }
+        let responsePlan = BLEAnnounceResponsePolicy.plan(
+            isDirectAnnounce: isDirectAnnounce,
+            isNewPeer: isNewPeer,
+            isReconnectedPeer: isReconnectedPeer,
+            shouldSendAnnounceBack: shouldSendBack
+        )
+
+        // Only notify of connection for new or reconnected peers when it is a
+        // direct announce; the list update always follows in the same hop.
+        env.deliverAnnounceUIEvents(
+            peerID,
+            responsePlan.shouldNotifyPeerConnected,
+            responsePlan.shouldNotifyPeerConnected && responsePlan.shouldScheduleInitialSync
+        )
+
+        // Track for sync (include our own and others' announces)
+        env.trackPacketSeen(packet)
+
+        if responsePlan.shouldSendAnnounceBack {
+            // Reciprocate announce for bidirectional discovery
+            // Force send to ensure the peer receives our announce
+            env.sendAnnounceBack()
+        }
+
+        // Afterglow: on first-seen peers, schedule a short re-announce to push presence one more hop
+        if responsePlan.shouldScheduleAfterglow {
+            let delay = Double.random(in: 0.3...0.6)
+            env.scheduleAfterglow(delay)
+        }
+
+        return BLEAnnounceHandlingResult(
+            peerID: peerID,
+            announcement: announcement,
+            isDirectAnnounce: isDirectAnnounce,
+            isVerified: verifiedAnnounce
+        )
+    }
+}

bitchat/Services/BLE/BLEConnectionScheduler.swift

@@ -41,13 +41,16 @@ final class BLEConnectionScheduler<Peripheral> {
     private let candidateCap: Int
     private let weakLinkCooldownSeconds: TimeInterval
     private let weakLinkRSSICutoff: Int
-    private let recentTimeoutWindowSeconds: TimeInterval
-    private let recentTimeoutCountThreshold: Int
 
     private var lastGlobalConnectAttempt: Date = .distantPast
     private var candidates: [BLEConnectionCandidate<Peripheral>] = []
     private var failureCounts: [String: Int] = [:]
     private var recentConnectTimeouts: [String: Date] = [:]
+    // Tracked separately from connect timeouts: a peer we held a connection
+    // with and lost (walked out of range) usually comes back, so it only gets
+    // a brief rediscovery ignore — not the timeout backoff/cooldown treatment
+    // reserved for peers that never answered a connect attempt.
+    private var recentDisconnects: [String: Date] = [:]
     private var lastIsolatedAt: Date?
 
     private let initialDynamicRSSIThreshold: Int
@@ -63,8 +66,6 @@ final class BLEConnectionScheduler<Peripheral> {
         candidateCap: Int = TransportConfig.bleConnectionCandidatesMax,
         weakLinkCooldownSeconds: TimeInterval = TransportConfig.bleWeakLinkCooldownSeconds,
         weakLinkRSSICutoff: Int = TransportConfig.bleWeakLinkRSSICutoff,
-        recentTimeoutWindowSeconds: TimeInterval = TransportConfig.bleRecentTimeoutWindowSeconds,
-        recentTimeoutCountThreshold: Int = TransportConfig.bleRecentTimeoutCountThreshold,
         dynamicRSSIThreshold: Int = TransportConfig.bleDynamicRSSIThresholdDefault
     ) {
         self.maxCentralLinks = maxCentralLinks
@@ -72,8 +73,6 @@ final class BLEConnectionScheduler<Peripheral> {
         self.candidateCap = candidateCap
         self.weakLinkCooldownSeconds = weakLinkCooldownSeconds
         self.weakLinkRSSICutoff = weakLinkRSSICutoff
-        self.recentTimeoutWindowSeconds = recentTimeoutWindowSeconds
-        self.recentTimeoutCountThreshold = recentTimeoutCountThreshold
         self.initialDynamicRSSIThreshold = dynamicRSSIThreshold
         self.dynamicRSSIThreshold = dynamicRSSIThreshold
     }
@@ -114,7 +113,12 @@ final class BLEConnectionScheduler<Peripheral> {
         }
 
         if let lastTimeout = recentConnectTimeouts[candidate.peripheralID],
-           now.timeIntervalSince(lastTimeout) < 15 {
+           now.timeIntervalSince(lastTimeout) < TransportConfig.bleTimeoutDiscoveryIgnoreSeconds {
+            return .ignore
+        }
+
+        if let lastDisconnect = recentDisconnects[candidate.peripheralID],
+           now.timeIntervalSince(lastDisconnect) < TransportConfig.bleDisconnectDiscoveryIgnoreSeconds {
             return .ignore
         }
 
@@ -163,6 +167,11 @@ final class BLEConnectionScheduler<Peripheral> {
                 return .retryAfter(delay)
             }
 
+            if let delay = disconnectSettleDelay(for: candidate, now: now) {
+                enqueue(candidate)
+                return .retryAfter(delay)
+            }
+
             if isAlreadyConnectingOrConnected(candidate.peripheralID) {
                 continue
             }
@@ -180,6 +189,7 @@ final class BLEConnectionScheduler<Peripheral> {
     func recordConnectionSuccess(peripheralID: String) {
         failureCounts[peripheralID] = 0
         recentConnectTimeouts.removeValue(forKey: peripheralID)
+        recentDisconnects.removeValue(forKey: peripheralID)
     }
 
     func recordConnectionFailure(peripheralID: String) {
@@ -187,7 +197,7 @@ final class BLEConnectionScheduler<Peripheral> {
     }
 
     func recordDisconnectError(peripheralID: String, at now: Date) {
-        recentConnectTimeouts[peripheralID] = now
+        recentDisconnects[peripheralID] = now
     }
 
     func recordConnectionTimeout(peripheralID: String, at now: Date) {
@@ -197,6 +207,7 @@ final class BLEConnectionScheduler<Peripheral> {
 
     func pruneConnectionTimeouts(before cutoff: Date) {
         recentConnectTimeouts = recentConnectTimeouts.filter { $0.value >= cutoff }
+        recentDisconnects = recentDisconnects.filter { $0.value >= cutoff }
     }
 
     func reset() {
@@ -204,6 +215,7 @@ final class BLEConnectionScheduler<Peripheral> {
         candidates.removeAll()
         failureCounts.removeAll()
         recentConnectTimeouts.removeAll()
+        recentDisconnects.removeAll()
         lastIsolatedAt = nil
         dynamicRSSIThreshold = initialDynamicRSSIThreshold
     }
@@ -225,18 +237,14 @@ final class BLEConnectionScheduler<Peripheral> {
         }
 
         lastIsolatedAt = nil
+        // Flaky links are handled per-peripheral (weak-link cooldown, discovery
+        // ignore window, score bias) — never globally, so one flaky distant peer
+        // can't blind us to every other edge-of-range peer.
         var threshold = TransportConfig.bleDynamicRSSIThresholdDefault
         if connectedOrConnectingLinkCount >= maxCentralLinks || candidates.count >= candidateCap {
             threshold = TransportConfig.bleRSSIConnectedThreshold
         }
 
-        let recentTimeouts = recentConnectTimeouts.filter {
-            now.timeIntervalSince($0.value) < recentTimeoutWindowSeconds
-        }.count
-        if recentTimeouts >= recentTimeoutCountThreshold {
-            threshold = max(threshold, TransportConfig.bleRSSIHighTimeoutThreshold)
-        }
-
         dynamicRSSIThreshold = threshold
         return threshold
     }
@@ -258,6 +266,20 @@ final class BLEConnectionScheduler<Peripheral> {
         return min(max(2.0, remaining), 15.0)
     }
 
+    // The disconnect settle window must hold on the queue path too: a stale
+    // candidate enqueued while the peripheral was still connected would
+    // otherwise reconnect immediately via the post-disconnect queue drain,
+    // bypassing the window and recreating reconnect/cancel thrash.
+    private func disconnectSettleDelay(
+        for candidate: BLEConnectionCandidate<Peripheral>,
+        now: Date
+    ) -> TimeInterval? {
+        guard let lastDisconnect = recentDisconnects[candidate.peripheralID] else { return nil }
+        let remaining = TransportConfig.bleDisconnectDiscoveryIgnoreSeconds - now.timeIntervalSince(lastDisconnect)
+        guard remaining > 0 else { return nil }
+        return remaining + 0.05
+    }
+
     private func score(_ candidate: BLEConnectionCandidate<Peripheral>, now: Date) -> Int {
         let failures = failureCounts[candidate.peripheralID] ?? 0
         let penalty = min(20, 1 << min(4, failures))

bitchat/Services/BLE/BLEFanoutSelector.swift

@@ -13,17 +13,45 @@ enum BLEFanoutSelector {
         centralIDs: [String],
         ingressLink: BLEIngressLinkID?,
         excludedLinks: Set<BLEIngressLinkID> = [],
+        peripheralPeerBindings: [String: PeerID] = [:],
+        centralPeerBindings: [String: PeerID] = [:],
         directedPeerHint: PeerID?,
         packetType: UInt8,
         messageID: String
     ) -> BLEFanoutSelection {
-        let allowed = allowedLinks(
+        let rawAllowed = allowedLinks(
             peripheralIDs: peripheralIDs,
             centralIDs: centralIDs,
             ingressLink: ingressLink,
             excludedLinks: excludedLinks
         )
 
+        if let directedPeerHint,
+           let directedSelection = directLinks(
+               to: directedPeerHint,
+               links: rawAllowed,
+               peripheralPeerBindings: peripheralPeerBindings,
+               centralPeerBindings: centralPeerBindings
+           ) {
+            return directedSelection
+        }
+        if let directedPeerHint,
+           hasBoundLink(
+               to: directedPeerHint,
+               peripheralIDs: peripheralIDs,
+               centralIDs: centralIDs,
+               peripheralPeerBindings: peripheralPeerBindings,
+               centralPeerBindings: centralPeerBindings
+           ) {
+            return BLEFanoutSelection(peripheralIDs: [], centralIDs: [])
+        }
+
+        let allowed = collapseDuplicateLinksPerPeer(
+            rawAllowed,
+            peripheralPeerBindings: peripheralPeerBindings,
+            centralPeerBindings: centralPeerBindings
+        )
+
         guard shouldSubset(packetType: packetType, directedPeerHint: directedPeerHint) else {
             return BLEFanoutSelection(
                 peripheralIDs: Set(allowed.peripheralIDs),
@@ -65,6 +93,79 @@ enum BLEFanoutSelector {
         return (allowedPeripheralIDs, allowedCentralIDs)
     }
 
+    private static func directLinks(
+        to peerID: PeerID,
+        links: (peripheralIDs: [String], centralIDs: [String]),
+        peripheralPeerBindings: [String: PeerID],
+        centralPeerBindings: [String: PeerID]
+    ) -> BLEFanoutSelection? {
+        let directLinks = collapseDuplicateLinksPerPeer(
+            (
+                peripheralIDs: links.peripheralIDs.filter { peripheralPeerBindings[$0] == peerID },
+                centralIDs: links.centralIDs.filter { centralPeerBindings[$0] == peerID }
+            ),
+            peripheralPeerBindings: peripheralPeerBindings,
+            centralPeerBindings: centralPeerBindings
+        )
+
+        guard !directLinks.peripheralIDs.isEmpty || !directLinks.centralIDs.isEmpty else {
+            return nil
+        }
+
+        return BLEFanoutSelection(
+            peripheralIDs: Set(directLinks.peripheralIDs),
+            centralIDs: Set(directLinks.centralIDs)
+        )
+    }
+
+    private static func hasBoundLink(
+        to peerID: PeerID,
+        peripheralIDs: [String],
+        centralIDs: [String],
+        peripheralPeerBindings: [String: PeerID],
+        centralPeerBindings: [String: PeerID]
+    ) -> Bool {
+        peripheralIDs.contains { peripheralPeerBindings[$0] == peerID }
+            || centralIDs.contains { centralPeerBindings[$0] == peerID }
+    }
+
+    // Dual-role pairs hold two live links (we-as-central writing to their
+    // peripheral, and they-as-central subscribed to ours). Sending the same
+    // packet down both doubles airtime for nothing — the receiver's assembler
+    // and deduplicator just discard the copy. Keep one link per bound peer,
+    // preferring the peripheral (write) side: it has per-link flow control
+    // via canSendWriteWithoutResponse, while notifications share the
+    // peripheral manager's update queue across all centrals. Links with no
+    // bound peer yet (pre-announce) pass through untouched.
+    private static func collapseDuplicateLinksPerPeer(
+        _ links: (peripheralIDs: [String], centralIDs: [String]),
+        peripheralPeerBindings: [String: PeerID],
+        centralPeerBindings: [String: PeerID]
+    ) -> (peripheralIDs: [String], centralIDs: [String]) {
+        guard !peripheralPeerBindings.isEmpty || !centralPeerBindings.isEmpty else {
+            return links
+        }
+
+        var seenPeers = Set<PeerID>()
+        var keptPeripheralIDs: [String] = []
+        for id in links.peripheralIDs {
+            if let peer = peripheralPeerBindings[id], !seenPeers.insert(peer).inserted {
+                continue
+            }
+            keptPeripheralIDs.append(id)
+        }
+
+        var keptCentralIDs: [String] = []
+        for id in links.centralIDs {
+            if let peer = centralPeerBindings[id], !seenPeers.insert(peer).inserted {
+                continue
+            }
+            keptCentralIDs.append(id)
+        }
+
+        return (keptPeripheralIDs, keptCentralIDs)
+    }
+
     private static func shouldSubset(packetType: UInt8, directedPeerHint: PeerID?) -> Bool {
         directedPeerHint == nil
             && packetType != MessageType.fragment.rawValue

bitchat/Services/BLE/BLEFileTransferHandler.swift

@@ -0,0 +1,125 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+/// Narrow environment for `BLEFileTransferHandler`.
+///
+/// All queue hops (collections registry reads/writes, main-actor UI
+/// notification) live inside the closures supplied by `BLEService`, keeping
+/// the handler queue-agnostic and synchronously testable.
+struct BLEFileTransferHandlerEnvironment {
+    /// Local peer identity at the time the transfer is handled.
+    let localPeerID: () -> PeerID
+    /// Local nickname used for sender resolution and collision checks.
+    let localNickname: () -> String
+    /// Snapshot of known peers keyed by ID (registry read).
+    let peersSnapshot: () -> [PeerID: BLEPeerInfo]
+    /// Resolves a display name from a verified packet signature for peers missing from the registry.
+    let signedSenderDisplayName: (_ packet: BitchatPacket, _ peerID: PeerID) -> String?
+    /// Tracks the broadcast file packet for gossip sync.
+    let trackPacketSeen: (BitchatPacket) -> Void
+    /// Enforces the incoming-media storage quota before saving (BCH-01-002).
+    let enforceStorageQuota: (_ reservingBytes: Int) -> Void
+    /// Persists the validated file to the incoming-media store; returns the destination URL.
+    let saveIncomingFile: (
+        _ data: Data,
+        _ preferredName: String?,
+        _ subdirectory: String,
+        _ fallbackExtension: String?,
+        _ defaultPrefix: String
+    ) -> URL?
+    /// Updates the registry last-seen timestamp for the peer (async barrier write).
+    let updatePeerLastSeen: (PeerID) -> Void
+    /// Delivers `.messageReceived` to the UI as one main-actor hop.
+    let deliverMessage: (BitchatMessage) -> Void
+}
+
+/// Orchestrates inbound file transfers: self-echo policy, sender display-name
+/// resolution, delivery planning, payload validation, quota-checked storage,
+/// and UI delivery.
+final class BLEFileTransferHandler {
+    private let environment: BLEFileTransferHandlerEnvironment
+
+    init(environment: BLEFileTransferHandlerEnvironment) {
+        self.environment = environment
+    }
+
+    /// `payloadLimit` defaults to the Bluetooth cap; Wi-Fi bulk deliveries
+    /// pass the ceiling that was enforced against the accepted offer.
+    func handle(_ packet: BitchatPacket, from peerID: PeerID, payloadLimit: Int = FileTransferLimits.maxPayloadBytes) {
+        let env = environment
+        if BLEFileTransferPolicy.isSelfEcho(packet: packet, from: peerID, localPeerID: env.localPeerID()) { return }
+
+        let peersSnapshot = env.peersSnapshot()
+        guard let senderNickname = BLEPeerSenderDisplayName.resolveKnownPeer(
+            peerID: peerID,
+            localPeerID: env.localPeerID(),
+            localNickname: env.localNickname(),
+            peers: peersSnapshot,
+            allowConnectedUnverified: true
+        ) ?? env.signedSenderDisplayName(packet, peerID) else {
+            SecureLogger.warning("🚫 Dropping file transfer from unverified or unknown peer \(peerID.id.prefix(8))…", category: .security)
+            return
+        }
+
+        guard let deliveryPlan = BLEFileTransferPolicy.deliveryPlan(packet: packet, localPeerID: env.localPeerID()) else {
+            return
+        }
+        if deliveryPlan.shouldTrackForSync {
+            env.trackPacketSeen(packet)
+        }
+
+        let filePacket: BitchatFilePacket
+        let mime: MimeType
+        switch BLEIncomingFileValidator.validate(payload: packet.payload, limit: payloadLimit) {
+        case .success(let acceptance):
+            filePacket = acceptance.filePacket
+            mime = acceptance.mime
+        case .failure(.malformedPayload):
+            SecureLogger.error("❌ Failed to decode file transfer payload", category: .session)
+            return
+        case .failure(.payloadTooLarge(let bytes)):
+            SecureLogger.warning("🚫 Dropping file transfer exceeding size cap (\(bytes) bytes)", category: .security)
+            return
+        case .failure(.unsupportedMime(let mimeType, let bytes)):
+            SecureLogger.warning("🚫 MIME REJECT: '\(mimeType ?? "<empty>")' not supported. Size=\(bytes)b from \(peerID.id.prefix(8))...", category: .security)
+            return
+        case .failure(.magicMismatch(let mime, let bytes, let prefixHex)):
+            SecureLogger.warning("🚫 MAGIC REJECT: MIME='\(mime)' size=\(bytes)b prefix=[\(prefixHex)] from \(peerID.id.prefix(8))...", category: .security)
+            return
+        }
+
+        // BCH-01-002: Enforce storage quota before saving
+        env.enforceStorageQuota(filePacket.content.count)
+
+        guard let destination = env.saveIncomingFile(
+            filePacket.content,
+            filePacket.fileName,
+            "\(mime.category.mediaDir)/incoming",
+            mime.defaultExtension,
+            mime.category.rawValue
+        ) else {
+            return
+        }
+
+        if deliveryPlan.isPrivateMessage {
+            env.updatePeerLastSeen(peerID)
+        }
+
+        let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
+        let message = BitchatMessage(
+            sender: senderNickname,
+            content: "\(mime.category.messagePrefix)\(destination.lastPathComponent)",
+            timestamp: ts,
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: deliveryPlan.isPrivateMessage,
+            recipientNickname: nil,
+            senderPeerID: peerID
+        )
+
+        SecureLogger.debug("📁 Stored incoming media from \(peerID.id.prefix(8))… -> \(destination.lastPathComponent)", category: .session)
+
+        env.deliverMessage(message)
+    }
+}

bitchat/Services/BLE/BLEFileTransferPolicy.swift

@@ -42,12 +42,17 @@ enum BLEIncomingFileRejection: Error, Equatable {
 }
 
 enum BLEIncomingFileValidator {
-    static func validate(payload: Data) -> Result<BLEIncomingFileAcceptance, BLEIncomingFileRejection> {
-        guard let filePacket = BitchatFilePacket.decode(payload) else {
+    /// `limit` defaults to the Bluetooth payload cap; Wi-Fi bulk deliveries
+    /// pass the ceiling enforced against the accepted offer.
+    static func validate(
+        payload: Data,
+        limit: Int = FileTransferLimits.maxPayloadBytes
+    ) -> Result<BLEIncomingFileAcceptance, BLEIncomingFileRejection> {
+        guard let filePacket = BitchatFilePacket.decode(payload, limit: limit) else {
             return .failure(.malformedPayload)
         }
 
-        guard FileTransferLimits.isValidPayload(filePacket.content.count) else {
+        guard FileTransferLimits.isValidPayload(filePacket.content.count, limit: limit) else {
             return .failure(.payloadTooLarge(bytes: filePacket.content.count))
         }
 

bitchat/Services/BLE/BLEFragmentHandler.swift

@@ -0,0 +1,94 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+/// Narrow environment for `BLEFragmentHandler`.
+///
+/// All queue hops (the message-queue entry hop and the collections barrier
+/// around the assembly buffer) live on the `BLEService` side — the entry hop
+/// in `BLEService.handleFragment`, the barrier inside the supplied closures —
+/// keeping the handler queue-agnostic and synchronously testable.
+struct BLEFragmentHandlerEnvironment {
+    /// Local peer identity at the time the fragment is handled.
+    let localPeerID: () -> PeerID
+    /// Tracks broadcast fragments for gossip sync.
+    let trackPacketSeen: (BitchatPacket) -> Void
+    /// Appends the fragment to the assembly buffer (collections barrier write).
+    let appendFragment: (BLEFragmentHeader) -> BLEFragmentAssemblyBuffer.AppendResult
+    /// Ingress acceptance check for the reassembled inner packet.
+    let isAcceptedIngressPayload: (_ packet: BitchatPacket, _ innerSender: PeerID) -> Bool
+    /// Re-enters the receive pipeline with the reassembled packet (TTL already zeroed).
+    let processReassembledPacket: (_ packet: BitchatPacket, _ from: PeerID) -> Void
+}
+
+/// Orchestrates inbound fragments: self-fragment suppression, gossip tracking,
+/// assembly-buffer appends, and reassembled-packet validation and re-injection
+/// into the receive pipeline.
+final class BLEFragmentHandler {
+    private let environment: BLEFragmentHandlerEnvironment
+
+    init(environment: BLEFragmentHandlerEnvironment) {
+        self.environment = environment
+    }
+
+    func handle(_ packet: BitchatPacket, from peerID: PeerID) {
+        let env = environment
+        // Don't process our own fragments
+        if peerID == env.localPeerID() {
+            return
+        }
+
+        guard let header = BLEFragmentHeader(packet: packet) else { return }
+
+        if header.isBroadcastFragment {
+            env.trackPacketSeen(packet)
+        }
+
+        let assemblyResult = env.appendFragment(header)
+
+        logFragmentAssemblyResult(assemblyResult)
+
+        guard case let .complete(completedHeader, reassembled, _) = assemblyResult else { return }
+
+        // Decode the original packet bytes we reassembled, so flags/compression are preserved
+        if var originalPacket = BinaryProtocol.decode(reassembled) {
+
+            // Reassembled packet validation
+            let innerSender = PeerID(hexData: originalPacket.senderID)
+            if !env.isAcceptedIngressPayload(originalPacket, innerSender) {
+                // Cleanup below
+            } else {
+                SecureLogger.debug("✅ Reassembled packet id=\(completedHeader.idLogString) type=\(originalPacket.type) bytes=\(reassembled.count)", category: .session)
+                originalPacket.ttl = 0
+                env.processReassembledPacket(originalPacket, peerID)
+            }
+        } else {
+            SecureLogger.error("❌ Failed to decode reassembled packet (type=\(completedHeader.originalType), total=\(completedHeader.total))", category: .session)
+        }
+    }
+
+    private func logFragmentAssemblyResult(_ result: BLEFragmentAssemblyBuffer.AppendResult) {
+        func logStartedIfNeeded(header: BLEFragmentHeader, started: Bool) {
+            if started {
+                SecureLogger.debug("📦 Started fragment assembly id=\(header.idLogString) total=\(header.total)", category: .session)
+            }
+        }
+
+        switch result {
+        case let .stored(header, started):
+            logStartedIfNeeded(header: header, started: started)
+            SecureLogger.debug("📦 Fragment \(header.index + 1)/\(header.total) (len=\(header.fragmentData.count)) for id=\(header.idLogString)", category: .session)
+
+        case let .complete(header, _, started):
+            logStartedIfNeeded(header: header, started: started)
+            SecureLogger.debug("📦 Fragment \(header.index + 1)/\(header.total) (len=\(header.fragmentData.count)) for id=\(header.idLogString)", category: .session)
+
+        case let .oversized(header, projectedSize, limit, started):
+            logStartedIfNeeded(header: header, started: started)
+            SecureLogger.warning(
+                "🚫 Fragment assembly exceeds size limit (\(projectedSize) bytes > \(limit)), evicting. Type=\(header.originalType) Index=\(header.index)/\(header.total)",
+                category: .security
+            )
+        }
+    }
+}

bitchat/Services/BLE/BLEIngressLinkRegistry.swift

@@ -99,7 +99,11 @@ struct BLEIngressLinkRegistry {
     }
 
     private static func requiresDirectSenderBinding(_ packet: BitchatPacket, directAnnounceTTL: UInt8) -> Bool {
-        packet.type == MessageType.announce.rawValue && packet.ttl == directAnnounceTTL
+        // REQUEST_SYNC is never relayed, so on a bound link the claimed sender
+        // must be the link peer — it elicits a full store replay, and the
+        // response is addressed to whoever the sender claims to be.
+        if packet.type == MessageType.requestSync.rawValue { return true }
+        return packet.type == MessageType.announce.rawValue && packet.ttl == directAnnounceTTL
     }
 
     private static func isSelfAuthoredSyncResponse(_ packet: BitchatPacket) -> Bool {

bitchat/Services/BLE/BLELinkStateStore.swift

@@ -26,36 +26,69 @@ struct BLESubscribedCentralSnapshot {
     }
 }
 
+/// Owns all BLE link state (peripheral connections we hold as central, and
+/// central subscriptions we serve as peripheral). The store has no internal
+/// locking: every access must happen on the single owning queue (the BLE
+/// queue). Other queues must go through BLEService's `readLinkState`, which
+/// hops to that queue. Call `assumeOwnership(of:)` to have debug builds trap
+/// any access from the wrong queue.
 final class BLELinkStateStore {
     private(set) var peripherals: [String: BLEPeripheralLinkState] = [:]
     private(set) var peerToPeripheralUUID: [PeerID: String] = [:]
     private(set) var subscribedCentrals: [CBCentral] = []
     private(set) var centralToPeerID: [String: PeerID] = [:]
 
+    #if DEBUG
+    private var ownerQueue: DispatchQueue?
+    #endif
+
+    /// Pin the store to its owning queue. Debug-only enforcement; release
+    /// builds are unchanged.
+    func assumeOwnership(of queue: DispatchQueue) {
+        #if DEBUG
+        ownerQueue = queue
+        #endif
+    }
+
+    @inline(__always)
+    private func assertOwned() {
+        #if DEBUG
+        if let queue = ownerQueue {
+            dispatchPrecondition(condition: .onQueue(queue))
+        }
+        #endif
+    }
+
     var peripheralStates: [BLEPeripheralLinkState] {
-        Array(peripherals.values)
+        assertOwned()
+        return Array(peripherals.values)
     }
 
     var subscribedCentralSnapshot: BLESubscribedCentralSnapshot {
-        BLESubscribedCentralSnapshot(
+        assertOwned()
+        return BLESubscribedCentralSnapshot(
             centrals: subscribedCentrals,
             peerIDsByCentralUUID: centralToPeerID
         )
     }
 
     var subscribedCentralCount: Int {
-        subscribedCentrals.count
+        assertOwned()
+        return subscribedCentrals.count
     }
 
     var connectedOrConnectingPeripheralCount: Int {
-        peripherals.values.filter { $0.isConnected || $0.isConnecting }.count
+        assertOwned()
+        return peripherals.values.filter { $0.isConnected || $0.isConnecting }.count
     }
 
     func state(forPeripheralID peripheralID: String) -> BLEPeripheralLinkState? {
-        peripherals[peripheralID]
+        assertOwned()
+        return peripherals[peripheralID]
     }
 
     func setPeripheralState(_ state: BLEPeripheralLinkState, for peripheralID: String) {
+        assertOwned()
         peripherals[peripheralID] = state
     }
 
@@ -64,6 +97,7 @@ final class BLELinkStateStore {
         _ peripheralID: String,
         _ update: (inout BLEPeripheralLinkState) -> Void
     ) -> BLEPeripheralLinkState? {
+        assertOwned()
         guard var state = peripherals[peripheralID] else { return nil }
         update(&state)
         peripherals[peripheralID] = state
@@ -113,10 +147,12 @@ final class BLELinkStateStore {
     }
 
     func directPeripheralState(for peerID: PeerID) -> BLEPeripheralLinkState? {
-        peerToPeripheralUUID[peerID].flatMap { peripherals[$0] }
+        assertOwned()
+        return peerToPeripheralUUID[peerID].flatMap { peripherals[$0] }
     }
 
     func directLinkState(for peerID: PeerID) -> BLEDirectLinkState {
+        assertOwned()
         let peripheralUUID = peerToPeripheralUUID[peerID]
         let hasPeripheral = peripheralUUID.flatMap { peripherals[$0]?.isConnected } ?? false
         let hasCentral = centralToPeerID.values.contains(peerID)
@@ -124,6 +160,7 @@ final class BLELinkStateStore {
     }
 
     func links(to peerID: PeerID?) -> Set<BLEIngressLinkID> {
+        assertOwned()
         guard let peerID else { return [] }
 
         var links: Set<BLEIngressLinkID> = []
@@ -137,35 +174,42 @@ final class BLELinkStateStore {
     }
 
     func peerID(forPeripheralID peripheralID: String) -> PeerID? {
-        peripherals[peripheralID]?.peerID
+        assertOwned()
+        return peripherals[peripheralID]?.peerID
     }
 
     func peerID(forCentralUUID centralUUID: String) -> PeerID? {
-        centralToPeerID[centralUUID]
+        assertOwned()
+        return centralToPeerID[centralUUID]
     }
 
     func addSubscribedCentral(_ central: CBCentral) {
+        assertOwned()
         guard !subscribedCentrals.contains(central) else { return }
         subscribedCentrals.append(central)
     }
 
     func removeSubscribedCentral(_ central: CBCentral) -> PeerID? {
+        assertOwned()
         let centralUUID = central.identifier.uuidString
         subscribedCentrals.removeAll { $0.identifier == central.identifier }
         return centralToPeerID.removeValue(forKey: centralUUID)
     }
 
     func bindCentral(_ centralUUID: String, to peerID: PeerID) {
+        assertOwned()
         centralToPeerID[centralUUID] = peerID
     }
 
     func bindPeripheral(_ peripheralUUID: String, to peerID: PeerID) {
+        assertOwned()
         if updatePeripheral(peripheralUUID, { $0.peerID = peerID }) != nil {
             peerToPeripheralUUID[peerID] = peripheralUUID
         }
     }
 
     func removePeripheral(_ peripheralID: String) -> PeerID? {
+        assertOwned()
         let peerID = peripherals.removeValue(forKey: peripheralID)?.peerID
         if let peerID {
             peerToPeripheralUUID.removeValue(forKey: peerID)
@@ -174,6 +218,7 @@ final class BLELinkStateStore {
     }
 
     func clearPeripherals() -> [PeerID] {
+        assertOwned()
         let peerIDs = peripherals.compactMap { $0.value.peerID }
         peripherals.removeAll()
         peerToPeripheralUUID.removeAll()
@@ -181,6 +226,7 @@ final class BLELinkStateStore {
     }
 
     func clearCentrals() -> [PeerID] {
+        assertOwned()
         let peerIDs = Array(centralToPeerID.values)
         subscribedCentrals.removeAll()
         centralToPeerID.removeAll()
@@ -188,6 +234,7 @@ final class BLELinkStateStore {
     }
 
     func clearAll() {
+        assertOwned()
         peripherals.removeAll()
         peerToPeripheralUUID.removeAll()
         subscribedCentrals.removeAll()

bitchat/Services/BLE/BLENoisePacketHandler.swift

@@ -0,0 +1,132 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+/// Narrow environment for `BLENoisePacketHandler`.
+///
+/// All queue hops (collections barrier writes, main-actor UI notification)
+/// and every `noiseService.*` crypto call live inside the closures supplied by
+/// `BLEService`, keeping the handler queue-agnostic and synchronously testable.
+struct BLENoisePacketHandlerEnvironment {
+    /// Local peer identity at the time the packet is handled.
+    let localPeerID: () -> PeerID
+    /// Local peer ID bytes used as the sender of handshake responses.
+    let localPeerIDData: () -> Data
+    /// TTL value used for direct (non-relayed) packets.
+    let messageTTL: UInt8
+    /// Current time source.
+    let now: () -> Date
+    /// Processes an inbound handshake message, returning an optional response payload (crypto).
+    let processHandshakeMessage: (_ peerID: PeerID, _ message: Data) throws -> Data?
+    /// Whether any Noise session (established or pending) exists for the peer (crypto).
+    let hasNoiseSession: (PeerID) -> Bool
+    /// Initiates a fresh Noise handshake with the peer (crypto + send).
+    let initiateHandshake: (PeerID) -> Void
+    /// Broadcasts a packet on the mesh (caller is already on the message queue).
+    let broadcastPacket: (BitchatPacket) -> Void
+    /// Updates the registry last-seen timestamp for the peer (async barrier write).
+    let updatePeerLastSeen: (PeerID) -> Void
+    /// Decrypts an encrypted payload from the peer (crypto).
+    let decrypt: (_ payload: Data, _ peerID: PeerID) throws -> Data
+    /// Clears the peer's Noise session after an unrecoverable decrypt failure (crypto).
+    let clearSession: (PeerID) -> Void
+    /// Delivers `.noisePayloadReceived` to the UI as one main-actor hop.
+    let deliverNoisePayload: (
+        _ peerID: PeerID,
+        _ type: NoisePayloadType,
+        _ payload: Data,
+        _ timestamp: Date
+    ) -> Void
+}
+
+/// Orchestrates the Noise session domain for inbound packets: handshake
+/// processing (with response), encrypted payload decryption and dispatch,
+/// and session recovery on decrypt failure.
+final class BLENoisePacketHandler {
+    private let environment: BLENoisePacketHandlerEnvironment
+
+    init(environment: BLENoisePacketHandlerEnvironment) {
+        self.environment = environment
+    }
+
+    func handleHandshake(_ packet: BitchatPacket, from peerID: PeerID) {
+        let env = environment
+        // Use NoiseEncryptionService for handshake processing
+        if PeerID(hexData: packet.recipientID) == env.localPeerID() {
+            // Handshake is for us
+            do {
+                if let response = try env.processHandshakeMessage(peerID, packet.payload) {
+                    // Send response
+                    let responsePacket = BitchatPacket(
+                        type: MessageType.noiseHandshake.rawValue,
+                        senderID: env.localPeerIDData(),
+                        recipientID: Data(hexString: peerID.id),
+                        timestamp: UInt64(env.now().timeIntervalSince1970 * 1000),
+                        payload: response,
+                        signature: nil,
+                        ttl: env.messageTTL
+                    )
+                    // We're on messageQueue from delegate callback
+                    env.broadcastPacket(responsePacket)
+                }
+
+                // Session establishment will trigger onPeerAuthenticated callback
+                // which will send any pending messages at the right time
+            } catch {
+                SecureLogger.error("Failed to process handshake: \(error)")
+                // Try initiating a new handshake
+                if !env.hasNoiseSession(peerID) {
+                    env.initiateHandshake(peerID)
+                }
+            }
+        }
+    }
+
+    func handleEncrypted(_ packet: BitchatPacket, from peerID: PeerID) {
+        let env = environment
+        guard let recipientID = PeerID(hexData: packet.recipientID) else {
+            SecureLogger.warning("⚠️ Encrypted message has no recipient ID", category: .session)
+            return
+        }
+
+        if recipientID != env.localPeerID() {
+            SecureLogger.debug("🔐 Encrypted message not for me (for \(recipientID.id.prefix(8))…, I am \(env.localPeerID().id.prefix(8))…)", category: .session)
+            return
+        }
+
+        // Update lastSeen for the peer we received from (important for private messages)
+        env.updatePeerLastSeen(peerID)
+
+        do {
+            let decrypted = try env.decrypt(packet.payload, peerID)
+            guard decrypted.count > 0 else { return }
+
+            // First byte indicates the payload type
+            let payloadType = decrypted[0]
+            let payloadData = decrypted.dropFirst()
+
+            guard let noisePayloadType = NoisePayloadType(rawValue: payloadType) else {
+                SecureLogger.warning("⚠️ Unknown noise payload type: \(payloadType)")
+                return
+            }
+
+            SecureLogger.debug("🔐 Decrypted noise payload type \(noisePayloadType.description) from \(peerID.id.prefix(8))…", category: .session)
+
+            let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
+            env.deliverNoisePayload(peerID, noisePayloadType, Data(payloadData), ts)
+        } catch NoiseEncryptionError.sessionNotEstablished {
+            // We received an encrypted message before establishing a session with this peer.
+            // Trigger a handshake so future messages can be decrypted.
+            SecureLogger.debug("🔑 Encrypted message from \(peerID.id.prefix(8))… without session; initiating handshake")
+            if !env.hasNoiseSession(peerID) {
+                env.initiateHandshake(peerID)
+            }
+        } catch {
+            // Decryption failed - clear the corrupted session and re-initiate handshake
+            // This handles cases where session state got out of sync (nonce mismatch, etc.)
+            SecureLogger.error("❌ Failed to decrypt message from \(peerID.id.prefix(8))…: \(error) - clearing session and re-initiating handshake")
+            env.clearSession(peerID)
+            env.initiateHandshake(peerID)
+        }
+    }
+}

bitchat/Services/BLE/BLEOutboundLinkPlanner.swift

@@ -18,6 +18,8 @@ enum BLEOutboundLinkPlanner {
         centralNotifyLimits: [Int],
         ingressRecord: BLEIngressLinkRecord?,
         excludedLinks: Set<BLEIngressLinkID>,
+        peripheralPeerBindings: [String: PeerID] = [:],
+        centralPeerBindings: [String: PeerID] = [:],
         directedOnlyPeer: PeerID?
     ) -> BLEOutboundLinkPlan {
         if let minLimit = minimumLinkLimit(
@@ -39,6 +41,8 @@ enum BLEOutboundLinkPlanner {
             centralIDs: centralIDs,
             ingressLink: ingressRecord?.link,
             excludedLinks: excludedLinks,
+            peripheralPeerBindings: peripheralPeerBindings,
+            centralPeerBindings: centralPeerBindings,
             directedPeerHint: directedPeerHint,
             packetType: packet.type,
             messageID: BLEOutboundPacketPolicy.messageID(for: packet)

bitchat/Services/BLE/BLEOutboundPacketPolicy.swift

@@ -12,7 +12,7 @@ enum BLEOutboundPacketPolicy {
         switch MessageType(rawValue: packetType) {
         case .noiseEncrypted, .noiseHandshake:
             return true
-        case .none, .announce, .message, .leave, .requestSync, .fragment, .fileTransfer:
+        case .none, .announce, .message, .leave, .requestSync, .fragment, .fileTransfer, .courierEnvelope:
             return false
         }
     }

bitchat/Services/BLE/BLEPeerRegistry.swift

@@ -9,6 +9,7 @@ struct BLEPeerInfo: Equatable {
     var signingPublicKey: Data?
     var isVerifiedNickname: Bool
     var lastSeen: Date
+    var capabilities: PeerCapabilities = []
 }
 
 struct BLEPeerAnnounceUpdate: Equatable {
@@ -107,6 +108,10 @@ struct BLEPeerRegistry {
         peers[peerID]?.noisePublicKey?.sha256Fingerprint()
     }
 
+    func capabilities(for peerID: PeerID) -> PeerCapabilities {
+        peers[peerID.toShort()]?.capabilities ?? []
+    }
+
     func displayNicknames(selfNickname: String) -> [PeerID: String] {
         let connected = peers.filter { $0.value.isConnected }
         let tuples = connected.map { ($0.key, $0.value.nickname, true) }
@@ -125,7 +130,8 @@ struct BLEPeerRegistry {
                 nickname: resolvedNames[info.peerID] ?? info.nickname,
                 isConnected: info.isConnected,
                 noisePublicKey: info.noisePublicKey,
-                lastSeen: info.lastSeen
+                lastSeen: info.lastSeen,
+                isVerified: info.isVerifiedNickname
             )
         }
     }
@@ -156,7 +162,8 @@ struct BLEPeerRegistry {
         noisePublicKey: Data,
         signingPublicKey: Data?,
         isConnected: Bool,
-        now: Date
+        now: Date,
+        capabilities: PeerCapabilities = []
     ) -> BLEPeerAnnounceUpdate {
         let existing = peers[peerID]
         let update = BLEPeerAnnounceUpdate(
@@ -172,7 +179,8 @@ struct BLEPeerRegistry {
             noisePublicKey: noisePublicKey,
             signingPublicKey: signingPublicKey,
             isVerifiedNickname: true,
-            lastSeen: now
+            lastSeen: now,
+            capabilities: capabilities
         )
 
         return update

bitchat/Services/BLE/BLEPublicMessageHandler.swift

@@ -0,0 +1,131 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+/// Narrow environment for `BLEPublicMessageHandler`.
+///
+/// All queue hops (collections registry reads, BLE-queue link-state reads,
+/// main-actor UI notification) live inside the closures supplied by
+/// `BLEService`, keeping the handler queue-agnostic and synchronously testable.
+struct BLEPublicMessageHandlerEnvironment {
+    /// Local peer identity at the time the message is handled.
+    let localPeerID: () -> PeerID
+    /// Local nickname used for sender resolution and collision checks.
+    let localNickname: () -> String
+    /// Current time source.
+    let now: () -> Date
+    /// Snapshot of known peers keyed by ID (registry read).
+    let peersSnapshot: () -> [PeerID: BLEPeerInfo]
+    /// Verifies a packet's signature against a known signing public key.
+    let verifyPacketSignature: (_ packet: BitchatPacket, _ signingPublicKey: Data) -> Bool
+    /// Resolves a display name from a verified packet signature for peers missing from the registry.
+    let signedSenderDisplayName: (_ packet: BitchatPacket, _ peerID: PeerID) -> String?
+    /// Tracks the broadcast message packet for gossip sync.
+    let trackPacketSeen: (BitchatPacket) -> Void
+    /// Direct link state for the peer (BLE-queue read).
+    let linkState: (PeerID) -> (hasPeripheral: Bool, hasCentral: Bool)
+    /// Resolves and consumes the original message ID for our own re-broadcast.
+    let takeSelfBroadcastMessageID: (BitchatPacket) -> String?
+    /// Delivers `.publicMessageReceived` to the UI as one main-actor hop.
+    let deliverPublicMessage: (
+        _ peerID: PeerID,
+        _ nickname: String,
+        _ content: String,
+        _ timestamp: Date,
+        _ messageID: String?
+    ) -> Void
+}
+
+/// Orchestrates inbound public (broadcast) messages: freshness/self-echo
+/// policy, sender display-name resolution, gossip tracking, payload decoding,
+/// and UI delivery.
+final class BLEPublicMessageHandler {
+    private let environment: BLEPublicMessageHandlerEnvironment
+
+    init(environment: BLEPublicMessageHandlerEnvironment) {
+        self.environment = environment
+    }
+
+    func handle(_ packet: BitchatPacket, from peerID: PeerID) {
+        let env = environment
+        let now = env.now()
+        let messageDecision = BLEPublicMessagePolicy.evaluate(
+            packet: packet,
+            from: peerID,
+            localPeerID: env.localPeerID(),
+            now: now
+        )
+
+        let messagePolicy: BLEPublicMessageAcceptance
+        switch messageDecision {
+        case .accept(let acceptance):
+            messagePolicy = acceptance
+        case .reject(.selfEcho):
+            return
+        case .reject(.staleBroadcast(let ageSeconds)):
+            SecureLogger.debug("⏰ Ignoring stale broadcast message from \(peerID.id.prefix(8))… (age: \(ageSeconds)s)", category: .session)
+            return
+        }
+
+        // Snapshot peers to avoid concurrent mutation while iterating during nickname collision checks.
+        let peersSnapshot = env.peersSnapshot()
+
+        // Public messages are always signed by their sender. `senderID` is
+        // attacker-controlled, so registry membership alone is NOT proof of
+        // identity — a peer in the registry as "verified" could be impersonated
+        // by anyone spoofing their senderID. Require a valid packet signature
+        // from the claimed sender (our own echoes are exempt; they are matched
+        // by self-broadcast tracking below).
+        //
+        // Verify against the signing key already in the (synchronously-updated)
+        // peer registry first: identity-cache persistence is asynchronous, so a
+        // message arriving right after a verified announce would otherwise be
+        // dropped because `signedSenderDisplayName` only searches the persisted
+        // cache. Fall back to that persisted-identity lookup for peers not (yet)
+        // in the registry.
+        let isSelf = peerID == env.localPeerID()
+        let registrySigningKey = peersSnapshot[peerID]?.signingPublicKey
+        let verifiedViaRegistry = !isSelf
+            && (registrySigningKey.map { env.verifyPacketSignature(packet, $0) } ?? false)
+        let signedDisplayName = (isSelf || verifiedViaRegistry) ? nil : env.signedSenderDisplayName(packet, peerID)
+        guard isSelf || verifiedViaRegistry || signedDisplayName != nil else {
+            SecureLogger.warning("🚫 Dropping public message with missing/invalid signature for claimed sender \(peerID.id.prefix(8))…", category: .security)
+            return
+        }
+
+        // Authenticity is established; prefer the registry's collision-resolved
+        // display name, then the signature-derived name.
+        guard let senderNickname = BLEPeerSenderDisplayName.resolveKnownPeer(
+            peerID: peerID,
+            localPeerID: env.localPeerID(),
+            localNickname: env.localNickname(),
+            peers: peersSnapshot,
+            allowConnectedUnverified: false
+        ) ?? signedDisplayName else {
+            SecureLogger.warning("🚫 Dropping public message from unknown peer \(peerID.id.prefix(8))…", category: .security)
+            return
+        }
+
+        if messagePolicy.shouldTrackForSync {
+            env.trackPacketSeen(packet)
+        }
+
+        guard let content = String(data: packet.payload, encoding: .utf8) else {
+            SecureLogger.error("❌ Failed to decode message payload as UTF-8", category: .session)
+            return
+        }
+        // Determine if we have a direct link to the sender
+        let directLink = env.linkState(peerID)
+        let hasDirectLink = directLink.hasPeripheral || directLink.hasCentral
+
+        let pathTag = hasDirectLink ? "direct" : "mesh"
+        SecureLogger.debug("💬 [\(senderNickname)] TTL:\(packet.ttl) (\(pathTag)) chars=\(content.count) bytes=\(packet.payload.count)", category: .session)
+
+        let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
+        var resolvedSelfMessageID: String? = nil
+        if peerID == env.localPeerID() {
+            resolvedSelfMessageID = env.takeSelfBroadcastMessageID(packet)
+        }
+        env.deliverPublicMessage(peerID, senderNickname, content, ts, resolvedSelfMessageID)
+    }
+}

bitchat/Services/BLE/BLEPublicMessagePolicy.swift

@@ -27,8 +27,15 @@ enum BLEPublicMessagePolicy {
         }
 
         let isBroadcast = BLEPacketFreshnessPolicy.isBroadcastRecipient(packet.recipientID)
+        // Acceptance window matches the gossip-sync serving window: a peer
+        // walking between partitions carries hours of public history, so the
+        // receive side must not drop what sync legitimately serves.
         if isBroadcast,
-           BLEPacketFreshnessPolicy.isStale(timestampMilliseconds: packet.timestamp, now: now) {
+           BLEPacketFreshnessPolicy.isStale(
+               timestampMilliseconds: packet.timestamp,
+               now: now,
+               maxAgeSeconds: TransportConfig.syncPublicMessageMaxAgeSeconds
+           ) {
             return .reject(.staleBroadcast(ageSeconds: BLEPacketFreshnessPolicy.ageSeconds(
                 timestampMilliseconds: packet.timestamp,
                 now: now

bitchat/Services/BLE/BLEReceivePipeline.swift

@@ -12,7 +12,13 @@ struct BLEReceivedPacketContext: Equatable {
 struct BLEReceivePipeline {
     static func context(for packet: BitchatPacket, localPeerID: PeerID) -> BLEReceivedPacketContext {
         let senderID = PeerID(hexData: packet.senderID)
-        let messageID = "\(senderID)-\(packet.timestamp)-\(packet.type)"
+        // Include a payload digest so that distinct packets sharing the same
+        // sender/timestamp(ms)/type are not collapsed as duplicates. The
+        // post-handshake flush sends queued messages, delivery and read receipts
+        // back-to-back within a single millisecond; without the digest every
+        // packet after the first would be silently dropped.
+        let digestPrefix = packet.payload.sha256Hash().prefix(4).hexEncodedString()
+        let messageID = "\(senderID)-\(packet.timestamp)-\(packet.type)-\(digestPrefix)"
         let messageType = MessageType(rawValue: packet.type)
         let allowSelfSyncReplay = packet.ttl == 0 && senderID == localPeerID
         let shouldDeduplicate = messageType != .fragment && !allowSelfSyncReplay
@@ -42,11 +48,16 @@ struct BLEReceivePipeline {
             senderIsSelf: senderID == localPeerID,
             recipientIsSelf: PeerID(hexData: packet.recipientID) == localPeerID,
             isEncrypted: packet.type == MessageType.noiseEncrypted.rawValue,
-            isDirectedEncrypted: packet.type == MessageType.noiseEncrypted.rawValue && packet.recipientID != nil,
+            // Courier envelopes are directed opaque ciphertext like DMs; a
+            // remote handover toward a relayed announce rides this same
+            // deterministic relay treatment instead of the broadcast clamp.
+            isDirectedEncrypted: (packet.type == MessageType.noiseEncrypted.rawValue
+                || packet.type == MessageType.courierEnvelope.rawValue) && packet.recipientID != nil,
             isFragment: packet.type == MessageType.fragment.rawValue,
             isDirectedFragment: packet.type == MessageType.fragment.rawValue && packet.recipientID != nil,
             isHandshake: packet.type == MessageType.noiseHandshake.rawValue,
             isAnnounce: packet.type == MessageType.announce.rawValue,
+            isRequestSync: packet.type == MessageType.requestSync.rawValue,
             degree: degree,
             highDegreeThreshold: highDegreeThreshold
         )

bitchat/Services/BLE/BLERouteForwardingPolicy.swift

@@ -35,6 +35,14 @@ struct BLERouteForwardingPolicy {
         routingPeer: (Data) -> PeerID?,
         isPeerConnected: (PeerID) -> Bool
     ) -> BLERouteForwardingPlan {
+        // REQUEST_SYNC is link-local: never forward it, on the flood path or
+        // the source-routed path. A crafted request with a route and TTL
+        // headroom must not be able to fan a full-store replay out to the next
+        // hop. Suppressing here also short-circuits the flood relay.
+        if packet.type == MessageType.requestSync.rawValue {
+            return .suppressFloodRelay
+        }
+
         if PeerID(hexData: packet.recipientID) == localPeerID {
             return .suppressFloodRelay
         }

bitchat/Services/CommandProcessor.swift

@@ -31,7 +31,6 @@ protocol CommandContextProvider: AnyObject {
     var activeChannel: ChannelID { get }
     var selectedPrivateChatPeer: PeerID? { get }
     var blockedUsers: Set<String> { get }
-    var privateChats: [PeerID: [BitchatMessage]] { get set }
     var idBridge: NostrIdentityBridge { get }
 
     // MARK: - Peer Lookup
@@ -43,6 +42,8 @@ protocol CommandContextProvider: AnyObject {
     func startPrivateChat(with peerID: PeerID)
     func sendPrivateMessage(_ content: String, to peerID: PeerID)
     func clearCurrentPublicTimeline()
+    /// Empties the peer's chat (single-writer store intent for `/clear`).
+    func clearPrivateChat(_ peerID: PeerID)
     func sendPublicRaw(_ content: String)
 
     // MARK: - System Messages
@@ -50,8 +51,9 @@ protocol CommandContextProvider: AnyObject {
     func addPublicSystemMessage(_ content: String)
 
     // MARK: - Favorites
+    /// Toggles the favorite via the unified peer flow, which persists by the
+    /// real noise key and notifies the peer over mesh or Nostr.
     func toggleFavorite(peerID: PeerID)
-    func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool)
 }
 
 /// Processes chat commands in a focused, efficient way
@@ -104,11 +106,28 @@ final class CommandProcessor {
         case "/unfav":
             if inGeoPublic || inGeoDM { return .error(message: "favorites are only for mesh peers in #mesh") }
             return handleFavorite(args, add: false)
+        case "/help":
+            return .success(message: Self.helpText)
         default:
-            return .error(message: "unknown command: \(cmd)")
+            return .error(message: "unknown command: \(cmd) — type /help for commands")
         }
     }
 
+    /// Local-only command reference, printed as a system message. The
+    /// suggestion panel hides once arguments are typed, and typos used to
+    /// dead-end in a bare "unknown command" — this is the way out.
+    static let helpText = """
+    commands:
+    /msg @name [message] — start a private chat
+    /who — list who's here
+    /clear — clear this chat
+    /hug @name — send a hug
+    /slap @name — slap with a large trout
+    /block @name · /unblock @name
+    /fav @name · /unfav @name — favorites (mesh only)
+    /help — this list
+    """
+
     // MARK: - Command Handlers
     
     private func handleMessage(_ args: String) -> CommandResult {
@@ -160,7 +179,7 @@ final class CommandProcessor {
     
     private func handleClear() -> CommandResult {
         if let peerID = contextProvider?.selectedPrivateChatPeer {
-            contextProvider?.privateChats[peerID]?.removeAll()
+            contextProvider?.clearPrivateChat(peerID)
         } else {
             contextProvider?.clearCurrentPublicTimeline()
         }
@@ -317,34 +336,31 @@ final class CommandProcessor {
         guard !targetName.isEmpty else {
             return .error(message: "usage: /\(add ? "fav" : "unfav") <nickname>")
         }
-        
+
         let nickname = targetName.hasPrefix("@") ? String(targetName.dropFirst()) : targetName
-        
-        guard let peerID = contextProvider?.getPeerIDForNickname(nickname),
-              let noisePublicKey = Data(hexString: peerID.id) else {
+
+        guard let peerID = contextProvider?.getPeerIDForNickname(nickname) else {
             return .error(message: "can't find peer: \(nickname)")
         }
-        
-        if add {
-            let existingFavorite = FavoritesPersistenceService.shared.getFavoriteStatus(for: noisePublicKey)
-            FavoritesPersistenceService.shared.addFavorite(
-                peerNoisePublicKey: noisePublicKey,
-                peerNostrPublicKey: existingFavorite?.peerNostrPublicKey,
-                peerNickname: nickname
-            )
-            
-            contextProvider?.toggleFavorite(peerID: peerID)
-            contextProvider?.sendFavoriteNotification(to: peerID, isFavorite: true)
-            
-            return .success(message: "added \(nickname) to favorites")
+
+        // Resolve current state by the peer's real noise key. The resolved
+        // peerID is either the short 16-hex mesh ID or the full 64-hex
+        // noise-key ID (offline favorite row) — never the noise key itself.
+        let isCurrentlyFavorite: Bool
+        if let noiseKey = peerID.noiseKey {
+            isCurrentlyFavorite = FavoritesPersistenceService.shared.isFavorite(noiseKey)
         } else {
-            FavoritesPersistenceService.shared.removeFavorite(peerNoisePublicKey: noisePublicKey)
-            
-            contextProvider?.toggleFavorite(peerID: peerID)
-            contextProvider?.sendFavoriteNotification(to: peerID, isFavorite: false)
-            
-            return .success(message: "removed \(nickname) from favorites")
+            isCurrentlyFavorite = FavoritesPersistenceService.shared.getFavoriteStatus(forPeerID: peerID)?.isFavorite ?? false
         }
+
+        guard add != isCurrentlyFavorite else {
+            return .success(message: add ? "\(nickname) is already a favorite" : "\(nickname) is not a favorite")
+        }
+
+        // toggleFavorite persists by the real noise key and notifies the peer.
+        contextProvider?.toggleFavorite(peerID: peerID)
+
+        return .success(message: add ? "added \(nickname) to favorites" : "removed \(nickname) from favorites")
     }
     
 }

bitchat/Services/Courier/CourierStore.swift

@@ -0,0 +1,352 @@
+//
+// CourierStore.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import BitFoundation
+import BitLogger
+import Combine
+import Foundation
+
+/// Trust level of a courier deposit, decided by the caller's policy.
+/// Favorites get the larger quota and are never evicted to make room for
+/// verified-tier mail; verified (signature-verified announce, not a mutual
+/// favorite) get a small quota so a crowd of strangers can still carry mail.
+enum CourierDepositTier: String, Codable {
+    case favorite
+    case verified
+}
+
+/// Holds courier envelopes this device is carrying for offline third parties.
+///
+/// Envelopes are opaque ciphertext; this store never learns sender,
+/// recipient, or content. Strict quotas keep the device from becoming a
+/// public mailbag: bounded count, bounded per-depositor count by trust tier,
+/// bounded size, and a 24-hour lifetime aligned with the outbox retention
+/// policy. Carried mail is included in the panic wipe.
+final class CourierStore {
+    struct StoredEnvelope: Codable, Equatable {
+        let recipientTag: Data
+        let expiry: UInt64
+        let ciphertext: Data
+        let depositorNoiseKey: Data
+        let storedAt: Date
+        var tier: CourierDepositTier
+        /// Remaining spray-and-wait budget (1 = carry-only).
+        var copies: UInt8
+        /// Couriers this envelope was already sprayed to, so a repeat announce
+        /// from the same peer doesn't burn budget on a copy they already hold.
+        var sprayedTo: Set<Data>
+        /// Last speculative multi-hop handover toward a relayed announce.
+        var lastRemoteHandoverAt: Date?
+
+        var envelope: CourierEnvelope {
+            CourierEnvelope(recipientTag: recipientTag, expiry: expiry, ciphertext: ciphertext, copies: copies)
+        }
+
+        init(
+            recipientTag: Data,
+            expiry: UInt64,
+            ciphertext: Data,
+            depositorNoiseKey: Data,
+            storedAt: Date,
+            tier: CourierDepositTier,
+            copies: UInt8,
+            sprayedTo: Set<Data> = [],
+            lastRemoteHandoverAt: Date? = nil
+        ) {
+            self.recipientTag = recipientTag
+            self.expiry = expiry
+            self.ciphertext = ciphertext
+            self.depositorNoiseKey = depositorNoiseKey
+            self.storedAt = storedAt
+            self.tier = tier
+            self.copies = copies
+            self.sprayedTo = sprayedTo
+            self.lastRemoteHandoverAt = lastRemoteHandoverAt
+        }
+
+        // Files written before tiers/spray lack the newer fields; treat that
+        // mail as favorite-tier carry-only, which is what it was.
+        init(from decoder: Decoder) throws {
+            let container = try decoder.container(keyedBy: CodingKeys.self)
+            recipientTag = try container.decode(Data.self, forKey: .recipientTag)
+            expiry = try container.decode(UInt64.self, forKey: .expiry)
+            ciphertext = try container.decode(Data.self, forKey: .ciphertext)
+            depositorNoiseKey = try container.decode(Data.self, forKey: .depositorNoiseKey)
+            storedAt = try container.decode(Date.self, forKey: .storedAt)
+            tier = try container.decodeIfPresent(CourierDepositTier.self, forKey: .tier) ?? .favorite
+            copies = try container.decodeIfPresent(UInt8.self, forKey: .copies) ?? 1
+            sprayedTo = try container.decodeIfPresent(Set<Data>.self, forKey: .sprayedTo) ?? []
+            lastRemoteHandoverAt = try container.decodeIfPresent(Date.self, forKey: .lastRemoteHandoverAt)
+        }
+    }
+
+    enum Limits {
+        static let maxEnvelopes = 40
+        /// Verified-tier mail can never crowd out favorites' share.
+        static let maxVerifiedEnvelopes = 20
+        static let maxPerFavoriteDepositor = 5
+        static let maxPerVerifiedDepositor = 2
+        /// Slack on top of the 24h lifetime for depositor clock skew.
+        static let maxExpirySlack: TimeInterval = 60 * 60
+    }
+
+    static let shared = CourierStore()
+
+    /// Number of envelopes currently carried, published on the main thread
+    /// so the UI can show a "carrying mail" indicator.
+    @Published private(set) var carriedCount: Int = 0
+
+    /// Fast path so hot code (announce handling) can skip tag computation.
+    var isEmpty: Bool {
+        queue.sync { envelopes.isEmpty }
+    }
+
+    private var envelopes: [StoredEnvelope] = []
+    private let queue = DispatchQueue(label: "chat.bitchat.courier.store")
+    private let fileURL: URL?
+    private let now: () -> Date
+
+    /// - Parameter fileURL: Overrides the on-disk location (tests). Ignored
+    ///   when `persistsToDisk` is false.
+    init(persistsToDisk: Bool = true, fileURL: URL? = nil, now: @escaping () -> Date = Date.init) {
+        self.now = now
+        self.fileURL = persistsToDisk ? (fileURL ?? Self.defaultFileURL()) : nil
+        loadFromDisk()
+    }
+
+    // MARK: - Depositing (courier side)
+
+    /// Accept an envelope from a depositor. Returns false when quotas or
+    /// validity checks reject it. Trust policy (which tier a depositor gets,
+    /// if any) is the caller's responsibility; this store only enforces
+    /// resource bounds.
+    @discardableResult
+    func deposit(_ envelope: CourierEnvelope, from depositorNoiseKey: Data, tier: CourierDepositTier = .favorite) -> Bool {
+        let date = now()
+        guard envelope.recipientTag.count == CourierEnvelope.tagLength,
+              !envelope.ciphertext.isEmpty,
+              envelope.ciphertext.count <= CourierEnvelope.maxCiphertextBytes,
+              !envelope.isExpired(at: date) else {
+            return false
+        }
+        // Reject expiries beyond the policy lifetime so depositors can't pin
+        // storage longer than the outbox would retain the message itself.
+        let maxExpiry = date.addingTimeInterval(CourierEnvelope.maxLifetimeSeconds + Limits.maxExpirySlack)
+        guard envelope.expiry <= UInt64(maxExpiry.timeIntervalSince1970 * 1000) else {
+            return false
+        }
+
+        return queue.sync {
+            pruneExpiredLocked(at: date)
+
+            // Identical ciphertext is the same envelope; accept idempotently,
+            // keeping the larger spray budget (bounded by maxCopies either way).
+            if let existing = envelopes.firstIndex(where: { $0.ciphertext == envelope.ciphertext }) {
+                envelopes[existing].copies = max(envelopes[existing].copies, envelope.copies)
+                persistLocked()
+                return true
+            }
+
+            let perDepositorLimit = tier == .favorite ? Limits.maxPerFavoriteDepositor : Limits.maxPerVerifiedDepositor
+            guard envelopes.filter({ $0.depositorNoiseKey == depositorNoiseKey }).count < perDepositorLimit else {
+                SecureLogger.debug("📦 Courier deposit rejected: per-depositor quota reached (\(tier.rawValue))", category: .session)
+                return false
+            }
+            if tier == .verified,
+               envelopes.filter({ $0.tier == .verified }).count >= Limits.maxVerifiedEnvelopes {
+                SecureLogger.debug("📦 Courier deposit rejected: verified-tier pool full", category: .session)
+                return false
+            }
+            if envelopes.count >= Limits.maxEnvelopes {
+                // Oldest-first eviction, shedding verified-tier mail before
+                // favorites' so open couriering can't crowd out trusted mail.
+                // A verified deposit never displaces a favorite: when only
+                // favorite mail is stored, it is rejected instead.
+                if let victim = envelopes.firstIndex(where: { $0.tier == .verified }) {
+                    let evicted = envelopes.remove(at: victim)
+                    SecureLogger.debug("📦 Courier store full - evicted verified envelope stored at \(evicted.storedAt)", category: .session)
+                } else if tier == .favorite {
+                    let evicted = envelopes.removeFirst()
+                    SecureLogger.debug("📦 Courier store full - evicted favorite envelope stored at \(evicted.storedAt)", category: .session)
+                } else {
+                    SecureLogger.debug("📦 Courier deposit rejected: store full of favorite-tier mail", category: .session)
+                    return false
+                }
+            }
+
+            envelopes.append(StoredEnvelope(
+                recipientTag: envelope.recipientTag,
+                expiry: envelope.expiry,
+                ciphertext: envelope.ciphertext,
+                depositorNoiseKey: depositorNoiseKey,
+                storedAt: date,
+                tier: tier,
+                copies: envelope.copies
+            ))
+            persistLocked()
+            return true
+        }
+    }
+
+    // MARK: - Handover (on encountering a peer)
+
+    /// Remove and return all envelopes addressed to the given peer, matching
+    /// the rotating recipient tag across adjacent days. Envelopes are removed
+    /// optimistically: handover happens over a live link, and the depositor's
+    /// outbox still retains the original for direct delivery.
+    func takeEnvelopes(for noiseStaticKey: Data) -> [CourierEnvelope] {
+        let date = now()
+        let candidates = CourierEnvelope.candidateTags(noiseStaticKey: noiseStaticKey, around: date)
+        return queue.sync {
+            pruneExpiredLocked(at: date)
+            let matched = envelopes.filter { candidates.contains($0.recipientTag) }
+            guard !matched.isEmpty else { return [] }
+            envelopes.removeAll { stored in matched.contains(stored) }
+            persistLocked()
+            return matched.map(\.envelope)
+        }
+    }
+
+    /// Envelopes addressed to a recipient we heard from via a *relayed*
+    /// announce. Non-destructive: a multi-hop send is speculative, so the
+    /// envelope stays carried until a direct handover or expiry. The per-
+    /// envelope cooldown keeps repeated announces from re-flooding the mesh.
+    func envelopesForRemoteHandover(recipientNoiseKey: Data, cooldown: TimeInterval) -> [CourierEnvelope] {
+        let date = now()
+        let candidates = CourierEnvelope.candidateTags(noiseStaticKey: recipientNoiseKey, around: date)
+        return queue.sync {
+            pruneExpiredLocked(at: date)
+            var matched: [CourierEnvelope] = []
+            for index in envelopes.indices where candidates.contains(envelopes[index].recipientTag) {
+                if let last = envelopes[index].lastRemoteHandoverAt,
+                   date.timeIntervalSince(last) < cooldown {
+                    continue
+                }
+                envelopes[index].lastRemoteHandoverAt = date
+                // The delivered copy carries no spray budget.
+                matched.append(envelopes[index].envelope.withCopies(1))
+            }
+            if !matched.isEmpty { persistLocked() }
+            return matched
+        }
+    }
+
+    // MARK: - Spray-and-wait (on encountering another courier)
+
+    /// Envelopes to re-deposit with a courier we just encountered, each with
+    /// half its remaining budget (binary spray). Skips envelopes the courier
+    /// deposited, envelopes addressed to them (those ride the handover path),
+    /// carry-only envelopes, and couriers already sprayed.
+    func takeSprayCopies(for courierNoiseKey: Data) -> [CourierEnvelope] {
+        let date = now()
+        let courierTags = CourierEnvelope.candidateTags(noiseStaticKey: courierNoiseKey, around: date)
+        return queue.sync {
+            pruneExpiredLocked(at: date)
+            var sprayed: [CourierEnvelope] = []
+            for index in envelopes.indices {
+                let stored = envelopes[index]
+                guard stored.copies > 1,
+                      stored.depositorNoiseKey != courierNoiseKey,
+                      !stored.sprayedTo.contains(courierNoiseKey),
+                      !courierTags.contains(stored.recipientTag) else { continue }
+                let given = stored.copies / 2
+                envelopes[index].copies = stored.copies - given
+                envelopes[index].sprayedTo.insert(courierNoiseKey)
+                sprayed.append(stored.envelope.withCopies(given))
+            }
+            if !sprayed.isEmpty { persistLocked() }
+            return sprayed
+        }
+    }
+
+    // MARK: - Maintenance
+
+    func pruneExpired() {
+        let date = now()
+        queue.sync {
+            pruneExpiredLocked(at: date)
+            persistLocked()
+        }
+    }
+
+    /// Panic wipe: drop all carried mail from memory and disk.
+    func wipe() {
+        queue.sync {
+            envelopes.removeAll()
+            if let fileURL {
+                try? FileManager.default.removeItem(at: fileURL)
+            }
+            publishCountLocked()
+        }
+    }
+
+    // MARK: - Internals (call only on `queue`)
+
+    private func pruneExpiredLocked(at date: Date) {
+        let before = envelopes.count
+        envelopes.removeAll { $0.envelope.isExpired(at: date) }
+        if envelopes.count != before {
+            SecureLogger.debug("📦 Courier store pruned \(before - envelopes.count) expired envelope(s)", category: .session)
+        }
+    }
+
+    private func publishCountLocked() {
+        let count = envelopes.count
+        DispatchQueue.main.async { [weak self] in
+            self?.carriedCount = count
+        }
+    }
+
+    private func persistLocked() {
+        publishCountLocked()
+        guard let fileURL else { return }
+        do {
+            if envelopes.isEmpty {
+                try? FileManager.default.removeItem(at: fileURL)
+                return
+            }
+            try FileManager.default.createDirectory(
+                at: fileURL.deletingLastPathComponent(),
+                withIntermediateDirectories: true
+            )
+            let data = try JSONEncoder().encode(envelopes)
+            var options: Data.WritingOptions = [.atomic]
+            #if os(iOS)
+            options.insert(.completeFileProtection)
+            #endif
+            try data.write(to: fileURL, options: options)
+        } catch {
+            SecureLogger.error("Failed to persist courier store: \(error)", category: .session)
+        }
+    }
+
+    private func loadFromDisk() {
+        guard let fileURL else { return }
+        queue.sync {
+            guard let data = try? Data(contentsOf: fileURL),
+                  let stored = try? JSONDecoder().decode([StoredEnvelope].self, from: data) else {
+                return
+            }
+            envelopes = stored
+            pruneExpiredLocked(at: now())
+            publishCountLocked()
+        }
+    }
+
+    private static func defaultFileURL() -> URL? {
+        guard let base = try? FileManager.default.url(
+            for: .applicationSupportDirectory,
+            in: .userDomainMask,
+            appropriateFor: nil,
+            create: true
+        ) else { return nil }
+        return base
+            .appendingPathComponent("courier", isDirectory: true)
+            .appendingPathComponent("envelopes.json")
+    }
+}

bitchat/Services/Courier/MessageOutboxStore.swift

@@ -0,0 +1,156 @@
+//
+// MessageOutboxStore.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import BitFoundation
+import BitLogger
+import CryptoKit
+import Foundation
+import Security
+
+/// Disk persistence for the MessageRouter outbox, so private messages queued
+/// for an offline peer survive an app kill instead of silently evaporating.
+///
+/// Nothing else in the app persists message plaintext, and this store keeps
+/// that property: the outbox is sealed with a ChaChaPoly key that lives only
+/// in the Keychain (after-first-unlock, this device only), on top of iOS file
+/// protection. Wiped on panic alongside the courier store.
+final class MessageOutboxStore {
+    struct QueuedMessage: Codable, Equatable {
+        let content: String
+        let nickname: String
+        let messageID: String
+        let timestamp: Date
+        var sendAttempts: Int
+        /// Noise keys of couriers already carrying this message, so deposit
+        /// retries add couriers instead of re-burning the same ones.
+        var depositedCourierKeys: Set<Data>
+
+        init(
+            content: String,
+            nickname: String,
+            messageID: String,
+            timestamp: Date,
+            sendAttempts: Int = 0,
+            depositedCourierKeys: Set<Data> = []
+        ) {
+            self.content = content
+            self.nickname = nickname
+            self.messageID = messageID
+            self.timestamp = timestamp
+            self.sendAttempts = sendAttempts
+            self.depositedCourierKeys = depositedCourierKeys
+        }
+
+        init(from decoder: Decoder) throws {
+            let container = try decoder.container(keyedBy: CodingKeys.self)
+            content = try container.decode(String.self, forKey: .content)
+            nickname = try container.decode(String.self, forKey: .nickname)
+            messageID = try container.decode(String.self, forKey: .messageID)
+            timestamp = try container.decode(Date.self, forKey: .timestamp)
+            sendAttempts = try container.decodeIfPresent(Int.self, forKey: .sendAttempts) ?? 0
+            depositedCourierKeys = try container.decodeIfPresent(Set<Data>.self, forKey: .depositedCourierKeys) ?? []
+        }
+    }
+
+    private static let keychainService = "chat.bitchat.outbox"
+    private static let keychainKey = "outbox-encryption-key"
+
+    private let fileURL: URL?
+    private let keychain: KeychainManagerProtocol
+
+    init(keychain: KeychainManagerProtocol, fileURL: URL? = nil) {
+        self.keychain = keychain
+        self.fileURL = fileURL ?? Self.defaultFileURL()
+    }
+
+    // MARK: - API (call from the router's actor; IO is small and atomic)
+
+    func load() -> [PeerID: [QueuedMessage]] {
+        guard let fileURL,
+              let sealed = try? Data(contentsOf: fileURL),
+              let key = encryptionKey(createIfMissing: false),
+              let box = try? ChaChaPoly.SealedBox(combined: sealed),
+              let plaintext = try? ChaChaPoly.open(box, using: key),
+              let decoded = try? JSONDecoder().decode([String: [QueuedMessage]].self, from: plaintext) else {
+            return [:]
+        }
+        var outbox: [PeerID: [QueuedMessage]] = [:]
+        for (peerID, queue) in decoded where !queue.isEmpty {
+            outbox[PeerID(str: peerID)] = queue
+        }
+        return outbox
+    }
+
+    func save(_ outbox: [PeerID: [QueuedMessage]]) {
+        guard let fileURL else { return }
+        let flattened = outbox.filter { !$0.value.isEmpty }
+        guard !flattened.isEmpty else {
+            try? FileManager.default.removeItem(at: fileURL)
+            return
+        }
+        guard let key = encryptionKey(createIfMissing: true) else {
+            SecureLogger.error("Outbox not persisted: no encryption key available", category: .session)
+            return
+        }
+        do {
+            let keyed = Dictionary(uniqueKeysWithValues: flattened.map { ($0.key.id, $0.value) })
+            let plaintext = try JSONEncoder().encode(keyed)
+            let sealed = try ChaChaPoly.seal(plaintext, using: key).combined
+            try FileManager.default.createDirectory(
+                at: fileURL.deletingLastPathComponent(),
+                withIntermediateDirectories: true
+            )
+            var options: Data.WritingOptions = [.atomic]
+            #if os(iOS)
+            options.insert(.completeFileProtection)
+            #endif
+            try sealed.write(to: fileURL, options: options)
+        } catch {
+            SecureLogger.error("Failed to persist outbox: \(error)", category: .session)
+        }
+    }
+
+    /// Panic wipe: drop the queued mail and the key that could ever read it.
+    func wipe() {
+        if let fileURL {
+            try? FileManager.default.removeItem(at: fileURL)
+        }
+        keychain.delete(key: Self.keychainKey, service: Self.keychainService)
+    }
+
+    // MARK: - Internals
+
+    private func encryptionKey(createIfMissing: Bool) -> SymmetricKey? {
+        if let data = keychain.load(key: Self.keychainKey, service: Self.keychainService), data.count == 32 {
+            return SymmetricKey(data: data)
+        }
+        guard createIfMissing else { return nil }
+        let key = SymmetricKey(size: .bits256)
+        let data = key.withUnsafeBytes { Data($0) }
+        // After-first-unlock so queued mail can flush from background BLE wakes.
+        keychain.save(
+            key: Self.keychainKey,
+            data: data,
+            service: Self.keychainService,
+            accessible: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        )
+        return key
+    }
+
+    private static func defaultFileURL() -> URL? {
+        guard let base = try? FileManager.default.url(
+            for: .applicationSupportDirectory,
+            in: .userDomainMask,
+            appropriateFor: nil,
+            create: true
+        ) else { return nil }
+        return base
+            .appendingPathComponent("courier", isDirectory: true)
+            .appendingPathComponent("outbox.sealed")
+    }
+}

bitchat/Services/Courier/StoreAndForwardMetrics.swift

@@ -0,0 +1,74 @@
+//
+// StoreAndForwardMetrics.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import BitLogger
+import Foundation
+
+/// Privacy-safe local counters for the store-and-forward stack: bare event
+/// tallies with no message IDs, peer identities, or timestamps, so delivery
+/// behavior can be measured on-device without recording who talked to whom.
+/// Log-only surface — nothing here ever leaves the device.
+final class StoreAndForwardMetrics {
+    enum Event: String, CaseIterable {
+        /// A private message entered the outbox (no prompt route available).
+        case outboxQueued = "outbox.queued"
+        /// A retained message was re-sent on a flush.
+        case outboxResent = "outbox.resent"
+        /// A delivery/read ack cleared a retained message.
+        case outboxDelivered = "outbox.delivered"
+        /// A retained message was dropped (attempt cap, TTL, or overflow).
+        case outboxDropped = "outbox.dropped"
+        /// We handed sealed mail to a courier.
+        case courierDeposited = "courier.deposited"
+        /// We accepted sealed mail to carry for a third party.
+        case courierAccepted = "courier.accepted"
+        /// We handed carried mail to its recipient over a direct link.
+        case courierHandedOver = "courier.handedOver"
+        /// We pushed carried mail toward a recipient heard via relay.
+        case courierRemoteHandover = "courier.remoteHandover"
+        /// We split spray copies to another courier.
+        case courierSprayed = "courier.sprayed"
+        /// Couriered mail addressed to us was opened and delivered.
+        case courierOpened = "courier.opened"
+    }
+
+    static let shared = StoreAndForwardMetrics()
+
+    private let lock = NSLock()
+    private var counts: [String: Int]
+    private let defaults: UserDefaults
+    private static let defaultsKey = "chat.bitchat.storeAndForwardMetrics"
+
+    init(defaults: UserDefaults = .standard) {
+        self.defaults = defaults
+        self.counts = defaults.dictionary(forKey: Self.defaultsKey) as? [String: Int] ?? [:]
+    }
+
+    func record(_ event: Event) {
+        lock.lock()
+        let total = (counts[event.rawValue] ?? 0) + 1
+        counts[event.rawValue] = total
+        defaults.set(counts, forKey: Self.defaultsKey)
+        lock.unlock()
+        SecureLogger.debug("📊 S&F \(event.rawValue) → \(total)", category: .session)
+    }
+
+    func snapshot() -> [String: Int] {
+        lock.lock()
+        defer { lock.unlock() }
+        return counts
+    }
+
+    /// Included in the panic wipe alongside the stores it describes.
+    func reset() {
+        lock.lock()
+        counts = [:]
+        defaults.removeObject(forKey: Self.defaultsKey)
+        lock.unlock()
+    }
+}

bitchat/Services/FavoritesPersistenceService.swift

@@ -34,7 +34,23 @@ final class FavoritesPersistenceService: ObservableObject {
     
     static let shared = FavoritesPersistenceService()
 
-    init(keychain: KeychainManagerProtocol = KeychainManager()) {
+    /// Default keychain for the `shared` singleton. Under test this is an
+    /// in-memory keychain so touching `shared` never blocks on securityd
+    /// (`SecItemCopyMatching` can hang in test environments) and never reads
+    /// or writes the developer's real keychain. Production behavior is
+    /// unchanged. Tests that need their own instance keep injecting a mock
+    /// via `init(keychain:)`.
+    private nonisolated static func makeDefaultKeychain() -> KeychainManagerProtocol {
+        // PreviewKeychainManager lives in _PreviewHelpers, a development
+        // asset excluded from archive builds — release code must not
+        // reference it. Tests always run Debug, so the guard is lossless.
+        #if DEBUG
+        if TestEnvironment.isRunningTests { return PreviewKeychainManager() }
+        #endif
+        return KeychainManager()
+    }
+
+    init(keychain: KeychainManagerProtocol = FavoritesPersistenceService.makeDefaultKeychain()) {
         self.keychain = keychain
         loadFavorites()
         
@@ -125,7 +141,13 @@ final class FavoritesPersistenceService: ObservableObject {
         peerNostrPublicKey: String? = nil
     ) {
         let existing = favorites[peerNoisePublicKey]
-        let displayName = peerNickname ?? existing?.peerNickname ?? "Unknown"
+        // Callers that can't resolve the live nickname pass the "Unknown"
+        // placeholder (e.g. a notification arriving before the announce);
+        // never let it clobber a real stored nickname.
+        let incoming = peerNickname.flatMap { name in
+            (name.isEmpty || name == "Unknown") ? nil : name
+        }
+        let displayName = incoming ?? existing?.peerNickname ?? "Unknown"
         
         SecureLogger.info("📨 Received favorite notification: \(displayName) \(favorited ? "favorited" : "unfavorited") us", category: .session)
         

bitchat/Services/LocationNotesManager.swift

@@ -1,4 +1,5 @@
 import BitLogger
+import Combine
 import Foundation
 
 /// Dependencies for location notes, allowing tests to stub relay/identity behavior.
@@ -14,7 +15,9 @@ struct LocationNotesDependencies {
     var sendEvent: SendEvent
     var deriveIdentity: (_ geohash: String) throws -> NostrIdentity
     var now: () -> Date
-    
+    // Fires when the geo relay directory refreshes; used to retry after "no relays".
+    var relayDirectoryUpdates: AnyPublisher<Void, Never> = Empty(completeImmediately: false).eraseToAnyPublisher()
+
     private static let idBridge = NostrIdentityBridge()
 
     static let live = LocationNotesDependencies(
@@ -39,7 +42,11 @@ struct LocationNotesDependencies {
         deriveIdentity: { geohash in
             try idBridge.deriveIdentity(forGeohash: geohash)
         },
-        now: { Date() }
+        now: { Date() },
+        relayDirectoryUpdates: NotificationCenter.default
+            .publisher(for: .geoRelayDirectoryDidRefresh)
+            .map { _ in () }
+            .eraseToAnyPublisher()
     )
 }
 
@@ -77,6 +84,7 @@ final class LocationNotesManager: ObservableObject {
     @Published private(set) var errorMessage: String?
     private var subscriptionID: String?
     private var noteIDs = Set<String>() // O(1) duplicate detection
+    private var directoryUpdateCancellable: AnyCancellable?
     private let dependencies: LocationNotesDependencies
     private let maxNotesInMemory = 500 // Defensive cap (relay limit is 200)
 
@@ -101,6 +109,15 @@ final class LocationNotesManager: ObservableObject {
             SecureLogger.warning("LocationNotesManager: invalid geohash '\(norm)' (expected 8 valid base32 chars)", category: .session)
         }
         subscribe()
+        // The relay directory may load after init (remote fetch over Tor);
+        // retry automatically instead of staying stuck on "no relays".
+        directoryUpdateCancellable = dependencies.relayDirectoryUpdates
+            .sink { [weak self] in
+                Task { @MainActor [weak self] in
+                    guard let self, self.state == .noRelays else { return }
+                    self.subscribe()
+                }
+            }
     }
 
     func setGeohash(_ newGeohash: String) {

bitchat/Services/LocationStateManager.swift

@@ -594,6 +594,22 @@ final class LocationStateManager: NSObject, CLLocationManagerDelegate, Observabl
         }
     }
 
+    /// Removes all persisted location state and resets the in-memory view.
+    /// Used by the panic wipe — selected channel, teleport set and bookmarks
+    /// (which reveal where the user has been) must not survive on device.
+    func panicWipe() {
+        storage.removeObject(forKey: selectedChannelKey)
+        storage.removeObject(forKey: teleportedStoreKey)
+        storage.removeObject(forKey: bookmarksKey)
+        storage.removeObject(forKey: bookmarkNamesKey)
+        teleportedSet.removeAll()
+        bookmarkMembership.removeAll()
+        bookmarks = []
+        bookmarkNames = [:]
+        teleported = false
+        selectedChannel = .mesh
+    }
+
     private static func normalizeGeohash(_ s: String) -> String {
         let allowed = Set("0123456789bcdefghjkmnpqrstuvwxyz")
         return s

bitchat/Services/MessageRouter.swift

@@ -2,27 +2,80 @@ import BitLogger
 import BitFoundation
 import Foundation
 
+/// Trust and identity lookups the router needs to pick couriers. Backed by
+/// the favorites store in production; injectable for tests.
+struct CourierDirectory {
+    /// Noise static key for a peer we can address while they're offline.
+    var noiseKey: (PeerID) -> Data?
+    /// Whether a peer (by Noise static key) is a mutual favorite — the
+    /// preferred courier tier. Verified non-favorites are the fallback tier,
+    /// read off the transport snapshot.
+    var isTrustedCourier: (Data) -> Bool
+
+    @MainActor
+    static func favoritesBacked() -> CourierDirectory {
+        CourierDirectory(
+            noiseKey: { peerID in
+                // Offline favorites are addressed by the full 64-hex
+                // noise-key ID, which carries the key itself; the favorites
+                // lookup only resolves short 16-hex IDs.
+                peerID.noiseKey
+                    ?? FavoritesPersistenceService.shared.getFavoriteStatus(forPeerID: peerID)?.peerNoisePublicKey
+            },
+            isTrustedCourier: { noiseKey in
+                FavoritesPersistenceService.shared.isMutualFavorite(noiseKey)
+            }
+        )
+    }
+}
+
 /// Routes messages using available transports (Mesh, Nostr, etc.)
 @MainActor
 final class MessageRouter {
-    private let transports: [Transport]
+    typealias QueuedMessage = MessageOutboxStore.QueuedMessage
 
-    // Outbox entry with timestamp for TTL-based eviction
-    private struct QueuedMessage {
-        let content: String
-        let nickname: String
-        let messageID: String
-        let timestamp: Date
-    }
+    private let transports: [Transport]
+    private let now: () -> Date
+    private let courierDirectory: CourierDirectory
+    private let outboxStore: MessageOutboxStore?
+    private let metrics: StoreAndForwardMetrics?
+
+    /// Invoked whenever a retained private message is dropped without a
+    /// delivery ack (attempt cap, TTL expiry, or per-peer overflow eviction)
+    /// so the UI can surface the failure instead of leaving the message in a
+    /// stale "sending/sent" state forever.
+    var onMessageDropped: ((_ messageID: String, _ peerID: PeerID) -> Void)?
+
+    /// Invoked when a message with no reachable transport was handed to at
+    /// least one courier (a connected peer who will physically carry the
+    /// sealed envelope). Delivery stays best-effort: the outbox retains the
+    /// message until an ack arrives.
+    var onMessageCarried: ((_ messageID: String, _ peerID: PeerID) -> Void)?
 
     private var outbox: [PeerID: [QueuedMessage]] = [:]
 
     // Outbox limits to prevent unbounded memory growth
     private static let maxMessagesPerPeer = 100
     private static let messageTTLSeconds: TimeInterval = 24 * 60 * 60 // 24 hours
+    // Bound resends of messages sent on a weak reachability signal that never
+    // get a delivery ack (e.g. peer on an old client that doesn't ack).
+    private static let maxSendAttempts = 8
+    // Redundant couriers improve delivery odds; receivers dedup by message ID.
+    private static let maxCouriersPerMessage = 3
 
-    init(transports: [Transport]) {
+    init(
+        transports: [Transport],
+        now: @escaping () -> Date = Date.init,
+        courierDirectory: CourierDirectory? = nil,
+        outboxStore: MessageOutboxStore? = nil,
+        metrics: StoreAndForwardMetrics? = nil
+    ) {
         self.transports = transports
+        self.now = now
+        self.courierDirectory = courierDirectory ?? .favoritesBacked()
+        self.outboxStore = outboxStore
+        self.metrics = metrics
+        self.outbox = outboxStore?.load() ?? [:]
 
         // Observe favorites changes to learn Nostr mapping and flush queued messages
         NotificationCenter.default.addObserver(
@@ -39,7 +92,7 @@ final class MessageRouter {
             }
             // Handle key updates
             if let newKey = note.userInfo?["peerPublicKey"] as? Data,
-               let _ = note.userInfo?["isKeyUpdate"] as? Bool {
+               note.userInfo?["isKeyUpdate"] is Bool {
                 let peerID = PeerID(publicKey: newKey)
                 Task { @MainActor in
                     self.flushOutbox(for: peerID)
@@ -61,24 +114,192 @@ final class MessageRouter {
     // MARK: - Message Sending
 
     func sendPrivate(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
-        if let transport = reachableTransport(for: peerID) {
-            SecureLogger.debug("Routing PM via \(type(of: transport)) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
+        if let transport = connectedTransport(for: peerID) {
+            // A live link is a strong delivery signal; trust it outright.
+            SecureLogger.debug("Routing PM via \(type(of: transport)) (connected) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
             transport.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
-        } else {
-            // Queue for later with timestamp for TTL tracking
-            if outbox[peerID] == nil { outbox[peerID] = [] }
-
-            let message = QueuedMessage(content: content, nickname: recipientNickname, messageID: messageID, timestamp: Date())
-            outbox[peerID]?.append(message)
-
-            // Enforce per-peer size limit with FIFO eviction
-            if let count = outbox[peerID]?.count, count > Self.maxMessagesPerPeer {
-                let evicted = outbox[peerID]?.removeFirst()
-                SecureLogger.warning("📤 Outbox overflow for \(peerID.id.prefix(8))… - evicted oldest message: \(evicted?.messageID.prefix(8) ?? "?")…", category: .session)
-            }
-
-            SecureLogger.debug("Queued PM for \(peerID.id.prefix(8))… (no reachable transport) id=\(messageID.prefix(8))… queue=\(outbox[peerID]?.count ?? 0)", category: .session)
+            return
         }
+
+        let message = QueuedMessage(content: content, nickname: recipientNickname, messageID: messageID, timestamp: now(), sendAttempts: 1)
+        if let transport = reachableTransport(for: peerID) {
+            // Reachability without a connection is a freshness heuristic (e.g.
+            // the mesh retention window), so the send can silently go nowhere.
+            // Send now, but retain a copy until a delivery/read ack clears it;
+            // receivers dedup resends by message ID.
+            SecureLogger.debug("Routing PM via \(type(of: transport)) (reachable) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
+            transport.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
+            enqueue(message, for: peerID)
+            // "Reachable" without prompt delivery means the send only joined
+            // a queue (Nostr with relays down): also hand a sealed copy to
+            // any connected couriers rather than waiting for internet that
+            // may never come. Double delivery is harmless — receivers dedup
+            // by message ID, and delivered/read acks never downgrade.
+            if !transport.canDeliverPromptly(to: peerID) {
+                attemptCourierDeposit(messageID: messageID, for: peerID)
+            }
+        } else {
+            var unsent = message
+            unsent.sendAttempts = 0
+            enqueue(unsent, for: peerID)
+            SecureLogger.debug("Queued PM for \(peerID.id.prefix(8))… (no reachable transport) id=\(messageID.prefix(8))… queue=\(outbox[peerID]?.count ?? 0)", category: .session)
+            attemptCourierDeposit(messageID: messageID, for: peerID)
+        }
+    }
+
+    // MARK: - Couriers
+
+    /// Last resort when no transport can deliver promptly — the peer is
+    /// unreachable, or only reachable through a send queue waiting on
+    /// internet: seal the message to their known static key and hand it to
+    /// connected couriers who may physically encounter them. Mutual favorites
+    /// are preferred; signature-verified strangers fill remaining slots so a
+    /// crowd without favorites can still carry mail (envelopes are opaque
+    /// either way). The queued copy stays retained, so direct delivery still
+    /// wins if the peer reappears first (receivers dedup by message ID).
+    private func attemptCourierDeposit(messageID: String, for peerID: PeerID) {
+        guard let recipientKey = courierDirectory.noiseKey(peerID),
+              let entry = queuedMessage(messageID, for: peerID) else { return }
+        let remainingSlots = Self.maxCouriersPerMessage - entry.depositedCourierKeys.count
+        guard remainingSlots > 0 else { return }
+
+        for transport in transports {
+            let couriers = eligibleCouriers(
+                on: transport,
+                recipientKey: recipientKey,
+                excluding: entry.depositedCourierKeys,
+                limit: remainingSlots
+            )
+            guard !couriers.isEmpty else { continue }
+            if transport.sendCourierMessage(entry.content, messageID: messageID, recipientNoiseKey: recipientKey, via: couriers.map(\.peerID)) {
+                SecureLogger.debug("📦 PM \(messageID.prefix(8))… handed to \(couriers.count) courier(s) for \(peerID.id.prefix(8))…", category: .session)
+                recordCourierDeposit(messageID: messageID, for: peerID, courierKeys: couriers.map(\.noiseKey))
+                onMessageCarried?(messageID, peerID)
+                return
+            }
+        }
+    }
+
+    /// A courier candidate just connected: hand them any queued mail they are
+    /// not already carrying. This is what turns couriering from "a favorite
+    /// happened to be around at send time" into eventual spread — deposits
+    /// retry as eligible peers appear, until each message rides with
+    /// `maxCouriersPerMessage` distinct couriers or expires.
+    func courierBecameAvailable(_ peerID: PeerID) {
+        for transport in transports {
+            guard transport.isPeerConnected(peerID),
+                  let snapshot = transport.currentPeerSnapshots().first(where: { $0.peerID == peerID && $0.isConnected }),
+                  let courierKey = snapshot.noisePublicKey,
+                  courierDirectory.isTrustedCourier(courierKey) || snapshot.isVerified else { continue }
+
+            let currentDate = now()
+            for (recipient, queue) in outbox {
+                // Mail *to* this peer flushes directly on connect.
+                guard recipient != peerID,
+                      let recipientKey = courierDirectory.noiseKey(recipient),
+                      recipientKey != courierKey else { continue }
+                for message in queue {
+                    guard message.depositedCourierKeys.count < Self.maxCouriersPerMessage,
+                          !message.depositedCourierKeys.contains(courierKey),
+                          currentDate.timeIntervalSince(message.timestamp) <= Self.messageTTLSeconds else { continue }
+                    if transport.sendCourierMessage(message.content, messageID: message.messageID, recipientNoiseKey: recipientKey, via: [peerID]) {
+                        SecureLogger.debug("📦 Deposit retry: PM \(message.messageID.prefix(8))… handed to \(peerID.id.prefix(8))… for \(recipient.id.prefix(8))…", category: .session)
+                        recordCourierDeposit(messageID: message.messageID, for: recipient, courierKeys: [courierKey])
+                        onMessageCarried?(message.messageID, recipient)
+                    }
+                }
+            }
+            return
+        }
+    }
+
+    private struct CourierCandidate {
+        let peerID: PeerID
+        let noiseKey: Data
+    }
+
+    private func eligibleCouriers(
+        on transport: Transport,
+        recipientKey: Data,
+        excluding excludedKeys: Set<Data>,
+        limit: Int
+    ) -> [CourierCandidate] {
+        guard limit > 0 else { return [] }
+        let candidates = transport.currentPeerSnapshots().compactMap { snapshot -> (CourierCandidate, isFavorite: Bool)? in
+            guard snapshot.isConnected,
+                  let key = snapshot.noisePublicKey,
+                  key != recipientKey,
+                  !excludedKeys.contains(key) else { return nil }
+            let isFavorite = courierDirectory.isTrustedCourier(key)
+            guard isFavorite || snapshot.isVerified else { return nil }
+            return (CourierCandidate(peerID: snapshot.peerID, noiseKey: key), isFavorite)
+        }
+        return candidates
+            .sorted { $0.isFavorite && !$1.isFavorite }
+            .prefix(limit)
+            .map(\.0)
+    }
+
+    private func queuedMessage(_ messageID: String, for peerID: PeerID) -> QueuedMessage? {
+        outbox[peerID]?.first { $0.messageID == messageID }
+    }
+
+    private func recordCourierDeposit(messageID: String, for peerID: PeerID, courierKeys: [Data]) {
+        metrics?.record(.courierDeposited)
+        guard var queue = outbox[peerID],
+              let index = queue.firstIndex(where: { $0.messageID == messageID }) else { return }
+        queue[index].depositedCourierKeys.formUnion(courierKeys)
+        outbox[peerID] = queue
+        persistOutbox()
+    }
+
+    // MARK: - Outbox Management
+
+    /// A delivery or read ack confirms receipt; stop retaining the message.
+    func markDelivered(_ messageID: String) {
+        var cleared = false
+        for (peerID, queue) in outbox {
+            let filtered = queue.filter { $0.messageID != messageID }
+            guard filtered.count != queue.count else { continue }
+            outbox[peerID] = filtered.isEmpty ? nil : filtered
+            cleared = true
+        }
+        if cleared {
+            metrics?.record(.outboxDelivered)
+            persistOutbox()
+        }
+    }
+
+    private func enqueue(_ message: QueuedMessage, for peerID: PeerID) {
+        var queue = outbox[peerID] ?? []
+        // Re-sending an already-queued ID replaces the entry (keeps attempt count fresh)
+        queue.removeAll { $0.messageID == message.messageID }
+        queue.append(message)
+
+        // Enforce per-peer size limit with FIFO eviction
+        if queue.count > Self.maxMessagesPerPeer {
+            let evicted = queue.removeFirst()
+            SecureLogger.warning("📤 Outbox overflow for \(peerID.id.prefix(8))… - evicted oldest message: \(evicted.messageID.prefix(8))…", category: .session)
+            dropMessage(evicted.messageID, for: peerID)
+        }
+        outbox[peerID] = queue
+        metrics?.record(.outboxQueued)
+        persistOutbox()
+    }
+
+    private func dropMessage(_ messageID: String, for peerID: PeerID) {
+        metrics?.record(.outboxDropped)
+        onMessageDropped?(messageID, peerID)
+    }
+
+    private func persistOutbox() {
+        outboxStore?.save(outbox)
+    }
+
+    /// Panic wipe: forget queued mail on disk and in memory.
+    func wipeOutbox() {
+        outbox.removeAll()
+        outboxStore?.wipe()
     }
 
     func sendReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
@@ -105,25 +326,40 @@ final class MessageRouter {
         }
     }
 
-    // MARK: - Outbox Management
-
     func flushOutbox(for peerID: PeerID) {
         guard let queued = outbox[peerID], !queued.isEmpty else { return }
         SecureLogger.debug("Flushing outbox for \(peerID.id.prefix(8))… count=\(queued.count)", category: .session)
 
-        let now = Date()
+        let now = now()
         var remaining: [QueuedMessage] = []
 
         for message in queued {
             // Skip expired messages (TTL exceeded)
             if now.timeIntervalSince(message.timestamp) > Self.messageTTLSeconds {
                 SecureLogger.debug("⏰ Expired queued message for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))… (age: \(Int(now.timeIntervalSince(message.timestamp)))s)", category: .session)
+                dropMessage(message.messageID, for: peerID)
                 continue
             }
 
-            if let transport = reachableTransport(for: peerID) {
-                SecureLogger.debug("Outbox -> \(type(of: transport)) for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))…", category: .session)
+            if let transport = connectedTransport(for: peerID) {
+                // Live link: send and stop retaining.
+                SecureLogger.debug("Outbox -> \(type(of: transport)) (connected) for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))…", category: .session)
                 transport.sendPrivateMessage(message.content, to: peerID, recipientNickname: message.nickname, messageID: message.messageID)
+                metrics?.record(.outboxResent)
+            } else if let transport = reachableTransport(for: peerID) {
+                // Weak signal: send but keep retaining until an ack clears it,
+                // bounded by attempt count for peers that never ack.
+                guard message.sendAttempts < Self.maxSendAttempts else {
+                    SecureLogger.warning("📤 Dropping unacked PM for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))… after \(message.sendAttempts) attempts", category: .session)
+                    dropMessage(message.messageID, for: peerID)
+                    continue
+                }
+                SecureLogger.debug("Outbox -> \(type(of: transport)) (reachable) for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))…", category: .session)
+                transport.sendPrivateMessage(message.content, to: peerID, recipientNickname: message.nickname, messageID: message.messageID)
+                metrics?.record(.outboxResent)
+                var retained = message
+                retained.sendAttempts += 1
+                remaining.append(retained)
             } else {
                 remaining.append(message)
             }
@@ -134,6 +370,7 @@ final class MessageRouter {
         } else {
             outbox[peerID] = remaining
         }
+        persistOutbox()
     }
 
     func flushAllOutbox() {
@@ -142,12 +379,26 @@ final class MessageRouter {
 
     /// Periodically clean up expired messages from all outboxes
     func cleanupExpiredMessages() {
-        let now = Date()
+        let now = now()
+        var droppedAny = false
         for peerID in Array(outbox.keys) {
-            outbox[peerID]?.removeAll { now.timeIntervalSince($0.timestamp) > Self.messageTTLSeconds }
+            var expiredMessageIDs: [String] = []
+            outbox[peerID]?.removeAll { message in
+                guard now.timeIntervalSince(message.timestamp) > Self.messageTTLSeconds else { return false }
+                expiredMessageIDs.append(message.messageID)
+                return true
+            }
             if outbox[peerID]?.isEmpty == true {
                 outbox.removeValue(forKey: peerID)
             }
+            for messageID in expiredMessageIDs {
+                SecureLogger.debug("⏰ Expired queued message for \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
+                dropMessage(messageID, for: peerID)
+                droppedAny = true
+            }
+        }
+        if droppedAny {
+            persistOutbox()
         }
     }
 }

bitchat/Services/NetworkActivationService.swift

@@ -44,7 +44,11 @@ final class NetworkActivationService: ObservableObject {
     private let permissionProvider: () -> LocationChannelManager.PermissionState
     private let mutualFavoritesProvider: () -> Set<Data>
     private let torController: NetworkActivationTorControlling
-    private let relayController: NetworkActivationRelayControlling
+    // Resolved lazily: NostrRelayManager.init() reads NetworkActivationService.shared
+    // (via its live dependencies), so capturing NostrRelayManager.shared here would
+    // re-enter whichever singleton's dispatch_once started first and trap at launch.
+    private lazy var relayController: NetworkActivationRelayControlling = relayControllerProvider()
+    private let relayControllerProvider: () -> NetworkActivationRelayControlling
     private let proxyController: NetworkActivationProxyControlling
     private let notificationCenter: NotificationCenter
 
@@ -55,7 +59,7 @@ final class NetworkActivationService: ObservableObject {
         permissionProvider = { LocationChannelManager.shared.permissionState }
         mutualFavoritesProvider = { FavoritesPersistenceService.shared.mutualFavorites }
         torController = TorManager.shared
-        relayController = NostrRelayManager.shared
+        relayControllerProvider = { NostrRelayManager.shared }
         proxyController = TorURLSession.shared
         notificationCenter = .default
     }
@@ -77,7 +81,7 @@ final class NetworkActivationService: ObservableObject {
         self.permissionProvider = permissionProvider
         self.mutualFavoritesProvider = mutualFavoritesProvider
         self.torController = torController
-        self.relayController = relayController
+        self.relayControllerProvider = { relayController }
         self.proxyController = proxyController
         self.notificationCenter = notificationCenter
     }

bitchat/Services/NoiseEncryptionService.swift

@@ -369,6 +369,49 @@ final class NoiseEncryptionService {
     func getPeerPublicKeyData(_ peerID: PeerID) -> Data? {
         return sessionManager.getRemoteStaticKey(for: peerID)?.rawRepresentation
     }
+
+    // MARK: - Courier Envelopes (one-way Noise X)
+
+    /// Domain separation for courier envelopes so X-pattern transcripts can
+    /// never be confused with interactive XX handshakes.
+    private static let courierPrologue = Data("bitchat-courier-v1".utf8)
+
+    /// Encrypt a payload to a peer's known static key without an interactive
+    /// handshake (Noise X pattern). Used for store-and-forward envelopes
+    /// carried by couriers while the recipient is offline.
+    /// - Warning: One-way messages have no forward secrecy: a later compromise
+    ///   of the recipient's static key exposes envelopes captured in transit.
+    ///   Use established sessions whenever the peer is reachable.
+    func sealCourierPayload(_ payload: Data, recipientStaticKey: Data) throws -> Data {
+        let remoteKey = try NoiseHandshakeState.validatePublicKey(recipientStaticKey)
+        let handshake = NoiseHandshakeState(
+            role: .initiator,
+            pattern: .X,
+            keychain: keychain,
+            localStaticKey: staticIdentityKey,
+            remoteStaticKey: remoteKey,
+            prologue: Self.courierPrologue
+        )
+        return try handshake.writeMessage(payload: payload)
+    }
+
+    /// Decrypt a courier envelope addressed to our static key. Returns the
+    /// payload and the sender's authenticated static public key (the `ss`
+    /// DH in the X pattern binds the sender's identity to the ciphertext).
+    func openCourierPayload(_ envelopeCiphertext: Data) throws -> (payload: Data, senderStaticKey: Data) {
+        let handshake = NoiseHandshakeState(
+            role: .responder,
+            pattern: .X,
+            keychain: keychain,
+            localStaticKey: staticIdentityKey,
+            prologue: Self.courierPrologue
+        )
+        let payload = try handshake.readMessage(envelopeCiphertext)
+        guard let senderKey = handshake.getRemoteStaticPublicKey() else {
+            throw NoiseError.missingKeys
+        }
+        return (payload: payload, senderStaticKey: senderKey.rawRepresentation)
+    }
     
     /// Clear persistent identity (for panic mode)
     func clearPersistentIdentity() {
@@ -428,7 +471,7 @@ final class NoiseEncryptionService {
     private func canonicalAnnounceBytes(peerID: Data, noiseKey: Data, ed25519Key: Data, nickname: String, timestampMs: UInt64) -> Data {
         var out = Data()
         // context
-        let context = "bitchat-announce-v1".data(using: .utf8) ?? Data()
+        let context = Data("bitchat-announce-v1".utf8)
         out.append(UInt8(min(context.count, 255)))
         out.append(context.prefix(255))
         // peerID (expect 8 bytes; pad/truncate to 8 for canonicalization)
@@ -444,7 +487,7 @@ final class NoiseEncryptionService {
         out.append(ed32)
         if ed32.count < 32 { out.append(Data(repeating: 0, count: 32 - ed32.count)) }
         // nickname length + bytes
-        let nickData = nickname.data(using: .utf8) ?? Data()
+        let nickData = Data(nickname.utf8)
         out.append(UInt8(min(nickData.count, 255)))
         out.append(nickData.prefix(255))
         // timestamp

bitchat/Services/NostrTransport.swift

@@ -14,7 +14,13 @@ final class NostrTransport: Transport, @unchecked Sendable {
         let registerPendingGiftWrap: @MainActor (String) -> Void
         let sendEvent: @MainActor (NostrEvent) -> Void
         let scheduleAfter: @Sendable (TimeInterval, @escaping @Sendable () -> Void) -> Void
+        /// Emits whether a relay that carries private messages is up
+        /// (fail-closed behind Tor). A connected geohash/custom relay alone
+        /// doesn't count: DM sends target the default relay set and would
+        /// still queue.
+        let relayConnectivity: @MainActor () -> AnyPublisher<Bool, Never>
 
+        @MainActor
         static func live(idBridge: NostrIdentityBridge) -> Dependencies {
             Dependencies(
                 notificationCenter: .default,
@@ -26,7 +32,8 @@ final class NostrTransport: Transport, @unchecked Sendable {
                 sendEvent: { NostrRelayManager.shared.sendEvent($0) },
                 scheduleAfter: { delay, action in
                     DispatchQueue.main.asyncAfter(deadline: .now() + delay, execute: action)
-                }
+                },
+                relayConnectivity: { NostrRelayManager.shared.$isDMRelayConnected.eraseToAnyPublisher() }
             )
         }
     }
@@ -49,6 +56,10 @@ final class NostrTransport: Transport, @unchecked Sendable {
 
     // Reachability Cache (thread-safe)
     private var reachablePeers: Set<PeerID> = []
+    // Mirror of the relay manager's connection state, cached here because
+    // canDeliverPromptly is called synchronously off the main actor.
+    private var relaysConnected = false
+    private var relayConnectivityCancellable: AnyCancellable?
     private let queue = DispatchQueue(label: "nostr.transport.state", attributes: .concurrent)
 
     @MainActor
@@ -72,6 +83,12 @@ final class NostrTransport: Transport, @unchecked Sendable {
         queue.sync(flags: .barrier) {
             self.reachablePeers = Set(reachable)
         }
+
+        relayConnectivityCancellable = self.dependencies.relayConnectivity()
+            .sink { [weak self] connected in
+                guard let self else { return }
+                self.queue.async(flags: .barrier) { self.relaysConnected = connected }
+            }
     }
 
     deinit {
@@ -125,34 +142,32 @@ final class NostrTransport: Transport, @unchecked Sendable {
     func isPeerConnected(_ peerID: PeerID) -> Bool { false }
     
     func isPeerReachable(_ peerID: PeerID) -> Bool {
-        queue.sync {
-            // Check if exact match
+        // Callers address peers by either the short 16-hex ID or the full
+        // 64-hex noise key (offline favorites), so compare in short form.
+        let short = peerID.toShort()
+        return queue.sync {
             if reachablePeers.contains(peerID) { return true }
-            // Check for short ID match
-            if peerID.isShort {
-                return reachablePeers.contains(where: { $0.toShort() == peerID })
-            }
-            return false
+            return reachablePeers.contains(where: { $0.toShort() == short })
         }
     }
+
+    func canDeliverPromptly(to peerID: PeerID) -> Bool {
+        // A known npub makes a peer "reachable", but with no relay
+        // connection a send only joins the local queue. Answering honestly
+        // here lets the router hand a sealed copy to a courier in parallel
+        // instead of waiting for internet that may never come.
+        isPeerReachable(peerID) && queue.sync { relaysConnected }
+    }
     
     func peerNickname(peerID: PeerID) -> String? { nil }
-    func getPeerNicknames() -> [PeerID : String] { [:] }
+    func getPeerNicknames() -> [PeerID: String] { [:] }
 
     func getFingerprint(for peerID: PeerID) -> String? { nil }
     func getNoiseSessionState(for peerID: PeerID) -> LazyHandshakeState { .none }
     func triggerHandshake(with peerID: PeerID) { /* no-op */ }
-    
-    // Nostr does not use Noise sessions here; return a cached placeholder to avoid reallocation
-    private static var cachedNoiseService: NoiseEncryptionService?
-    func getNoiseService() -> NoiseEncryptionService {
-        if let noiseService = Self.cachedNoiseService {
-            return noiseService
-        }
-        let noiseService = NoiseEncryptionService(keychain: keychain)
-        Self.cachedNoiseService = noiseService
-        return noiseService
-    }
+
+    // Nostr does not use Noise sessions here; the inert Transport defaults
+    // for the noise* identity hooks apply.
 
     // Public broadcast not supported over Nostr here
     func sendMessage(_ content: String, mentions: [String]) { /* no-op */ }

bitchat/Services/NotificationService.swift

@@ -111,7 +111,7 @@ final class NotificationService {
 
     func requestAuthorization() {
         guard !isRunningTests else { return }
-        authorizer.requestAuthorization(options: [.alert, .sound, .badge]) { granted, error in
+        authorizer.requestAuthorization(options: [.alert, .sound, .badge]) { granted, _ in
             if granted {
                 // Permission granted
             } else {

bitchat/Services/PrivateChatManager.swift

@@ -8,14 +8,25 @@
 
 import BitLogger
 import BitFoundation
+import Combine
 import Foundation
 import SwiftUI
 
-/// Manages all private chat functionality
+/// Manages private chat session policy (selection, read receipts,
+/// consolidation). Message storage lives in the single-writer
+/// `ConversationStore` (docs/CONVERSATION-STORE-DESIGN.md); the
+/// `privateChats` / `unreadMessages` properties below are read-only views
+/// derived from it.
+@MainActor
 final class PrivateChatManager: ObservableObject {
-    @Published var privateChats: [PeerID: [BitchatMessage]] = [:]
-    @Published var selectedPeer: PeerID? = nil
-    @Published var unreadMessages: Set<PeerID> = []
+    /// Read-only mirror of `ConversationStore.selectedPrivatePeerID` — the
+    /// store is the sole owner of conversation selection. Kept `@Published`
+    /// so existing observers (`objectWillChange` forwarding into
+    /// `ChatViewModel`) keep firing on selection changes. Mutate via
+    /// `startChat(with:)` / `endChat()`, which route through the store's
+    /// `setSelectedPrivatePeer` intent.
+    @Published private(set) var selectedPeer: PeerID? = nil
+    private var selectedPeerMirrorCancellable: AnyCancellable? = nil
 
     private var selectedPeerFingerprint: String? = nil
     var sentReadReceipts: Set<String> = []  // Made accessible for ChatViewModel
@@ -25,13 +36,51 @@ final class PrivateChatManager: ObservableObject {
     weak var messageRouter: MessageRouter?
     // Peer service for looking up peer info during consolidation
     weak var unifiedPeerService: UnifiedPeerService?
-
-    init(meshService: Transport? = nil) {
-        self.meshService = meshService
+    /// Single source of truth for message and selection state; injected by
+    /// the bootstrapper (`wireServiceGraph`).
+    var conversationStore: ConversationStore? {
+        didSet { bindSelectionMirror() }
     }
 
-    // Cap for messages stored per private chat
-    private let privateChatCap = TransportConfig.privateChatCap
+    init(meshService: Transport? = nil, conversationStore: ConversationStore? = nil) {
+        self.meshService = meshService
+        self.conversationStore = conversationStore
+        bindSelectionMirror() // didSet does not fire during init
+    }
+
+    /// Keeps `selectedPeer` in lock-step with the store's selection axis
+    /// (including store-internal handoffs such as conversation migration).
+    private func bindSelectionMirror() {
+        guard let store = conversationStore else {
+            selectedPeerMirrorCancellable = nil
+            return
+        }
+        selectedPeerMirrorCancellable = store.$selectedPrivatePeerID
+            .sink { [weak self] peerID in
+                guard let self, self.selectedPeer != peerID else { return }
+                self.selectedPeer = peerID
+            }
+    }
+
+    // MARK: - Derived message state (read-only compat views)
+
+    /// All private chats keyed by routing peer ID, derived from the store.
+    /// Mutations go through the store's intent API only.
+    @MainActor
+    var privateChats: [PeerID: [BitchatMessage]] {
+        conversationStore?.directMessagesByRoutingPeerID() ?? [:]
+    }
+
+    /// Unread chats, derived from the store's unread state.
+    @MainActor
+    var unreadMessages: Set<PeerID> {
+        conversationStore?.unreadDirectRoutingPeerIDs() ?? []
+    }
+
+    @MainActor
+    private func messages(for peerID: PeerID) -> [BitchatMessage] {
+        conversationStore?.conversationsByID[.directPeer(peerID)]?.messages ?? []
+    }
 
     // MARK: - Message Consolidation
 
@@ -44,57 +93,51 @@ final class PrivateChatManager: ObservableObject {
     /// - Returns: True if any unread messages were found during consolidation
     @MainActor
     func consolidateMessages(for peerID: PeerID, peerNickname: String, persistedReadReceipts: Set<String>) -> Bool {
-        guard let meshService = meshService else { return false }
+        guard let meshService = meshService, let store = conversationStore else { return false }
         var hasUnreadMessages = false
 
         // 1. Consolidate from stable Noise key (64-char hex)
         if let peer = unifiedPeerService?.getPeer(by: peerID) {
             let noiseKeyHex = PeerID(hexData: peer.noisePublicKey)
+            let nostrMessages = messages(for: noiseKeyHex)
 
-            if noiseKeyHex != peerID, let nostrMessages = privateChats[noiseKeyHex], !nostrMessages.isEmpty {
-                if privateChats[peerID] == nil {
-                    privateChats[peerID] = []
-                }
-
-                let existingMessageIds = Set(privateChats[peerID]?.map { $0.id } ?? [])
+            if noiseKeyHex != peerID, !nostrMessages.isEmpty {
                 for message in nostrMessages {
-                    if !existingMessageIds.contains(message.id) {
-                        // Update senderPeerID for correct read receipts
-                        let updatedMessage = BitchatMessage(
-                            id: message.id,
-                            sender: message.sender,
-                            content: message.content,
-                            timestamp: message.timestamp,
-                            isRelay: message.isRelay,
-                            originalSender: message.originalSender,
-                            isPrivate: message.isPrivate,
-                            recipientNickname: message.recipientNickname,
-                            senderPeerID: message.senderPeerID == meshService.myPeerID ? meshService.myPeerID : peerID,
-                            mentions: message.mentions,
-                            deliveryStatus: message.deliveryStatus
-                        )
-                        privateChats[peerID]?.append(updatedMessage)
+                    // Update senderPeerID for correct read receipts
+                    let updatedMessage = BitchatMessage(
+                        id: message.id,
+                        sender: message.sender,
+                        content: message.content,
+                        timestamp: message.timestamp,
+                        isRelay: message.isRelay,
+                        originalSender: message.originalSender,
+                        isPrivate: message.isPrivate,
+                        recipientNickname: message.recipientNickname,
+                        senderPeerID: message.senderPeerID == meshService.myPeerID ? meshService.myPeerID : peerID,
+                        mentions: message.mentions,
+                        deliveryStatus: message.deliveryStatus
+                    )
+                    // Store append dedups by message ID (skips ones the
+                    // target chat already has).
+                    guard store.append(updatedMessage, to: .directPeer(peerID)) else { continue }
 
-                        // Check for recent unread messages (< 60s, not sent by us, not already read)
-                        // Use persistedReadReceipts to correctly identify already-read messages after app restart
-                        if message.senderPeerID != meshService.myPeerID {
-                            let messageAge = Date().timeIntervalSince(message.timestamp)
-                            if messageAge < 60 && !persistedReadReceipts.contains(message.id) {
-                                hasUnreadMessages = true
-                            }
+                    // Check for recent unread messages (< 60s, not sent by us, not already read)
+                    // Use persistedReadReceipts to correctly identify already-read messages after app restart
+                    if message.senderPeerID != meshService.myPeerID {
+                        let messageAge = Date().timeIntervalSince(message.timestamp)
+                        if messageAge < 60 && !persistedReadReceipts.contains(message.id) {
+                            hasUnreadMessages = true
                         }
                     }
                 }
 
-                privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
-
                 if hasUnreadMessages {
-                    unreadMessages.insert(peerID)
-                } else if unreadMessages.contains(noiseKeyHex) {
-                    unreadMessages.remove(noiseKeyHex)
+                    store.markUnread(.directPeer(peerID))
+                } else {
+                    store.markRead(.directPeer(noiseKeyHex))
                 }
 
-                privateChats.removeValue(forKey: noiseKeyHex)
+                store.removeConversation(.directPeer(noiseKeyHex))
             }
         }
 
@@ -112,52 +155,43 @@ final class PrivateChatManager: ObservableObject {
         }
 
         if !tempPeerIDsToConsolidate.isEmpty {
-            if privateChats[peerID] == nil {
-                privateChats[peerID] = []
-            }
-
-            let existingMessageIds = Set(privateChats[peerID]?.map { $0.id } ?? [])
             var consolidatedCount = 0
             var hadUnreadTemp = false
+            let unreadPeerIDs = unreadMessages
 
             for tempPeerID in tempPeerIDsToConsolidate {
-                if unreadMessages.contains(tempPeerID) {
+                if unreadPeerIDs.contains(tempPeerID) {
                     hadUnreadTemp = true
                 }
 
-                if let tempMessages = privateChats[tempPeerID] {
-                    for message in tempMessages {
-                        if !existingMessageIds.contains(message.id) {
-                            let updatedMessage = BitchatMessage(
-                                id: message.id,
-                                sender: message.sender,
-                                content: message.content,
-                                timestamp: message.timestamp,
-                                isRelay: message.isRelay,
-                                originalSender: message.originalSender,
-                                isPrivate: message.isPrivate,
-                                recipientNickname: message.recipientNickname,
-                                senderPeerID: peerID,
-                                mentions: message.mentions,
-                                deliveryStatus: message.deliveryStatus
-                            )
-                            privateChats[peerID]?.append(updatedMessage)
-                            consolidatedCount += 1
-                        }
+                for message in messages(for: tempPeerID) {
+                    let updatedMessage = BitchatMessage(
+                        id: message.id,
+                        sender: message.sender,
+                        content: message.content,
+                        timestamp: message.timestamp,
+                        isRelay: message.isRelay,
+                        originalSender: message.originalSender,
+                        isPrivate: message.isPrivate,
+                        recipientNickname: message.recipientNickname,
+                        senderPeerID: peerID,
+                        mentions: message.mentions,
+                        deliveryStatus: message.deliveryStatus
+                    )
+                    if store.append(updatedMessage, to: .directPeer(peerID)) {
+                        consolidatedCount += 1
                     }
-                    privateChats.removeValue(forKey: tempPeerID)
-                    unreadMessages.remove(tempPeerID)
                 }
+                store.removeConversation(.directPeer(tempPeerID))
             }
 
             if hadUnreadTemp {
-                unreadMessages.insert(peerID)
+                store.markUnread(.directPeer(peerID))
                 hasUnreadMessages = true
                 SecureLogger.debug("📬 Transferred unread status from temp peer IDs to \(peerID)", category: .session)
             }
 
             if consolidatedCount > 0 {
-                privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
                 SecureLogger.info("📥 Consolidated \(consolidatedCount) Nostr messages from temporary peer IDs to \(peerNickname)", category: .session)
             }
         }
@@ -168,102 +202,82 @@ final class PrivateChatManager: ObservableObject {
     /// Syncs the read receipt tracking between manager and view model for sent messages
     @MainActor
     func syncReadReceiptsForSentMessages(peerID: PeerID, nickname: String, externalReceipts: inout Set<String>) {
-        guard let messages = privateChats[peerID] else { return }
-
-        for message in messages {
+        for message in messages(for: peerID) {
             if message.sender == nickname {
                 if let status = message.deliveryStatus {
                     switch status {
                     case .read, .delivered:
                         externalReceipts.insert(message.id)
                         sentReadReceipts.insert(message.id)
-                    case .failed, .partiallyDelivered, .sending, .sent:
+                    case .failed, .partiallyDelivered, .sending, .sent, .carried:
                         break
                     }
                 }
             }
         }
     }
-    
-    /// Start a private chat with a peer
+
+    /// Start a private chat with a peer. Selection is mutated through the
+    /// store's intent (the store owns it); the manager keeps its side
+    /// effects (fingerprint tracking, read receipts, unread clearing).
+    @MainActor
     func startChat(with peerID: PeerID) {
-        selectedPeer = peerID
-        
+        // Also creates the conversation if needed and updates the derived
+        // `selectedConversationID`; `selectedPeer` mirrors the change.
+        conversationStore?.setSelectedPrivatePeer(peerID)
+
         // Store fingerprint for persistence across reconnections
         if let fingerprint = meshService?.getFingerprint(for: peerID) {
             selectedPeerFingerprint = fingerprint
         }
-        
+
         // Mark messages as read
         markAsRead(from: peerID)
-        
-        // Initialize chat if needed
-        if privateChats[peerID] == nil {
-            privateChats[peerID] = []
-        }
     }
-    
-    /// End the current private chat
+
+    /// End the current private chat (selection returns to the active public
+    /// channel's conversation).
     func endChat() {
-        selectedPeer = nil
+        conversationStore?.setSelectedPrivatePeer(nil)
         selectedPeerFingerprint = nil
     }
 
-    /// Remove duplicate messages by ID and keep chronological order
-    func sanitizeChat(for peerID: PeerID) {
-        guard let arr = privateChats[peerID] else { return }
-        if arr.count <= 1 {
-            return
-        }
+    /// No-op since the `ConversationStore` cutover: the store maintains
+    /// chronological order and dedups by message ID on every insert, so the
+    /// per-append re-sort/dedup sweep this performed is no longer needed.
+    /// Kept only for API compatibility until step 5 removes the callers.
+    func sanitizeChat(for peerID: PeerID) {}
 
-        var indexByID: [String: Int] = [:]
-        indexByID.reserveCapacity(arr.count)
-        var deduped: [BitchatMessage] = []
-        deduped.reserveCapacity(arr.count)
-
-        for msg in arr.sorted(by: { $0.timestamp < $1.timestamp }) {
-            if let existing = indexByID[msg.id] {
-                deduped[existing] = msg
-            } else {
-                indexByID[msg.id] = deduped.count
-                deduped.append(msg)
-            }
-        }
-
-        privateChats[peerID] = deduped
-    }
-    
     /// Mark messages from a peer as read
+    @MainActor
     func markAsRead(from peerID: PeerID) {
-        unreadMessages.remove(peerID)
-        
+        conversationStore?.markRead(.directPeer(peerID))
+
         // Send read receipts for unread messages that haven't been sent yet
-        if let messages = privateChats[peerID] {
-            for message in messages {
-                if message.senderPeerID == peerID && !message.isRelay && !sentReadReceipts.contains(message.id) {
-                    sendReadReceipt(for: message)
-                }
+        for message in messages(for: peerID) {
+            if message.senderPeerID == peerID && !message.isRelay && !sentReadReceipts.contains(message.id) {
+                sendReadReceipt(for: message)
             }
         }
     }
-    
+
     // MARK: - Private Methods
-    
+
     private func sendReadReceipt(for message: BitchatMessage) {
         guard !sentReadReceipts.contains(message.id),
               let senderPeerID = message.senderPeerID else {
             return
         }
-        
+
         sentReadReceipts.insert(message.id)
-        
+
         // Create read receipt using the simplified method
         let receipt = ReadReceipt(
             originalMessageID: message.id,
             readerID: meshService?.myPeerID ?? PeerID(str: ""),
             readerNickname: meshService?.myNickname ?? ""
         )
-        
+
         // Route via MessageRouter to avoid handshakeRequired spam when session isn't established
         if let router = messageRouter {
             SecureLogger.debug("PrivateChatManager: sending READ ack for \(message.id.prefix(8))… to \(senderPeerID.id.prefix(8))… via router", category: .session)

bitchat/Services/RelayController.swift

@@ -18,10 +18,17 @@ struct RelayController {
                        isDirectedFragment: Bool,
                        isHandshake: Bool,
                        isAnnounce: Bool,
+                       isRequestSync: Bool = false,
                        degree: Int,
                        highDegreeThreshold: Int) -> RelayDecision {
         let ttlCap = min(ttl, TransportConfig.messageTTLDefault)
 
+        // REQUEST_SYNC is link-local: never relay it, even when a peer crafts
+        // one with TTL headroom to turn every reachable node into a responder.
+        if isRequestSync {
+            return RelayDecision(shouldRelay: false, newTTL: ttlCap, delayMs: 0)
+        }
+
         // Suppress obvious non-relays
         if ttlCap <= 1 || senderIsSelf || recipientIsSelf {
             return RelayDecision(shouldRelay: false, newTTL: ttlCap, delayMs: 0)
@@ -39,7 +46,12 @@ struct RelayController {
         }
 
         if isFragment {
-            let ttlLimit = min(ttlCap, TransportConfig.bleFragmentRelayTtlCap)
+            // Dense graphs clamp harder to contain full-fanout fragment floods;
+            // sparse graphs get full depth so media reaches as far as text.
+            let fragmentCap = degree >= highDegreeThreshold
+                ? TransportConfig.bleFragmentRelayTtlCapDense
+                : TransportConfig.bleFragmentRelayTtlCap
+            let ttlLimit = min(ttlCap, fragmentCap)
             guard ttlLimit > 1 else {
                 return RelayDecision(shouldRelay: false, newTTL: ttlLimit, delayMs: 0)
             }
@@ -50,11 +62,16 @@ struct RelayController {
 
         // TTL clamping for broadcast
         // - Dense graphs: keep lower but still allow multi-hop bridging
+        // - Thin chains (degree <= 2): every hop counts and flood cost is
+        //   minimal, so relay at full incoming depth
         // - Announces get a bit more headroom
         let ttlLimit: UInt8 = {
             if degree >= highDegreeThreshold {
                 return max(UInt8(2), min(ttlCap, UInt8(5)))
             }
+            if degree <= 2 {
+                return ttlCap
+            }
             let preferred = UInt8(isAnnounce ? 7 : 6)
             return max(UInt8(2), min(ttlCap, preferred))
         }()

bitchat/Services/TestEnvironment.swift

@@ -0,0 +1,25 @@
+//
+// TestEnvironment.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import Foundation
+
+/// Process-level test-environment detection for singletons that must swap a
+/// real OS-backed dependency (keychain, persistent defaults, notifications)
+/// for an in-memory one under test. Mirrors the detection already used by
+/// `NotificationService` and `LocationStateManager`.
+enum TestEnvironment {
+    /// True when running under XCTest / Swift Testing or in CI.
+    static let isRunningTests: Bool = {
+        let env = ProcessInfo.processInfo.environment
+        return NSClassFromString("XCTestCase") != nil ||
+               env["XCTestConfigurationFilePath"] != nil ||
+               env["XCTestBundlePath"] != nil ||
+               env["GITHUB_ACTIONS"] != nil ||
+               env["CI"] != nil
+    }()
+}

bitchat/Services/Transport.swift

@@ -11,6 +11,24 @@ struct TransportPeerSnapshot: Equatable, Hashable {
     let isConnected: Bool
     let noisePublicKey: Data?
     let lastSeen: Date
+    /// Whether the peer's announce was signature-verified (courier tier gate).
+    let isVerified: Bool
+
+    init(
+        peerID: PeerID,
+        nickname: String,
+        isConnected: Bool,
+        noisePublicKey: Data?,
+        lastSeen: Date,
+        isVerified: Bool = false
+    ) {
+        self.peerID = peerID
+        self.nickname = nickname
+        self.isConnected = isConnected
+        self.noisePublicKey = noisePublicKey
+        self.lastSeen = lastSeen
+        self.isVerified = isVerified
+    }
 }
 
 enum TransportEvent: @unchecked Sendable {
@@ -54,6 +72,11 @@ protocol Transport: AnyObject {
     // Connectivity and peers
     func isPeerConnected(_ peerID: PeerID) -> Bool
     func isPeerReachable(_ peerID: PeerID) -> Bool
+    /// Whether a send to this peer is likely to leave the device promptly.
+    /// Distinct from reachability: Nostr claims any favorite with a known
+    /// npub as reachable even with no relay connection, where a send only
+    /// joins a queue waiting for internet that may never come.
+    func canDeliverPromptly(to peerID: PeerID) -> Bool
     func peerNickname(peerID: PeerID) -> String?
     func getPeerNicknames() -> [PeerID: String]
 
@@ -61,7 +84,27 @@ protocol Transport: AnyObject {
     func getFingerprint(for peerID: PeerID) -> String?
     func getNoiseSessionState(for peerID: PeerID) -> LazyHandshakeState
     func triggerHandshake(with peerID: PeerID)
-    func getNoiseService() -> NoiseEncryptionService
+
+    // Noise identity/session access. Narrow, purpose-named wrappers so the
+    // underlying NoiseEncryptionService (and its peer-binding/session
+    // orchestration) is never exposed outside the transport.
+    /// The remote static public key of the Noise session with `peerID`, if established.
+    func noiseSessionPublicKeyData(for peerID: PeerID) -> Data?
+    /// Fingerprint of our own Noise static identity key.
+    func noiseIdentityFingerprint() -> String
+    /// Our Noise static public key (Curve25519 key agreement).
+    func noiseStaticPublicKeyData() -> Data
+    /// Our Noise signing public key (Ed25519).
+    func noiseSigningPublicKeyData() -> Data
+    /// Signs `data` with our Noise signing key.
+    func noiseSignData(_ data: Data) -> Data?
+    /// Verifies an Ed25519 `signature` over `data` against `publicKey`.
+    func noiseVerifySignature(_ signature: Data, for data: Data, publicKey: Data) -> Bool
+    /// Registers session-lifecycle callbacks (peer authenticated / handshake required).
+    func installNoiseSessionCallbacks(
+        onPeerAuthenticated: @escaping (PeerID, String) -> Void,
+        onHandshakeRequired: @escaping (PeerID) -> Void
+    )
 
     // Messaging
     func sendMessage(_ content: String, mentions: [String])
@@ -75,6 +118,12 @@ protocol Transport: AnyObject {
     func sendFilePrivate(_ packet: BitchatFilePacket, to peerID: PeerID, transferId: String)
     func cancelTransfer(_ transferId: String)
 
+    // Courier store-and-forward (mesh transports only): seal a message to the
+    // recipient's static key and hand it to connected couriers for physical
+    // delivery while the recipient is offline. Returns false when the
+    // transport cannot courier (no connected courier, or unsupported).
+    func sendCourierMessage(_ content: String, messageID: String, recipientNoiseKey: Data, via couriers: [PeerID]) -> Bool
+
     // QR verification (optional for transports)
     func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data)
     func sendVerifyResponse(to peerID: PeerID, noiseKeyHex: String, nonceA: Data)
@@ -85,8 +134,26 @@ protocol Transport: AnyObject {
 }
 
 extension Transport {
+    // Reachability implies prompt delivery for transports that hand packets
+    // straight to the radio; queue-backed transports override this.
+    func canDeliverPromptly(to peerID: PeerID) -> Bool { isPeerReachable(peerID) }
+
+    // Noise identity hooks default to inert for transports that do not carry
+    // Noise sessions (e.g. NostrTransport).
+    func noiseSessionPublicKeyData(for peerID: PeerID) -> Data? { nil }
+    func noiseIdentityFingerprint() -> String { "" }
+    func noiseStaticPublicKeyData() -> Data { Data() }
+    func noiseSigningPublicKeyData() -> Data { Data() }
+    func noiseSignData(_ data: Data) -> Data? { nil }
+    func noiseVerifySignature(_ signature: Data, for data: Data, publicKey: Data) -> Bool { false }
+    func installNoiseSessionCallbacks(
+        onPeerAuthenticated: @escaping (PeerID, String) -> Void,
+        onHandshakeRequired: @escaping (PeerID) -> Void
+    ) {}
+
     func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {}
     func sendVerifyResponse(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {}
+    func sendCourierMessage(_ content: String, messageID: String, recipientNoiseKey: Data, via couriers: [PeerID]) -> Bool { false }
     func sendFileBroadcast(_ packet: BitchatFilePacket, transferId: String) {}
     func sendFilePrivate(_ packet: BitchatFilePacket, to peerID: PeerID, transferId: String) {}
     func cancelTransfer(_ transferId: String) {}

bitchat/Services/TransportConfig.swift

@@ -11,13 +11,17 @@ enum TransportConfig {
     static let bleMaxConcurrentTransfers: Int = 2           // Limit simultaneous large media sends
     static let bleFragmentRelayMinDelayMs: Int = 8          // Faster forwarding for media fragments
     static let bleFragmentRelayMaxDelayMs: Int = 25         // Upper jitter bound for fragment relays
-    static let bleFragmentRelayTtlCap: UInt8 = 5            // Clamp fragment TTL to contain floods
+    // Fragment relay TTL in sparse graphs; matches messageTTLDefault so media
+    // reaches as far as text. Dense graphs clamp harder in RelayController.
+    static let bleFragmentRelayTtlCap: UInt8 = 7
+    static let bleFragmentRelayTtlCapDense: UInt8 = 5       // Contain fragment floods in dense graphs
 
     // UI / Storage Caps
     static let privateChatCap: Int = 1337
     static let meshTimelineCap: Int = 1337
     static let geoTimelineCap: Int = 1337
     static let contentLRUCap: Int = 2000
+    static let geoSamplingEventLRUCap: Int = 2000
 
     // Timers
     static let networkResetGraceSeconds: TimeInterval = 600 // 10 minutes
@@ -40,14 +44,27 @@ enum TransportConfig {
     static let blePendingNotificationsCapCount: Int = 128
     static let bleNotificationRetryDelayMs: Int = 25
     static let bleNotificationRetryMaxAttempts: Int = 80
+    // Sample interval for notification backpressure logs (fire per fragment
+    // during media transfers).
+    static let bleBackpressureLogInterval: Int = 25
 
     // Nostr
     static let nostrReadAckInterval: TimeInterval = 0.35 // ~3 per second
+    static let nostrInboundEventDedupCap: Int = 4096
+    static let nostrInboundEventDedupTrimTarget: Int = 3072
+    static let nostrDuplicateEventLogInterval: Int = 50
+    // Sample interval for per-event debug logs on the inbound hot path.
+    static let nostrInboundEventLogInterval: Int = 100
+
+    // Conversation store diagnostics (field observability)
+    // Sample interval for the periodic store-audit "OK" heartbeat line
+    // (first + every Nth audit); violations always log at error level.
+    static let conversationStoreAuditLogInterval: Int = 10
+    // Sample interval for the mirrored-republish debug line in the ID-only
+    // delivery fan-out (first + every Nth republish).
+    static let conversationStoreMirroredRepublishLogInterval: Int = 25
 
     // UI thresholds
-    static let uiLateInsertThreshold: TimeInterval = 15.0
-    // Geohash public chats are more sensitive to ordering; use a tighter threshold
-    static let uiLateInsertThresholdGeo: TimeInterval = 0.0
     static let uiProcessedNostrEventsCap: Int = 2000
     static let uiChannelInactivityThresholdSeconds: TimeInterval = 9 * 60
     
@@ -76,19 +93,21 @@ enum TransportConfig {
     // BLE maintenance & thresholds
     static let bleMaintenanceInterval: TimeInterval = 5.0
     static let bleMaintenanceLeewaySeconds: Int = 1
-    static let bleIsolationRelaxThresholdSeconds: TimeInterval = 60
-    static let bleRecentTimeoutWindowSeconds: TimeInterval = 60
-    static let bleRecentTimeoutCountThreshold: Int = 3
-    static let bleRSSIIsolatedBase: Int = -90
-    static let bleRSSIIsolatedRelaxed: Int = -92
+    static let bleIsolationRelaxThresholdSeconds: TimeInterval = 30
+    // Isolated nodes accept the weakest usable links — a fringe connection
+    // beats no connection. Relaxed floor sits at CoreBluetooth's practical
+    // reporting limit so prolonged isolation gates on nothing but decode.
+    static let bleRSSIIsolatedBase: Int = -95
+    static let bleRSSIIsolatedRelaxed: Int = -100
     static let bleRSSIConnectedThreshold: Int = -85
-    static let bleRSSIHighTimeoutThreshold: Int = -80
     // How long without seeing traffic before we sanity-check the direct link
     // Lowered to make connected→reachable icon changes react faster when walking out of range
     static let blePeerInactivityTimeoutSeconds: TimeInterval = 8.0
-    // How long to retain a peer as "reachable" (not directly connected) since lastSeen
-    static let bleReachabilityRetentionVerifiedSeconds: TimeInterval = 21.0    // 21s for verified/favorites
-    static let bleReachabilityRetentionUnverifiedSeconds: TimeInterval = 21.0  // 21s for unknown/unverified
+    // How long to retain a peer as "reachable" (not directly connected) since lastSeen.
+    // Must comfortably exceed the worst-case dense announce interval (38s) plus a
+    // missed cycle, so duty-cycled nodes don't forget peers between announces.
+    static let bleReachabilityRetentionVerifiedSeconds: TimeInterval = 60.0    // verified/favorites
+    static let bleReachabilityRetentionUnverifiedSeconds: TimeInterval = 45.0  // unknown/unverified
     static let bleFragmentLifetimeSeconds: TimeInterval = 30.0
     static let bleIngressRecordLifetimeSeconds: TimeInterval = 3.0
     static let bleConnectTimeoutBackoffWindowSeconds: TimeInterval = 120.0
@@ -145,7 +164,27 @@ enum TransportConfig {
     static let nostrRelayMaxBackoffSeconds: TimeInterval = 300.0
     static let nostrRelayBackoffMultiplier: Double = 2.0
     static let nostrRelayMaxReconnectAttempts: Int = 10
+    // Reconnect delays get ±20% random jitter so relays that dropped together
+    // (e.g. a network blip) don't thundering-herd the same reconnect instant.
+    static let nostrRelayBackoffJitterRatio: Double = 0.2
     static let nostrRelayDefaultFetchLimit: Int = 100
+    // How many consecutive Tor-readiness waits (each bounded by TorManager's
+    // bootstrap deadline) to attempt before unblocking pending EOSE callers.
+    static let nostrTorReadyMaxWaitAttempts: Int = 3
+    static let nostrPendingSendQueueCap: Int = 200
+    // Sample interval for the send-queue overflow warning (first + every Nth
+    // dropped event). Drops are ephemeral presence/geo traffic — log-only.
+    static let nostrPendingSendDropLogInterval: Int = 10
+    // Pending (not-yet-flushed) REQs are bounded per relay: oldest-by-insertion
+    // eviction at the cap, plus an age sweep on connect attempts. Durable
+    // subscription intent survives in subscriptionRequestState either way.
+    static let nostrPendingSubscriptionsPerRelayCap: Int = 64
+    static let nostrPendingSubscriptionTTLSeconds: TimeInterval = 600.0
+    // Fallback deadline for treating a subscription's initial fetch as complete
+    // when a relay never sends EOSE (generous to cover Tor circuit setup).
+    static let nostrSubscriptionEOSEFallbackSeconds: TimeInterval = 10.0
+    // After this long, a relay marked permanently failed gets another chance.
+    static let nostrRelayFailureCooldownSeconds: TimeInterval = 600.0
 
     // Geo relay directory
     static let geoRelayFetchIntervalSeconds: TimeInterval = 60 * 60 * 24
@@ -169,8 +208,10 @@ enum TransportConfig {
     static let bleSubscriptionRateLimitWindowSeconds: TimeInterval = 60.0   // Window for tracking subscription attempts
     static let bleSubscriptionRateLimitMaxAttempts: Int = 5                 // Max attempts before extended cooldown
 
-    // Store-and-forward for directed packets at relays
-    static let bleDirectedSpoolWindowSeconds: TimeInterval = 15.0
+    // Store-and-forward for directed packets at relays. Spooled packets retry
+    // on each maintenance flush until the window lapses; a longer window lets
+    // brief link gaps (walking between rooms, reconnect churn) heal themselves.
+    static let bleDirectedSpoolWindowSeconds: TimeInterval = 60.0
 
     // Log/UI debounce windows
     // Shorter debounce so UI reacts faster while still suppressing duplicate callbacks
@@ -180,6 +221,12 @@ enum TransportConfig {
     // Weak-link cooldown after connection timeouts
     static let bleWeakLinkCooldownSeconds: TimeInterval = 30.0
     static let bleWeakLinkRSSICutoff: Int = -90
+    // Rediscovery ignore windows after a failed link, by failure kind:
+    // a connect attempt that timed out means the peer likely isn't reachable,
+    // so back off; a dropped established connection (walked out of range)
+    // usually returns, so only pause long enough for CoreBluetooth to settle.
+    static let bleTimeoutDiscoveryIgnoreSeconds: TimeInterval = 15.0
+    static let bleDisconnectDiscoveryIgnoreSeconds: TimeInterval = 3.0
 
     // Content hashing / formatting
     static let contentKeyPrefixLength: Int = 256
@@ -215,7 +262,14 @@ enum TransportConfig {
     static let syncSeenCapacity: Int = 1000
     static let syncGCSMaxBytes: Int = 400
     static let syncGCSTargetFpr: Double = 0.01
+    // Fragments and file transfers keep the short window; whole public
+    // messages get hours so a phone walking between partitions carries the
+    // room's recent history with it (see syncPublicMessageMaxAgeSeconds).
     static let syncMaxMessageAgeSeconds: TimeInterval = 900
+    // How far back public broadcast messages stay sync-able. Must not exceed
+    // the receive-side acceptance window (BLEPublicMessagePolicy uses this
+    // same constant) or served packets would be dropped as stale.
+    static let syncPublicMessageMaxAgeSeconds: TimeInterval = 6 * 60 * 60
     static let syncMaintenanceIntervalSeconds: TimeInterval = 30.0
     static let syncStalePeerCleanupIntervalSeconds: TimeInterval = 60.0
     static let syncStalePeerTimeoutSeconds: TimeInterval = 60.0
@@ -224,4 +278,30 @@ enum TransportConfig {
     static let syncFragmentIntervalSeconds: TimeInterval = 30.0
     static let syncFileTransferIntervalSeconds: TimeInterval = 60.0
     static let syncMessageIntervalSeconds: TimeInterval = 15.0
+    static let syncResponseRateLimitMaxResponses: Int = 8
+    static let syncResponseRateLimitWindowSeconds: TimeInterval = 30.0
+
+    // Wi-Fi bulk transport (peer-to-peer AWDL data plane for large media).
+    // BLE stays the control plane: offers/responses ride the Noise session,
+    // only the sealed chunk stream moves to TCP over AWDL.
+    static let wifiBulkEnabled: Bool = true
+    // Below this size BLE fragmentation is fast enough that negotiation
+    // overhead isn't worth it.
+    static let wifiBulkMinPayloadBytes: Int = 64 * 1024
+    static let wifiBulkChunkBytes: Int = 64 * 1024
+    // Offer unanswered for this long → fall back to BLE fragmentation.
+    static let wifiBulkOfferTimeoutSeconds: TimeInterval = 10.0
+    // Hard ceiling on how long the Bonjour listener/connection may live.
+    static let wifiBulkTransferWindowSeconds: TimeInterval = 60.0
+    static let wifiBulkServiceType: String = "_bitchat-bulk._tcp"
+    static let wifiBulkMaxConcurrentIncoming: Int = 4
+
+    // Courier store-and-forward
+    // Initial spray-and-wait budget per deposited envelope: each courier may
+    // hand half its remaining copies to another courier on encounter, so a
+    // message diffuses through a moving crowd instead of riding one person.
+    static let courierInitialCopies: UInt8 = 4
+    // Cooldown between speculative multi-hop handovers of the same envelope
+    // toward a recipient heard only via relayed announces.
+    static let courierRemoteHandoverCooldownSeconds: TimeInterval = 10 * 60
 }

bitchat/Services/UnifiedPeerService.swift

@@ -86,45 +86,44 @@ final class UnifiedPeerService: ObservableObject, TransportPeerEventsDelegate {
         var enrichedPeers: [BitchatPeer] = []
         var connected: Set<PeerID> = []
         var addedPeerIDs: Set<PeerID> = []
-        
+        var meshNoiseKeys: Set<Data> = []
+
         // Phase 1: Add all mesh peers (connected and reachable)
         for peerInfo in meshPeers {
             let peerID = peerInfo.peerID
             guard peerID != meshService.myPeerID else { continue }  // Never add self
-            
+
             let peer = buildPeerFromMesh(
                 peerInfo: peerInfo,
                 favorites: favorites,
                 meshAttached: hasAnyConnected
             )
-            
+
             enrichedPeers.append(peer)
             if peer.isConnected { connected.insert(peerID) }
             addedPeerIDs.insert(peerID)
-            
+
             // Update fingerprint cache
             if let publicKey = peerInfo.noisePublicKey {
+                meshNoiseKeys.insert(publicKey)
                 fingerprintCache[peerID] = publicKey.sha256Fingerprint()
             }
         }
-        
-        // Phase 2: Add offline favorites that we actively favorite
+
+        // Phase 2: Add offline favorites that we actively favorite.
+        // Mesh rows use the short 16-hex peer ID while favorites are keyed by
+        // the full 32-byte noise key, so dedup must compare noise keys — a
+        // PeerID comparison between the two forms can never match.
         for (favoriteKey, favorite) in favorites where favorite.isFavorite {
+            if meshNoiseKeys.contains(favoriteKey) { continue }
+
             let peerID = PeerID(hexData: favoriteKey)
-            
-            // Skip if already added (connected peer)
             if addedPeerIDs.contains(peerID) { continue }
-            
-            // Skip if connected under different ID but same nickname
-            let isConnectedByNickname = enrichedPeers.contains { 
-                $0.nickname == favorite.peerNickname && $0.isConnected 
-            }
-            if isConnectedByNickname { continue }
-            
+
             let peer = buildPeerFromFavorite(favorite: favorite, peerID: peerID)
             enrichedPeers.append(peer)
             addedPeerIDs.insert(peerID)
-            
+
             // Update fingerprint cache
             fingerprintCache[peerID] = favoriteKey.sha256Fingerprint()
         }
@@ -257,7 +256,29 @@ final class UnifiedPeerService: ObservableObject, TransportPeerEventsDelegate {
         
         return false
     }
-    
+
+    /// Block or unblock a mesh peer by its stable Noise identity.
+    ///
+    /// The block is keyed by the peer's fingerprint, resolved from `peerID`
+    /// (cache / mesh session / known-peer Noise key). This works even when the
+    /// peer is offline — including offline favorites — so the exact tapped peer
+    /// is (un)blocked unambiguously instead of being re-resolved by a
+    /// display-name string that two peers could share.
+    /// - Returns: the resolved fingerprint, or `nil` if the identity is unknown.
+    @discardableResult
+    func setBlocked(_ peerID: PeerID, blocked: Bool) -> String? {
+        guard let fingerprint = getFingerprint(for: peerID) else {
+            SecureLogger.warning(
+                "⚠️ Cannot \(blocked ? "block" : "unblock") - unknown identity for peer: \(peerID)",
+                category: .session
+            )
+            return nil
+        }
+        identityManager.setBlocked(fingerprint, isBlocked: blocked)
+        updatePeers()
+        return fingerprint
+    }
+
     /// Toggle favorite status
     func toggleFavorite(_ peerID: PeerID) {
         guard let peer = getPeer(by: peerID) else {

bitchat/Services/VerificationService.swift

@@ -4,9 +4,11 @@ import Foundation
 final class VerificationService {
     static let shared = VerificationService()
 
-    // Injected Noise service from the running transport (do NOT create new BLEService)
-    private var noise: NoiseEncryptionService?
-    func configure(with noise: NoiseEncryptionService) { self.noise = noise }
+    // Injected running transport (do NOT create new BLEService). Noise
+    // identity operations go through the transport's narrow noise* wrappers
+    // so the raw NoiseEncryptionService is never exposed.
+    private var transport: Transport?
+    func configure(with transport: Transport) { self.transport = transport }
 
     /// Encapsulates the data encoded into a verification QR
     struct VerificationQR: Codable {
@@ -77,16 +79,16 @@ final class VerificationService {
         if let c = Cache.last, c.nick == nickname, c.npub == npub, Date().timeIntervalSince(c.builtAt) < 60 {
             return c.value
         }
-        guard let noise = noise else { return nil }
-        let noiseKey = noise.getStaticPublicKeyData().hexEncodedString()
-        let signKey = noise.getSigningPublicKeyData().hexEncodedString()
+        guard let transport = transport else { return nil }
+        let noiseKey = transport.noiseStaticPublicKeyData().hexEncodedString()
+        let signKey = transport.noiseSigningPublicKeyData().hexEncodedString()
         let ts = Int64(Date().timeIntervalSince1970)
         var nonce = Data(count: 16)
         _ = nonce.withUnsafeMutableBytes { SecRandomCopyBytes(kSecRandomDefault, 16, $0.baseAddress!) }
         let nonceB64 = nonce.base64EncodedString().replacingOccurrences(of: "+", with: "-").replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "=", with: "")
         let payload = VerificationQR(v: 1, noiseKeyHex: noiseKey, signKeyHex: signKey, npub: npub, nickname: nickname, ts: ts, nonceB64: nonceB64, sigHex: "")
         let msg = payload.canonicalBytes()
-        guard let sig = noise.signData(msg) else { return nil }
+        guard let sig = transport.noiseSignData(msg) else { return nil }
         let signed = VerificationQR(v: payload.v,
                                     noiseKeyHex: payload.noiseKeyHex,
                                     signKeyHex: payload.signKeyHex,
@@ -108,8 +110,8 @@ final class VerificationService {
         if now - Double(qr.ts) > maxAge { return nil }
         // Verify signature using embedded ed25519 signKey
         guard let sig = Data(hexString: qr.sigHex), let signKey = Data(hexString: qr.signKeyHex) else { return nil }
-        guard let noise = noise else { return nil }
-        let ok = noise.verifySignature(sig, for: qr.canonicalBytes(), publicKey: signKey)
+        guard let transport = transport else { return nil }
+        let ok = transport.noiseVerifySignature(sig, for: qr.canonicalBytes(), publicKey: signKey)
         return ok ? qr : nil
     }
 
@@ -133,7 +135,7 @@ final class VerificationService {
         let nk = noiseKeyHex.data(using: .utf8) ?? Data()
         msg.append(UInt8(min(nk.count, 255))); msg.append(nk.prefix(255))
         msg.append(nonceA)
-        guard let noise = noise, let sig = noise.signData(msg) else { return nil }
+        guard let transport = transport, let sig = transport.noiseSignData(msg) else { return nil }
         var tlv = Data()
         tlv.append(0x01); tlv.append(UInt8(min(nk.count, 255))); tlv.append(nk.prefix(255))
         tlv.append(0x02); tlv.append(UInt8(min(nonceA.count, 255))); tlv.append(nonceA.prefix(255))
@@ -178,7 +180,7 @@ final class VerificationService {
         let nk = noiseKeyHex.data(using: .utf8) ?? Data()
         msg.append(UInt8(min(nk.count, 255))); msg.append(nk.prefix(255))
         msg.append(nonceA)
-        guard let noise = noise, let pub = Data(hexString: signerPublicKeyHex) else { return false }
-        return noise.verifySignature(signature, for: msg, publicKey: pub)
+        guard let transport = transport, let pub = Data(hexString: signerPublicKeyHex) else { return false }
+        return transport.noiseVerifySignature(signature, for: msg, publicKey: pub)
     }
 }

bitchat/Services/WifiBulk/WifiBulkChannel.swift

@@ -0,0 +1,463 @@
+//
+// WifiBulkChannel.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import BitLogger
+import CryptoKit
+import Foundation
+import Network
+
+/// Shared frame-stream reading over an `NWConnection`. All callbacks fire on
+/// the connection's dispatch queue.
+enum WifiBulkStream {
+    /// Largest sealed frame body on the wire: one plaintext chunk plus AEAD overhead.
+    static func maxFrameBodyBytes(chunkBytes: Int) -> Int {
+        chunkBytes + WifiBulkCrypto.frameOverhead
+    }
+
+    /// Reads frames until `onFrame` returns false (stop) or the stream
+    /// errors/closes. `onFrame` returning true keeps the loop alive.
+    static func readFrames(
+        on connection: NWConnection,
+        buffer: WifiBulkFrameBuffer,
+        maxFrameBodyBytes: Int,
+        onFrame: @escaping (Data) -> Bool,
+        onError: @escaping (String) -> Void
+    ) {
+        // Drain any frames already buffered before touching the socket.
+        do {
+            while let body = try buffer.nextFrameBody() {
+                guard onFrame(body) else { return }
+            }
+        } catch {
+            onError("frame decode failed: \(error)")
+            return
+        }
+
+        connection.receive(
+            minimumIncompleteLength: 1,
+            maximumLength: maxFrameBodyBytes + WifiBulkCrypto.framePrefixLength
+        ) { data, _, isComplete, error in
+            if let data, !data.isEmpty {
+                buffer.append(data)
+            }
+            if let error {
+                onError("receive failed: \(error)")
+                return
+            }
+            if isComplete {
+                // Peer closed: hand over whatever complete frames remain, then
+                // report the close (sessions that already got what they need
+                // will have stopped the loop from inside onFrame).
+                do {
+                    while let body = try buffer.nextFrameBody() {
+                        guard onFrame(body) else { return }
+                    }
+                } catch {
+                    onError("frame decode failed: \(error)")
+                    return
+                }
+                onError("connection closed by peer")
+                return
+            }
+            readFrames(
+                on: connection,
+                buffer: buffer,
+                maxFrameBodyBytes: maxFrameBodyBytes,
+                onFrame: onFrame,
+                onError: onError
+            )
+        }
+    }
+}
+
+/// Sender side of the bulk channel: publishes the per-transfer Bonjour
+/// listener, requires the first inbound frame to prove knowledge of the
+/// Noise-exchanged channel key, then streams sealed chunks and waits for the
+/// receiver's verified receipt.
+///
+/// The listener starts at offer time (Bonjour registration takes a moment)
+/// but data can only flow after `activate(key:)` supplies the channel key
+/// derived from the accepted response.
+final class WifiBulkSenderSession {
+    private let queue: DispatchQueue
+    private let payload: Data
+    private let transferID: Data
+    private let payloadHash: Data
+    private let chunkBytes: Int
+    private let parameters: NWParameters
+    private let service: NWListener.Service?
+    private let maxCandidateConnections = 4
+
+    private var key: SymmetricKey?
+    private var listener: NWListener?
+    /// Connections that have not yet produced a valid auth frame.
+    private var candidates: [NWConnection] = []
+    private var authenticated: NWConnection?
+    private var finished = false
+
+    let totalChunks: Int
+
+    /// Test hook: fires once the listener is ready, with its bound port.
+    var onListenerReady: ((UInt16) -> Void)?
+    var onChunkSent: ((_ sent: Int, _ total: Int) -> Void)?
+    var onCompleted: (() -> Void)?
+    var onFailed: ((String) -> Void)?
+
+    init(
+        payload: Data,
+        transferID: Data,
+        chunkBytes: Int,
+        parameters: NWParameters,
+        service: NWListener.Service?,
+        queue: DispatchQueue
+    ) {
+        self.payload = payload
+        self.transferID = transferID
+        self.payloadHash = Data(SHA256.hash(data: payload))
+        self.chunkBytes = chunkBytes
+        self.parameters = parameters
+        self.service = service
+        self.queue = queue
+        self.totalChunks = (payload.count + chunkBytes - 1) / chunkBytes
+    }
+
+    deinit {
+        cancelNetworkResources()
+    }
+
+    /// Starts the listener. Returns false when the listener cannot be created
+    /// (caller falls back to BLE immediately).
+    func start() -> Bool {
+        let listener: NWListener
+        do {
+            listener = try NWListener(using: parameters)
+        } catch {
+            SecureLogger.error("WifiBulk: listener creation failed: \(error)", category: .session)
+            return false
+        }
+        listener.service = service
+        listener.stateUpdateHandler = { [weak self] state in
+            guard let self else { return }
+            switch state {
+            case .ready:
+                if let port = listener.port?.rawValue {
+                    self.onListenerReady?(port)
+                }
+            case .failed(let error):
+                self.fail("listener failed: \(error)")
+            default:
+                break
+            }
+        }
+        listener.newConnectionHandler = { [weak self] connection in
+            self?.acceptCandidate(connection)
+        }
+        self.listener = listener
+        listener.start(queue: queue)
+        return true
+    }
+
+    /// Supplies the channel key once the receiver accepted the offer; begins
+    /// authenticating any connections that raced ahead of the response.
+    func activate(key: SymmetricKey) {
+        guard !finished, self.key == nil else { return }
+        self.key = key
+        for candidate in candidates {
+            beginAuthentication(on: candidate, key: key)
+        }
+    }
+
+    func cancel() {
+        finished = true
+        cancelNetworkResources()
+    }
+
+    // MARK: - Connection handling
+
+    private func acceptCandidate(_ connection: NWConnection) {
+        guard !finished, authenticated == nil, candidates.count < maxCandidateConnections else {
+            connection.cancel()
+            return
+        }
+        candidates.append(connection)
+        connection.stateUpdateHandler = { [weak self, weak connection] state in
+            guard let self, let connection else { return }
+            if case .failed = state {
+                self.dropCandidate(connection)
+            }
+        }
+        connection.start(queue: queue)
+        if let key {
+            beginAuthentication(on: connection, key: key)
+        }
+    }
+
+    private func dropCandidate(_ connection: NWConnection) {
+        if let index = candidates.firstIndex(where: { $0 === connection }) {
+            candidates.remove(at: index)
+            connection.cancel()
+        }
+    }
+
+    private func beginAuthentication(on connection: NWConnection, key: SymmetricKey) {
+        let buffer = WifiBulkFrameBuffer(maxBodyBytes: WifiBulkStream.maxFrameBodyBytes(chunkBytes: chunkBytes))
+        WifiBulkStream.readFrames(
+            on: connection,
+            buffer: buffer,
+            maxFrameBodyBytes: WifiBulkStream.maxFrameBodyBytes(chunkBytes: chunkBytes),
+            onFrame: { [weak self, weak connection] body in
+                guard let self, let connection, !self.finished, self.authenticated == nil else { return false }
+                guard WifiBulkCrypto.validateClientAuthFrameBody(body, transferID: self.transferID, key: key) else {
+                    // Bonjour-level gatecrasher: no channel key, no service.
+                    SecureLogger.warning("WifiBulk: disconnecting client with invalid auth frame", category: .security)
+                    self.dropCandidate(connection)
+                    return false
+                }
+                self.promoteAuthenticated(connection, key: key, residualBuffer: buffer)
+                return false
+            },
+            onError: { [weak self, weak connection] _ in
+                guard let self, let connection, self.authenticated !== connection else { return }
+                self.dropCandidate(connection)
+            }
+        )
+    }
+
+    private func promoteAuthenticated(_ connection: NWConnection, key: SymmetricKey, residualBuffer: WifiBulkFrameBuffer) {
+        authenticated = connection
+        // One authenticated peer is all a transfer needs: stop advertising and
+        // shed the other candidates.
+        listener?.cancel()
+        listener = nil
+        for candidate in candidates where candidate !== connection {
+            candidate.cancel()
+        }
+        candidates.removeAll()
+        streamChunk(at: 0, over: connection, key: key, receiptBuffer: residualBuffer)
+    }
+
+    // MARK: - Streaming
+
+    private func streamChunk(at index: Int, over connection: NWConnection, key: SymmetricKey, receiptBuffer: WifiBulkFrameBuffer) {
+        guard !finished else { return }
+        guard index < totalChunks else {
+            awaitReceipt(on: connection, key: key, buffer: receiptBuffer)
+            return
+        }
+
+        let start = payload.index(payload.startIndex, offsetBy: index * chunkBytes)
+        let end = payload.index(start, offsetBy: min(chunkBytes, payload.distance(from: start, to: payload.endIndex)))
+        let chunk = Data(payload[start..<end])
+
+        let body: Data
+        do {
+            body = try WifiBulkCrypto.sealFrameBody(chunk, direction: .senderToReceiver, counter: UInt64(index), key: key)
+        } catch {
+            fail("chunk seal failed: \(error)")
+            return
+        }
+
+        connection.send(content: WifiBulkCrypto.frameData(body: body), completion: .contentProcessed { [weak self] error in
+            guard let self, !self.finished else { return }
+            if let error {
+                self.fail("send failed: \(error)")
+                return
+            }
+            self.onChunkSent?(index + 1, self.totalChunks)
+            self.streamChunk(at: index + 1, over: connection, key: key, receiptBuffer: receiptBuffer)
+        })
+    }
+
+    private func awaitReceipt(on connection: NWConnection, key: SymmetricKey, buffer: WifiBulkFrameBuffer) {
+        WifiBulkStream.readFrames(
+            on: connection,
+            buffer: buffer,
+            maxFrameBodyBytes: WifiBulkStream.maxFrameBodyBytes(chunkBytes: chunkBytes),
+            onFrame: { [weak self] body in
+                guard let self, !self.finished else { return false }
+                guard WifiBulkCrypto.validateReceiptFrameBody(body, payloadHash: self.payloadHash, key: key) else {
+                    self.fail("invalid receipt frame")
+                    return false
+                }
+                self.finished = true
+                self.cancelNetworkResources()
+                self.onCompleted?()
+                return false
+            },
+            onError: { [weak self] reason in
+                self?.fail("receipt wait failed: \(reason)")
+            }
+        )
+    }
+
+    // MARK: - Teardown
+
+    private func fail(_ reason: String) {
+        guard !finished else { return }
+        finished = true
+        cancelNetworkResources()
+        onFailed?(reason)
+    }
+
+    private func cancelNetworkResources() {
+        listener?.cancel()
+        listener = nil
+        authenticated?.cancel()
+        authenticated = nil
+        for candidate in candidates {
+            candidate.cancel()
+        }
+        candidates.removeAll()
+    }
+}
+
+/// Receiver side of the bulk channel: connects to the sender's per-transfer
+/// endpoint, proves knowledge of the channel key with the first frame, then
+/// reassembles sealed chunks, verifies the offer hash, and returns a receipt.
+final class WifiBulkReceiverSession {
+    private let queue: DispatchQueue
+    private let connection: NWConnection
+    private let key: SymmetricKey
+    private let transferID: Data
+    private let payloadHash: Data
+    private let chunkBytes: Int
+    private let assembler: WifiBulkPayloadAssembler
+
+    private var finished = false
+
+    var onCompleted: ((Data) -> Void)?
+    var onFailed: ((String) -> Void)?
+
+    /// Fails (returns nil) when the offer exceeds `sizeCap` — the receiver
+    /// enforces the cap it advertised, not the sender's word.
+    init?(
+        endpoint: NWEndpoint,
+        parameters: NWParameters,
+        key: SymmetricKey,
+        transferID: Data,
+        expectedSize: UInt64,
+        expectedHash: Data,
+        sizeCap: Int,
+        chunkBytes: Int,
+        queue: DispatchQueue
+    ) {
+        guard let assembler = WifiBulkPayloadAssembler(
+            key: key,
+            expectedSize: expectedSize,
+            expectedHash: expectedHash,
+            sizeCap: sizeCap
+        ) else {
+            return nil
+        }
+        self.assembler = assembler
+        self.connection = NWConnection(to: endpoint, using: parameters)
+        self.key = key
+        self.transferID = transferID
+        self.payloadHash = expectedHash
+        self.chunkBytes = chunkBytes
+        self.queue = queue
+    }
+
+    deinit {
+        connection.cancel()
+    }
+
+    func start() {
+        connection.stateUpdateHandler = { [weak self] state in
+            guard let self else { return }
+            switch state {
+            case .ready:
+                self.sendAuthFrameAndReceive()
+            case .failed(let error):
+                self.fail("connect failed: \(error)")
+            case .waiting(let error):
+                // .waiting can resolve on its own, but a per-transfer channel
+                // has a peer actively listening; treat unreachable as fatal so
+                // the sender's fallback isn't left to the window timeout alone.
+                self.fail("connection waiting: \(error)")
+            default:
+                break
+            }
+        }
+        connection.start(queue: queue)
+    }
+
+    func cancel() {
+        finished = true
+        connection.cancel()
+    }
+
+    private func sendAuthFrameAndReceive() {
+        guard !finished else { return }
+        let authBody: Data
+        do {
+            authBody = try WifiBulkCrypto.makeClientAuthFrameBody(transferID: transferID, key: key)
+        } catch {
+            fail("auth frame seal failed: \(error)")
+            return
+        }
+        connection.send(content: WifiBulkCrypto.frameData(body: authBody), completion: .contentProcessed { [weak self] error in
+            guard let self, !self.finished else { return }
+            if let error {
+                self.fail("auth frame send failed: \(error)")
+                return
+            }
+            self.receiveChunks()
+        })
+    }
+
+    private func receiveChunks() {
+        let buffer = WifiBulkFrameBuffer(maxBodyBytes: WifiBulkStream.maxFrameBodyBytes(chunkBytes: chunkBytes))
+        WifiBulkStream.readFrames(
+            on: connection,
+            buffer: buffer,
+            maxFrameBodyBytes: WifiBulkStream.maxFrameBodyBytes(chunkBytes: chunkBytes),
+            onFrame: { [weak self] body in
+                guard let self, !self.finished else { return false }
+                do {
+                    guard let payload = try self.assembler.consume(frameBody: body) else {
+                        return true // keep reading
+                    }
+                    self.sendReceiptAndComplete(payload)
+                    return false
+                } catch {
+                    self.fail("chunk rejected: \(error)")
+                    return false
+                }
+            },
+            onError: { [weak self] reason in
+                self?.fail(reason)
+            }
+        )
+    }
+
+    private func sendReceiptAndComplete(_ payload: Data) {
+        let receiptBody: Data
+        do {
+            receiptBody = try WifiBulkCrypto.makeReceiptFrameBody(payloadHash: payloadHash, key: key)
+        } catch {
+            fail("receipt seal failed: \(error)")
+            return
+        }
+        connection.send(content: WifiBulkCrypto.frameData(body: receiptBody), completion: .contentProcessed { [weak self] _ in
+            // Receipt is best-effort from the receiver's perspective: the
+            // payload is already verified. Close the channel either way.
+            guard let self, !self.finished else { return }
+            self.finished = true
+            self.connection.cancel()
+            self.onCompleted?(payload)
+        })
+    }
+
+    private func fail(_ reason: String) {
+        guard !finished else { return }
+        finished = true
+        connection.cancel()
+        onFailed?(reason)
+    }
+}

bitchat/Services/WifiBulk/WifiBulkCrypto.swift

@@ -0,0 +1,215 @@
+//
+// WifiBulkCrypto.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import CryptoKit
+import Foundation
+
+/// Channel security for the Wi-Fi bulk data plane.
+///
+/// The TCP stream is encrypted and authenticated independently of TLS: both
+/// endpoints exchanged random 32-byte tokens inside the established Noise
+/// session, so only they can derive the ChaChaPoly channel key via
+/// HKDF-SHA256 (domain "bitchat-bulk-v1", transferID as salt). A Bonjour-level
+/// gatecrasher that connects to the listener cannot produce a single valid
+/// frame and is disconnected.
+///
+/// Stream format: length-prefixed frames, each a ChaChaPoly sealed box in
+/// combined form (12-byte nonce ‖ ciphertext ‖ 16-byte tag). Nonces are
+/// structured, never random: [direction byte][3 zero bytes][8-byte BE counter],
+/// and the reader requires the exact expected nonce for each frame, so frames
+/// cannot be replayed, reordered, or reflected across directions.
+enum WifiBulkCryptoError: Error, Equatable {
+    case invalidParameters
+    case frameTooLarge
+    case truncatedFrame
+    case nonceMismatch
+    case authenticationFailed
+    case emptyChunk
+    case payloadOverflow
+    case hashMismatch
+}
+
+enum WifiBulkFrameDirection: UInt8 {
+    /// Data chunks: counters 0, 1, 2, …
+    case senderToReceiver = 0x00
+    /// Counter 0 = client auth frame, counter 1 = final receipt.
+    case receiverToSender = 0x01
+}
+
+enum WifiBulkCrypto {
+    static let keyDomain = "bitchat-bulk-v1"
+    static let nonceLength = 12
+    static let tagLength = 16
+    /// AEAD overhead per frame body (nonce + tag).
+    static let frameOverhead = nonceLength + tagLength
+    /// 4-byte big-endian length prefix per frame.
+    static let framePrefixLength = 4
+
+    // MARK: Key derivation
+
+    /// Derives the ChaChaPoly channel key from the two Noise-exchanged tokens.
+    /// Deterministic: same tokens + transferID always yield the same key.
+    static func deriveKey(senderToken: Data, receiverToken: Data, transferID: Data) -> SymmetricKey? {
+        guard senderToken.count == WifiBulkWire.tokenLength,
+              receiverToken.count == WifiBulkWire.tokenLength,
+              transferID.count == WifiBulkWire.transferIDLength else {
+            return nil
+        }
+        var inputKeyMaterial = Data()
+        inputKeyMaterial.append(senderToken)
+        inputKeyMaterial.append(receiverToken)
+        return HKDF<SHA256>.deriveKey(
+            inputKeyMaterial: SymmetricKey(data: inputKeyMaterial),
+            salt: transferID,
+            info: Data(keyDomain.utf8),
+            outputByteCount: 32
+        )
+    }
+
+    // MARK: Frame sealing
+
+    static func nonceData(direction: WifiBulkFrameDirection, counter: UInt64) -> Data {
+        var nonce = Data(count: nonceLength)
+        nonce[0] = direction.rawValue
+        var counterBE = counter.bigEndian
+        withUnsafeBytes(of: &counterBE) { nonce.replaceSubrange(4..<nonceLength, with: $0) }
+        return nonce
+    }
+
+    /// Seals one frame body (nonce ‖ ciphertext ‖ tag), without length prefix.
+    static func sealFrameBody(
+        _ plaintext: Data,
+        direction: WifiBulkFrameDirection,
+        counter: UInt64,
+        key: SymmetricKey
+    ) throws -> Data {
+        let nonce = try ChaChaPoly.Nonce(data: nonceData(direction: direction, counter: counter))
+        return try ChaChaPoly.seal(plaintext, using: key, nonce: nonce).combined
+    }
+
+    /// Opens one frame body, enforcing the exact expected nonce.
+    static func openFrameBody(
+        _ body: Data,
+        direction: WifiBulkFrameDirection,
+        counter: UInt64,
+        key: SymmetricKey
+    ) throws -> Data {
+        guard body.count >= frameOverhead else { throw WifiBulkCryptoError.truncatedFrame }
+        guard body.prefix(nonceLength) == nonceData(direction: direction, counter: counter) else {
+            throw WifiBulkCryptoError.nonceMismatch
+        }
+        do {
+            let box = try ChaChaPoly.SealedBox(combined: body)
+            return try ChaChaPoly.open(box, using: key)
+        } catch {
+            throw WifiBulkCryptoError.authenticationFailed
+        }
+    }
+
+    /// Prefixes a frame body with its 4-byte big-endian length for the wire.
+    static func frameData(body: Data) -> Data {
+        var framed = Data(capacity: framePrefixLength + body.count)
+        var lengthBE = UInt32(body.count).bigEndian
+        withUnsafeBytes(of: &lengthBE) { framed.append(contentsOf: $0) }
+        framed.append(body)
+        return framed
+    }
+
+    // MARK: Control frames
+
+    /// First frame on the wire, receiver → sender: proves the connecting
+    /// client holds the Noise-exchanged secret before any data flows.
+    static func makeClientAuthFrameBody(transferID: Data, key: SymmetricKey) throws -> Data {
+        try sealFrameBody(transferID, direction: .receiverToSender, counter: 0, key: key)
+    }
+
+    static func validateClientAuthFrameBody(_ body: Data, transferID: Data, key: SymmetricKey) -> Bool {
+        (try? openFrameBody(body, direction: .receiverToSender, counter: 0, key: key)) == transferID
+    }
+
+    /// Final frame, receiver → sender: acknowledges the fully verified payload.
+    static func makeReceiptFrameBody(payloadHash: Data, key: SymmetricKey) throws -> Data {
+        try sealFrameBody(payloadHash, direction: .receiverToSender, counter: 1, key: key)
+    }
+
+    static func validateReceiptFrameBody(_ body: Data, payloadHash: Data, key: SymmetricKey) -> Bool {
+        (try? openFrameBody(body, direction: .receiverToSender, counter: 1, key: key)) == payloadHash
+    }
+}
+
+/// Incremental length-prefix parser for the frame stream. Bounded: bodies
+/// larger than `maxBodyBytes` throw instead of buffering unboundedly.
+final class WifiBulkFrameBuffer {
+    private var buffer = Data()
+    private let maxBodyBytes: Int
+
+    init(maxBodyBytes: Int) {
+        self.maxBodyBytes = maxBodyBytes
+    }
+
+    func append(_ data: Data) {
+        buffer.append(data)
+    }
+
+    /// Extracts the next complete frame body, or nil when more bytes are needed.
+    func nextFrameBody() throws -> Data? {
+        guard buffer.count >= WifiBulkCrypto.framePrefixLength else { return nil }
+        let length = buffer.prefix(WifiBulkCrypto.framePrefixLength).reduce(Int(0)) { ($0 << 8) | Int($1) }
+        guard length <= maxBodyBytes else { throw WifiBulkCryptoError.frameTooLarge }
+        guard buffer.count >= WifiBulkCrypto.framePrefixLength + length else { return nil }
+        let body = Data(buffer.dropFirst(WifiBulkCrypto.framePrefixLength).prefix(length))
+        buffer.removeFirst(WifiBulkCrypto.framePrefixLength + length)
+        return body
+    }
+}
+
+/// Receiver-side reassembly: opens sequential data frames, enforces the size
+/// negotiated in the accepted offer, and verifies the final SHA-256.
+final class WifiBulkPayloadAssembler {
+    private let key: SymmetricKey
+    private let expectedSize: Int
+    private let expectedHash: Data
+    private var received = Data()
+    private var counter: UInt64 = 0
+
+    /// Fails when the offer exceeds the receiver-enforced cap.
+    init?(key: SymmetricKey, expectedSize: UInt64, expectedHash: Data, sizeCap: Int) {
+        guard expectedSize > 0,
+              expectedSize <= UInt64(sizeCap),
+              expectedHash.count == WifiBulkWire.hashLength else {
+            return nil
+        }
+        self.key = key
+        self.expectedSize = Int(expectedSize)
+        self.expectedHash = expectedHash
+    }
+
+    var isComplete: Bool { received.count == expectedSize }
+
+    /// Consumes one sealed data frame body. Returns the verified payload when
+    /// the final byte arrives; throws on tampering, overflow, or hash mismatch.
+    func consume(frameBody: Data) throws -> Data? {
+        let chunk = try WifiBulkCrypto.openFrameBody(
+            frameBody,
+            direction: .senderToReceiver,
+            counter: counter,
+            key: key
+        )
+        guard !chunk.isEmpty else { throw WifiBulkCryptoError.emptyChunk }
+        counter += 1
+        guard received.count + chunk.count <= expectedSize else {
+            throw WifiBulkCryptoError.payloadOverflow
+        }
+        received.append(chunk)
+        guard isComplete else { return nil }
+        guard Data(SHA256.hash(data: received)) == expectedHash else {
+            throw WifiBulkCryptoError.hashMismatch
+        }
+        return received
+    }
+}

bitchat/Services/WifiBulk/WifiBulkMessages.swift

@@ -0,0 +1,191 @@
+//
+// WifiBulkMessages.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import Foundation
+
+/// TLV payloads for negotiating a Wi-Fi bulk transfer inside an established
+/// Noise session (`NoisePayloadType.bulkTransferOffer` / `.bulkTransferResponse`).
+///
+/// Both messages ride the encrypted Noise channel, so every field — including
+/// the session tokens and the random Bonjour instance name — is only visible
+/// to the two endpoints. TLV format matches `BitchatFilePacket`: 1-byte type,
+/// 2-byte big-endian length, value. Unknown TLVs are skipped for forward
+/// compatibility.
+enum WifiBulkWire {
+    static let transferIDLength = 16
+    static let tokenLength = 32
+    static let hashLength = 32
+    /// Bonjour instance names are capped at 63 UTF-8 bytes.
+    static let maxServiceNameBytes = 63
+
+    static func appendTLV(_ type: UInt8, value: Data, into data: inout Data) {
+        data.append(type)
+        var length = UInt16(value.count).bigEndian
+        withUnsafeBytes(of: &length) { data.append(contentsOf: $0) }
+        data.append(value)
+    }
+
+    /// Iterates well-formed TLVs, handing each (type, value) to `visit`.
+    /// Returns false when the buffer is structurally malformed.
+    static func parseTLVs(_ data: Data, visit: (UInt8, Data) -> Void) -> Bool {
+        var cursor = data.startIndex
+        let end = data.endIndex
+        while cursor < end {
+            let type = data[cursor]
+            cursor = data.index(after: cursor)
+            guard data.distance(from: cursor, to: end) >= 2 else { return false }
+            let length = Int(data[cursor]) << 8 | Int(data[data.index(after: cursor)])
+            cursor = data.index(cursor, offsetBy: 2)
+            guard data.distance(from: cursor, to: end) >= length else { return false }
+            let valueEnd = data.index(cursor, offsetBy: length)
+            visit(type, Data(data[cursor..<valueEnd]))
+            cursor = valueEnd
+        }
+        return true
+    }
+}
+
+/// Sender → receiver: proposal to move an already-encoded file payload over
+/// a peer-to-peer Wi-Fi (AWDL) TCP channel instead of BLE fragmentation.
+struct WifiBulkOffer: Equatable {
+    /// Random per-transfer identifier; also the HKDF salt.
+    let transferID: Data
+    /// Exact byte count of the payload that will cross the channel.
+    let fileSize: UInt64
+    /// SHA-256 over the payload bytes as they cross the channel, verified by
+    /// the receiver after reassembly.
+    let payloadHash: Data
+    /// Sender's random half of the channel secret.
+    let token: Data
+    /// Random Bonjour instance name the sender publishes for this transfer.
+    /// Never derived from nickname or peer ID.
+    let serviceName: String
+
+    private enum TLVType: UInt8 {
+        case transferID = 0x01
+        case fileSize = 0x02
+        case payloadHash = 0x03
+        case token = 0x04
+        case serviceName = 0x05
+    }
+
+    func encode() -> Data? {
+        guard transferID.count == WifiBulkWire.transferIDLength,
+              payloadHash.count == WifiBulkWire.hashLength,
+              token.count == WifiBulkWire.tokenLength else { return nil }
+        let nameData = Data(serviceName.utf8)
+        guard !nameData.isEmpty, nameData.count <= WifiBulkWire.maxServiceNameBytes else { return nil }
+
+        var encoded = Data()
+        WifiBulkWire.appendTLV(TLVType.transferID.rawValue, value: transferID, into: &encoded)
+        var sizeBE = fileSize.bigEndian
+        WifiBulkWire.appendTLV(TLVType.fileSize.rawValue, value: withUnsafeBytes(of: &sizeBE) { Data($0) }, into: &encoded)
+        WifiBulkWire.appendTLV(TLVType.payloadHash.rawValue, value: payloadHash, into: &encoded)
+        WifiBulkWire.appendTLV(TLVType.token.rawValue, value: token, into: &encoded)
+        WifiBulkWire.appendTLV(TLVType.serviceName.rawValue, value: nameData, into: &encoded)
+        return encoded
+    }
+
+    static func decode(_ data: Data) -> WifiBulkOffer? {
+        var transferID: Data?
+        var fileSize: UInt64?
+        var payloadHash: Data?
+        var token: Data?
+        var serviceName: String?
+
+        let wellFormed = WifiBulkWire.parseTLVs(data) { type, value in
+            switch TLVType(rawValue: type) {
+            case .transferID where value.count == WifiBulkWire.transferIDLength:
+                transferID = value
+            case .fileSize where value.count == 8:
+                fileSize = value.reduce(UInt64(0)) { ($0 << 8) | UInt64($1) }
+            case .payloadHash where value.count == WifiBulkWire.hashLength:
+                payloadHash = value
+            case .token where value.count == WifiBulkWire.tokenLength:
+                token = value
+            case .serviceName where !value.isEmpty && value.count <= WifiBulkWire.maxServiceNameBytes:
+                serviceName = String(data: value, encoding: .utf8)
+            default:
+                break // Unknown or malformed field: ignore; required checks below.
+            }
+        }
+        guard wellFormed,
+              let transferID, let fileSize, let payloadHash, let token, let serviceName else {
+            return nil
+        }
+        return WifiBulkOffer(
+            transferID: transferID,
+            fileSize: fileSize,
+            payloadHash: payloadHash,
+            token: token,
+            serviceName: serviceName
+        )
+    }
+}
+
+/// Receiver → sender: accept (with the receiver's token half) or decline.
+struct WifiBulkResponse: Equatable {
+    let transferID: Data
+    let accepted: Bool
+    /// Receiver's random half of the channel secret; present iff accepted.
+    let token: Data?
+
+    private enum TLVType: UInt8 {
+        case transferID = 0x01
+        case accepted = 0x02
+        case token = 0x03
+    }
+
+    static func accept(transferID: Data, token: Data) -> WifiBulkResponse {
+        WifiBulkResponse(transferID: transferID, accepted: true, token: token)
+    }
+
+    static func decline(transferID: Data) -> WifiBulkResponse {
+        WifiBulkResponse(transferID: transferID, accepted: false, token: nil)
+    }
+
+    func encode() -> Data? {
+        guard transferID.count == WifiBulkWire.transferIDLength else { return nil }
+        if accepted {
+            guard token?.count == WifiBulkWire.tokenLength else { return nil }
+        }
+
+        var encoded = Data()
+        WifiBulkWire.appendTLV(TLVType.transferID.rawValue, value: transferID, into: &encoded)
+        WifiBulkWire.appendTLV(TLVType.accepted.rawValue, value: Data([accepted ? 1 : 0]), into: &encoded)
+        if accepted, let token {
+            WifiBulkWire.appendTLV(TLVType.token.rawValue, value: token, into: &encoded)
+        }
+        return encoded
+    }
+
+    static func decode(_ data: Data) -> WifiBulkResponse? {
+        var transferID: Data?
+        var accepted: Bool?
+        var token: Data?
+
+        let wellFormed = WifiBulkWire.parseTLVs(data) { type, value in
+            switch TLVType(rawValue: type) {
+            case .transferID where value.count == WifiBulkWire.transferIDLength:
+                transferID = value
+            case .accepted where value.count == 1:
+                accepted = value.first == 1
+            case .token where value.count == WifiBulkWire.tokenLength:
+                token = value
+            default:
+                break
+            }
+        }
+        guard wellFormed, let transferID, let accepted else { return nil }
+        if accepted {
+            guard let token else { return nil }
+            return WifiBulkResponse(transferID: transferID, accepted: true, token: token)
+        }
+        return WifiBulkResponse(transferID: transferID, accepted: false, token: nil)
+    }
+}

bitchat/Services/WifiBulk/WifiBulkPolicy.swift

@@ -0,0 +1,57 @@
+//
+// WifiBulkPolicy.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import BitFoundation
+import Foundation
+
+/// Pure eligibility decisions for the Wi-Fi bulk data plane. Anything that
+/// fails these gates rides BLE fragmentation exactly as before — the BLE
+/// fallback is the common case and must stay bulletproof.
+enum WifiBulkPolicy {
+    struct SendCandidate {
+        let payloadBytes: Int
+        let peerCapabilities: PeerCapabilities
+        /// Direct BLE link (1 hop). Multi-hop recipients stay on BLE: AWDL
+        /// only reaches direct neighbors, and relays can't proxy the channel.
+        let isDirectlyConnected: Bool
+        /// The offer rides the Noise session, so one must already exist.
+        let hasEstablishedNoiseSession: Bool
+    }
+
+    static func shouldOffer(
+        _ candidate: SendCandidate,
+        enabled: Bool = TransportConfig.wifiBulkEnabled,
+        minPayloadBytes: Int = TransportConfig.wifiBulkMinPayloadBytes,
+        maxPayloadBytes: Int = FileTransferLimits.maxWifiBulkPayloadBytes
+    ) -> Bool {
+        enabled
+            && candidate.payloadBytes > minPayloadBytes
+            && candidate.payloadBytes <= maxPayloadBytes
+            && candidate.peerCapabilities.contains(.wifiBulk)
+            && candidate.isDirectlyConnected
+            && candidate.hasEstablishedNoiseSession
+    }
+
+    /// Receiver-side gate. Field lengths were validated at decode; this
+    /// enforces the size cap (from the local ceiling, not the sender's word)
+    /// and local enablement.
+    static func shouldAccept(
+        offer: WifiBulkOffer,
+        senderIsDirectlyConnected: Bool,
+        activeIncomingTransfers: Int,
+        enabled: Bool = TransportConfig.wifiBulkEnabled,
+        maxPayloadBytes: Int = FileTransferLimits.maxWifiBulkPayloadBytes,
+        maxConcurrentIncoming: Int = TransportConfig.wifiBulkMaxConcurrentIncoming
+    ) -> Bool {
+        enabled
+            && senderIsDirectlyConnected
+            && activeIncomingTransfers < maxConcurrentIncoming
+            && offer.fileSize > 0
+            && offer.fileSize <= UInt64(maxPayloadBytes)
+    }
+}

bitchat/Services/WifiBulk/WifiBulkTransferService.swift

@@ -0,0 +1,477 @@
+//
+// WifiBulkTransferService.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import BitFoundation
+import BitLogger
+import CryptoKit
+import Foundation
+import Network
+
+/// Narrow environment for `WifiBulkTransferService`. All BLE-service queue
+/// hops live inside the closures supplied by `BLEService`, keeping this
+/// service independently testable.
+struct WifiBulkTransferServiceEnvironment {
+    /// Sends a typed payload inside the established Noise session with the
+    /// peer. Returns false when no established session exists (the caller
+    /// falls back to BLE).
+    let sendNoisePayload: (_ typedPayload: Data, _ peerID: PeerID) -> Bool
+    /// Whether the peer is on a direct BLE link right now.
+    let isPeerConnected: (PeerID) -> Bool
+    /// Delivers a fully received, hash-verified payload (encoded
+    /// `BitchatFilePacket` TLV) into the normal incoming-file pipeline.
+    let deliverReceivedFile: (_ payload: Data, _ peerID: PeerID, _ payloadLimit: Int) -> Void
+    /// Progress bus hooks mirroring the BLE fragmentation path so the UI is
+    /// unchanged (chunks report as "fragments").
+    let progressStart: (_ transferId: String, _ totalChunks: Int) -> Void
+    let progressChunkSent: (_ transferId: String) -> Void
+    /// Silently forgets progress state ahead of a BLE fallback re-start.
+    let progressReset: (_ transferId: String) -> Void
+    /// Emits the cancelled event for user-cancelled transfers.
+    let progressCancel: (_ transferId: String) -> Void
+}
+
+/// Knobs with test overrides; production values come from `TransportConfig`.
+struct WifiBulkTransferServiceConfig {
+    var serviceType: String = TransportConfig.wifiBulkServiceType
+    var chunkBytes: Int = TransportConfig.wifiBulkChunkBytes
+    var offerTimeout: TimeInterval = TransportConfig.wifiBulkOfferTimeoutSeconds
+    var transferWindow: TimeInterval = TransportConfig.wifiBulkTransferWindowSeconds
+    var maxIncomingPayloadBytes: Int = FileTransferLimits.maxWifiBulkPayloadBytes
+    var maxConcurrentIncoming: Int = TransportConfig.wifiBulkMaxConcurrentIncoming
+    /// Tests disable peer-to-peer so loopback interfaces stay usable.
+    var usePeerToPeer: Bool = true
+    /// Tests disable Bonjour publication (unit-test hosts may lack mDNS access).
+    var publishBonjourService: Bool = true
+}
+
+/// Orchestrates the Wi-Fi bulk data plane: BLE/Noise carries the offer and
+/// response (control plane), then the payload crosses a per-transfer TCP
+/// channel over AWDL, sealed with a key both sides derived from the
+/// Noise-exchanged tokens. Any failure at any stage falls back to BLE
+/// fragmentation exactly once; the receiver side fails silently and lets the
+/// sender's timeout drive that fallback.
+final class WifiBulkTransferService {
+    private let queue = DispatchQueue(label: "com.bitchat.wifi-bulk", qos: .userInitiated)
+    private let environment: WifiBulkTransferServiceEnvironment
+    private let config: WifiBulkTransferServiceConfig
+
+    private final class OutgoingTransfer {
+        let transferID: Data
+        let transferId: String
+        let peerID: PeerID
+        let token: Data
+        let fallback: () -> Void
+        var session: WifiBulkSenderSession?
+        var offerTimeout: DispatchWorkItem?
+        var windowTimeout: DispatchWorkItem?
+        var accepted = false
+        var finished = false
+
+        init(transferID: Data, transferId: String, peerID: PeerID, token: Data, fallback: @escaping () -> Void) {
+            self.transferID = transferID
+            self.transferId = transferId
+            self.peerID = peerID
+            self.token = token
+            self.fallback = fallback
+        }
+    }
+
+    private final class IncomingTransfer {
+        let offer: WifiBulkOffer
+        let peerID: PeerID
+        let key: SymmetricKey
+        var browser: NWBrowser?
+        var session: WifiBulkReceiverSession?
+        var windowTimeout: DispatchWorkItem?
+
+        init(offer: WifiBulkOffer, peerID: PeerID, key: SymmetricKey) {
+            self.offer = offer
+            self.peerID = peerID
+            self.key = key
+        }
+    }
+
+    private var outgoing: [Data: OutgoingTransfer] = [:]
+    private var incoming: [Data: IncomingTransfer] = [:]
+
+    init(
+        environment: WifiBulkTransferServiceEnvironment,
+        config: WifiBulkTransferServiceConfig = WifiBulkTransferServiceConfig()
+    ) {
+        self.environment = environment
+        self.config = config
+    }
+
+    // MARK: - Sender
+
+    /// Offers `payload` over the Wi-Fi bulk channel. `fallbackToBLE` runs at
+    /// most once, on decline, timeout, or any mid-transfer error.
+    func sendFile(payload: Data, to peerID: PeerID, transferId: String, fallbackToBLE: @escaping () -> Void) {
+        queue.async { [weak self] in
+            self?.beginOutgoing(payload: payload, peerID: peerID, transferId: transferId, fallbackToBLE: fallbackToBLE)
+        }
+    }
+
+    /// Handles a decrypted `bulkTransferResponse` Noise payload.
+    func handleResponsePayload(_ payload: Data, from peerID: PeerID) {
+        queue.async { [weak self] in
+            self?.processResponse(payload, from: peerID)
+        }
+    }
+
+    /// User-initiated cancel from the UI (mirrors BLE `cancelTransfer`).
+    func cancelTransfer(transferId: String) {
+        queue.async { [weak self] in
+            guard let self,
+                  let transfer = self.outgoing.values.first(where: { $0.transferId == transferId }) else { return }
+            self.finishOutgoing(transfer, outcome: .cancelled, reason: "cancelled by user")
+        }
+    }
+
+    /// Tears down every transfer (service shutdown / emergency disconnect).
+    /// In-flight outgoing transfers do NOT fall back — the transport is going away.
+    func stop() {
+        queue.async { [weak self] in
+            guard let self else { return }
+            for transfer in self.outgoing.values {
+                transfer.finished = true
+                transfer.offerTimeout?.cancel()
+                transfer.windowTimeout?.cancel()
+                transfer.session?.cancel()
+            }
+            self.outgoing.removeAll()
+            for transfer in self.incoming.values {
+                self.tearDownIncomingResources(transfer)
+            }
+            self.incoming.removeAll()
+        }
+    }
+
+    private enum OutgoingOutcome {
+        case completed
+        case fallback
+        case cancelled
+    }
+
+    private func beginOutgoing(payload: Data, peerID: PeerID, transferId: String, fallbackToBLE: @escaping () -> Void) {
+        let transferID = Self.randomData(WifiBulkWire.transferIDLength)
+        let token = Self.randomData(WifiBulkWire.tokenLength)
+        // Random per-transfer instance name — never the nickname or peer ID.
+        let serviceName = Self.randomData(16).hexEncodedString()
+
+        let offer = WifiBulkOffer(
+            transferID: transferID,
+            fileSize: UInt64(payload.count),
+            payloadHash: Data(SHA256.hash(data: payload)),
+            token: token,
+            serviceName: serviceName
+        )
+        guard let offerData = offer.encode() else {
+            fallbackToBLE()
+            return
+        }
+
+        let transfer = OutgoingTransfer(
+            transferID: transferID,
+            transferId: transferId,
+            peerID: peerID,
+            token: token,
+            fallback: fallbackToBLE
+        )
+
+        let session = WifiBulkSenderSession(
+            payload: payload,
+            transferID: transferID,
+            chunkBytes: config.chunkBytes,
+            parameters: makeParameters(),
+            service: config.publishBonjourService
+                ? NWListener.Service(name: serviceName, type: config.serviceType)
+                : nil,
+            queue: queue
+        )
+        if let onListenerReady = _test_onListenerReady {
+            session.onListenerReady = { port in onListenerReady(transferID, port) }
+        }
+        session.onChunkSent = { [weak self, weak transfer] sent, total in
+            guard let self, let transfer, !transfer.finished else { return }
+            // Hold the final tick until the receipt confirms delivery, so the
+            // progress bus only emits .completed for verified transfers.
+            if sent < total {
+                self.environment.progressChunkSent(transfer.transferId)
+            }
+        }
+        session.onCompleted = { [weak self, weak transfer] in
+            guard let self, let transfer, !transfer.finished else { return }
+            self.environment.progressChunkSent(transfer.transferId)
+            self.finishOutgoing(transfer, outcome: .completed, reason: "receipt verified")
+        }
+        session.onFailed = { [weak self, weak transfer] reason in
+            guard let self, let transfer else { return }
+            self.finishOutgoing(transfer, outcome: .fallback, reason: reason)
+        }
+        transfer.session = session
+        outgoing[transferID] = transfer
+
+        guard session.start() else {
+            finishOutgoing(transfer, outcome: .fallback, reason: "listener unavailable")
+            return
+        }
+        guard environment.sendNoisePayload(
+            BLENoisePayloadFactory.typedPayload(.bulkTransferOffer, payload: offerData),
+            peerID
+        ) else {
+            finishOutgoing(transfer, outcome: .fallback, reason: "no established noise session")
+            return
+        }
+
+        SecureLogger.debug("WifiBulk: offered \(payload.count) bytes to \(peerID.id.prefix(8))… over \(serviceName.prefix(8))…", category: .session)
+        environment.progressStart(transferId, session.totalChunks)
+
+        let offerTimeout = DispatchWorkItem { [weak self, weak transfer] in
+            guard let self, let transfer, !transfer.accepted else { return }
+            self.finishOutgoing(transfer, outcome: .fallback, reason: "offer timed out")
+        }
+        transfer.offerTimeout = offerTimeout
+        queue.asyncAfter(deadline: .now() + config.offerTimeout, execute: offerTimeout)
+
+        let windowTimeout = DispatchWorkItem { [weak self, weak transfer] in
+            guard let self, let transfer else { return }
+            self.finishOutgoing(transfer, outcome: .fallback, reason: "transfer window expired")
+        }
+        transfer.windowTimeout = windowTimeout
+        queue.asyncAfter(deadline: .now() + config.transferWindow, execute: windowTimeout)
+    }
+
+    private func processResponse(_ payload: Data, from peerID: PeerID) {
+        guard let response = WifiBulkResponse.decode(payload),
+              let transfer = outgoing[response.transferID],
+              transfer.peerID.toShort() == peerID.toShort(),
+              !transfer.accepted, !transfer.finished else {
+            return
+        }
+
+        guard response.accepted, let receiverToken = response.token else {
+            finishOutgoing(transfer, outcome: .fallback, reason: "offer declined")
+            return
+        }
+        guard let key = WifiBulkCrypto.deriveKey(
+            senderToken: transfer.token,
+            receiverToken: receiverToken,
+            transferID: transfer.transferID
+        ) else {
+            finishOutgoing(transfer, outcome: .fallback, reason: "key derivation failed")
+            return
+        }
+
+        transfer.accepted = true
+        transfer.offerTimeout?.cancel()
+        transfer.offerTimeout = nil
+        transfer.session?.activate(key: key)
+    }
+
+    private func finishOutgoing(_ transfer: OutgoingTransfer, outcome: OutgoingOutcome, reason: String) {
+        guard !transfer.finished else { return }
+        transfer.finished = true
+        transfer.offerTimeout?.cancel()
+        transfer.windowTimeout?.cancel()
+        transfer.session?.cancel()
+        outgoing.removeValue(forKey: transfer.transferID)
+
+        switch outcome {
+        case .completed:
+            SecureLogger.debug("WifiBulk: transfer \(transfer.transferId.prefix(8))… completed (\(reason))", category: .session)
+        case .fallback:
+            SecureLogger.info("WifiBulk: transfer \(transfer.transferId.prefix(8))… falling back to BLE (\(reason))", category: .session)
+            environment.progressReset(transfer.transferId)
+            transfer.fallback()
+        case .cancelled:
+            SecureLogger.debug("WifiBulk: transfer \(transfer.transferId.prefix(8))… cancelled", category: .session)
+            environment.progressCancel(transfer.transferId)
+        }
+    }
+
+    // MARK: - Receiver
+
+    /// Handles a decrypted `bulkTransferOffer` Noise payload.
+    func handleOfferPayload(_ payload: Data, from peerID: PeerID) {
+        queue.async { [weak self] in
+            self?.processOffer(payload, from: peerID)
+        }
+    }
+
+    private func processOffer(_ payload: Data, from peerID: PeerID) {
+        guard let offer = WifiBulkOffer.decode(payload) else { return }
+        guard incoming[offer.transferID] == nil else { return }
+
+        guard WifiBulkPolicy.shouldAccept(
+            offer: offer,
+            senderIsDirectlyConnected: environment.isPeerConnected(peerID),
+            activeIncomingTransfers: incoming.count,
+            maxPayloadBytes: config.maxIncomingPayloadBytes,
+            maxConcurrentIncoming: config.maxConcurrentIncoming
+        ) else {
+            decline(offer: offer, peerID: peerID)
+            return
+        }
+
+        let token = Self.randomData(WifiBulkWire.tokenLength)
+        guard let key = WifiBulkCrypto.deriveKey(
+            senderToken: offer.token,
+            receiverToken: token,
+            transferID: offer.transferID
+        ),
+        let responseData = WifiBulkResponse.accept(transferID: offer.transferID, token: token).encode() else {
+            decline(offer: offer, peerID: peerID)
+            return
+        }
+        guard environment.sendNoisePayload(
+            BLENoisePayloadFactory.typedPayload(.bulkTransferResponse, payload: responseData),
+            peerID
+        ) else {
+            return // No session to answer on; the sender's timeout handles fallback.
+        }
+
+        let transfer = IncomingTransfer(offer: offer, peerID: peerID, key: key)
+        incoming[offer.transferID] = transfer
+        SecureLogger.debug("WifiBulk: accepted offer of \(offer.fileSize) bytes from \(peerID.id.prefix(8))…", category: .session)
+
+        startBrowsing(for: transfer)
+
+        let windowTimeout = DispatchWorkItem { [weak self, weak transfer] in
+            guard let self, let transfer else { return }
+            SecureLogger.info("WifiBulk: incoming transfer window expired", category: .session)
+            self.tearDownIncoming(transfer)
+        }
+        transfer.windowTimeout = windowTimeout
+        queue.asyncAfter(deadline: .now() + config.transferWindow, execute: windowTimeout)
+    }
+
+    private func decline(offer: WifiBulkOffer, peerID: PeerID) {
+        SecureLogger.debug("WifiBulk: declining offer of \(offer.fileSize) bytes from \(peerID.id.prefix(8))…", category: .session)
+        guard let responseData = WifiBulkResponse.decline(transferID: offer.transferID).encode() else { return }
+        _ = environment.sendNoisePayload(
+            BLENoisePayloadFactory.typedPayload(.bulkTransferResponse, payload: responseData),
+            peerID
+        )
+    }
+
+    private func startBrowsing(for transfer: IncomingTransfer) {
+        let browser = NWBrowser(
+            for: .bonjour(type: config.serviceType, domain: nil),
+            using: makeParameters()
+        )
+        transfer.browser = browser
+        browser.browseResultsChangedHandler = { [weak self, weak transfer] results, _ in
+            guard let self, let transfer, transfer.session == nil else { return }
+            let match = results.first { result in
+                if case .service(let name, _, _, _) = result.endpoint {
+                    return name == transfer.offer.serviceName
+                }
+                return false
+            }
+            guard let match else { return }
+            self.connect(transfer, to: match.endpoint)
+        }
+        browser.stateUpdateHandler = { [weak self, weak transfer] state in
+            guard let self, let transfer else { return }
+            if case .failed(let error) = state {
+                SecureLogger.warning("WifiBulk: browser failed: \(error)", category: .session)
+                self.tearDownIncoming(transfer)
+            }
+        }
+        browser.start(queue: queue)
+    }
+
+    /// Test hook: connects an accepted incoming transfer straight to an
+    /// endpoint, standing in for Bonjour discovery on hosts without mDNS.
+    func _test_connectIncoming(transferID: Data, to endpoint: NWEndpoint) {
+        queue.async { [weak self] in
+            guard let self, let transfer = self.incoming[transferID], transfer.session == nil else { return }
+            self.connect(transfer, to: endpoint)
+        }
+    }
+
+    private func connect(_ transfer: IncomingTransfer, to endpoint: NWEndpoint) {
+        transfer.browser?.cancel()
+        transfer.browser = nil
+
+        guard let session = WifiBulkReceiverSession(
+            endpoint: endpoint,
+            parameters: makeParameters(),
+            key: transfer.key,
+            transferID: transfer.offer.transferID,
+            expectedSize: transfer.offer.fileSize,
+            expectedHash: transfer.offer.payloadHash,
+            sizeCap: config.maxIncomingPayloadBytes,
+            chunkBytes: config.chunkBytes,
+            queue: queue
+        ) else {
+            tearDownIncoming(transfer)
+            return
+        }
+        session.onCompleted = { [weak self, weak transfer] payload in
+            guard let self, let transfer else { return }
+            SecureLogger.debug("WifiBulk: received \(payload.count) bytes from \(transfer.peerID.id.prefix(8))…", category: .session)
+            self.environment.deliverReceivedFile(payload, transfer.peerID, self.config.maxIncomingPayloadBytes)
+            self.tearDownIncoming(transfer)
+        }
+        session.onFailed = { [weak self, weak transfer] reason in
+            guard let self, let transfer else { return }
+            SecureLogger.info("WifiBulk: incoming transfer failed (\(reason)); sender falls back to BLE", category: .session)
+            self.tearDownIncoming(transfer)
+        }
+        transfer.session = session
+        session.start()
+    }
+
+    private func tearDownIncoming(_ transfer: IncomingTransfer) {
+        tearDownIncomingResources(transfer)
+        incoming.removeValue(forKey: transfer.offer.transferID)
+    }
+
+    private func tearDownIncomingResources(_ transfer: IncomingTransfer) {
+        transfer.windowTimeout?.cancel()
+        transfer.windowTimeout = nil
+        transfer.browser?.cancel()
+        transfer.browser = nil
+        transfer.session?.cancel()
+        transfer.session = nil
+    }
+
+    // MARK: - Helpers
+
+    private func makeParameters() -> NWParameters {
+        let parameters = NWParameters.tcp
+        if config.usePeerToPeer {
+            parameters.includePeerToPeer = true
+            // Keep the channel off infrastructure-independent radios we never
+            // want (cellular/wired); AWDL rides on the peer-to-peer flag.
+            parameters.prohibitedInterfaceTypes = [.cellular, .wiredEthernet, .loopback]
+        }
+        return parameters
+    }
+
+    /// Cryptographically secure random bytes (Swift's default RNG is CSPRNG-backed).
+    private static func randomData(_ count: Int) -> Data {
+        Data((0..<count).map { _ in UInt8.random(in: .min ... .max) })
+    }
+
+    // MARK: - Test observability
+
+    /// Test hook: reports each outgoing listener's bound port, standing in
+    /// for Bonjour resolution on hosts without mDNS. Set before `sendFile`.
+    var _test_onListenerReady: ((_ transferID: Data, _ port: UInt16) -> Void)?
+
+    var _test_activeOutgoingCount: Int {
+        queue.sync { outgoing.count }
+    }
+
+    var _test_activeIncomingCount: Int {
+        queue.sync { incoming.count }
+    }
+}

bitchat/Sync/GCSFilter.swift

@@ -10,7 +10,18 @@ import CryptoKit
 //  - Golomb-Rice with parameter P: q = (x - 1) >> P encoded as unary (q ones then a zero), then write P-bit remainder r = (x - 1) & ((1<<P)-1).
 //  - Bitstream is MSB-first within each byte.
 enum GCSFilter {
-    struct Params { let p: Int; let m: UInt32; let data: Data }
+    // `includedCount` is how many of the input `ids` (in input order) the
+    // returned filter actually encodes. It can be below `ids.count` when the
+    // Golomb-Rice encoding overflows the byte budget and the tail is trimmed.
+    // Callers that derive a since-cursor need this: trimming drops from the
+    // input tail, so the first `includedCount` inputs are exactly what the
+    // filter covers.
+    struct Params { let p: Int; let m: UInt32; let data: Data; let includedCount: Int }
+
+    // Highest Golomb-Rice parameter we accept from the wire. P maps to an FPR
+    // of ~1/2^P; beyond 32 the remainder width exceeds any practical filter
+    // and shifts in decode would silently overflow to garbage values.
+    static let maxP = 32
 
     // Derive P from FPR (~ 1 / 2^P)
     static func deriveP(targetFpr: Double) -> Int {
@@ -30,42 +41,46 @@ enum GCSFilter {
     static func buildFilter(ids: [Data], maxBytes: Int, targetFpr: Double) -> Params {
         let p = deriveP(targetFpr: targetFpr)
         guard !ids.isEmpty else {
-            return Params(p: p, m: 1, data: Data())
+            return Params(p: p, m: 1, data: Data(), includedCount: 0)
         }
 
         let cap = estimateMaxElements(sizeBytes: maxBytes, p: p)
-        let selected = Array(ids.prefix(cap))
-        let range = max(1, hashRange(count: selected.count, p: p))
+        // Modulus is fixed to the initial candidate count so `m` stays stable
+        // as the tail is trimmed to fit the byte budget below.
+        let range = max(1, hashRange(count: min(ids.count, cap), p: p))
         let modulo = UInt64(range)
 
-        var mapped = selected
-            .map { h64($0) }
-            .map { mapHash($0, modulo: modulo) }
-            .sorted()
-        mapped = normalizeMappedValues(mapped, modulo: modulo)
-
-        if mapped.isEmpty {
-            return Params(p: p, m: range, data: Data())
+        // Encode the first `count` inputs (input order). The caller passes IDs
+        // newest-first, so trimming from the tail drops the oldest — which is
+        // what lets a since-cursor stay exact: the surviving set is always a
+        // contiguous newest-prefix, never a hash-order-arbitrary subset.
+        func encodeFirst(_ count: Int) -> Data {
+            var mapped = ids.prefix(count)
+                .map { h64($0) }
+                .map { mapHash($0, modulo: modulo) }
+                .sorted()
+            mapped = normalizeMappedValues(mapped, modulo: modulo)
+            return mapped.isEmpty ? Data() : encode(sorted: mapped, p: p)
         }
 
-        var encoded = encode(sorted: mapped, p: p)
-        var trimmedCount = mapped.count
-
-        while encoded.count > maxBytes && trimmedCount > 0 {
-            if trimmedCount == 1 {
-                mapped.removeAll()
-                encoded = Data()
-                break
-            }
-            trimmedCount = max(1, (trimmedCount * 9) / 10)
-            mapped = Array(mapped.prefix(trimmedCount))
-            encoded = encode(sorted: mapped, p: p)
+        var count = min(ids.count, cap)
+        var encoded = encodeFirst(count)
+        while encoded.count > maxBytes && count > 1 {
+            count = max(1, (count * 9) / 10)
+            encoded = encodeFirst(count)
+        }
+        // A single element that still overflows can't be represented.
+        if encoded.count > maxBytes {
+            return Params(p: p, m: range, data: Data(), includedCount: 0)
         }
 
-        return Params(p: p, m: range, data: encoded)
+        return Params(p: p, m: range, data: encoded, includedCount: encoded.isEmpty ? 0 : count)
     }
 
     static func decodeToSortedSet(p: Int, m: UInt32, data: Data) -> [UInt64] {
+        // Reject out-of-range parameters rather than decoding garbage: callers
+        // treat the result as "peer has nothing" and fall back to sending data.
+        guard p >= 1, p <= maxP, m > 1 else { return [] }
         var values: [UInt64] = []
         let reader = BitReader(data)
         var acc: UInt64 = 0

bitchat/Sync/GossipMessageArchive.swift

@@ -0,0 +1,80 @@
+//
+// GossipMessageArchive.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import BitLogger
+import Foundation
+
+/// Disk persistence for the gossip-sync public message store, so the recent
+/// public history a device carries survives app restarts. This is what lets
+/// a phone act as a town crier: walk between two mesh partitions (or relaunch
+/// hours later) and sync the room's backlog to whoever missed it.
+///
+/// Contents are signed public broadcasts — already visible to anyone in radio
+/// range — so file protection (no additional sealing) is the right at-rest
+/// posture. Wiped on panic.
+final class GossipMessageArchive {
+    private let fileURL: URL?
+
+    init(fileURL: URL? = nil) {
+        self.fileURL = fileURL ?? Self.defaultFileURL()
+    }
+
+    /// Raw binary packets, decoded and freshness-filtered by the caller.
+    func load() -> [Data] {
+        guard let fileURL,
+              let data = try? Data(contentsOf: fileURL),
+              let packets = try? JSONDecoder().decode([Data].self, from: data) else {
+            return []
+        }
+        return packets
+    }
+
+    func save(_ packets: [Data]) {
+        guard let fileURL else { return }
+        guard !packets.isEmpty else {
+            try? FileManager.default.removeItem(at: fileURL)
+            return
+        }
+        do {
+            try FileManager.default.createDirectory(
+                at: fileURL.deletingLastPathComponent(),
+                withIntermediateDirectories: true
+            )
+            let data = try JSONEncoder().encode(packets)
+            var options: Data.WritingOptions = [.atomic]
+            #if os(iOS)
+            options.insert(.completeFileProtection)
+            #endif
+            try data.write(to: fileURL, options: options)
+        } catch {
+            SecureLogger.error("Failed to persist gossip archive: \(error)", category: .sync)
+        }
+    }
+
+    func wipe() {
+        guard let fileURL else { return }
+        try? FileManager.default.removeItem(at: fileURL)
+    }
+
+    /// Panic-wipe hook for callers that don't hold the live instance.
+    static func wipeDefault() {
+        GossipMessageArchive().wipe()
+    }
+
+    private static func defaultFileURL() -> URL? {
+        guard let base = try? FileManager.default.url(
+            for: .applicationSupportDirectory,
+            in: .userDomainMask,
+            appropriateFor: nil,
+            create: true
+        ) else { return nil }
+        return base
+            .appendingPathComponent("sync", isDirectory: true)
+            .appendingPathComponent("public-messages.json")
+    }
+}

bitchat/Sync/GossipSyncManager.swift

@@ -64,7 +64,10 @@ final class GossipSyncManager {
         var seenCapacity: Int = 1000          // max packets per sync (cap across types)
         var gcsMaxBytes: Int = 400           // filter size budget (128..1024)
         var gcsTargetFpr: Double = 0.01      // 1%
-        var maxMessageAgeSeconds: TimeInterval = 900  // 15 min - discard older messages
+        var maxMessageAgeSeconds: TimeInterval = 900  // 15 min - fragments/files/announces
+        // Whole public messages stay sync-able much longer so devices carry
+        // the room's recent history between partitions and across restarts.
+        var publicMessageMaxAgeSeconds: TimeInterval = 900
         var maintenanceIntervalSeconds: TimeInterval = 30.0
         var stalePeerCleanupIntervalSeconds: TimeInterval = 60.0
         var stalePeerTimeoutSeconds: TimeInterval = 60.0
@@ -73,11 +76,14 @@ final class GossipSyncManager {
         var fragmentSyncIntervalSeconds: TimeInterval = 30.0
         var fileTransferSyncIntervalSeconds: TimeInterval = 60.0
         var messageSyncIntervalSeconds: TimeInterval = 15.0
+        var responseRateLimitMaxResponses: Int = 8
+        var responseRateLimitWindowSeconds: TimeInterval = 30.0
     }
 
     private let myPeerID: PeerID
     private let config: Config
     private let requestSyncManager: RequestSyncManager
+    private let archive: GossipMessageArchive?
     weak var delegate: Delegate?
 
     // Storage: broadcast packets by type, and latest announce per sender
@@ -85,17 +91,24 @@ final class GossipSyncManager {
     private var fragments = PacketStore()
     private var fileTransfers = PacketStore()
     private var latestAnnouncementByPeer: [PeerID: (id: String, packet: BitchatPacket)] = [:]
+    private var archiveDirty = false
 
     // Timer
     private var periodicTimer: DispatchSourceTimer?
     private let queue = DispatchQueue(label: "mesh.sync", qos: .utility)
     private var lastStalePeerCleanup: Date = .distantPast
     private var syncSchedules: [SyncSchedule] = []
+    private var responseRateLimiter: SyncResponseRateLimiter
 
-    init(myPeerID: PeerID, config: Config = Config(), requestSyncManager: RequestSyncManager) {
+    init(myPeerID: PeerID, config: Config = Config(), requestSyncManager: RequestSyncManager, archive: GossipMessageArchive? = nil) {
         self.myPeerID = myPeerID
         self.config = config
         self.requestSyncManager = requestSyncManager
+        self.archive = archive
+        self.responseRateLimiter = SyncResponseRateLimiter(
+            maxResponses: config.responseRateLimitMaxResponses,
+            window: config.responseRateLimitWindowSeconds
+        )
         var schedules: [SyncSchedule] = []
         if config.seenCapacity > 0 && config.messageSyncIntervalSeconds > 0 {
             schedules.append(SyncSchedule(types: .publicMessages, interval: config.messageSyncIntervalSeconds, lastSent: .distantPast))
@@ -107,6 +120,12 @@ final class GossipSyncManager {
             schedules.append(SyncSchedule(types: .fileTransfer, interval: config.fileTransferSyncIntervalSeconds, lastSent: .distantPast))
         }
         syncSchedules = schedules
+
+        if archive != nil {
+            queue.async { [weak self] in
+                self?.restoreArchivedMessages()
+            }
+        }
     }
 
     func start() {
@@ -146,10 +165,15 @@ final class GossipSyncManager {
         }
     }
 
-    // Helper to check if a packet is within the age threshold
+    // Helper to check if a packet is within the age threshold. Whole public
+    // messages get the long town-crier window; fragments, file transfers and
+    // announces keep the short one.
     private func isPacketFresh(_ packet: BitchatPacket) -> Bool {
+        let maxAgeSeconds = packet.type == MessageType.message.rawValue
+            ? config.publicMessageMaxAgeSeconds
+            : config.maxMessageAgeSeconds
         let nowMs = UInt64(Date().timeIntervalSince1970 * 1000)
-        let ageThresholdMs = UInt64(config.maxMessageAgeSeconds * 1000)
+        let ageThresholdMs = UInt64(maxAgeSeconds * 1000)
 
         // If current time is less than threshold, accept all (handle clock issues gracefully)
         guard nowMs >= ageThresholdMs else { return true }
@@ -190,6 +214,7 @@ final class GossipSyncManager {
             guard isPacketFresh(packet) else { return }
             let idHex = PacketIdUtil.computeId(packet).hexEncodedString()
             messages.insert(idHex: idHex, packet: packet, capacity: max(1, config.seenCapacity))
+            archiveDirty = true
         case .fragment:
             guard isBroadcastRecipient else { return }
             guard isPacketFresh(packet) else { return }
@@ -265,7 +290,17 @@ final class GossipSyncManager {
     }
 
     private func _handleRequestSync(from peerID: PeerID, request: RequestSyncPacket) {
+        // A response can replay the whole store, so bound how often one peer
+        // can trigger a diff pass regardless of how fast it asks.
+        guard responseRateLimiter.shouldRespond(to: peerID, now: Date()) else {
+            SecureLogger.warning("Rate-limited REQUEST_SYNC from \(peerID.id.prefix(8))…", category: .sync)
+            return
+        }
         let requestedTypes = (request.types ?? .publicMessages)
+        // The requester's filter only covers packets at or after this cursor;
+        // older packets are outside the filter but not missing, and without
+        // the cursor they would be re-sent every round.
+        let since = request.sinceTimestamp
         // Decode GCS into sorted set and prepare membership checker
         let sorted = GCSFilter.decodeToSortedSet(p: request.p, m: request.m, data: request.data)
         func mightContain(_ id: Data) -> Bool {
@@ -273,6 +308,9 @@ final class GossipSyncManager {
             return GCSFilter.contains(sortedValues: sorted, candidate: bucket)
         }
 
+        // Announces are exempt from the since-cursor: they carry the signing
+        // keys needed to verify everything else, and there is at most one per
+        // peer, so the resend cost is negligible.
         if requestedTypes.contains(.announce) {
             for (_, pair) in latestAnnouncementByPeer {
                 let (idHex, pkt) = pair
@@ -290,6 +328,7 @@ final class GossipSyncManager {
         if requestedTypes.contains(.message) {
             let toSendMsgs = messages.allPackets(isFresh: isPacketFresh)
             for pkt in toSendMsgs {
+                if let since, pkt.timestamp < since { continue }
                 let idBytes = PacketIdUtil.computeId(pkt)
                 if !mightContain(idBytes) {
                     var toSend = pkt
@@ -303,6 +342,7 @@ final class GossipSyncManager {
         if requestedTypes.contains(.fragment) {
             let frags = fragments.allPackets(isFresh: isPacketFresh)
             for pkt in frags {
+                if let since, pkt.timestamp < since { continue }
                 let idBytes = PacketIdUtil.computeId(pkt)
                 if !mightContain(idBytes) {
                     var toSend = pkt
@@ -316,6 +356,7 @@ final class GossipSyncManager {
         if requestedTypes.contains(.fileTransfer) {
             let files = fileTransfers.allPackets(isFresh: isPacketFresh)
             for pkt in files {
+                if let since, pkt.timestamp < since { continue }
                 let idBytes = PacketIdUtil.computeId(pkt)
                 if !mightContain(idBytes) {
                     var toSend = pkt
@@ -368,9 +409,22 @@ final class GossipSyncManager {
             let req = RequestSyncPacket(p: p, m: 1, data: Data(), types: types)
             return req.encode()
         }
-        let ids: [Data] = candidates.prefix(takeN).map { PacketIdUtil.computeId($0) }
+        let included = Array(candidates.prefix(takeN))
+        let ids: [Data] = included.map { PacketIdUtil.computeId($0) }
         let params = GCSFilter.buildFilter(ids: ids, maxBytes: config.gcsMaxBytes, targetFpr: config.gcsTargetFpr)
-        let req = RequestSyncPacket(p: params.p, m: params.m, data: params.data, types: types)
+        // When the filter can't cover every candidate — either the store
+        // exceeds `takeN` or the encoder trimmed the tail to fit the byte
+        // budget — tell the responder how far back the filter actually
+        // reaches. `includedCount` counts inputs in newest-first order, so the
+        // covered set is a contiguous newest-prefix and the oldest included
+        // timestamp is an exact cursor. Packets older than it are outside the
+        // filter but not missing; without the cursor the responder would
+        // re-send that entire tail every round.
+        let covered = params.includedCount
+        let sinceTimestamp: UInt64? = (covered < candidates.count && covered > 0)
+            ? included[covered - 1].timestamp
+            : nil
+        let req = RequestSyncPacket(p: params.p, m: params.m, data: params.data, types: types, sinceTimestamp: sinceTimestamp)
         return req.encode()
     }
 
@@ -381,28 +435,68 @@ final class GossipSyncManager {
             isPacketFresh(pair.packet)
         }
 
+        let messageCountBefore = messages.packets.count
         messages.removeExpired(isFresh: isPacketFresh)
+        if messages.packets.count != messageCountBefore {
+            archiveDirty = true
+        }
         fragments.removeExpired(isFresh: isPacketFresh)
         fileTransfers.removeExpired(isFresh: isPacketFresh)
     }
 
+    // MARK: - Archive (public message persistence)
+
+    /// Rebuild the public message store from disk on launch, dropping
+    /// anything that aged out while the app was dead.
+    private func restoreArchivedMessages() {
+        guard let archive else { return }
+        var restored = 0
+        for data in archive.load() {
+            guard let packet = BitchatPacket.from(data),
+                  packet.type == MessageType.message.rawValue,
+                  isPacketFresh(packet) else { continue }
+            let idHex = PacketIdUtil.computeId(packet).hexEncodedString()
+            messages.insert(idHex: idHex, packet: packet, capacity: max(1, config.seenCapacity))
+            restored += 1
+        }
+        if restored > 0 {
+            SecureLogger.debug("Restored \(restored) archived public message(s) for gossip sync", category: .sync)
+            archiveDirty = true
+        }
+    }
+
+    private func persistArchiveIfDirty() {
+        guard archiveDirty, let archive else { return }
+        archiveDirty = false
+        let packets = messages.allPackets(isFresh: isPacketFresh)
+            .compactMap { $0.toBinaryData(padding: false) }
+        archive.save(packets)
+    }
+
+    /// Flush the archive outside the maintenance cadence (app backgrounding).
+    func persistNow() {
+        queue.async { [weak self] in
+            self?.persistArchiveIfDirty()
+        }
+    }
+
     private func performPeriodicMaintenance(now: Date = Date()) {
         cleanupExpiredMessages()
         cleanupStaleAnnouncementsIfNeeded(now: now)
+        persistArchiveIfDirty()
         requestSyncManager.cleanup() // Cleanup expired sync requests
+        responseRateLimiter.prune(now: now)
         
-        var dueTypes: SyncTypeFlags = []
+        // One request per due schedule rather than a union filter: each type
+        // group gets the full GCS capacity and its own since-cursor, so heavy
+        // fragment traffic can't crowd messages out of the filter.
         for index in syncSchedules.indices {
             guard syncSchedules[index].interval > 0 else { continue }
             if syncSchedules[index].lastSent == .distantPast || now.timeIntervalSince(syncSchedules[index].lastSent) >= syncSchedules[index].interval {
                 syncSchedules[index].lastSent = now
-                dueTypes.formUnion(syncSchedules[index].types)
+                sendPeriodicSync(for: syncSchedules[index].types)
             }
         }
-
-        if !dueTypes.isEmpty {
-            sendPeriodicSync(for: dueTypes)
-        }
     }
 
     private func cleanupStaleAnnouncementsIfNeeded(now: Date) {
@@ -436,7 +530,11 @@ final class GossipSyncManager {
 
     private func removeState(for peerID: PeerID) {
         _ = latestAnnouncementByPeer.removeValue(forKey: peerID)
+        let messageCountBefore = messages.packets.count
         messages.remove { PeerID(hexData: $0.senderID) == peerID }
+        if messages.packets.count != messageCountBefore {
+            archiveDirty = true
+        }
         fragments.remove { PeerID(hexData: $0.senderID) == peerID }
         fileTransfers.remove { PeerID(hexData: $0.senderID) == peerID }
     }

bitchat/Sync/SyncResponseRateLimiter.swift

@@ -0,0 +1,42 @@
+import BitFoundation
+import Foundation
+
+/// Sliding-window limiter for REQUEST_SYNC responses.
+///
+/// A single sync response can replay the entire gossip store, so a peer that
+/// requests in a tight loop must not be able to drain the airtime and battery
+/// of everyone in radio range. Legitimate peers send at most a few requests
+/// per maintenance tick (one per type schedule, plus the initial sync).
+struct SyncResponseRateLimiter {
+    private let maxResponses: Int
+    private let window: TimeInterval
+    private var history: [PeerID: [Date]] = [:]
+
+    init(maxResponses: Int, window: TimeInterval) {
+        self.maxResponses = max(1, maxResponses)
+        self.window = max(0, window)
+    }
+
+    /// Returns true (and records the response) if the peer is under its
+    /// response budget for the current window.
+    mutating func shouldRespond(to peerID: PeerID, now: Date) -> Bool {
+        let cutoff = now.addingTimeInterval(-window)
+        var recent = (history[peerID] ?? []).filter { $0 >= cutoff }
+        guard recent.count < maxResponses else {
+            history[peerID] = recent
+            return false
+        }
+        recent.append(now)
+        history[peerID] = recent
+        return true
+    }
+
+    /// Drops history outside the window so departed peers don't accumulate.
+    mutating func prune(now: Date) {
+        let cutoff = now.addingTimeInterval(-window)
+        history = history.compactMapValues { dates in
+            let recent = dates.filter { $0 >= cutoff }
+            return recent.isEmpty ? nil : recent
+        }
+    }
+}

bitchat/Sync/SyncTypeFlags.swift

@@ -20,6 +20,9 @@ struct SyncTypeFlags: OptionSet {
         case .fragment: return 5
         case .requestSync: return 6
         case .fileTransfer: return 7
+        // Courier envelopes are directed deposits between trusted peers and
+        // must never spread via gossip sync.
+        case .courierEnvelope: return nil
         }
     }
 

bitchat/Utils/PeerDisplayNameResolver.swift

@@ -27,4 +27,3 @@ struct PeerDisplayNameResolver {
         return result
     }
 }
-

bitchat/Utils/Theme.swift

@@ -0,0 +1,339 @@
+//
+// Theme.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import SwiftUI
+
+/// A user-selectable app-wide visual theme. Persisted by raw value.
+enum AppTheme: String, CaseIterable, Identifiable {
+    case matrix
+    case liquidGlass
+
+    var id: String { rawValue }
+
+    /// UserDefaults key backing the theme selection.
+    static let storageKey = "appTheme"
+
+    var displayNameKey: LocalizedStringKey {
+        switch self {
+        case .matrix: return "app_info.appearance.matrix"
+        case .liquidGlass: return "app_info.appearance.liquid_glass"
+        }
+    }
+
+    /// Font design used for themed text. Matrix keeps the terminal monospace;
+    /// liquid glass uses the system default.
+    var bodyFontDesign: Font.Design {
+        switch self {
+        case .matrix: return .monospaced
+        case .liquidGlass: return .default
+        }
+    }
+
+    /// Whether chrome surfaces (header/composer bars, input field) render as
+    /// translucent glass/material instead of the flat matrix background.
+    var usesGlassChrome: Bool {
+        self == .liquidGlass
+    }
+
+    /// Discriminator mixed into per-message formatting caches so cached
+    /// AttributedStrings from one theme are never served under another.
+    /// Empty for matrix to keep its historical cache keys.
+    var formatCacheVariant: String {
+        switch self {
+        case .matrix: return ""
+        case .liquidGlass: return "lg:"
+        }
+    }
+
+    /// Resolves the semantic color palette for this theme under the given color scheme.
+    func palette(for colorScheme: ColorScheme) -> ThemePalette {
+        switch self {
+        case .matrix:
+            return .matrix(colorScheme)
+        case .liquidGlass:
+            return .liquidGlass(colorScheme)
+        }
+    }
+}
+
+/// Semantic colors for the active theme, resolved against the current color scheme.
+/// Views should consume these via `@ThemedPalette` rather than computing colors inline.
+struct ThemePalette {
+    /// Primary window/sheet background.
+    let background: Color
+    /// Primary text color.
+    let primary: Color
+    /// De-emphasized text (timestamps, hints, captions).
+    let secondary: Color
+    /// Interactive tint (buttons, toggles, selection).
+    let accent: Color
+    /// Location/geohash channel accent (badges, counts, subtitles).
+    let locationAccent: Color
+    /// Informational accent (links, read receipts, teleport markers).
+    let accentBlue: Color
+    /// Destructive/error accent.
+    let alertRed: Color
+    /// Hairline separators.
+    let divider: Color
+
+    static func matrix(_ colorScheme: ColorScheme) -> ThemePalette {
+        let isDark = colorScheme == .dark
+        let green = isDark ? Color.green : Color(red: 0, green: 0.5, blue: 0)
+        return ThemePalette(
+            background: isDark ? Color.black : Color.white,
+            primary: green,
+            secondary: green.opacity(0.8),
+            accent: green,
+            locationAccent: green,
+            accentBlue: Color(red: 0.0, green: 0.478, blue: 1.0),
+            alertRed: Color(red: 0.75, green: 0.1, blue: 0.1),
+            divider: isDark ? Color.white.opacity(0.12) : Color.black.opacity(0.08)
+        )
+    }
+
+    static func liquidGlass(_ colorScheme: ColorScheme) -> ThemePalette {
+        ThemePalette(
+            background: systemBackground,
+            primary: .primary,
+            secondary: .secondary,
+            accent: .blue,
+            locationAccent: .green,
+            accentBlue: .blue,
+            alertRed: .red,
+            divider: separator
+        )
+    }
+
+    private static var systemBackground: Color {
+        #if os(iOS)
+        Color(UIColor.systemBackground)
+        #else
+        Color(NSColor.windowBackgroundColor)
+        #endif
+    }
+
+    private static var separator: Color {
+        #if os(iOS)
+        Color(UIColor.separator)
+        #else
+        Color(NSColor.separatorColor)
+        #endif
+    }
+}
+
+private struct AppThemeKey: EnvironmentKey {
+    static let defaultValue: AppTheme = .matrix
+}
+
+extension EnvironmentValues {
+    var appTheme: AppTheme {
+        get { self[AppThemeKey.self] }
+        set { self[AppThemeKey.self] = newValue }
+    }
+}
+
+/// Resolves the active theme's palette against the view's color scheme.
+///
+///     @ThemedPalette private var palette
+///     var body: some View { Text("hi").foregroundColor(palette.primary) }
+@propertyWrapper
+struct ThemedPalette: DynamicProperty {
+    @Environment(\.appTheme) private var theme
+    @Environment(\.colorScheme) private var colorScheme
+
+    var wrappedValue: ThemePalette { theme.palette(for: colorScheme) }
+}
+
+// MARK: - Themed view helpers
+
+/// Themed replacement for `.font(.bitchatSystem(size:weight:design: .monospaced))`:
+/// monospaced under matrix, system default under liquid glass.
+private struct ThemedFontModifier: ViewModifier {
+    @Environment(\.appTheme) private var theme
+    let size: CGFloat
+    let weight: Font.Weight
+
+    func body(content: Content) -> some View {
+        content.font(.bitchatSystem(size: size, weight: weight, design: theme.bodyFontDesign))
+    }
+}
+
+/// Root backdrop. Matrix gets its flat background; glass gets a subtle static
+/// gradient with a soft tinted glow — glass panels need visual texture behind
+/// them to refract, and collapse to flat gray over a solid color.
+struct ThemedRootBackground: View {
+    @Environment(\.appTheme) private var theme
+    @Environment(\.colorScheme) private var colorScheme
+    @ThemedPalette private var palette
+
+    var body: some View {
+        if theme.usesGlassChrome {
+            let isDark = colorScheme == .dark
+            ZStack {
+                LinearGradient(
+                    colors: isDark
+                        ? [Color(red: 0.09, green: 0.10, blue: 0.15), Color(red: 0.04, green: 0.04, blue: 0.07)]
+                        : [Color(red: 0.93, green: 0.95, blue: 1.0), Color(red: 0.98, green: 0.97, blue: 0.99)],
+                    startPoint: .top,
+                    endPoint: .bottom
+                )
+                RadialGradient(
+                    colors: [Color.blue.opacity(isDark ? 0.22 : 0.12), .clear],
+                    center: .topLeading,
+                    startRadius: 0,
+                    endRadius: 600
+                )
+                RadialGradient(
+                    colors: [Color.purple.opacity(isDark ? 0.14 : 0.08), .clear],
+                    center: .bottomTrailing,
+                    startRadius: 0,
+                    endRadius: 500
+                )
+            }
+            .ignoresSafeArea()
+        } else {
+            palette.background
+        }
+    }
+}
+
+/// Wraps glass-shape content in real Liquid Glass on OS 26+, with a material
+/// fallback below that keeps the frosted look.
+private struct GlassPanel<S: Shape>: ViewModifier {
+    let shape: S
+
+    @ViewBuilder
+    func body(content: Content) -> some View {
+        #if compiler(>=6.2)
+        if #available(iOS 26.0, macOS 26.0, *) {
+            content.glassEffect(.regular, in: shape)
+        } else {
+            materialFallback(content)
+        }
+        #else
+        materialFallback(content)
+        #endif
+    }
+
+    private func materialFallback(_ content: Content) -> some View {
+        content
+            .background(shape.fill(.ultraThinMaterial))
+            .overlay(shape.stroke(Color.white.opacity(0.15), lineWidth: 0.5))
+    }
+}
+
+/// Chrome surface for the header and composer. Matrix keeps the original flat
+/// edge-to-edge wash; glass floats the content as an inset Liquid Glass panel
+/// (content is expected to scroll underneath via safe-area insets).
+private struct ThemedChromePanelModifier: ViewModifier {
+    @Environment(\.appTheme) private var theme
+    @ThemedPalette private var palette
+    let edge: VerticalEdge
+
+    @ViewBuilder
+    func body(content: Content) -> some View {
+        if theme.usesGlassChrome {
+            content
+                .modifier(GlassPanel(shape: RoundedRectangle(cornerRadius: 18, style: .continuous)))
+                .padding(.horizontal, 8)
+                .padding(edge == .top ? .top : .bottom, 4)
+        } else {
+            content.background(palette.background.opacity(0.95))
+        }
+    }
+}
+
+/// Background for the composer input field. Matrix keeps its translucent fill;
+/// glass leaves it clear — the field sits inside the composer's glass panel,
+/// and glass cannot sample other glass.
+private struct ThemedInputBackgroundModifier: ViewModifier {
+    @Environment(\.appTheme) private var theme
+    @Environment(\.colorScheme) private var colorScheme
+
+    private var shape: RoundedRectangle {
+        RoundedRectangle(cornerRadius: 14, style: .continuous)
+    }
+
+    @ViewBuilder
+    func body(content: Content) -> some View {
+        if theme.usesGlassChrome {
+            content
+        } else {
+            content.background(
+                shape.fill(colorScheme == .dark ? Color.black.opacity(0.35) : Color.white.opacity(0.7))
+            )
+        }
+    }
+}
+
+extension View {
+    func bitchatFont(size: CGFloat, weight: Font.Weight = .regular) -> some View {
+        modifier(ThemedFontModifier(size: size, weight: weight))
+    }
+
+    func themedChromePanel(edge: VerticalEdge) -> some View {
+        modifier(ThemedChromePanelModifier(edge: edge))
+    }
+
+    func themedInputBackground() -> some View {
+        modifier(ThemedInputBackgroundModifier())
+    }
+
+    /// Floating surface for popover-style boxes (autocomplete, command
+    /// suggestions): glass panel under liquid glass, the original flat
+    /// background + hairline stroke under matrix.
+    func themedOverlayPanel() -> some View {
+        modifier(ThemedOverlayPanelModifier())
+    }
+
+    /// Root background for sheets — same backdrop as the main window so every
+    /// surface speaks one visual language.
+    func themedSheetBackground() -> some View {
+        background(ThemedRootBackground())
+    }
+
+    /// Flat background wash for bars/headers inside sheets. Matrix keeps its
+    /// opaque wash; glass goes transparent so the backdrop gradient shows.
+    func themedSurface(opacity: Double = 1.0) -> some View {
+        modifier(ThemedSurfaceModifier(opacity: opacity))
+    }
+}
+
+private struct ThemedSurfaceModifier: ViewModifier {
+    @Environment(\.appTheme) private var theme
+    @ThemedPalette private var palette
+    let opacity: Double
+
+    @ViewBuilder
+    func body(content: Content) -> some View {
+        if theme.usesGlassChrome {
+            content
+        } else {
+            content.background(palette.background.opacity(opacity))
+        }
+    }
+}
+
+private struct ThemedOverlayPanelModifier: ViewModifier {
+    @Environment(\.appTheme) private var theme
+    @ThemedPalette private var palette
+
+    @ViewBuilder
+    func body(content: Content) -> some View {
+        if theme.usesGlassChrome {
+            content.modifier(GlassPanel(shape: RoundedRectangle(cornerRadius: 12, style: .continuous)))
+        } else {
+            content
+                .background(palette.background)
+                .overlay(
+                    RoundedRectangle(cornerRadius: 4)
+                        .stroke(palette.secondary.opacity(0.3), lineWidth: 1)
+                )
+        }
+    }
+}

bitchat/ViewModels/ChatComposerCoordinator.swift

@@ -1,44 +1,105 @@
 import BitFoundation
 import Foundation
 
+/// The narrow surface `ChatComposerCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding an `unowned` back-ref
+/// to the whole `ChatViewModel`. This keeps the coordinator independently
+/// testable (see `ChatComposerCoordinatorContextTests`) and makes its true
+/// dependencies explicit.
+@MainActor
+protocol ChatComposerContext: AnyObject {
+    // MARK: Autocomplete UI state
+    var autocompleteSuggestions: [String] { get set }
+    var autocompleteRange: NSRange? { get set }
+    var showAutocomplete: Bool { get set }
+    var selectedAutocompleteIndex: Int { get set }
+    /// Computes mention suggestions for the text up to the cursor.
+    func autocompleteQuery(
+        for text: String,
+        peers: [String],
+        cursorPosition: Int
+    ) -> (suggestions: [String], range: NSRange?)
+    /// Replaces the matched range in `text` with the chosen suggestion.
+    func applyAutocompleteSuggestion(_ suggestion: String, to text: String, range: NSRange) -> String
+
+    // MARK: Identity & channel state
+    var nickname: String { get }
+    var myPeerID: PeerID { get }
+    var activeChannel: ChannelID { get }
+    /// The transport's own nickname (excluded from autocomplete candidates).
+    var meshNickname: String { get }
+    func meshPeerNicknames() -> [PeerID: String]
+
+    // MARK: Geohash identity (shared with the other contexts)
+    var geoNicknames: [String: String] { get }
+    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
+}
+
+extension ChatViewModel: ChatComposerContext {
+    // `autocompleteSuggestions`, `autocompleteRange`, `showAutocomplete`,
+    // `selectedAutocompleteIndex`, `nickname`, `myPeerID`, `activeChannel`,
+    // `geoNicknames`, `meshPeerNicknames()`, and
+    // `deriveNostrIdentity(forGeohash:)` are shared requirements with the
+    // other contexts or satisfied by existing `ChatViewModel` members. The
+    // members below flatten nested service accesses into intent-named calls.
+
+    func autocompleteQuery(
+        for text: String,
+        peers: [String],
+        cursorPosition: Int
+    ) -> (suggestions: [String], range: NSRange?) {
+        autocompleteService.getSuggestions(for: text, peers: peers, cursorPosition: cursorPosition)
+    }
+
+    func applyAutocompleteSuggestion(_ suggestion: String, to text: String, range: NSRange) -> String {
+        autocompleteService.applySuggestion(suggestion, to: text, range: range)
+    }
+
+    var meshNickname: String {
+        meshService.myNickname
+    }
+}
+
 @MainActor
 final class ChatComposerCoordinator {
-    private unowned let viewModel: ChatViewModel
+    private unowned let context: any ChatComposerContext
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    init(context: any ChatComposerContext) {
+        self.context = context
     }
 
     func updateAutocomplete(for text: String, cursorPosition: Int) {
         let peerCandidates = autocompleteCandidates()
-        let (suggestions, range) = viewModel.autocompleteService.getSuggestions(
+        let (suggestions, range) = context.autocompleteQuery(
             for: text,
             peers: peerCandidates,
             cursorPosition: cursorPosition
         )
 
         if !suggestions.isEmpty {
-            viewModel.autocompleteSuggestions = suggestions
-            viewModel.autocompleteRange = range
-            viewModel.showAutocomplete = true
-            viewModel.selectedAutocompleteIndex = 0
+            context.autocompleteSuggestions = suggestions
+            context.autocompleteRange = range
+            context.showAutocomplete = true
+            context.selectedAutocompleteIndex = 0
         } else {
-            viewModel.autocompleteSuggestions = []
-            viewModel.autocompleteRange = nil
-            viewModel.showAutocomplete = false
-            viewModel.selectedAutocompleteIndex = 0
+            context.autocompleteSuggestions = []
+            context.autocompleteRange = nil
+            context.showAutocomplete = false
+            context.selectedAutocompleteIndex = 0
         }
     }
 
     func completeNickname(_ nickname: String, in text: inout String) -> Int {
-        guard let range = viewModel.autocompleteRange else { return text.count }
+        guard let range = context.autocompleteRange else { return text.count }
 
-        text = viewModel.autocompleteService.applySuggestion(nickname, to: text, range: range)
+        text = context.applyAutocompleteSuggestion(nickname, to: text, range: range)
 
-        viewModel.showAutocomplete = false
-        viewModel.autocompleteSuggestions = []
-        viewModel.autocompleteRange = nil
-        viewModel.selectedAutocompleteIndex = 0
+        context.showAutocomplete = false
+        context.autocompleteSuggestions = []
+        context.autocompleteRange = nil
+        context.selectedAutocompleteIndex = 0
 
         return range.location + nickname.count + (nickname.hasPrefix("@") ? 1 : 2)
     }
@@ -52,10 +113,10 @@ final class ChatComposerCoordinator {
             range: NSRange(location: 0, length: nsContent.length)
         )
 
-        let peerNicknames = viewModel.meshService.getPeerNicknames()
+        let peerNicknames = context.meshPeerNicknames()
         var validTokens = Set(peerNicknames.values)
-        validTokens.insert(viewModel.nickname)
-        validTokens.insert(viewModel.nickname + "#" + String(viewModel.meshService.myPeerID.id.prefix(4)))
+        validTokens.insert(context.nickname)
+        validTokens.insert(context.nickname + "#" + String(context.myPeerID.id.prefix(4)))
 
         var mentions: [String] = []
         for match in matches {
@@ -72,18 +133,18 @@ final class ChatComposerCoordinator {
 
 private extension ChatComposerCoordinator {
     func autocompleteCandidates() -> [String] {
-        switch viewModel.activeChannel {
+        switch context.activeChannel {
         case .mesh:
-            let values = viewModel.meshService.getPeerNicknames().values
-            return Array(values.filter { $0 != viewModel.meshService.myNickname })
+            let values = context.meshPeerNicknames().values
+            return Array(values.filter { $0 != context.meshNickname })
 
         case .location(let channel):
             var tokens = Set<String>()
-            for (pubkey, nick) in viewModel.geoNicknames {
+            for (pubkey, nick) in context.geoNicknames {
                 tokens.insert("\(nick)#\(pubkey.suffix(4))")
             }
-            if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
-                let myToken = viewModel.nickname + "#" + String(identity.publicKeyHex.suffix(4))
+            if let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
+                let myToken = context.nickname + "#" + String(identity.publicKeyHex.suffix(4))
                 tokens.remove(myToken)
             }
             return Array(tokens)

bitchat/ViewModels/ChatDeliveryCoordinator.swift

@@ -2,29 +2,80 @@ import BitFoundation
 import BitLogger
 import Foundation
 
-final class ChatDeliveryCoordinator {
-    private unowned let viewModel: ChatViewModel
+/// The narrow surface `ChatDeliveryCoordinator` needs from its owner.
+///
+/// Coordinators should depend on the minimal context they actually use rather
+/// than holding an `unowned` back-reference to the whole `ChatViewModel`. This
+/// keeps the coordinator independently testable (see
+/// `ChatDeliveryCoordinatorContextTests`) and makes its true dependencies
+/// explicit. This protocol is the exemplar for migrating the other
+/// coordinators off their `unowned let viewModel: ChatViewModel` back-refs.
+@MainActor
+protocol ChatDeliveryContext: AnyObject {
+    var isStartupPhase: Bool { get }
+    /// Applies a delivery status to every copy of the message across
+    /// conversations (`ConversationStore` intent, ID-only: the store's
+    /// message-ID → conversation map resolves which conversations hold the
+    /// message, including mirrored ephemeral/stable private copies). The
+    /// no-downgrade rule is enforced in the store. Returns `false` when the
+    /// message is unknown or no copy changed.
+    @discardableResult
+    func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool
+    /// Current delivery status of the message in whichever conversation holds it.
+    func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus?
+    /// Message IDs across all direct conversations (read-receipt pruning).
+    func privateMessageIDs() -> Set<String>
+    /// Drops every recorded read receipt whose message ID is not in `validMessageIDs`.
+    /// Returns the number of receipts removed. (Single mutation path for the
+    /// owner's `sentReadReceipts`; this coordinator never reads the raw set.)
+    func pruneSentReadReceipts(keeping validMessageIDs: Set<String>) -> Int
+    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
+    func notifyUIChanged()
+    /// Confirms receipt so the message router stops retaining the message for resend.
+    func markMessageDelivered(_ messageID: String)
+}
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+extension ChatViewModel: ChatDeliveryContext {
+    @discardableResult
+    func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool {
+        conversations.setDeliveryStatus(status, forMessageID: messageID)
+    }
+
+    func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus? {
+        conversations.deliveryStatus(forMessageID: messageID)
+    }
+
+    func privateMessageIDs() -> Set<String> {
+        conversations.directMessageIDs()
+    }
+
+    func notifyUIChanged() {
+        objectWillChange.send()
+    }
+
+    func markMessageDelivered(_ messageID: String) {
+        messageRouter.markDelivered(messageID)
+    }
+}
+
+/// Thin mapper from delivery events (read receipts, transport delivery
+/// callbacks) onto `ConversationStore` delivery intents, plus read-receipt
+/// retention cleanup. The store's message-ID → conversation map replaces the
+/// positional `messageLocationIndex` this coordinator used to maintain.
+final class ChatDeliveryCoordinator {
+    private unowned let context: any ChatDeliveryContext
+
+    init(context: any ChatDeliveryContext) {
+        self.context = context
     }
 
     @MainActor
     func cleanupOldReadReceipts() {
-        guard !viewModel.isStartupPhase, !viewModel.privateChats.isEmpty else {
-            return
-        }
+        guard !context.isStartupPhase else { return }
+        let validMessageIDs = context.privateMessageIDs()
+        guard !validMessageIDs.isEmpty else { return }
 
-        let validMessageIDs = Set(
-            viewModel.privateChats.values.flatMap { messages in
-                messages.map(\.id)
-            }
-        )
-
-        let oldCount = viewModel.sentReadReceipts.count
-        viewModel.sentReadReceipts = viewModel.sentReadReceipts.intersection(validMessageIDs)
-
-        let removedCount = oldCount - viewModel.sentReadReceipts.count
+        let removedCount = context.pruneSentReadReceipts(keeping: validMessageIDs)
         if removedCount > 0 {
             SecureLogger.debug("🧹 Cleaned up \(removedCount) old read receipts", category: .session)
         }
@@ -45,63 +96,24 @@ final class ChatDeliveryCoordinator {
 
     @MainActor
     func deliveryStatus(for messageID: String) -> DeliveryStatus? {
-        if let message = viewModel.messages.first(where: { $0.id == messageID }) {
-            return message.deliveryStatus
-        }
-
-        for messages in viewModel.privateChats.values {
-            if let message = messages.first(where: { $0.id == messageID }) {
-                return message.deliveryStatus
-            }
-        }
-
-        return nil
+        context.deliveryStatus(forMessageID: messageID)
     }
 
     @MainActor
     @discardableResult
     func updateMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool {
-        var didUpdateStatus = false
-
-        if let index = viewModel.messages.firstIndex(where: { $0.id == messageID }) {
-            let currentStatus = viewModel.messages[index].deliveryStatus
-            if !shouldSkipUpdate(currentStatus: currentStatus, newStatus: status) {
-                viewModel.messages[index].deliveryStatus = status
-                didUpdateStatus = true
-            }
-        }
-
-        var privateChats = viewModel.privateChats
-        for (peerID, chatMessages) in privateChats {
-            guard let index = chatMessages.firstIndex(where: { $0.id == messageID }) else { continue }
-
-            let currentStatus = chatMessages[index].deliveryStatus
-            guard !shouldSkipUpdate(currentStatus: currentStatus, newStatus: status) else { continue }
-
-            let updatedMessages = chatMessages
-            updatedMessages[index].deliveryStatus = status
-            privateChats[peerID] = updatedMessages
-            didUpdateStatus = true
-        }
-
-        if didUpdateStatus {
-            viewModel.privateChats = privateChats
-            viewModel.objectWillChange.send()
-        }
-
-        return didUpdateStatus
-    }
-}
-
-private extension ChatDeliveryCoordinator {
-    func shouldSkipUpdate(currentStatus: DeliveryStatus?, newStatus: DeliveryStatus) -> Bool {
-        guard let currentStatus else { return false }
-
-        switch (currentStatus, newStatus) {
-        case (.read, .delivered), (.read, .sent):
-            return true
+        switch status {
+        case .delivered, .read:
+            // Confirmed receipt — stop retaining the message for resend.
+            context.markMessageDelivered(messageID)
         default:
+            break
+        }
+
+        guard context.setDeliveryStatus(status, forMessageID: messageID) else {
             return false
         }
+        context.notifyUIChanged()
+        return true
     }
 }

bitchat/ViewModels/ChatLifecycleCoordinator.swift

@@ -2,36 +2,149 @@ import BitFoundation
 import BitLogger
 import Foundation
 
+/// The narrow surface `ChatLifecycleCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding an `unowned` back-ref
+/// to the whole `ChatViewModel`. This keeps the coordinator independently
+/// testable (see `ChatLifecycleCoordinatorContextTests`) and makes its true
+/// dependencies explicit.
 @MainActor
-final class ChatLifecycleCoordinator {
-    private unowned let viewModel: ChatViewModel
+protocol ChatLifecycleContext: AnyObject {
+    // MARK: Chat & receipt state
+    var messages: [BitchatMessage] { get }
+    /// A single private chat's timeline (store-direct lookup on
+    /// `ChatViewModel`; no `privateChats` dictionary build).
+    func privateMessages(for peerID: PeerID) -> [BitchatMessage]
+    var unreadPrivateMessages: Set<PeerID> { get }
+    var selectedPrivateChatPeer: PeerID? { get }
+    /// Appends a private message via the single-writer store intent.
+    @discardableResult
+    func appendPrivateMessage(_ message: BitchatMessage, to peerID: PeerID) -> Bool
+    /// Clears the peer's unread flag (store unread state only).
+    func markPrivateChatRead(_ peerID: PeerID)
+    var sentReadReceipts: Set<String> { get }
+    var nickname: String { get }
+    var myPeerID: PeerID { get }
+    var activeChannel: ChannelID { get }
+    var nostrKeyMapping: [PeerID: String] { get }
+    /// Records that a read receipt is being sent for `messageID`.
+    /// Returns `false` when one was already recorded — the caller must skip sending.
+    @discardableResult
+    func markReadReceiptSent(_ messageID: String) -> Bool
+    /// The owner-level read pass (chat manager + receipts); used for the
+    /// delayed re-run after the app becomes active.
+    func markPrivateMessagesAsRead(from peerID: PeerID)
+    /// Marks the chat read in the private chat manager (sends pending mesh READ acks).
+    func markChatAsRead(from peerID: PeerID)
+    /// Schedules main-actor work after a UI-timing delay. Injected so tests
+    /// can run the work synchronously instead of polling wall-clock queues.
+    func scheduleOnMainAfter(_ delay: TimeInterval, _ work: @escaping @MainActor () -> Void)
+    func addSystemMessage(_ content: String)
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    // MARK: Peers & sessions
+    func peerNickname(for peerID: PeerID) -> String?
+    /// The peer's current entry in the unified peer service, if known.
+    func unifiedPeer(for peerID: PeerID) -> BitchatPeer?
+    func noiseSessionState(for peerID: PeerID) -> LazyHandshakeState
+    func stopMeshServices()
+    /// Re-reads the transport's current Bluetooth state and updates the alert UI.
+    func refreshBluetoothState()
+
+    // MARK: Routing & receipts
+    func routePrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String)
+    func routeReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID)
+    func sendMeshMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date)
+    func sendGeohashReadReceipt(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
+
+    // MARK: Nostr & geohash
+    var isTeleported: Bool { get }
+    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
+    func recordGeoParticipant(pubkeyHex: String)
+
+    // MARK: Favorites (shared with `ChatPrivateConversationContext`)
+    /// The persisted favorite relationship for the peer's Noise static key, if any.
+    func favoriteRelationship(forNoiseKey noiseKey: Data) -> FavoritesPersistenceService.FavoriteRelationship?
+
+    // MARK: Identity persistence
+    /// Forces the identity manager to persist its state now.
+    func forceSaveIdentity()
+    /// Confirms the Noise identity key is still present in the keychain.
+    @discardableResult
+    func verifyIdentityKeyExists() -> Bool
+}
+
+extension ChatViewModel: ChatLifecycleContext {
+    // `messages`, `privateMessages(for:)`, `unreadPrivateMessages`,
+    // `selectedPrivateChatPeer`, `sentReadReceipts`, `nickname`, `myPeerID`,
+    // `activeChannel`, `nostrKeyMapping`, `markReadReceiptSent(_:)`,
+    // `markPrivateMessagesAsRead(from:)`, `appendPrivateMessage(_:to:)`,
+    // `markPrivateChatRead(_:)`, `addSystemMessage(_:)`,
+    // `peerNickname(for:)`, `unifiedPeer(for:)`, `noiseSessionState(for:)`,
+    // the routing/ack members, `isTeleported`,
+    // `deriveNostrIdentity(forGeohash:)`, `recordGeoParticipant(pubkeyHex:)`,
+    // and `favoriteRelationship(forNoiseKey:)`
+    // are shared requirements with the other contexts or satisfied by
+    // existing `ChatViewModel` members. The members below flatten nested
+    // service accesses into intent-named calls.
+
+    func markChatAsRead(from peerID: PeerID) {
+        privateChatManager.markAsRead(from: peerID)
     }
 
-    func handleDidBecomeActive() {
-        if let bleService = viewModel.meshService as? BLEService {
-            let currentState = bleService.getCurrentBluetoothState()
-            viewModel.updateBluetoothState(currentState)
-        }
-
-        guard let peerID = viewModel.selectedPrivateChatPeer else { return }
-
-        markPrivateMessagesAsRead(from: peerID)
-
-        let viewModel = self.viewModel
-        DispatchQueue.main.asyncAfter(deadline: .now() + TransportConfig.uiAnimationMediumSeconds) { [weak viewModel] in
+    func scheduleOnMainAfter(_ delay: TimeInterval, _ work: @escaping @MainActor () -> Void) {
+        DispatchQueue.main.asyncAfter(deadline: .now() + delay) {
             Task { @MainActor in
-                viewModel?.markPrivateMessagesAsRead(from: peerID)
+                work()
             }
         }
     }
 
-    func handleScreenshotCaptured() {
-        let screenshotMessage = "* \(viewModel.nickname) took a screenshot *"
+    func stopMeshServices() {
+        meshService.stopServices()
+    }
 
-        if let peerID = viewModel.selectedPrivateChatPeer {
+    func refreshBluetoothState() {
+        if let bleService = meshService as? BLEService {
+            updateBluetoothState(bleService.getCurrentBluetoothState())
+        }
+    }
+
+    func forceSaveIdentity() {
+        identityManager.forceSave()
+    }
+
+    @discardableResult
+    func verifyIdentityKeyExists() -> Bool {
+        keychain.verifyIdentityKeyExists()
+    }
+}
+
+@MainActor
+final class ChatLifecycleCoordinator {
+    private unowned let context: any ChatLifecycleContext
+
+    init(context: any ChatLifecycleContext) {
+        self.context = context
+    }
+
+    func handleDidBecomeActive() {
+        context.refreshBluetoothState()
+
+        guard let peerID = context.selectedPrivateChatPeer else { return }
+
+        markPrivateMessagesAsRead(from: peerID)
+
+        let context = self.context
+        context.scheduleOnMainAfter(TransportConfig.uiAnimationMediumSeconds) { [weak context] in
+            context?.markPrivateMessagesAsRead(from: peerID)
+        }
+    }
+
+    func handleScreenshotCaptured() {
+        let screenshotMessage = "* \(context.nickname) took a screenshot *"
+
+        if let peerID = context.selectedPrivateChatPeer {
             sendPrivateScreenshotNotificationIfPossible(
                 screenshotMessage,
                 to: peerID
@@ -40,9 +153,9 @@ final class ChatLifecycleCoordinator {
             return
         }
 
-        switch viewModel.activeChannel {
+        switch context.activeChannel {
         case .mesh:
-            viewModel.meshService.sendMessage(
+            context.sendMeshMessage(
                 screenshotMessage,
                 mentions: [],
                 messageID: UUID().uuidString,
@@ -56,43 +169,40 @@ final class ChatLifecycleCoordinator {
             )
         }
 
-        viewModel.addSystemMessage("you took a screenshot")
+        context.addSystemMessage("you took a screenshot")
     }
 
     func saveIdentityState() {
-        viewModel.identityManager.forceSave()
-        _ = viewModel.keychain.verifyIdentityKeyExists()
+        context.forceSaveIdentity()
+        context.verifyIdentityKeyExists()
     }
 
     func applicationWillTerminate() {
-        viewModel.meshService.stopServices()
+        context.stopMeshServices()
         saveIdentityState()
     }
 
     func markPrivateMessagesAsRead(from peerID: PeerID) {
-        viewModel.privateChatManager.markAsRead(from: peerID)
-        viewModel.synchronizePrivateConversationStore()
+        context.markChatAsRead(from: peerID)
 
         if peerID.isGeoDM,
-           let recipientHex = viewModel.nostrKeyMapping[peerID],
-           case .location(let channel) = viewModel.activeChannel,
-           let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
-            let messages = viewModel.privateChats[peerID] ?? []
+           let recipientHex = context.nostrKeyMapping[peerID],
+           case .location(let channel) = context.activeChannel,
+           let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
+            let messages = context.privateMessages(for: peerID)
             for message in messages where message.senderPeerID == peerID && !message.isRelay {
-                guard !viewModel.sentReadReceipts.contains(message.id) else { continue }
+                guard !context.sentReadReceipts.contains(message.id) else { continue }
 
                 SecureLogger.debug(
                     "GeoDM: sending READ for mid=\(message.id.prefix(8))… to=\(recipientHex.prefix(8))…",
                     category: .session
                 )
-                let nostrTransport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-                nostrTransport.senderPeerID = viewModel.meshService.myPeerID
-                nostrTransport.sendReadReceiptGeohash(
+                context.sendGeohashReadReceipt(
                     message.id,
                     toRecipientHex: recipientHex,
                     from: identity
                 )
-                viewModel.sentReadReceipts.insert(message.id)
+                context.markReadReceiptSent(message.id)
             }
             return
         }
@@ -101,16 +211,16 @@ final class ChatLifecycleCoordinator {
         var peerNostrPubkey: String?
 
         if let noiseKey = Data(hexString: peerID.id),
-           let favoriteStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey) {
+           let favoriteStatus = context.favoriteRelationship(forNoiseKey: noiseKey) {
             noiseKeyHex = peerID
             peerNostrPubkey = favoriteStatus.peerNostrPublicKey
-        } else if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
+        } else if let peer = context.unifiedPeer(for: peerID) {
             noiseKeyHex = PeerID(hexData: peer.noisePublicKey)
-            let favoriteStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: peer.noisePublicKey)
+            let favoriteStatus = context.favoriteRelationship(forNoiseKey: peer.noisePublicKey)
             peerNostrPubkey = favoriteStatus?.peerNostrPublicKey
 
-            if let noiseKeyHex, viewModel.unreadPrivateMessages.contains(noiseKeyHex) {
-                viewModel.unreadPrivateMessages.remove(noiseKeyHex)
+            if let noiseKeyHex, context.unreadPrivateMessages.contains(noiseKeyHex) {
+                context.markPrivateChatRead(noiseKeyHex)
             }
         }
 
@@ -121,38 +231,36 @@ final class ChatLifecycleCoordinator {
                 continue
             }
 
-            guard !viewModel.sentReadReceipts.contains(message.id) else { continue }
+            guard !context.sentReadReceipts.contains(message.id) else { continue }
 
             let receipt = ReadReceipt(
                 originalMessageID: message.id,
-                readerID: viewModel.meshService.myPeerID,
-                readerNickname: viewModel.nickname
+                readerID: context.myPeerID,
+                readerNickname: context.nickname
             )
             let recipientPeerID = peerID.isHex
                 ? peerID
-                : (viewModel.unifiedPeerService.getPeer(by: peerID)?.peerID ?? peerID)
+                : (context.unifiedPeer(for: peerID)?.peerID ?? peerID)
 
-            viewModel.messageRouter.sendReadReceipt(receipt, to: recipientPeerID)
-            viewModel.sentReadReceipts.insert(message.id)
+            context.routeReadReceipt(receipt, to: recipientPeerID)
+            context.markReadReceiptSent(message.id)
         }
     }
 
     func getMessages(for peerID: PeerID?) -> [BitchatMessage] {
-        guard let peerID else { return viewModel.messages }
+        guard let peerID else { return context.messages }
         return getPrivateChatMessages(for: peerID)
     }
 
     func getPrivateChatMessages(for peerID: PeerID) -> [BitchatMessage] {
         var combined: [BitchatMessage] = []
 
-        if let ephemeralMessages = viewModel.privateChats[peerID] {
-            combined.append(contentsOf: ephemeralMessages)
-        }
+        combined.append(contentsOf: context.privateMessages(for: peerID))
 
-        if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
+        if let peer = context.unifiedPeer(for: peerID) {
             let noiseKeyHex = PeerID(hexData: peer.noisePublicKey)
-            if noiseKeyHex != peerID, let stableMessages = viewModel.privateChats[noiseKeyHex] {
-                combined.append(contentsOf: stableMessages)
+            if noiseKeyHex != peerID {
+                combined.append(contentsOf: context.privateMessages(for: noiseKeyHex))
             }
         }
 
@@ -175,12 +283,12 @@ final class ChatLifecycleCoordinator {
 
 private extension ChatLifecycleCoordinator {
     func sendPrivateScreenshotNotificationIfPossible(_ message: String, to peerID: PeerID) {
-        guard let peerNickname = viewModel.meshService.peerNickname(peerID: peerID) else { return }
+        guard let peerNickname = context.peerNickname(for: peerID) else { return }
 
-        let sessionState = viewModel.meshService.getNoiseSessionState(for: peerID)
+        let sessionState = context.noiseSessionState(for: peerID)
         switch sessionState {
         case .established:
-            viewModel.messageRouter.sendPrivate(
+            context.routePrivateMessage(
                 message,
                 to: peerID,
                 recipientNickname: peerNickname,
@@ -203,30 +311,25 @@ private extension ChatLifecycleCoordinator {
             isRelay: false,
             originalSender: nil,
             isPrivate: true,
-            recipientNickname: viewModel.meshService.peerNickname(peerID: peerID),
-            senderPeerID: viewModel.meshService.myPeerID
+            recipientNickname: context.peerNickname(for: peerID),
+            senderPeerID: context.myPeerID
         )
 
-        var chats = viewModel.privateChats
-        if chats[peerID] == nil {
-            chats[peerID] = []
-        }
-        chats[peerID]?.append(notice)
-        viewModel.privateChats = chats
+        context.appendPrivateMessage(notice, to: peerID)
     }
 
     func sendPublicGeohashScreenshotMessage(_ message: String, channel: GeohashChannel) {
-        Task { @MainActor [weak viewModel] in
-            guard let viewModel else { return }
+        Task { @MainActor [weak context = self.context] in
+            guard let context else { return }
 
             do {
-                let identity = try viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash)
+                let identity = try context.deriveNostrIdentity(forGeohash: channel.geohash)
                 let event = try NostrProtocol.createEphemeralGeohashEvent(
                     content: message,
                     geohash: channel.geohash,
                     senderIdentity: identity,
-                    nickname: viewModel.nickname,
-                    teleported: viewModel.locationManager.teleported
+                    nickname: context.nickname,
+                    teleported: context.isTeleported
                 )
 
                 let targetRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: channel.geohash, count: 5)
@@ -236,10 +339,10 @@ private extension ChatLifecycleCoordinator {
                     NostrRelayManager.shared.sendEvent(event, to: targetRelays)
                 }
 
-                viewModel.participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
+                context.recordGeoParticipant(pubkeyHex: identity.publicKeyHex)
             } catch {
                 SecureLogger.error("❌ Failed to send geohash screenshot message: \(error)", category: .session)
-                viewModel.addSystemMessage(
+                context.addSystemMessage(
                     String(localized: "system.location.send_failed", comment: "System message when a location channel send fails")
                 )
             }
@@ -252,9 +355,10 @@ private extension ChatLifecycleCoordinator {
         case .failed: return 1
         case .sending: return 2
         case .sent: return 3
-        case .partiallyDelivered: return 4
-        case .delivered: return 5
-        case .read: return 6
+        case .carried: return 4
+        case .partiallyDelivered: return 5
+        case .delivered: return 6
+        case .read: return 7
         }
     }
 }

bitchat/ViewModels/ChatMediaTransferCoordinator.swift

@@ -6,26 +6,92 @@ import Foundation
 import UIKit
 #endif
 
+/// The narrow surface `ChatMediaTransferCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding an `unowned` back-ref
+/// to the whole `ChatViewModel`. This keeps the coordinator independently
+/// testable (see `ChatMediaTransferCoordinatorContextTests`) and makes its
+/// true dependencies explicit.
+@MainActor
+protocol ChatMediaTransferContext: AnyObject {
+    // MARK: Composition state
+    var canSendMediaInCurrentContext: Bool { get }
+    var selectedPrivateChatPeer: PeerID? { get }
+    var nickname: String { get }
+    var myPeerID: PeerID { get }
+    var activeChannel: ChannelID { get }
+    func nicknameForPeer(_ peerID: PeerID) -> String
+    func currentPublicSender() -> (name: String, peerID: PeerID)
+
+    // MARK: Message state
+    /// Appends a private message via the single-writer store intent.
+    @discardableResult
+    func appendPrivateMessage(_ message: BitchatMessage, to peerID: PeerID) -> Bool
+    /// Appends a public message via the single-writer store intent
+    /// (immediate: outgoing media placeholders must render without batching).
+    @discardableResult
+    func appendPublicMessage(_ message: BitchatMessage, to conversationID: ConversationID) -> Bool
+    func removeMessage(withID messageID: String, cleanupFile: Bool)
+    func addSystemMessage(_ content: String)
+    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
+    func notifyUIChanged()
+
+    // MARK: Delivery status & dedup
+    func updateMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus)
+    func normalizedContentKey(_ content: String) -> String
+    func recordContentKey(_ key: String, timestamp: Date)
+
+    // MARK: Mesh file transfer
+    func sendFilePrivate(_ packet: BitchatFilePacket, to peerID: PeerID, transferId: String)
+    func sendFileBroadcast(_ packet: BitchatFilePacket, transferId: String)
+    func cancelTransfer(_ transferId: String)
+}
+
+extension ChatViewModel: ChatMediaTransferContext {
+    // `canSendMediaInCurrentContext`, `selectedPrivateChatPeer`, `nickname`,
+    // `myPeerID`, `activeChannel`, `nicknameForPeer(_:)`,
+    // `currentPublicSender()`,
+    // `appendPublicMessage(_:to:)`, `removeMessage(withID:cleanupFile:)`,
+    // `addSystemMessage(_:)`, `notifyUIChanged()`,
+    // `updateMessageDeliveryStatus(_:status:)`, `normalizedContentKey(_:)`,
+    // and `recordContentKey(_:timestamp:)` are shared requirements with the
+    // other contexts or satisfied by existing `ChatViewModel` members. The
+    // members below flatten mesh service accesses.
+
+    func sendFilePrivate(_ packet: BitchatFilePacket, to peerID: PeerID, transferId: String) {
+        meshService.sendFilePrivate(packet, to: peerID, transferId: transferId)
+    }
+
+    func sendFileBroadcast(_ packet: BitchatFilePacket, transferId: String) {
+        meshService.sendFileBroadcast(packet, transferId: transferId)
+    }
+
+    func cancelTransfer(_ transferId: String) {
+        meshService.cancelTransfer(transferId)
+    }
+}
+
 @MainActor
 final class ChatMediaTransferCoordinator {
-    private unowned let viewModel: ChatViewModel
+    private unowned let context: any ChatMediaTransferContext
 
     private(set) var transferIdToMessageIDs: [String: [String]] = [:]
     private(set) var messageIDToTransferId: [String: String] = [:]
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    init(context: any ChatMediaTransferContext) {
+        self.context = context
     }
 
     func sendVoiceNote(at url: URL) {
-        guard viewModel.canSendMediaInCurrentContext else {
+        guard context.canSendMediaInCurrentContext else {
             SecureLogger.info("Voice note blocked outside mesh/private context", category: .session)
             try? FileManager.default.removeItem(at: url)
-            viewModel.addSystemMessage("Voice notes are only available in mesh chats.")
+            context.addSystemMessage("Voice notes are only available in mesh chats.")
             return
         }
 
-        let targetPeer = viewModel.selectedPrivateChatPeer
+        let targetPeer = context.selectedPrivateChatPeer
         let message = enqueueMediaMessage(
             content: "\(MimeType.Category.audio.messagePrefix)\(url.lastPathComponent)",
             targetPeer: targetPeer
@@ -34,28 +100,30 @@ final class ChatMediaTransferCoordinator {
         let transferId = makeTransferID(messageID: messageID)
 
         Task.detached(priority: .userInitiated) { [weak self] in
-            guard let self else { return }
             do {
                 let packet = try ChatMediaPreparation.prepareVoiceNotePacket(at: url)
 
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     self.registerTransfer(transferId: transferId, messageID: messageID)
                     if let peerID = targetPeer {
-                        self.viewModel.meshService.sendFilePrivate(packet, to: peerID, transferId: transferId)
+                        self.context.sendFilePrivate(packet, to: peerID, transferId: transferId)
                     } else {
-                        self.viewModel.meshService.sendFileBroadcast(packet, transferId: transferId)
+                        self.context.sendFileBroadcast(packet, transferId: transferId)
                     }
                 }
             } catch ChatMediaPreparationError.voiceNoteTooLarge(let size) {
                 SecureLogger.warning("Voice note exceeds size limit (\(size) bytes)", category: .session)
                 try? FileManager.default.removeItem(at: url)
-                await MainActor.run {
-                    self.handleMediaSendFailure(messageID: messageID, reason: "Voice note too large")
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
+                    self.handleMediaSendFailure(messageID: messageID, reason: String(localized: "content.delivery.reason.voice_too_large", comment: "Failure reason shown when a voice note exceeds the size limit"))
                 }
             } catch {
                 SecureLogger.error("Voice note send failed: \(error)", category: .session)
-                await MainActor.run {
-                    self.handleMediaSendFailure(messageID: messageID, reason: "Failed to send voice note")
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
+                    self.handleMediaSendFailure(messageID: messageID, reason: String(localized: "content.delivery.reason.voice_send_failed", comment: "Failure reason shown when a voice note could not be sent"))
                 }
             }
         }
@@ -65,10 +133,10 @@ final class ChatMediaTransferCoordinator {
     func processThenSendImage(_ image: UIImage?) {
         guard let image else { return }
         Task.detached { [weak self] in
-            guard let self else { return }
             do {
                 let processedURL = try ImageUtils.processImage(image)
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     self.sendImage(from: processedURL)
                 }
             } catch {
@@ -80,10 +148,10 @@ final class ChatMediaTransferCoordinator {
     func processThenSendImage(from url: URL?) {
         guard let url else { return }
         Task.detached { [weak self] in
-            guard let self else { return }
             do {
                 let processedURL = try ImageUtils.processImage(at: url)
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     self.sendImage(from: processedURL)
                 }
             } catch {
@@ -94,29 +162,29 @@ final class ChatMediaTransferCoordinator {
     #endif
 
     func sendImage(from sourceURL: URL, cleanup: (() -> Void)? = nil) {
-        guard viewModel.canSendMediaInCurrentContext else {
+        guard context.canSendMediaInCurrentContext else {
             SecureLogger.info("Image send blocked outside mesh/private context", category: .session)
             cleanup?()
-            viewModel.addSystemMessage("Images are only available in mesh chats.")
+            context.addSystemMessage("Images are only available in mesh chats.")
             return
         }
 
-        let targetPeer = viewModel.selectedPrivateChatPeer
+        let targetPeer = context.selectedPrivateChatPeer
 
         do {
             try ImageUtils.validateImageSource(at: sourceURL)
         } catch {
             SecureLogger.error("Image send preparation failed: \(error)", category: .session)
-            viewModel.addSystemMessage("Failed to prepare image for sending.")
+            context.addSystemMessage("Failed to prepare image for sending.")
             return
         }
 
         Task.detached(priority: .userInitiated) { [weak self] in
-            guard let self else { return }
             do {
                 let prepared = try ChatMediaPreparation.prepareImagePacket(from: sourceURL)
 
-                await MainActor.run {
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
                     let message = self.enqueueMediaMessage(
                         content: "\(MimeType.Category.image.messagePrefix)\(prepared.outputURL.lastPathComponent)",
                         targetPeer: targetPeer
@@ -125,20 +193,22 @@ final class ChatMediaTransferCoordinator {
                     let transferId = self.makeTransferID(messageID: messageID)
                     self.registerTransfer(transferId: transferId, messageID: messageID)
                     if let peerID = targetPeer {
-                        self.viewModel.meshService.sendFilePrivate(prepared.packet, to: peerID, transferId: transferId)
+                        self.context.sendFilePrivate(prepared.packet, to: peerID, transferId: transferId)
                     } else {
-                        self.viewModel.meshService.sendFileBroadcast(prepared.packet, transferId: transferId)
+                        self.context.sendFileBroadcast(prepared.packet, transferId: transferId)
                     }
                 }
             } catch ChatMediaPreparationError.imageTooLarge(let size) {
                 SecureLogger.warning("Processed image exceeds size limit (\(size) bytes)", category: .session)
-                await MainActor.run {
-                    self.viewModel.addSystemMessage("Image is too large to send.")
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
+                    self.context.addSystemMessage("Image is too large to send.")
                 }
             } catch {
                 SecureLogger.error("Image send preparation failed: \(error)", category: .session)
-                await MainActor.run {
-                    self.viewModel.addSystemMessage("Failed to prepare image for sending.")
+                await MainActor.run { [weak self] in
+                    guard let self else { return }
+                    self.context.addSystemMessage("Failed to prepare image for sending.")
                 }
             }
         }
@@ -150,22 +220,19 @@ final class ChatMediaTransferCoordinator {
 
         if let peerID = targetPeer {
             message = BitchatMessage(
-                sender: viewModel.nickname,
+                sender: context.nickname,
                 content: content,
                 timestamp: timestamp,
                 isRelay: false,
                 originalSender: nil,
                 isPrivate: true,
-                recipientNickname: viewModel.nicknameForPeer(peerID),
-                senderPeerID: viewModel.meshService.myPeerID,
+                recipientNickname: context.nicknameForPeer(peerID),
+                senderPeerID: context.myPeerID,
                 deliveryStatus: .sending
             )
-            var chats = viewModel.privateChats
-            chats[peerID, default: []].append(message)
-            viewModel.privateChats = chats
-            viewModel.trimMessagesIfNeeded()
+            context.appendPrivateMessage(message, to: peerID)
         } else {
-            let (displayName, senderPeerID) = viewModel.currentPublicSender()
+            let (displayName, senderPeerID) = context.currentPublicSender()
             message = BitchatMessage(
                 sender: displayName,
                 content: content,
@@ -177,14 +244,12 @@ final class ChatMediaTransferCoordinator {
                 senderPeerID: senderPeerID,
                 deliveryStatus: .sending
             )
-            viewModel.timelineStore.append(message, to: viewModel.activeChannel)
-            viewModel.refreshVisibleMessages(from: viewModel.activeChannel)
-            viewModel.trimMessagesIfNeeded()
+            context.appendPublicMessage(message, to: ConversationID(channelID: context.activeChannel))
         }
 
-        let key = viewModel.deduplicationService.normalizedContentKey(message.content)
-        viewModel.deduplicationService.recordContentKey(key, timestamp: timestamp)
-        viewModel.objectWillChange.send()
+        let key = context.normalizedContentKey(message.content)
+        context.recordContentKey(key, timestamp: timestamp)
+        context.notifyUIChanged()
         return message
     }
 
@@ -213,7 +278,7 @@ final class ChatMediaTransferCoordinator {
     }
 
     func handleMediaSendFailure(messageID: String, reason: String) {
-        viewModel.updateMessageDeliveryStatus(messageID, status: .failed(reason: reason))
+        context.updateMessageDeliveryStatus(messageID, status: .failed(reason: reason))
         clearTransferMapping(for: messageID)
     }
 
@@ -221,18 +286,18 @@ final class ChatMediaTransferCoordinator {
         switch event {
         case .started(let id, let total):
             guard let messageID = transferIdToMessageIDs[id]?.first else { return }
-            viewModel.updateMessageDeliveryStatus(messageID, status: .partiallyDelivered(reached: 0, total: total))
+            context.updateMessageDeliveryStatus(messageID, status: .partiallyDelivered(reached: 0, total: total))
         case .updated(let id, let sent, let total):
             guard let messageID = transferIdToMessageIDs[id]?.first else { return }
-            viewModel.updateMessageDeliveryStatus(messageID, status: .partiallyDelivered(reached: sent, total: total))
+            context.updateMessageDeliveryStatus(messageID, status: .partiallyDelivered(reached: sent, total: total))
         case .completed(let id, _):
             guard let messageID = transferIdToMessageIDs[id]?.first else { return }
-            viewModel.updateMessageDeliveryStatus(messageID, status: .sent)
+            context.updateMessageDeliveryStatus(messageID, status: .sent)
             clearTransferMapping(for: messageID)
         case .cancelled(let id, _, _):
             guard let messageID = transferIdToMessageIDs[id]?.first else { return }
             clearTransferMapping(for: messageID)
-            viewModel.removeMessage(withID: messageID, cleanupFile: true)
+            context.removeMessage(withID: messageID, cleanupFile: true)
         }
     }
 
@@ -266,15 +331,15 @@ final class ChatMediaTransferCoordinator {
         if let transferId = messageIDToTransferId[messageID],
            let active = transferIdToMessageIDs[transferId]?.first,
            active == messageID {
-            viewModel.meshService.cancelTransfer(transferId)
+            context.cancelTransfer(transferId)
         }
         clearTransferMapping(for: messageID)
-        viewModel.removeMessage(withID: messageID, cleanupFile: true)
+        context.removeMessage(withID: messageID, cleanupFile: true)
     }
 
     func deleteMediaMessage(messageID: String) {
         clearTransferMapping(for: messageID)
-        viewModel.removeMessage(withID: messageID, cleanupFile: true)
+        context.removeMessage(withID: messageID, cleanupFile: true)
     }
 }
 

bitchat/ViewModels/ChatMessageFormatter.swift

@@ -14,7 +14,8 @@ final class ChatMessageFormatter {
         self.viewModel = viewModel
     }
 
-    func formatMessageAsText(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
+    func formatMessageAsText(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme = .matrix) -> AttributedString {
+        let design = theme.bodyFontDesign
         let isSelf: Bool = {
             if let spid = message.senderPeerID {
                 if case .location(let channel) = viewModel.activeChannel, spid.isGeoChat {
@@ -40,7 +41,7 @@ final class ChatMessageFormatter {
         }()
 
         let isDark = colorScheme == .dark
-        if let cachedText = message.getCachedFormattedText(isDark: isDark, isSelf: isSelf) {
+        if let cachedText = message.getCachedFormattedText(isDark: isDark, isSelf: isSelf, variant: theme.formatCacheVariant) {
             return cachedText
         }
 
@@ -52,7 +53,7 @@ final class ChatMessageFormatter {
             var senderStyle = AttributeContainer()
             senderStyle.foregroundColor = baseColor
             let fontWeight: Font.Weight = isSelf ? .bold : .medium
-            senderStyle.font = .bitchatSystem(size: 14, weight: fontWeight, design: .monospaced)
+            senderStyle.font = .bitchatSystem(size: 14, weight: fontWeight, design: design)
             if let spid = message.senderPeerID,
                let url = URL(string: "bitchat://user/\(spid.toPercentEncoded())") {
                 senderStyle.link = url
@@ -79,8 +80,8 @@ final class ChatMessageFormatter {
                 var plainStyle = AttributeContainer()
                 plainStyle.foregroundColor = baseColor
                 plainStyle.font = isSelf
-                    ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
-                    : .bitchatSystem(size: 14, design: .monospaced)
+                    ? .bitchatSystem(size: 14, weight: .bold, design: design)
+                    : .bitchatSystem(size: 14, design: design)
                 result.append(AttributedString(content).mergingAttributes(plainStyle))
             } else {
                 let hashtagRegex = Patterns.hashtag
@@ -197,8 +198,8 @@ final class ChatMessageFormatter {
                             var beforeStyle = AttributeContainer()
                             beforeStyle.foregroundColor = baseColor
                             beforeStyle.font = isSelf
-                                ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
-                                : .bitchatSystem(size: 14, design: .monospaced)
+                                ? .bitchatSystem(size: 14, weight: .bold, design: design)
+                                : .bitchatSystem(size: 14, design: design)
                             if isMentioned {
                                 beforeStyle.font = beforeStyle.font?.bold()
                             }
@@ -230,7 +231,7 @@ final class ChatMessageFormatter {
                         mentionStyle.font = .bitchatSystem(
                             size: 14,
                             weight: isSelf ? .bold : .semibold,
-                            design: .monospaced
+                            design: design
                         )
                         let mentionColor: Color = isMentionToMe ? .orange : baseColor
                         mentionStyle.foregroundColor = mentionColor
@@ -267,8 +268,8 @@ final class ChatMessageFormatter {
 
                         var tagStyle = AttributeContainer()
                         tagStyle.font = isSelf
-                            ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
-                            : .bitchatSystem(size: 14, design: .monospaced)
+                            ? .bitchatSystem(size: 14, weight: .bold, design: design)
+                            : .bitchatSystem(size: 14, design: design)
                         tagStyle.foregroundColor = baseColor
                         if isGeohash && !attachedToMentionToken && standalone,
                            let url = URL(string: "bitchat://geohash/\(token)") {
@@ -280,15 +281,15 @@ final class ChatMessageFormatter {
                         var spacer = AttributeContainer()
                         spacer.foregroundColor = baseColor
                         spacer.font = isSelf
-                            ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
-                            : .bitchatSystem(size: 14, design: .monospaced)
+                            ? .bitchatSystem(size: 14, weight: .bold, design: design)
+                            : .bitchatSystem(size: 14, design: design)
                         result.append(AttributedString(" ").mergingAttributes(spacer))
                     } else {
                         var matchStyle = AttributeContainer()
                         matchStyle.font = .bitchatSystem(
                             size: 14,
                             weight: isSelf ? .bold : .semibold,
-                            design: .monospaced
+                            design: design
                         )
                         if type == "url" {
                             matchStyle.foregroundColor = isSelf ? .orange : .blue
@@ -310,8 +311,8 @@ final class ChatMessageFormatter {
                     var remainingStyle = AttributeContainer()
                     remainingStyle.foregroundColor = baseColor
                     remainingStyle.font = isSelf
-                        ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
-                        : .bitchatSystem(size: 14, design: .monospaced)
+                        ? .bitchatSystem(size: 14, weight: .bold, design: design)
+                        : .bitchatSystem(size: 14, design: design)
                     if isMentioned {
                         remainingStyle.font = remainingStyle.font?.bold()
                     }
@@ -322,27 +323,28 @@ final class ChatMessageFormatter {
             let timestamp = AttributedString(" [\(message.formattedTimestamp)]")
             var timestampStyle = AttributeContainer()
             timestampStyle.foregroundColor = Color.gray.opacity(0.7)
-            timestampStyle.font = .bitchatSystem(size: 10, design: .monospaced)
+            timestampStyle.font = .bitchatSystem(size: 10, design: design)
             result.append(timestamp.mergingAttributes(timestampStyle))
         } else {
             var contentStyle = AttributeContainer()
             contentStyle.foregroundColor = Color.gray
             let content = AttributedString("* \(message.content) *")
-            contentStyle.font = .bitchatSystem(size: 12, design: .monospaced).italic()
+            contentStyle.font = .bitchatSystem(size: 12, design: design).italic()
             result.append(content.mergingAttributes(contentStyle))
 
             let timestamp = AttributedString(" [\(message.formattedTimestamp)]")
             var timestampStyle = AttributeContainer()
             timestampStyle.foregroundColor = Color.gray.opacity(0.5)
-            timestampStyle.font = .bitchatSystem(size: 10, design: .monospaced)
+            timestampStyle.font = .bitchatSystem(size: 10, design: design)
             result.append(timestamp.mergingAttributes(timestampStyle))
         }
 
-        message.setCachedFormattedText(result, isDark: isDark, isSelf: isSelf)
+        message.setCachedFormattedText(result, isDark: isDark, isSelf: isSelf, variant: theme.formatCacheVariant)
         return result
     }
 
-    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
+    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme = .matrix) -> AttributedString {
+        let design = theme.bodyFontDesign
         let isSelf: Bool = {
             if let spid = message.senderPeerID {
                 if case .location(let channel) = viewModel.activeChannel, spid.id.hasPrefix("nostr:"),
@@ -362,7 +364,7 @@ final class ChatMessageFormatter {
         if message.sender == "system" {
             var style = AttributeContainer()
             style.foregroundColor = baseColor
-            style.font = .bitchatSystem(size: 14, weight: .medium, design: .monospaced)
+            style.font = .bitchatSystem(size: 14, weight: .medium, design: design)
             return AttributedString(message.sender).mergingAttributes(style)
         }
 
@@ -370,7 +372,7 @@ final class ChatMessageFormatter {
         let (baseName, suffix) = message.sender.splitSuffix()
         var senderStyle = AttributeContainer()
         senderStyle.foregroundColor = baseColor
-        senderStyle.font = .bitchatSystem(size: 14, weight: isSelf ? .bold : .medium, design: .monospaced)
+        senderStyle.font = .bitchatSystem(size: 14, weight: isSelf ? .bold : .medium, design: design)
         if let spid = message.senderPeerID,
            let url = URL(string: "bitchat://user/\(spid.id.addingPercentEncoding(withAllowedCharacters: .urlPathAllowed) ?? spid.id)") {
             senderStyle.link = url

bitchat/ViewModels/ChatNostrCoordinator.swift

@@ -1,707 +1,62 @@
 import BitFoundation
 import BitLogger
 import Foundation
-import SwiftUI
-import Tor
 
+/// The surface `ChatNostrCoordinator` needs from its owner.
+///
+/// Inherits the component contexts (`GeohashSubscriptionContext`,
+/// `NostrInboundPipelineContext`, `GeoPresenceContext`) so a single object —
+/// `ChatViewModel` in production, one mock in tests — can back the whole
+/// Nostr stack. The members declared here are only the residual
+/// favorites/ack glue the slimmed coordinator still owns.
+@MainActor
+protocol ChatNostrContext: GeohashSubscriptionContext, NostrInboundPipelineContext, GeoPresenceContext {
+    var selectedPrivateChatPeer: PeerID? { get }
+    var nostrKeyMapping: [PeerID: String] { get }
+    func startPrivateChat(with peerID: PeerID)
+    func visibleGeohashPeople() -> [GeoPerson]
+
+    // MARK: Routing & acknowledgements (shared with `ChatPrivateConversationContext`)
+    func routeFavoriteNotification(to peerID: PeerID, isFavorite: Bool)
+    func sendGeohashDeliveryAck(for messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
+    func sendGeohashReadReceipt(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
+
+    // MARK: Favorites (shared with the other contexts)
+    /// The persisted favorite relationship for the peer's Noise static key, if any.
+    func favoriteRelationship(forNoiseKey noiseKey: Data) -> FavoritesPersistenceService.FavoriteRelationship?
+}
+
+extension ChatViewModel: ChatNostrContext {
+    // All requirements — including the component-context witnesses declared
+    // in `GeohashSubscriptionManager.swift`, `NostrInboundPipeline.swift`,
+    // `GeoPresenceTracker.swift`, and the favorites/notification witnesses in
+    // `ChatPrivateConversationCoordinator.swift`,
+    // `ChatPeerIdentityCoordinator.swift`, and
+    // `ChatVerificationCoordinator.swift` — already exist on `ChatViewModel`.
+}
+
+/// Thin facade over the Nostr stack: owns and wires the three components and
+/// keeps the residual favorites/ack glue that fits none of them.
+///
+/// - `subscriptions`: relay lifecycle and subscription IDs
+///   (`GeohashSubscriptionManager`)
+/// - `inbound`: the hot event -> message/payload pipeline
+///   (`NostrInboundPipeline`)
+/// - `presence`: teleport marking, sampling dedup, notification cooldown
+///   (`GeoPresenceTracker`)
 final class ChatNostrCoordinator {
-    private unowned let viewModel: ChatViewModel
-
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
-    }
-
-    @MainActor
-    func resubscribeCurrentGeohash() {
-        guard case .location(let channel) = viewModel.activeChannel else { return }
-        guard let subID = viewModel.geoSubscriptionID else {
-            switchLocationChannel(to: viewModel.activeChannel)
-            return
-        }
-
-        viewModel.participantTracker.startRefreshTimer()
-        NostrRelayManager.shared.unsubscribe(id: subID)
-        let filter = NostrFilter.geohashEphemeral(
-            channel.geohash,
-            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds),
-            limit: TransportConfig.nostrGeohashInitialLimit
-        )
-        let subRelays = GeoRelayDirectory.shared.closestRelays(
-            toGeohash: channel.geohash,
-            count: TransportConfig.nostrGeoRelayCount
-        )
-        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
-            Task { @MainActor [weak self] in
-                self?.subscribeNostrEvent(event)
-            }
-        }
-
-        if let dmSub = viewModel.geoDmSubscriptionID {
-            NostrRelayManager.shared.unsubscribe(id: dmSub)
-            viewModel.geoDmSubscriptionID = nil
-        }
-
-        if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
-            let dmSub = "geo-dm-\(channel.geohash)"
-            viewModel.geoDmSubscriptionID = dmSub
-            let dmFilter = NostrFilter.giftWrapsFor(
-                pubkey: identity.publicKeyHex,
-                since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
-            )
-            NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
-                Task { @MainActor [weak self] in
-                    self?.subscribeGiftWrap(giftWrap, id: identity)
-                }
-            }
-        }
-    }
-
-    @MainActor
-    func subscribeNostrEvent(_ event: NostrEvent) {
-        guard event.isValidSignature() else { return }
-        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
-            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue),
-              !viewModel.deduplicationService.hasProcessedNostrEvent(event.id)
-        else {
-            return
-        }
-
-        viewModel.deduplicationService.recordNostrEvent(event.id)
-
-        if let gh = viewModel.currentGeohash,
-           let myGeoIdentity = try? viewModel.idBridge.deriveIdentity(forGeohash: gh),
-           myGeoIdentity.publicKeyHex.lowercased() == event.pubkey.lowercased() {
-            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-            if Date().timeIntervalSince(eventTime) < 15 {
-                return
-            }
-        }
-
-        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
-            let nick = nickTag[1].trimmed
-            viewModel.locationPresenceStore.setNickname(nick, for: event.pubkey)
-        }
-
-        viewModel.nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
-        viewModel.nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
-        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey)
-
-        if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
-            return
-        }
-
-        let hasTeleportTag = event.tags.contains { tag in
-            tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
-        }
-
-        if hasTeleportTag {
-            let key = event.pubkey.lowercased()
-            let isSelf: Bool = {
-                if let gh = viewModel.currentGeohash,
-                   let myIdentity = try? viewModel.idBridge.deriveIdentity(forGeohash: gh) {
-                    return myIdentity.publicKeyHex.lowercased() == key
-                }
-                return false
-            }()
-            if !isSelf {
-                Task { @MainActor [weak viewModel] in
-                    viewModel?.locationPresenceStore.markTeleported(key)
-                }
-            }
-        }
-
-        let senderName = viewModel.displayNameForNostrPubkey(event.pubkey)
-        let content = event.content.trimmed
-        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-        let timestamp = min(rawTs, Date())
-        let mentions = viewModel.parseMentions(from: content)
-        let message = BitchatMessage(
-            id: event.id,
-            sender: senderName,
-            content: content,
-            timestamp: timestamp,
-            isRelay: false,
-            senderPeerID: PeerID(nostr: event.pubkey),
-            mentions: mentions.isEmpty ? nil : mentions
-        )
-
-        Task { @MainActor [weak viewModel] in
-            guard let viewModel else { return }
-            let isBlocked = viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased())
-            viewModel.handlePublicMessage(message)
-            if !isBlocked {
-                viewModel.checkForMentions(message)
-                viewModel.sendHapticFeedback(for: message)
-            }
-        }
-    }
-
-    @MainActor
-    func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        guard giftWrap.isValidSignature() else { return }
-        guard !viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) else { return }
-        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
-
-        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
-            giftWrap: giftWrap,
-            recipientIdentity: id
-        ),
-        let packet = Self.decodeEmbeddedBitChatPacket(from: content),
-        packet.type == MessageType.noiseEncrypted.rawValue,
-        let noisePayload = NoisePayload.decode(packet.payload)
-        else {
-            return
-        }
-
-        let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
-        let convKey = PeerID(nostr_: senderPubkey)
-        viewModel.nostrKeyMapping[convKey] = senderPubkey
-
-        switch noisePayload.type {
-        case .privateMessage:
-            viewModel.handlePrivateMessage(
-                noisePayload,
-                senderPubkey: senderPubkey,
-                convKey: convKey,
-                id: id,
-                messageTimestamp: messageTimestamp
-            )
-        case .delivered:
-            viewModel.handleDelivered(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
-        case .readReceipt:
-            viewModel.handleReadReceipt(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
-        case .verifyChallenge, .verifyResponse:
-            break
-        }
-    }
-
-    @MainActor
-    func switchLocationChannel(to channel: ChannelID) {
-        viewModel.publicMessagePipeline.reset()
-        viewModel.activeChannel = channel
-        viewModel.publicMessagePipeline.updateActiveChannel(channel)
-
-        viewModel.deduplicationService.clearNostrCaches()
-        switch channel {
-        case .mesh:
-            viewModel.refreshVisibleMessages(from: .mesh)
-            let emptyMesh = viewModel.messages.filter { $0.content.trimmed.isEmpty }.count
-            if emptyMesh > 0 {
-                SecureLogger.debug("RenderGuard: mesh timeline contains \(emptyMesh) empty messages", category: .session)
-            }
-            viewModel.participantTracker.stopRefreshTimer()
-            viewModel.participantTracker.setActiveGeohash(nil)
-            viewModel.locationPresenceStore.clearTeleportedGeo()
-
-        case .location:
-            viewModel.refreshVisibleMessages(from: channel)
-        }
-
-        if case .location = channel {
-            for content in viewModel.timelineStore.drainPendingGeohashSystemMessages() {
-                viewModel.addPublicSystemMessage(content)
-            }
-        }
-
-        if let sub = viewModel.geoSubscriptionID {
-            NostrRelayManager.shared.unsubscribe(id: sub)
-            viewModel.geoSubscriptionID = nil
-        }
-        if let dmSub = viewModel.geoDmSubscriptionID {
-            NostrRelayManager.shared.unsubscribe(id: dmSub)
-            viewModel.geoDmSubscriptionID = nil
-        }
-        viewModel.currentGeohash = nil
-        viewModel.participantTracker.setActiveGeohash(nil)
-        viewModel.locationPresenceStore.clearGeoNicknames()
-
-        guard case .location(let channel) = channel else { return }
-        viewModel.currentGeohash = channel.geohash
-        viewModel.participantTracker.setActiveGeohash(channel.geohash)
-
-        if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
-            viewModel.participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
-            let hasRegional = !viewModel.locationManager.availableChannels.isEmpty
-            let inRegional = viewModel.locationManager.availableChannels.contains { $0.geohash == channel.geohash }
-            let key = identity.publicKeyHex.lowercased()
-            if viewModel.locationManager.teleported && hasRegional && !inRegional {
-                viewModel.locationPresenceStore.markTeleported(key)
-                SecureLogger.info(
-                    "GeoTeleport: channel switch mark self teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
-                    category: .session
-                )
-            } else {
-                viewModel.locationPresenceStore.clearTeleported(key)
-            }
-        }
-
-        let subID = "geo-\(channel.geohash)"
-        viewModel.geoSubscriptionID = subID
-        viewModel.participantTracker.startRefreshTimer()
-        let ts = Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds)
-        let filter = NostrFilter.geohashEphemeral(channel.geohash, since: ts, limit: TransportConfig.nostrGeohashInitialLimit)
-        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: channel.geohash, count: 5)
-        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
-            Task { @MainActor [weak self] in
-                self?.handleNostrEvent(event)
-            }
-        }
-
-        subscribeToGeoChat(channel)
-    }
-
-    @MainActor
-    func handleNostrEvent(_ event: NostrEvent) {
-        guard event.isValidSignature() else { return }
-        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
-            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue)
-        else {
-            return
-        }
-
-        if viewModel.deduplicationService.hasProcessedNostrEvent(event.id) { return }
-        viewModel.deduplicationService.recordNostrEvent(event.id)
-
-        let tagSummary = event.tags.map { "[" + $0.joined(separator: ",") + "]" }.joined(separator: ",")
-        SecureLogger.debug("GeoTeleport: recv pub=\(event.pubkey.prefix(8))… tags=\(tagSummary)", category: .session)
-
-        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
-            return
-        }
-
-        let hasTeleportTag = event.tags.contains { tag in
-            tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
-        }
-
-        let isSelf: Bool = {
-            if let gh = viewModel.currentGeohash,
-               let my = try? viewModel.idBridge.deriveIdentity(forGeohash: gh) {
-                return my.publicKeyHex.lowercased() == event.pubkey.lowercased()
-            }
-            return false
-        }()
-
-        if hasTeleportTag, !isSelf {
-            let key = event.pubkey.lowercased()
-            Task { @MainActor [weak viewModel] in
-                guard let viewModel else { return }
-                viewModel.locationPresenceStore.markTeleported(key)
-                SecureLogger.info(
-                    "GeoTeleport: mark peer teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
-                    category: .session
-                )
-            }
-        }
-
-        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey)
-
-        if isSelf {
-            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-            if Date().timeIntervalSince(eventTime) < 15 {
-                return
-            }
-        }
-
-        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
-            viewModel.locationPresenceStore.setNickname(nickTag[1].trimmed, for: event.pubkey)
-        }
-
-        viewModel.nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
-        viewModel.nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
-
-        if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
-            return
-        }
-
-        let senderName = viewModel.displayNameForNostrPubkey(event.pubkey)
-        let content = event.content
-
-        if let teleTag = event.tags.first(where: { $0.first == "t" }),
-           teleTag.count >= 2,
-           teleTag[1] == "teleport",
-           content.trimmed.isEmpty {
-            return
-        }
-
-        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-        let mentions = viewModel.parseMentions(from: content)
-        let message = BitchatMessage(
-            id: event.id,
-            sender: senderName,
-            content: content,
-            timestamp: min(rawTs, Date()),
-            isRelay: false,
-            senderPeerID: PeerID(nostr: event.pubkey),
-            mentions: mentions.isEmpty ? nil : mentions
-        )
-
-        Task { @MainActor [weak viewModel] in
-            guard let viewModel else { return }
-            viewModel.handlePublicMessage(message)
-            viewModel.checkForMentions(message)
-            viewModel.sendHapticFeedback(for: message)
-        }
-    }
-
-    @MainActor
-    func subscribeToGeoChat(_ channel: GeohashChannel) {
-        guard let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) else { return }
-
-        let dmSub = "geo-dm-\(channel.geohash)"
-        viewModel.geoDmSubscriptionID = dmSub
-        if TorManager.shared.isReady {
-            SecureLogger.debug("GeoDM: subscribing DMs pub=\(identity.publicKeyHex.prefix(8))… sub=\(dmSub)", category: .session)
-        }
-        let dmFilter = NostrFilter.giftWrapsFor(
-            pubkey: identity.publicKeyHex,
-            since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
-        )
-        NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
-            Task { @MainActor [weak self] in
-                self?.handleGiftWrap(giftWrap, id: identity)
-            }
-        }
-    }
-
-    @MainActor
-    func handleGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        guard giftWrap.isValidSignature() else { return }
-        if viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) {
-            return
-        }
-        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
-
-        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
-            giftWrap: giftWrap,
-            recipientIdentity: id
-        ) else {
-            SecureLogger.warning("GeoDM: failed decrypt giftWrap id=\(giftWrap.id.prefix(8))…", category: .session)
-            return
-        }
-
-        SecureLogger.debug(
-            "GeoDM: decrypted gift-wrap id=\(giftWrap.id.prefix(16))... from=\(senderPubkey.prefix(8))...",
-            category: .session
-        )
-
-        guard let packet = Self.decodeEmbeddedBitChatPacket(from: content),
-              packet.type == MessageType.noiseEncrypted.rawValue,
-              let payload = NoisePayload.decode(packet.payload)
-        else {
-            return
-        }
-
-        let convKey = PeerID(nostr_: senderPubkey)
-        viewModel.nostrKeyMapping[convKey] = senderPubkey
-
-        switch payload.type {
-        case .privateMessage:
-            let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
-            viewModel.handlePrivateMessage(
-                payload,
-                senderPubkey: senderPubkey,
-                convKey: convKey,
-                id: id,
-                messageTimestamp: messageTimestamp
-            )
-        case .delivered:
-            viewModel.handleDelivered(payload, senderPubkey: senderPubkey, convKey: convKey)
-        case .readReceipt:
-            viewModel.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: convKey)
-        case .verifyChallenge, .verifyResponse:
-            break
-        }
-    }
-
-    @MainActor
-    func sendGeohash(context: ChatViewModel.GeoOutgoingContext) {
-        let channel = context.channel
-        let event = context.event
-        let identity = context.identity
-
-        let targetRelays = GeoRelayDirectory.shared.closestRelays(
-            toGeohash: channel.geohash,
-            count: TransportConfig.nostrGeoRelayCount
-        )
-
-        if targetRelays.isEmpty {
-            SecureLogger.warning("Geo: no geohash relays available for \(channel.geohash); not sending", category: .session)
-        } else {
-            NostrRelayManager.shared.sendEvent(event, to: targetRelays)
-        }
-
-        viewModel.participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
-        viewModel.nostrKeyMapping[PeerID(nostr: identity.publicKeyHex)] = identity.publicKeyHex
-        SecureLogger.debug(
-            "GeoTeleport: sent geo message pub=\(identity.publicKeyHex.prefix(8))… teleported=\(context.teleported)",
-            category: .session
-        )
-
-        let hasRegional = !viewModel.locationManager.availableChannels.isEmpty
-        let inRegional = viewModel.locationManager.availableChannels.contains { $0.geohash == channel.geohash }
-        if context.teleported && hasRegional && !inRegional {
-            let key = identity.publicKeyHex.lowercased()
-            viewModel.locationPresenceStore.markTeleported(key)
-            SecureLogger.info(
-                "GeoTeleport: mark self teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
-                category: .session
-            )
-        }
-
-        viewModel.deduplicationService.recordNostrEvent(event.id)
-    }
-
-    @MainActor
-    func beginGeohashSampling(for geohashes: [String]) {
-        if !TorManager.shared.isForeground() {
-            endGeohashSampling()
-            return
-        }
-
-        let desired = Set(geohashes)
-        let current = Set(viewModel.geoSamplingSubs.values)
-        let toAdd = desired.subtracting(current)
-        let toRemove = current.subtracting(desired)
-
-        for (subID, gh) in viewModel.geoSamplingSubs where toRemove.contains(gh) {
-            NostrRelayManager.shared.unsubscribe(id: subID)
-            viewModel.geoSamplingSubs.removeValue(forKey: subID)
-        }
-
-        for gh in toAdd {
-            subscribe(gh)
-        }
-    }
-
-    @MainActor
-    func subscribe(_ gh: String) {
-        let subID = "geo-sample-\(gh)"
-        viewModel.geoSamplingSubs[subID] = gh
-        let filter = NostrFilter.geohashEphemeral(
-            gh,
-            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashSampleLookbackSeconds),
-            limit: TransportConfig.nostrGeohashSampleLimit
-        )
-        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: gh, count: 5)
-        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
-            Task { @MainActor [weak self] in
-                self?.subscribeNostrEvent(event, gh: gh)
-            }
-        }
-    }
-
-    @MainActor
-    func subscribeNostrEvent(_ event: NostrEvent, gh: String) {
-        guard event.isValidSignature() else { return }
-        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
-            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue)
-        else {
-            return
-        }
-
-        let existingCount = viewModel.participantTracker.participantCount(for: gh)
-        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey, geohash: gh)
-
-        guard let content = event.content.trimmedOrNilIfEmpty else { return }
-        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased()) { return }
-        if let my = try? viewModel.idBridge.deriveIdentity(forGeohash: gh),
-           my.publicKeyHex.lowercased() == event.pubkey.lowercased() {
-            return
-        }
-        guard existingCount == 0 else { return }
-
-        let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-        if Date().timeIntervalSince(eventTime) > 30 { return }
-
-        #if os(iOS)
-        guard UIApplication.shared.applicationState == .active else { return }
-        if case .location(let channel) = viewModel.activeChannel, channel.geohash == gh { return }
-        #elseif os(macOS)
-        guard NSApplication.shared.isActive else { return }
-        if case .location(let channel) = viewModel.activeChannel, channel.geohash == gh { return }
-        #endif
-
-        cooldownPerGeohash(gh, content: content, event: event)
-    }
-
-    @MainActor
-    func cooldownPerGeohash(_ gh: String, content: String, event: NostrEvent) {
-        let now = Date()
-        let last = viewModel.lastGeoNotificationAt[gh] ?? .distantPast
-        if now.timeIntervalSince(last) < TransportConfig.uiGeoNotifyCooldownSeconds { return }
-
-        let preview: String = {
-            let maxLen = TransportConfig.uiGeoNotifySnippetMaxLen
-            if content.count <= maxLen { return content }
-            let idx = content.index(content.startIndex, offsetBy: maxLen)
-            return String(content[..<idx]) + "…"
-        }()
-
-        Task { @MainActor [weak viewModel] in
-            guard let viewModel else { return }
-            viewModel.lastGeoNotificationAt[gh] = now
-            let senderSuffix = String(event.pubkey.suffix(4))
-            let nick = viewModel.geoNicknames[event.pubkey.lowercased()]
-            let senderName = (nick?.isEmpty == false ? nick! : "anon") + "#" + senderSuffix
-
-            let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-            let ts = min(rawTs, Date())
-            let mentions = viewModel.parseMentions(from: content)
-            let message = BitchatMessage(
-                id: event.id,
-                sender: senderName,
-                content: content,
-                timestamp: ts,
-                isRelay: false,
-                senderPeerID: PeerID(nostr: event.pubkey),
-                mentions: mentions.isEmpty ? nil : mentions
-            )
-            if viewModel.timelineStore.appendIfAbsent(message, toGeohash: gh) {
-                viewModel.synchronizePublicConversationStore(forGeohash: gh)
-                NotificationService.shared.sendGeohashActivityNotification(geohash: gh, bodyPreview: preview)
-            }
-        }
-    }
-
-    @MainActor
-    func endGeohashSampling() {
-        for subID in viewModel.geoSamplingSubs.keys {
-            NostrRelayManager.shared.unsubscribe(id: subID)
-        }
-        viewModel.geoSamplingSubs.removeAll()
-    }
-
-    @MainActor
-    func setupNostrMessageHandling() {
-        guard let currentIdentity = try? viewModel.idBridge.getCurrentNostrIdentity() else {
-            SecureLogger.warning("⚠️ No Nostr identity available for message handling", category: .session)
-            return
-        }
-
-        SecureLogger.debug(
-            "🔑 Setting up Nostr subscription for pubkey: \(currentIdentity.publicKeyHex.prefix(16))...",
-            category: .session
-        )
-
-        let filter = NostrFilter.giftWrapsFor(
-            pubkey: currentIdentity.publicKeyHex,
-            since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
-        )
-
-        viewModel.nostrRelayManager?.subscribe(filter: filter, id: "chat-messages") { [weak self] event in
-            Task { @MainActor [weak self] in
-                self?.handleNostrMessage(event)
-            }
-        }
-    }
-
-    @MainActor
-    func handleNostrMessage(_ giftWrap: NostrEvent) {
-        if viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) { return }
-        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
-
-        Task.detached(priority: .userInitiated) { [weak self] in
-            await self?.processNostrMessage(giftWrap)
-        }
-    }
-
-    func processNostrMessage(_ giftWrap: NostrEvent) async {
-        guard giftWrap.isValidSignature() else { return }
-        let currentIdentity: NostrIdentity? = await MainActor.run {
-            try? viewModel.idBridge.getCurrentNostrIdentity()
-        }
-        guard let currentIdentity else { return }
-
-        do {
-            let (content, senderPubkey, rumorTimestamp) = try NostrProtocol.decryptPrivateMessage(
-                giftWrap: giftWrap,
-                recipientIdentity: currentIdentity
-            )
-
-            if content.hasPrefix("verify:") {
-                return
-            }
-
-            if content.hasPrefix("bitchat1:") {
-                let packet: BitchatPacket? = await MainActor.run {
-                    Self.decodeEmbeddedBitChatPacket(from: content)
-                }
-                guard let packet else {
-                    SecureLogger.error("Failed to decode embedded BitChat packet from Nostr DM", category: .session)
-                    return
-                }
-
-                let actualSenderNoiseKey: Data? = await MainActor.run {
-                    self.findNoiseKey(for: senderPubkey)
-                }
-                let targetPeerID = PeerID(str: actualSenderNoiseKey?.hexEncodedString()) ?? PeerID(nostr_: senderPubkey)
-
-                if packet.type == MessageType.noiseEncrypted.rawValue,
-                   let payload = NoisePayload.decode(packet.payload) {
-                    let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTimestamp))
-                    await MainActor.run {
-                        viewModel.nostrKeyMapping[targetPeerID] = senderPubkey
-
-                        switch payload.type {
-                        case .privateMessage:
-                            viewModel.handlePrivateMessage(
-                                payload,
-                                senderPubkey: senderPubkey,
-                                convKey: targetPeerID,
-                                id: currentIdentity,
-                                messageTimestamp: messageTimestamp
-                            )
-                        case .delivered:
-                            viewModel.handleDelivered(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
-                        case .readReceipt:
-                            viewModel.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
-                        case .verifyChallenge, .verifyResponse:
-                            break
-                        }
-                    }
-                }
-            } else {
-                SecureLogger.debug("Ignoring non-embedded Nostr DM content", category: .session)
-            }
-        } catch {
-            SecureLogger.error("Failed to decrypt Nostr message: \(error)", category: .session)
-        }
-    }
-
-    @MainActor
-    func findNoiseKey(for nostrPubkey: String) -> Data? {
-        let favorites = FavoritesPersistenceService.shared.favorites.values
-        var npubToMatch = nostrPubkey
-
-        if !nostrPubkey.hasPrefix("npub") {
-            if let pubkeyData = Data(hexString: nostrPubkey),
-               let encoded = try? Bech32.encode(hrp: "npub", data: pubkeyData) {
-                npubToMatch = encoded
-            } else {
-                SecureLogger.warning(
-                    "⚠️ Invalid hex public key format or encoding failed: \(nostrPubkey.prefix(16))...",
-                    category: .session
-                )
-            }
-        }
-
-        for relationship in favorites {
-            if let storedNostrKey = relationship.peerNostrPublicKey {
-                if storedNostrKey == npubToMatch {
-                    return relationship.peerNoisePublicKey
-                }
-                if !storedNostrKey.hasPrefix("npub") && storedNostrKey == nostrPubkey {
-                    SecureLogger.debug("✅ Found Noise key for Nostr sender (hex match)", category: .session)
-                    return relationship.peerNoisePublicKey
-                }
-            }
-        }
-
-        SecureLogger.debug(
-            "⚠️ No matching Noise key found for Nostr pubkey: \(nostrPubkey.prefix(16))... (tried npub: \(npubToMatch.prefix(16))...)",
-            category: .session
-        )
-        return nil
+    private weak var context: (any ChatNostrContext)?
+    let presence: GeoPresenceTracker
+    let inbound: NostrInboundPipeline
+    let subscriptions: GeohashSubscriptionManager
+
+    init(context: any ChatNostrContext) {
+        self.context = context
+        let presence = GeoPresenceTracker(context: context)
+        let inbound = NostrInboundPipeline(context: context, presence: presence)
+        self.presence = presence
+        self.inbound = inbound
+        self.subscriptions = GeohashSubscriptionManager(context: context, inbound: inbound, presence: presence)
     }
 
     @MainActor
@@ -711,33 +66,26 @@ final class ChatNostrCoordinator {
         senderPubkey: String,
         key: Data?
     ) {
-        if let _ = key {
-            if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
-                let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-                transport.senderPeerID = viewModel.meshService.myPeerID
-                transport.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: identity)
+        guard let context else { return }
+        if key != nil {
+            if let identity = context.currentNostrIdentity() {
+                context.sendGeohashDeliveryAck(for: message.id, toRecipientHex: senderPubkey, from: identity)
             }
-        } else if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
-            let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-            transport.senderPeerID = viewModel.meshService.myPeerID
-            transport.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: identity)
+        } else if let identity = context.currentNostrIdentity() {
+            context.sendGeohashDeliveryAck(for: message.id, toRecipientHex: senderPubkey, from: identity)
             SecureLogger.debug(
                 "Sent DELIVERED ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…",
                 category: .session
             )
         }
 
-        if !wasReadBefore && viewModel.selectedPrivateChatPeer == message.senderPeerID {
-            if let _ = key {
-                if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
-                    let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-                    transport.senderPeerID = viewModel.meshService.myPeerID
-                    transport.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: identity)
+        if !wasReadBefore && context.selectedPrivateChatPeer == message.senderPeerID {
+            if key != nil {
+                if let identity = context.currentNostrIdentity() {
+                    context.sendGeohashReadReceipt(message.id, toRecipientHex: senderPubkey, from: identity)
                 }
-            } else if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
-                let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
-                transport.senderPeerID = viewModel.meshService.myPeerID
-                transport.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: identity)
+            } else if let identity = context.currentNostrIdentity() {
+                context.sendGeohashReadReceipt(message.id, toRecipientHex: senderPubkey, from: identity)
                 SecureLogger.debug(
                     "Viewing chat; sent READ ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…",
                     category: .session
@@ -746,74 +94,26 @@ final class ChatNostrCoordinator {
         }
     }
 
-    @MainActor
-    func handleFavoriteNotification(content: String, from nostrPubkey: String) {
-        guard let senderNoiseKey = findNoiseKey(for: nostrPubkey) else { return }
-
-        let isFavorite = content.contains("FAVORITE:TRUE")
-        let senderNickname = content.components(separatedBy: "|").last ?? "Unknown"
-
-        if isFavorite {
-            FavoritesPersistenceService.shared.addFavorite(
-                peerNoisePublicKey: senderNoiseKey,
-                peerNostrPublicKey: nostrPubkey,
-                peerNickname: senderNickname
-            )
-        }
-
-        var extractedNostrPubkey: String?
-        if let range = content.range(of: "NPUB:") {
-            let suffix = content[range.upperBound...]
-            let parts = suffix.components(separatedBy: "|")
-            if let key = parts.first {
-                extractedNostrPubkey = String(key)
-            }
-        } else if content.contains(":") {
-            let parts = content.components(separatedBy: ":")
-            if parts.count >= 3 {
-                extractedNostrPubkey = String(parts[2])
-            }
-        }
-
-        SecureLogger.info("📝 Received favorite notification from \(senderNickname): \(isFavorite)", category: .session)
-
-        if isFavorite && extractedNostrPubkey != nil {
-            SecureLogger.info(
-                "💾 Storing Nostr key association for \(senderNickname): \(extractedNostrPubkey!.prefix(16))...",
-                category: .session
-            )
-            FavoritesPersistenceService.shared.addFavorite(
-                peerNoisePublicKey: senderNoiseKey,
-                peerNostrPublicKey: extractedNostrPubkey,
-                peerNickname: senderNickname
-            )
-        }
-
-        NotificationService.shared.sendLocalNotification(
-            title: isFavorite ? "New Favorite" : "Favorite Removed",
-            body: "\(senderNickname) \(isFavorite ? "favorited" : "unfavorited") you",
-            identifier: "fav-\(UUID().uuidString)"
-        )
-    }
-
     @MainActor
     func sendFavoriteNotificationViaNostr(noisePublicKey: Data, isFavorite: Bool) {
-        guard let relationship = FavoritesPersistenceService.shared.getFavoriteStatus(for: noisePublicKey),
+        guard let context else { return }
+        guard let relationship = context.favoriteRelationship(forNoiseKey: noisePublicKey),
               relationship.peerNostrPublicKey != nil else {
             SecureLogger.warning("⚠️ Cannot send favorite notification - no Nostr key for peer", category: .session)
             return
         }
 
         let peerID = PeerID(hexData: noisePublicKey)
-        viewModel.messageRouter.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
+        context.routeFavoriteNotification(to: peerID, isFavorite: isFavorite)
     }
 
     @MainActor
     func nostrPubkeyForDisplayName(_ name: String) -> String? {
-        for person in viewModel.visibleGeohashPeople() where person.displayName == name {
+        guard let context else { return nil }
+        for person in context.visibleGeohashPeople() where person.displayName == name {
             return person.id
         }
-        for (pub, nick) in viewModel.geoNicknames where nick == name {
+        for (pub, nick) in context.geoNicknames where nick == name {
             return pub
         }
         return nil
@@ -821,38 +121,24 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func startGeohashDM(withPubkeyHex hex: String) {
+        guard let context else { return }
         let convKey = PeerID(nostr_: hex)
-        viewModel.nostrKeyMapping[convKey] = hex
-        viewModel.startPrivateChat(with: convKey)
+        context.registerNostrKeyMapping(hex, for: convKey)
+        context.startPrivateChat(with: convKey)
     }
 
     @MainActor
     func fullNostrHex(forSenderPeerID senderID: PeerID) -> String? {
-        viewModel.nostrKeyMapping[senderID]
+        guard let context else { return nil }
+        return context.nostrKeyMapping[senderID]
     }
 
     @MainActor
     func geohashDisplayName(for convKey: PeerID) -> String {
-        guard let full = viewModel.nostrKeyMapping[convKey] else {
+        guard let context else { return convKey.bare }
+        guard let full = context.nostrKeyMapping[convKey] else {
             return convKey.bare
         }
-        return viewModel.displayNameForNostrPubkey(full)
-    }
-}
-
-private extension ChatNostrCoordinator {
-    @MainActor
-    static func decodeEmbeddedBitChatPacket(from content: String) -> BitchatPacket? {
-        guard content.hasPrefix("bitchat1:") else { return nil }
-        let encoded = String(content.dropFirst("bitchat1:".count))
-        let maxBytes = FileTransferLimits.maxFramedFileBytes
-        let maxEncoded = ((maxBytes + 2) / 3) * 4
-        guard encoded.count <= maxEncoded else { return nil }
-        guard let packetData = Base64URLCoding.decode(encoded),
-              packetData.count <= maxBytes
-        else {
-            return nil
-        }
-        return BitchatPacket.from(packetData)
+        return context.displayNameForNostrPubkey(full)
     }
 }

bitchat/ViewModels/ChatOutgoingCoordinator.swift

@@ -2,34 +2,96 @@ import BitFoundation
 import BitLogger
 import Foundation
 
+/// The narrow surface `ChatOutgoingCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding an `unowned` back-ref
+/// to the whole `ChatViewModel`. This keeps the coordinator independently
+/// testable (see `ChatOutgoingCoordinatorContextTests`) and makes its true
+/// dependencies explicit.
+@MainActor
+protocol ChatOutgoingContext: AnyObject {
+    // MARK: Identity & channel state
+    var nickname: String { get }
+    var myPeerID: PeerID { get }
+    var activeChannel: ChannelID { get }
+    var selectedPrivateChatPeer: PeerID? { get }
+    var isTeleported: Bool { get }
+
+    // MARK: Commands & private messages
+    func handleCommand(_ command: String)
+    func updatePrivateChatPeerIfNeeded()
+    func sendPrivateMessage(_ content: String, to peerID: PeerID)
+
+    // MARK: Public timeline (local echo)
+    func parseMentions(from content: String) -> [String]
+    /// Appends a public message via the single-writer store intent
+    /// (immediate: the local echo must render without batching).
+    @discardableResult
+    func appendPublicMessage(_ message: BitchatMessage, to conversationID: ConversationID) -> Bool
+    func addSystemMessage(_ content: String)
+
+    // MARK: Content dedup
+    func normalizedContentKey(_ content: String) -> String
+    func recordContentKey(_ key: String, timestamp: Date)
+
+    // MARK: Outbound routing
+    /// Stamps "now" as the channel's last public activity (background nudges).
+    /// (Single mutation path for the owner's `lastPublicActivityAt`; this
+    /// coordinator never reads it.)
+    func recordPublicActivity(forChannelKey key: String)
+    func sendMeshMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date)
+    func sendGeohash(context: ChatViewModel.GeoOutgoingContext)
+
+    // MARK: Geohash identity (shared with the other contexts)
+    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
+}
+
+extension ChatViewModel: ChatOutgoingContext {
+    // `nickname`, `myPeerID`, `activeChannel`, `selectedPrivateChatPeer`,
+    // `isTeleported`, `handleCommand(_:)`, `updatePrivateChatPeerIfNeeded()`,
+    // `sendPrivateMessage(_:to:)`, `parseMentions(from:)`,
+    // `appendPublicMessage(_:to:)`, `addSystemMessage(_:)`,
+    // `normalizedContentKey(_:)`, `recordContentKey(_:timestamp:)`,
+    // `sendMeshMessage(_:mentions:messageID:timestamp:)`,
+    // `sendGeohash(context:)`, and `deriveNostrIdentity(forGeohash:)` are
+    // shared requirements with the other contexts or satisfied by existing
+    // `ChatViewModel` members. The single-writer intent op below lives next to
+    // its backing state's owner.
+
+    func recordPublicActivity(forChannelKey key: String) {
+        lastPublicActivityAt[key] = Date()
+    }
+}
+
 @MainActor
 final class ChatOutgoingCoordinator {
-    private unowned let viewModel: ChatViewModel
+    private unowned let context: any ChatOutgoingContext
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    init(context: any ChatOutgoingContext) {
+        self.context = context
     }
 
     func sendMessage(_ content: String) {
         guard let trimmed = content.trimmedOrNilIfEmpty else { return }
 
         if content.hasPrefix("/") {
-            Task { @MainActor [weak viewModel] in
-                viewModel?.handleCommand(content)
+            Task { @MainActor [weak context = self.context] in
+                context?.handleCommand(content)
             }
             return
         }
 
-        if viewModel.selectedPrivateChatPeer != nil {
-            viewModel.updatePrivateChatPeerIfNeeded()
+        if context.selectedPrivateChatPeer != nil {
+            context.updatePrivateChatPeerIfNeeded()
 
-            if let selectedPeer = viewModel.selectedPrivateChatPeer {
-                viewModel.sendPrivateMessage(content, to: selectedPeer)
+            if let selectedPeer = context.selectedPrivateChatPeer {
+                context.sendPrivateMessage(content, to: selectedPeer)
             }
             return
         }
 
-        let mentions = viewModel.parseMentions(from: content)
+        let mentions = context.parseMentions(from: content)
         let preparedMessage = preparePublicMessage(content: content, trimmed: trimmed, mentions: mentions)
         guard let preparedMessage else { return }
 
@@ -51,28 +113,28 @@ private extension ChatOutgoingCoordinator {
         mentions: [String]
     ) -> (message: BitchatMessage, geoContext: ChatViewModel.GeoOutgoingContext?)? {
         var geoContext: ChatViewModel.GeoOutgoingContext?
-        var displaySender = viewModel.nickname
-        var localSenderPeerID = viewModel.meshService.myPeerID
+        var displaySender = context.nickname
+        var localSenderPeerID = context.myPeerID
         var messageID: String?
         var messageTimestamp = Date()
 
-        switch viewModel.activeChannel {
+        switch context.activeChannel {
         case .mesh:
             break
 
         case .location(let channel):
             do {
-                let identity = try viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash)
+                let identity = try context.deriveNostrIdentity(forGeohash: channel.geohash)
                 let suffix = String(identity.publicKeyHex.suffix(4))
-                displaySender = viewModel.nickname + "#" + suffix
+                displaySender = context.nickname + "#" + suffix
                 localSenderPeerID = PeerID(nostr: identity.publicKeyHex)
 
-                let teleported = viewModel.locationManager.teleported
+                let teleported = context.isTeleported
                 let event = try NostrProtocol.createEphemeralGeohashEvent(
                     content: trimmed,
                     geohash: channel.geohash,
                     senderIdentity: identity,
-                    nickname: viewModel.nickname,
+                    nickname: context.nickname,
                     teleported: teleported
                 )
 
@@ -86,7 +148,7 @@ private extension ChatOutgoingCoordinator {
                 )
             } catch {
                 SecureLogger.error("❌ Failed to prepare geohash message: \(error)", category: .session)
-                viewModel.addSystemMessage(
+                context.addSystemMessage(
                     String(localized: "system.location.send_failed", comment: "System message when a location channel send fails")
                 )
                 return nil
@@ -107,12 +169,10 @@ private extension ChatOutgoingCoordinator {
     }
 
     func appendLocalEcho(_ message: BitchatMessage) {
-        viewModel.timelineStore.append(message, to: viewModel.activeChannel)
-        viewModel.refreshVisibleMessages(from: viewModel.activeChannel)
+        context.appendPublicMessage(message, to: ConversationID(channelID: context.activeChannel))
 
-        let contentKey = viewModel.deduplicationService.normalizedContentKey(message.content)
-        viewModel.deduplicationService.recordContentKey(contentKey, timestamp: message.timestamp)
-        viewModel.trimMessagesIfNeeded()
+        let contentKey = context.normalizedContentKey(message.content)
+        context.recordContentKey(contentKey, timestamp: message.timestamp)
     }
 
     func routePublicMessage(
@@ -122,10 +182,10 @@ private extension ChatOutgoingCoordinator {
         messageID: String,
         timestamp: Date
     ) {
-        switch viewModel.activeChannel {
+        switch context.activeChannel {
         case .mesh:
-            viewModel.lastPublicActivityAt["mesh"] = Date()
-            viewModel.meshService.sendMessage(
+            context.recordPublicActivity(forChannelKey: "mesh")
+            context.sendMeshMessage(
                 originalContent,
                 mentions: mentions,
                 messageID: messageID,
@@ -133,18 +193,18 @@ private extension ChatOutgoingCoordinator {
             )
 
         case .location(let channel):
-            viewModel.lastPublicActivityAt["geo:\(channel.geohash)"] = Date()
+            context.recordPublicActivity(forChannelKey: "geo:\(channel.geohash)")
 
             guard let geoContext, geoContext.channel.geohash == channel.geohash else {
                 SecureLogger.error("Geo: missing send context for \(channel.geohash)", category: .session)
-                viewModel.addSystemMessage(
+                context.addSystemMessage(
                     String(localized: "system.location.send_failed", comment: "System message when a location channel send fails")
                 )
                 return
             }
 
-            Task { @MainActor [weak viewModel] in
-                viewModel?.sendGeohash(context: geoContext)
+            Task { @MainActor [weak context = self.context] in
+                context?.sendGeohash(context: geoContext)
             }
         }
     }

bitchat/ViewModels/ChatPeerIdentityCoordinator.swift

@@ -3,24 +3,247 @@ import BitLogger
 import CoreBluetooth
 import Foundation
 
-final class ChatPeerIdentityCoordinator {
-    private unowned let viewModel: ChatViewModel
+/// The narrow surface `ChatPeerIdentityCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding an `unowned` back-ref
+/// to the whole `ChatViewModel`. This keeps the coordinator independently
+/// testable (see `ChatPeerIdentityCoordinatorContextTests`) and makes its true
+/// dependencies explicit. Several members are flattened service accesses —
+/// this coordinator implements the `ChatViewModel`-level peer-identity API, so
+/// its context members deliberately sit one level below those wrappers
+/// (`unifiedIsBlocked(_:)` vs `isPeerBlocked(_:)`, `unifiedFingerprint(for:)`
+/// vs `getFingerprint(for:)`, …) to avoid call cycles.
+@MainActor
+protocol ChatPeerIdentityContext: AnyObject {
+    // MARK: Conversation state
+    var privateChats: [PeerID: [BitchatMessage]] { get }
+    /// A single private chat's timeline. Witnessed by the store-direct
+    /// lookup on `ChatViewModel` (no `privateChats` dictionary build).
+    func privateMessages(for peerID: PeerID) -> [BitchatMessage]
+    var unreadPrivateMessages: Set<PeerID> { get }
+    /// Clears the peer's unread flag (single-writer store intent).
+    func markPrivateChatRead(_ peerID: PeerID)
+    /// Moves all messages from `oldPeerID`'s chat into `newPeerID`'s chat
+    /// (dedup by ID, order preserved, unread carried, old chat removed).
+    func migratePrivateChat(from oldPeerID: PeerID, to newPeerID: PeerID)
+    var selectedPrivateChatPeer: PeerID? { get set }
+    var selectedPrivateChatFingerprint: String? { get set }
+    var nickname: String { get }
+    var myPeerID: PeerID { get }
+    var activeChannel: ChannelID { get }
+    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
+    func notifyUIChanged()
+    func addSystemMessage(_ content: String)
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    // MARK: Private chat session lifecycle
+    /// Merges messages stored under alternate peer-ID representations into `peerID`'s chat.
+    /// Returns `true` when unread messages were discovered during consolidation.
+    @discardableResult
+    func consolidatePrivateMessages(for peerID: PeerID, peerNickname: String) -> Bool
+    /// Marks read receipts as sent for own messages already delivered/read in
+    /// `peerID`'s chat. (Single mutation path into the owner's
+    /// `sentReadReceipts`; this coordinator never touches the raw set.)
+    func syncReadReceiptsForSentMessages(for peerID: PeerID)
+    /// Re-targets the private chat session: selection mutates through the
+    /// `ConversationStore` intent (the store owns selection).
+    func beginPrivateChatSession(with peerID: PeerID)
+    func markPrivateMessagesAsRead(from peerID: PeerID)
+
+    // MARK: Unified peer service
+    var connectedPeers: Set<PeerID> { get }
+    /// The peer's current entry in the unified peer service, if known.
+    func unifiedPeer(for peerID: PeerID) -> BitchatPeer?
+    func unifiedIsBlocked(_ peerID: PeerID) -> Bool
+    func unifiedToggleFavorite(_ peerID: PeerID)
+    func unifiedFingerprint(for peerID: PeerID) -> String?
+    func unifiedPeerID(forNickname nickname: String) -> PeerID?
+    /// Resolves the ephemeral (short) peer ID for a known Noise public key, if connected.
+    func ephemeralPeerID(forNoiseKey noiseKey: Data) -> PeerID?
+
+    // MARK: Mesh & Noise sessions
+    func peerNickname(for peerID: PeerID) -> String?
+    func meshPeerNicknames() -> [PeerID: String]
+    func noiseSessionState(for peerID: PeerID) -> LazyHandshakeState
+    func triggerHandshake(with peerID: PeerID)
+    func hasEstablishedNoiseSession(with peerID: PeerID) -> Bool
+    func hasNoiseSession(with peerID: PeerID) -> Bool
+    /// Our own Noise identity fingerprint.
+    func noiseIdentityFingerprint() -> String
+
+    // MARK: Identity store (fingerprints & encryption status)
+    func setStoredFingerprint(_ fingerprint: String, for peerID: PeerID)
+    /// Moves the stored fingerprint mapping from `oldPeerID` to `newPeerID`,
+    /// falling back to `fallback` when none was stored. Returns the migrated fingerprint.
+    func migrateFingerprintMapping(from oldPeerID: PeerID, to newPeerID: PeerID, fallback: String?) -> String?
+    func isVerifiedFingerprint(_ fingerprint: String) -> Bool
+    func setEncryptionStatus(_ status: EncryptionStatus?, for peerID: PeerID)
+    func cachedEncryptionStatus(for peerID: PeerID) -> EncryptionStatus?
+    func setCachedEncryptionStatus(_ status: EncryptionStatus, for peerID: PeerID)
+    func invalidateStoredEncryptionCache(for peerID: PeerID?)
+    func socialIdentity(forFingerprint fingerprint: String) -> SocialIdentity?
+
+    // MARK: Favorites
+    /// The persisted favorite relationship for the peer's Noise static key, if any.
+    func favoriteRelationship(forNoiseKey noiseKey: Data) -> FavoritesPersistenceService.FavoriteRelationship?
+    /// The persisted favorite relationship for a short (ephemeral) peer ID, if any.
+    func favoriteRelationship(forPeerID peerID: PeerID) -> FavoritesPersistenceService.FavoriteRelationship?
+    /// Adds (or updates) a favorite in the favorites store.
+    func addFavorite(noiseKey: Data, nostrPublicKey: String?, nickname: String)
+    /// Removes a favorite from the favorites store.
+    func removeFavorite(noiseKey: Data)
+
+    // MARK: Geohash & Nostr
+    var geoNicknames: [String: String] { get }
+    func visibleGeohashPeople() -> [GeoPerson]
+    /// Records the Nostr pubkey behind a (possibly virtual) peer ID.
+    func registerNostrKeyMapping(_ pubkey: String, for peerID: PeerID)
+    func bridgedNostrPublicKey(for noiseKey: Data) -> String?
+    func sendFavoriteNotificationViaNostr(noisePublicKey: Data, isFavorite: Bool)
+}
+
+extension ChatViewModel: ChatPeerIdentityContext {
+    // `privateChats`, `unreadPrivateMessages`, `selectedPrivateChatPeer`,
+    // `selectedPrivateChatFingerprint`, `nickname`, `myPeerID`,
+    // `activeChannel`, `connectedPeers`, `geoNicknames`, `notifyUIChanged()`,
+    // `addSystemMessage(_:)`, `peerNickname(for:)`, `meshPeerNicknames()`,
+    // `ephemeralPeerID(forNoiseKey:)`, `unifiedPeer(for:)`,
+    // `registerNostrKeyMapping(_:for:)`, `visibleGeohashPeople()`,
+    // `markPrivateMessagesAsRead(from:)`, `sendFavoriteNotificationViaNostr`,
+    // and the conversation-store sync methods are shared requirements with
+    // the other contexts or satisfied by existing `ChatViewModel` members.
+    // The single-writer intent op `syncReadReceiptsForSentMessages(for:)`
+    // lives next to its backing state in `ChatViewModel`. The members below
+    // flatten nested service accesses into intent-named calls.
+
+    @discardableResult
+    func consolidatePrivateMessages(for peerID: PeerID, peerNickname: String) -> Bool {
+        privateChatManager.consolidateMessages(
+            for: peerID,
+            peerNickname: peerNickname,
+            persistedReadReceipts: sentReadReceipts
+        )
+    }
+
+    func beginPrivateChatSession(with peerID: PeerID) {
+        privateChatManager.startChat(with: peerID)
+    }
+
+    func unifiedIsBlocked(_ peerID: PeerID) -> Bool {
+        unifiedPeerService.isBlocked(peerID)
+    }
+
+    func unifiedToggleFavorite(_ peerID: PeerID) {
+        unifiedPeerService.toggleFavorite(peerID)
+    }
+
+    func unifiedFingerprint(for peerID: PeerID) -> String? {
+        unifiedPeerService.getFingerprint(for: peerID)
+    }
+
+    func unifiedPeerID(forNickname nickname: String) -> PeerID? {
+        unifiedPeerService.getPeerID(for: nickname)
+    }
+
+    func noiseSessionState(for peerID: PeerID) -> LazyHandshakeState {
+        meshService.getNoiseSessionState(for: peerID)
+    }
+
+    func triggerHandshake(with peerID: PeerID) {
+        meshService.triggerHandshake(with: peerID)
+    }
+
+    func hasEstablishedNoiseSession(with peerID: PeerID) -> Bool {
+        if case .established = meshService.getNoiseSessionState(for: peerID) { return true }
+        return false
+    }
+
+    func hasNoiseSession(with peerID: PeerID) -> Bool {
+        switch meshService.getNoiseSessionState(for: peerID) {
+        case .established, .handshaking: return true
+        case .none, .handshakeQueued, .failed: return false
+        }
+    }
+
+    func noiseIdentityFingerprint() -> String {
+        meshService.noiseIdentityFingerprint()
+    }
+
+    func setStoredFingerprint(_ fingerprint: String, for peerID: PeerID) {
+        peerIdentityStore.setFingerprint(fingerprint, for: peerID)
+    }
+
+    func migrateFingerprintMapping(from oldPeerID: PeerID, to newPeerID: PeerID, fallback: String?) -> String? {
+        peerIdentityStore.migrateFingerprintMapping(from: oldPeerID, to: newPeerID, fallback: fallback)
+    }
+
+    func isVerifiedFingerprint(_ fingerprint: String) -> Bool {
+        peerIdentityStore.isVerified(fingerprint)
+    }
+
+    func setEncryptionStatus(_ status: EncryptionStatus?, for peerID: PeerID) {
+        peerIdentityStore.setEncryptionStatus(status, for: peerID)
+    }
+
+    func cachedEncryptionStatus(for peerID: PeerID) -> EncryptionStatus? {
+        peerIdentityStore.cachedEncryptionStatus(for: peerID)
+    }
+
+    func setCachedEncryptionStatus(_ status: EncryptionStatus, for peerID: PeerID) {
+        peerIdentityStore.setCachedEncryptionStatus(status, for: peerID)
+    }
+
+    func invalidateStoredEncryptionCache(for peerID: PeerID?) {
+        peerIdentityStore.invalidateEncryptionCache(for: peerID)
+    }
+
+    func socialIdentity(forFingerprint fingerprint: String) -> SocialIdentity? {
+        identityManager.getSocialIdentity(for: fingerprint)
+    }
+
+    func bridgedNostrPublicKey(for noiseKey: Data) -> String? {
+        idBridge.getNostrPublicKey(for: noiseKey)
+    }
+
+    // `favoriteRelationship(forNoiseKey:)` is shared with
+    // `ChatPrivateConversationContext`; its witness lives in
+    // `ChatPrivateConversationCoordinator.swift`.
+
+    func favoriteRelationship(forPeerID peerID: PeerID) -> FavoritesPersistenceService.FavoriteRelationship? {
+        FavoritesPersistenceService.shared.getFavoriteStatus(forPeerID: peerID)
+    }
+
+    func addFavorite(noiseKey: Data, nostrPublicKey: String?, nickname: String) {
+        FavoritesPersistenceService.shared.addFavorite(
+            peerNoisePublicKey: noiseKey,
+            peerNostrPublicKey: nostrPublicKey,
+            peerNickname: nickname
+        )
+    }
+
+    func removeFavorite(noiseKey: Data) {
+        FavoritesPersistenceService.shared.removeFavorite(peerNoisePublicKey: noiseKey)
+    }
+}
+
+final class ChatPeerIdentityCoordinator {
+    private unowned let context: any ChatPeerIdentityContext
+
+    init(context: any ChatPeerIdentityContext) {
+        self.context = context
     }
 
     @MainActor
     func openMostRelevantPrivateChat() {
-        let unreadSorted = viewModel.unreadPrivateMessages
-            .map { ($0, viewModel.privateChats[$0]?.last?.timestamp ?? Date.distantPast) }
+        let unreadSorted = context.unreadPrivateMessages
+            .map { ($0, context.privateMessages(for: $0).last?.timestamp ?? Date.distantPast) }
             .sorted { $0.1 > $1.1 }
         if let target = unreadSorted.first?.0 {
             startPrivateChat(with: target)
             return
         }
 
-        let recent = viewModel.privateChats
+        let recent = context.privateChats
             .map { (id: $0.key, ts: $0.value.last?.timestamp ?? Date.distantPast) }
             .sorted { $0.ts > $1.ts }
         if let target = recent.first?.id {
@@ -30,7 +253,7 @@ final class ChatPeerIdentityCoordinator {
 
     @MainActor
     func isPeerBlocked(_ peerID: PeerID) -> Bool {
-        viewModel.unifiedPeerService.isBlocked(peerID)
+        context.unifiedIsBlocked(peerID)
     }
 
     @MainActor
@@ -38,24 +261,24 @@ final class ChatPeerIdentityCoordinator {
         var noiseKeyPeerID: PeerID?
         var nostrPeerID: PeerID?
 
-        if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
+        if let peer = context.unifiedPeer(for: peerID) {
             noiseKeyPeerID = PeerID(hexData: peer.noisePublicKey)
             if let nostrHex = peer.nostrPublicKey {
                 nostrPeerID = PeerID(nostr_: nostrHex)
             }
         }
 
-        let context = ChatUnreadPeerContext(
+        let unreadContext = ChatUnreadPeerContext(
             peerID: peerID,
             noiseKeyPeerID: noiseKeyPeerID,
             nostrPeerID: nostrPeerID,
-            nickname: viewModel.meshService.peerNickname(peerID: peerID)
+            nickname: context.peerNickname(for: peerID)
         )
 
         return ChatUnreadStateResolver.hasUnreadMessages(
-            for: context,
-            unreadPrivateMessages: viewModel.unreadPrivateMessages,
-            privateChats: viewModel.privateChats
+            for: unreadContext,
+            unreadPrivateMessages: context.unreadPrivateMessages,
+            privateChats: context.privateChats
         )
     }
 
@@ -66,46 +289,44 @@ final class ChatPeerIdentityCoordinator {
             return
         }
 
-        viewModel.unifiedPeerService.toggleFavorite(peerID)
-        viewModel.objectWillChange.send()
+        context.unifiedToggleFavorite(peerID)
+        context.notifyUIChanged()
     }
 
     @MainActor
     func isFavorite(peerID: PeerID) -> Bool {
         if let noisePublicKey = peerID.noiseKey {
-            return FavoritesPersistenceService.shared.getFavoriteStatus(for: noisePublicKey)?.isFavorite ?? false
+            return context.favoriteRelationship(forNoiseKey: noisePublicKey)?.isFavorite ?? false
         }
 
-        return viewModel.unifiedPeerService.getPeer(by: peerID)?.isFavorite ?? false
+        return context.unifiedPeer(for: peerID)?.isFavorite ?? false
     }
 
     @MainActor
     func updatePrivateChatPeerIfNeeded() {
-        guard let chatFingerprint = viewModel.selectedPrivateChatFingerprint,
+        guard let chatFingerprint = context.selectedPrivateChatFingerprint,
               let currentPeerID = currentPeerID(forFingerprint: chatFingerprint) else {
             return
         }
 
-        if let oldPeerID = viewModel.selectedPrivateChatPeer, oldPeerID != currentPeerID {
+        if let oldPeerID = context.selectedPrivateChatPeer, oldPeerID != currentPeerID {
             migrateChatState(from: oldPeerID, to: currentPeerID)
-            viewModel.selectedPrivateChatPeer = currentPeerID
-        } else if viewModel.selectedPrivateChatPeer == nil {
-            viewModel.selectedPrivateChatPeer = currentPeerID
+            context.selectedPrivateChatPeer = currentPeerID
+        } else if context.selectedPrivateChatPeer == nil {
+            context.selectedPrivateChatPeer = currentPeerID
         }
 
-        var unread = viewModel.unreadPrivateMessages
-        unread.remove(currentPeerID)
-        viewModel.unreadPrivateMessages = unread
+        context.markPrivateChatRead(currentPeerID)
     }
 
     @MainActor
     func startPrivateChat(with peerID: PeerID) {
-        guard peerID != viewModel.meshService.myPeerID else { return }
+        guard peerID != context.myPeerID else { return }
 
-        let peerNickname = viewModel.meshService.peerNickname(peerID: peerID) ?? "unknown"
+        let peerNickname = context.peerNickname(for: peerID) ?? "unknown"
 
-        if viewModel.unifiedPeerService.isBlocked(peerID) {
-            viewModel.addSystemMessage(
+        if context.unifiedIsBlocked(peerID) {
+            context.addSystemMessage(
                 String(
                     format: String(
                         localized: "system.chat.blocked",
@@ -118,9 +339,9 @@ final class ChatPeerIdentityCoordinator {
             return
         }
 
-        if let peer = viewModel.unifiedPeerService.getPeer(by: peerID),
+        if let peer = context.unifiedPeer(for: peerID),
            peer.isFavorite && !peer.theyFavoritedUs && !peer.isConnected {
-            viewModel.addSystemMessage(
+            context.addSystemMessage(
                 String(
                     format: String(
                         localized: "system.chat.requires_favorite",
@@ -133,16 +354,12 @@ final class ChatPeerIdentityCoordinator {
             return
         }
 
-        _ = viewModel.privateChatManager.consolidateMessages(
-            for: peerID,
-            peerNickname: peerNickname,
-            persistedReadReceipts: viewModel.sentReadReceipts
-        )
+        _ = context.consolidatePrivateMessages(for: peerID, peerNickname: peerNickname)
 
         if !peerID.isGeoDM && !peerID.isGeoChat {
-            switch viewModel.meshService.getNoiseSessionState(for: peerID) {
+            switch context.noiseSessionState(for: peerID) {
             case .none, .failed:
-                viewModel.meshService.triggerHandshake(with: peerID)
+                context.triggerHandshake(with: peerID)
             case .handshakeQueued, .handshaking, .established:
                 break
             }
@@ -150,28 +367,22 @@ final class ChatPeerIdentityCoordinator {
             SecureLogger.debug("GeoDM: skipping mesh handshake for virtual peerID=\(peerID)", category: .session)
         }
 
-        viewModel.privateChatManager.syncReadReceiptsForSentMessages(
-            peerID: peerID,
-            nickname: viewModel.nickname,
-            externalReceipts: &viewModel.sentReadReceipts
-        )
+        context.syncReadReceiptsForSentMessages(for: peerID)
 
         if let fingerprint = getFingerprint(for: peerID) {
-            viewModel.peerIdentityStore.setFingerprint(fingerprint, for: peerID)
-            viewModel.peerIdentityStore.setSelectedPrivateChatFingerprint(fingerprint)
+            context.setStoredFingerprint(fingerprint, for: peerID)
+            context.selectedPrivateChatFingerprint = fingerprint
         } else {
-            viewModel.peerIdentityStore.setSelectedPrivateChatFingerprint(nil)
+            context.selectedPrivateChatFingerprint = nil
         }
-        viewModel.privateChatManager.startChat(with: peerID)
-        viewModel.synchronizePrivateConversationStore()
-        viewModel.synchronizeConversationSelectionStore()
-        viewModel.markPrivateMessagesAsRead(from: peerID)
+        context.beginPrivateChatSession(with: peerID)
+        context.markPrivateMessagesAsRead(from: peerID)
     }
 
     @MainActor
     func endPrivateChat() {
-        viewModel.selectedPrivateChatPeer = nil
-        viewModel.peerIdentityStore.setSelectedPrivateChatFingerprint(nil)
+        context.selectedPrivateChatPeer = nil
+        context.selectedPrivateChatFingerprint = nil
     }
 
     @MainActor
@@ -182,8 +393,8 @@ final class ChatPeerIdentityCoordinator {
     func handleFavoriteStatusChanged(_ notification: Notification) {
         guard let peerPublicKey = notification.userInfo?["peerPublicKey"] as? Data else { return }
 
-        Task { @MainActor [weak viewModel] in
-            guard let viewModel else { return }
+        Task { @MainActor [weak context = self.context] in
+            guard let context else { return }
 
             if let isKeyUpdate = notification.userInfo?["isKeyUpdate"] as? Bool,
                isKeyUpdate,
@@ -200,28 +411,26 @@ final class ChatPeerIdentityCoordinator {
                 let peerID = PeerID(hexData: peerPublicKey)
                 let action = isFavorite ? "favorited" : "unfavorited"
                 let peerNickname = favoriteNotificationNickname(for: peerID, peerPublicKey: peerPublicKey)
-                viewModel.addSystemMessage("\(peerNickname) \(action) you")
+                context.addSystemMessage("\(peerNickname) \(action) you")
             }
         }
     }
 
     @MainActor
     func updateEncryptionStatusForPeers() {
-        for peerID in viewModel.connectedPeers {
+        for peerID in context.connectedPeers {
             updateEncryptionStatus(for: peerID)
         }
     }
 
     @MainActor
     func updateEncryptionStatus(for peerID: PeerID) {
-        let noiseService = viewModel.meshService.getNoiseService()
-
-        if noiseService.hasEstablishedSession(with: peerID) {
-            viewModel.peerIdentityStore.setEncryptionStatus(verifiedEncryptionStatus(for: peerID), for: peerID)
-        } else if noiseService.hasSession(with: peerID) {
-            viewModel.peerIdentityStore.setEncryptionStatus(.noiseHandshaking, for: peerID)
+        if context.hasEstablishedNoiseSession(with: peerID) {
+            context.setEncryptionStatus(verifiedEncryptionStatus(for: peerID), for: peerID)
+        } else if context.hasNoiseSession(with: peerID) {
+            context.setEncryptionStatus(.noiseHandshaking, for: peerID)
         } else {
-            viewModel.peerIdentityStore.setEncryptionStatus(nil, for: peerID)
+            context.setEncryptionStatus(nil, for: peerID)
         }
 
         invalidateEncryptionCache(for: peerID)
@@ -229,12 +438,12 @@ final class ChatPeerIdentityCoordinator {
 
     @MainActor
     func getEncryptionStatus(for peerID: PeerID) -> EncryptionStatus {
-        if let cachedStatus = viewModel.peerIdentityStore.cachedEncryptionStatus(for: peerID) {
+        if let cachedStatus = context.cachedEncryptionStatus(for: peerID) {
             return cachedStatus
         }
 
         let hasEverEstablishedSession = getFingerprint(for: peerID) != nil
-        let sessionState = viewModel.meshService.getNoiseSessionState(for: peerID)
+        let sessionState = context.noiseSessionState(for: peerID)
 
         let status: EncryptionStatus
         switch sessionState {
@@ -248,18 +457,18 @@ final class ChatPeerIdentityCoordinator {
             status = hasEverEstablishedSession ? verifiedEncryptionStatus(for: peerID) : .none
         }
 
-        viewModel.peerIdentityStore.setCachedEncryptionStatus(status, for: peerID)
+        context.setCachedEncryptionStatus(status, for: peerID)
         return status
     }
 
     @MainActor
     func invalidateEncryptionCache(for peerID: PeerID? = nil) {
-        viewModel.peerIdentityStore.invalidateEncryptionCache(for: peerID)
+        context.invalidateStoredEncryptionCache(for: peerID)
     }
 
     @MainActor
     func getFingerprint(for peerID: PeerID) -> String? {
-        viewModel.unifiedPeerService.getFingerprint(for: peerID)
+        context.unifiedFingerprint(for: peerID)
     }
 
     @MainActor
@@ -270,12 +479,12 @@ final class ChatPeerIdentityCoordinator {
             return peerID.id
         }
 
-        if let nickname = viewModel.meshService.getPeerNicknames()[peerID] {
+        if let nickname = context.meshPeerNicknames()[peerID] {
             return nickname
         }
 
         if let fingerprint = getFingerprint(for: peerID),
-           let identity = viewModel.identityManager.getSocialIdentity(for: fingerprint) {
+           let identity = context.socialIdentity(forFingerprint: fingerprint) {
             if let petname = identity.localPetname {
                 return petname
             }
@@ -289,19 +498,18 @@ final class ChatPeerIdentityCoordinator {
 
     @MainActor
     func getMyFingerprint() -> String {
-        viewModel.meshService.getNoiseService().getIdentityFingerprint()
+        context.noiseIdentityFingerprint()
     }
 
     @MainActor
     func getPeerIDForNickname(_ nickname: String) -> PeerID? {
-        switch viewModel.activeChannel {
+        switch context.activeChannel {
         case .location:
             if nickname.contains("#"),
-               let person = viewModel.publicConversationCoordinator
-                .visibleGeohashPeople()
+               let person = context.visibleGeohashPeople()
                 .first(where: { $0.displayName == nickname }) {
                 let conversationKey = PeerID(nostr_: person.id)
-                viewModel.nostrKeyMapping[conversationKey] = person.id
+                context.registerNostrKeyMapping(person.id, for: conversationKey)
                 return conversationKey
             }
 
@@ -310,9 +518,9 @@ final class ChatPeerIdentityCoordinator {
                 .first
                 .map(String.init)?
                 .lowercased() ?? nickname.lowercased()
-            if let pubkey = viewModel.geoNicknames.first(where: { $0.value.lowercased() == base })?.key {
+            if let pubkey = context.geoNicknames.first(where: { $0.value.lowercased() == base })?.key {
                 let conversationKey = PeerID(nostr_: pubkey)
-                viewModel.nostrKeyMapping[conversationKey] = pubkey
+                context.registerNostrKeyMapping(pubkey, for: conversationKey)
                 return conversationKey
             }
 
@@ -320,20 +528,20 @@ final class ChatPeerIdentityCoordinator {
             break
         }
 
-        return viewModel.unifiedPeerService.getPeerID(for: nickname)
+        return context.unifiedPeerID(forNickname: nickname)
     }
 
     @MainActor
     func nicknameForPeer(_ peerID: PeerID) -> String {
-        if let name = viewModel.meshService.peerNickname(peerID: peerID) {
+        if let name = context.peerNickname(for: peerID) {
             return name
         }
-        if let favorite = FavoritesPersistenceService.shared.getFavoriteStatus(forPeerID: peerID),
+        if let favorite = context.favoriteRelationship(forPeerID: peerID),
            !favorite.peerNickname.isEmpty {
             return favorite.peerNickname
         }
         if let noiseKey = Data(hexString: peerID.id),
-           let favorite = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey),
+           let favorite = context.favoriteRelationship(forNoiseKey: noiseKey),
            !favorite.peerNickname.isEmpty {
             return favorite.peerNickname
         }
@@ -344,7 +552,7 @@ final class ChatPeerIdentityCoordinator {
 private extension ChatPeerIdentityCoordinator {
     @MainActor
     func currentPeerID(forFingerprint fingerprint: String) -> PeerID? {
-        for peerID in viewModel.connectedPeers where getFingerprint(for: peerID) == fingerprint {
+        for peerID in context.connectedPeers where getFingerprint(for: peerID) == fingerprint {
             return peerID
         }
         return nil
@@ -352,63 +560,46 @@ private extension ChatPeerIdentityCoordinator {
 
     @MainActor
     func migrateChatState(from oldPeerID: PeerID, to newPeerID: PeerID) {
-        if let oldMessages = viewModel.privateChats[oldPeerID] {
-            var chats = viewModel.privateChats
-            chats[newPeerID, default: []].append(contentsOf: oldMessages)
-            chats[newPeerID]?.sort { $0.timestamp < $1.timestamp }
-
-            var seenMessageIDs = Set<String>()
-            chats[newPeerID] = chats[newPeerID]?.filter { message in
-                if seenMessageIDs.contains(message.id) {
-                    return false
-                }
-                seenMessageIDs.insert(message.id)
-                return true
-            }
-
-            chats.removeValue(forKey: oldPeerID)
-            viewModel.privateChats = chats
-        }
-
-        var unread = viewModel.unreadPrivateMessages
-        if unread.contains(oldPeerID) {
-            unread.remove(oldPeerID)
-            unread.insert(newPeerID)
-            viewModel.unreadPrivateMessages = unread
-        }
+        // The store migration dedups by message ID, preserves timestamp
+        // order, carries the unread flag, and removes the old chat.
+        context.migratePrivateChat(from: oldPeerID, to: newPeerID)
     }
 
     @MainActor
     func migrateNoiseKeyUpdate(oldPeerID: PeerID, newPeerID: PeerID) {
-        if viewModel.selectedPrivateChatPeer == oldPeerID {
+        // Capture before the migration: the store hands its selection off to
+        // `newPeerID` during `migrateChatState`, and the manager's selection
+        // mirrors the store, so the old peer ID is no longer selected after.
+        let wasSelected = context.selectedPrivateChatPeer == oldPeerID
+        if wasSelected {
             SecureLogger.info("📱 Updating private chat peer ID due to key change: \(oldPeerID) -> \(newPeerID)", category: .session)
-        } else if viewModel.privateChats[oldPeerID] != nil {
+        } else if !context.privateMessages(for: oldPeerID).isEmpty {
             SecureLogger.debug("📱 Migrating private chat messages from \(oldPeerID) to \(newPeerID)", category: .session)
         }
 
         migrateChatState(from: oldPeerID, to: newPeerID)
 
-        if viewModel.selectedPrivateChatPeer == oldPeerID {
-            viewModel.selectedPrivateChatPeer = newPeerID
+        if wasSelected {
+            context.selectedPrivateChatPeer = newPeerID
         }
 
-        if let fingerprint = viewModel.peerIdentityStore.migrateFingerprintMapping(
+        if let fingerprint = context.migrateFingerprintMapping(
             from: oldPeerID,
             to: newPeerID,
             fallback: getFingerprint(for: newPeerID)
         ) {
-            if viewModel.selectedPrivateChatPeer == newPeerID {
-                viewModel.peerIdentityStore.setSelectedPrivateChatFingerprint(fingerprint)
+            if context.selectedPrivateChatPeer == newPeerID {
+                context.selectedPrivateChatFingerprint = fingerprint
             }
         }
     }
 
     @MainActor
     func favoriteNotificationNickname(for peerID: PeerID, peerPublicKey: Data) -> String {
-        if let nickname = viewModel.meshService.peerNickname(peerID: peerID) {
+        if let nickname = context.peerNickname(for: peerID) {
             return nickname
         }
-        if let favorite = FavoritesPersistenceService.shared.getFavoriteStatus(for: peerPublicKey) {
+        if let favorite = context.favoriteRelationship(forNoiseKey: peerPublicKey) {
             return favorite.peerNickname
         }
         return "Unknown"
@@ -417,7 +608,7 @@ private extension ChatPeerIdentityCoordinator {
     @MainActor
     func verifiedEncryptionStatus(for peerID: PeerID) -> EncryptionStatus {
         if let fingerprint = getFingerprint(for: peerID),
-           viewModel.peerIdentityStore.isVerified(fingerprint) {
+           context.isVerifiedFingerprint(fingerprint) {
             return .noiseVerified
         }
         return .noiseSecured
@@ -425,39 +616,47 @@ private extension ChatPeerIdentityCoordinator {
 
     @MainActor
     func toggleFavoriteForNoiseKey(_ noisePublicKey: Data, peerID: PeerID) {
-        if let ephemeralID = viewModel.unifiedPeerService.peers.first(where: { $0.noisePublicKey == noisePublicKey })?.peerID {
-            viewModel.unifiedPeerService.toggleFavorite(ephemeralID)
-            viewModel.objectWillChange.send()
+        if let ephemeralID = context.ephemeralPeerID(forNoiseKey: noisePublicKey) {
+            context.unifiedToggleFavorite(ephemeralID)
+            context.notifyUIChanged()
             return
         }
 
-        let currentStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: noisePublicKey)
-        let fallbackNickname = viewModel.privateChats[peerID]?.first { $0.senderPeerID == peerID }?.sender
+        let currentStatus = context.favoriteRelationship(forNoiseKey: noisePublicKey)
+        let fallbackNickname = context.privateMessages(for: peerID).first { $0.senderPeerID == peerID }?.sender
         let plan = ChatFavoriteTogglePolicy.plan(
             currentStatus: currentStatus.map(ChatFavoriteStatusSnapshot.init),
             fallbackNickname: fallbackNickname,
-            bridgedNostrKey: viewModel.idBridge.getNostrPublicKey(for: noisePublicKey)
+            bridgedNostrKey: context.bridgedNostrPublicKey(for: noisePublicKey)
         )
 
         switch plan.persistenceAction {
         case .add(let nickname, let nostrKey):
-            FavoritesPersistenceService.shared.addFavorite(
-                peerNoisePublicKey: noisePublicKey,
-                peerNostrPublicKey: nostrKey,
-                peerNickname: nickname
+            context.addFavorite(
+                noiseKey: noisePublicKey,
+                nostrPublicKey: nostrKey,
+                nickname: nickname
             )
 
         case .remove:
-            FavoritesPersistenceService.shared.removeFavorite(peerNoisePublicKey: noisePublicKey)
+            context.removeFavorite(noiseKey: noisePublicKey)
         }
 
-        viewModel.objectWillChange.send()
+        context.notifyUIChanged()
 
         if case .send(let isFavorite) = plan.notification {
-            viewModel.sendFavoriteNotificationViaNostr(
+            context.sendFavoriteNotificationViaNostr(
                 noisePublicKey: noisePublicKey,
                 isFavorite: isFavorite
             )
         }
     }
 }
+
+/// Default for conforming test contexts that model chats as a dictionary;
+/// `ChatViewModel` overrides with a store-direct lookup.
+extension ChatPeerIdentityContext {
+    func privateMessages(for peerID: PeerID) -> [BitchatMessage] {
+        privateChats[peerID] ?? []
+    }
+}

bitchat/ViewModels/ChatPeerListCoordinator.swift

@@ -2,16 +2,86 @@ import BitFoundation
 import BitLogger
 import Foundation
 
+/// The narrow surface `ChatPeerListCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding an `unowned` back-ref
+/// to the whole `ChatViewModel`. This keeps the coordinator independently
+/// testable (see `ChatPeerListCoordinatorContextTests`) and makes its true
+/// dependencies explicit.
+@MainActor
+protocol ChatPeerListContext: AnyObject {
+    // MARK: Connection & chat state
+    var isConnected: Bool { get set }
+    /// A single private chat's timeline (store-direct lookup on
+    /// `ChatViewModel`; no `privateChats` dictionary build).
+    func privateMessages(for peerID: PeerID) -> [BitchatMessage]
+    var unreadPrivateMessages: Set<PeerID> { get }
+    /// Clears the peer's unread flag (single-writer store intent).
+    func markPrivateChatRead(_ peerID: PeerID)
+    var hasTrackedPrivateChatSelection: Bool { get }
+    func updatePrivateChatPeerIfNeeded()
+    func cleanupOldReadReceipts()
+
+    // MARK: Peers & sessions
+    var unifiedPeers: [BitchatPeer] { get }
+    func isPeerConnected(_ peerID: PeerID) -> Bool
+    func isPeerReachable(_ peerID: PeerID) -> Bool
+    /// Number of mesh peers currently connected or reachable, from the
+    /// transport's live peer snapshots.
+    func activeMeshPeerCount() -> Int
+    func registerEphemeralSession(peerID: PeerID)
+    func updateEncryptionStatusForPeers()
+
+    // MARK: Notifications
+    /// Posts the "bitchatters nearby" local notification.
+    func notifyNetworkAvailable(peerCount: Int)
+}
+
+extension ChatViewModel: ChatPeerListContext {
+    // `isConnected`, `privateMessages(for:)`, `unreadPrivateMessages`,
+    // `hasTrackedPrivateChatSelection`, `updatePrivateChatPeerIfNeeded()`,
+    // `cleanupOldReadReceipts()`, `unifiedPeers`, `isPeerConnected(_:)`,
+    // `isPeerReachable(_:)`, `registerEphemeralSession(peerID:)`, and
+    // `updateEncryptionStatusForPeers()` are shared requirements with the
+    // other contexts or satisfied by existing `ChatViewModel` members. The
+    // member below flattens the nested transport access into an intent-named
+    // call.
+
+    func activeMeshPeerCount() -> Int {
+        meshService
+            .currentPeerSnapshots()
+            .filter { snapshot in
+                snapshot.isConnected || meshService.isPeerReachable(snapshot.peerID)
+            }
+            .count
+    }
+
+    func notifyNetworkAvailable(peerCount: Int) {
+        NotificationService.shared.sendNetworkAvailableNotification(peerCount: peerCount)
+    }
+}
+
 final class ChatPeerListCoordinator: @unchecked Sendable {
-    private unowned let viewModel: ChatViewModel
+    private unowned let context: any ChatPeerListContext
     private var recentlySeenPeers: Set<PeerID> = []
+    // The "bitchatters nearby" notification only fires on the transition from
+    // an empty mesh to a populated one — joining peers while already meshed
+    // are visible in the app and must not notify. Set back to true only after
+    // a confirmed-empty reset, so brief link flaps stay silent.
+    private var meshWasEmpty = true
     private var lastNetworkNotificationTime = Date.distantPast
     private var networkResetTimer: Timer?
     private var networkEmptyTimer: Timer?
     private let networkResetGraceSeconds = TransportConfig.networkResetGraceSeconds
+    private let notificationCooldownSeconds: TimeInterval
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    init(
+        context: any ChatPeerListContext,
+        notificationCooldownSeconds: TimeInterval = TransportConfig.networkNotificationCooldownSeconds
+    ) {
+        self.context = context
+        self.notificationCooldownSeconds = notificationCooldownSeconds
     }
 
     deinit {
@@ -29,23 +99,23 @@ final class ChatPeerListCoordinator: @unchecked Sendable {
 private extension ChatPeerListCoordinator {
     @MainActor
     func handlePeerListUpdate(_ peers: [PeerID]) {
-        viewModel.isConnected = !peers.isEmpty
+        context.isConnected = !peers.isEmpty
         cleanupStaleUnreadPeerIDs()
 
         let meshPeers = peers.filter { peerID in
-            viewModel.meshService.isPeerConnected(peerID) || viewModel.meshService.isPeerReachable(peerID)
+            context.isPeerConnected(peerID) || context.isPeerReachable(peerID)
         }
 
         handleNetworkAvailability(meshPeers)
 
         for peerID in peers {
-            viewModel.identityManager.registerEphemeralSession(peerID: peerID, handshakeState: .none)
+            context.registerEphemeralSession(peerID: peerID)
         }
 
-        viewModel.updateEncryptionStatusForPeers()
+        context.updateEncryptionStatusForPeers()
 
-        if viewModel.hasTrackedPrivateChatSelection {
-            viewModel.updatePrivateChatPeerIfNeeded()
+        if context.hasTrackedPrivateChatSelection {
+            context.updatePrivateChatPeerIfNeeded()
         }
     }
 
@@ -61,13 +131,20 @@ private extension ChatPeerListCoordinator {
         invalidateNetworkEmptyTimer()
 
         let newPeers = meshPeerSet.subtracting(recentlySeenPeers)
-        guard !newPeers.isEmpty else { return }
+        // Record every sighted peer even when no notification fires. A peer
+        // first seen during the cooldown (or while already meshed) must not
+        // still count as "new" at some later peer-list event — that re-fired
+        // the notification while devices sat idle and connected.
+        recentlySeenPeers.formUnion(meshPeerSet)
 
-        let cooldown = TransportConfig.networkNotificationCooldownSeconds
-        if Date().timeIntervalSince(lastNetworkNotificationTime) >= cooldown {
-            recentlySeenPeers.formUnion(newPeers)
+        let cameFromEmpty = meshWasEmpty
+        meshWasEmpty = false
+
+        guard cameFromEmpty, !newPeers.isEmpty else { return }
+
+        if Date().timeIntervalSince(lastNetworkNotificationTime) >= notificationCooldownSeconds {
             lastNetworkNotificationTime = Date()
-            NotificationService.shared.sendNetworkAvailableNotification(peerCount: meshPeers.count)
+            context.notifyNetworkAvailable(peerCount: meshPeers.count)
             SecureLogger.info(
                 "👥 Sent bitchatters nearby notification for \(meshPeers.count) mesh peers (new: \(newPeers.count))",
                 category: .session
@@ -79,34 +156,34 @@ private extension ChatPeerListCoordinator {
 
     @MainActor
     func cleanupStaleUnreadPeerIDs() {
-        let currentPeerIDs = Set(viewModel.unifiedPeerService.peers.map(\.peerID))
-        let staleIDs = viewModel.unreadPrivateMessages.subtracting(currentPeerIDs)
+        let currentPeerIDs = Set(context.unifiedPeers.map(\.peerID))
+        let staleIDs = context.unreadPrivateMessages.subtracting(currentPeerIDs)
 
         guard !staleIDs.isEmpty else {
-            viewModel.cleanupOldReadReceipts()
+            context.cleanupOldReadReceipts()
             return
         }
 
         var idsToRemove: [PeerID] = []
 
         for staleID in staleIDs {
-            if staleID.isGeoDM, let messages = viewModel.privateChats[staleID], !messages.isEmpty {
+            if staleID.isGeoDM, !context.privateMessages(for: staleID).isEmpty {
                 continue
             }
 
-            if staleID.isNoiseKeyHex, let messages = viewModel.privateChats[staleID], !messages.isEmpty {
+            if staleID.isNoiseKeyHex, !context.privateMessages(for: staleID).isEmpty {
                 continue
             }
 
             idsToRemove.append(staleID)
-            viewModel.unreadPrivateMessages.remove(staleID)
+            context.markPrivateChatRead(staleID)
         }
 
         if !idsToRemove.isEmpty {
             SecureLogger.debug("🧹 Cleaned up \(idsToRemove.count) stale unread peer IDs", category: .session)
         }
 
-        viewModel.cleanupOldReadReceipts()
+        context.cleanupOldReadReceipts()
     }
 
     @MainActor
@@ -121,18 +198,15 @@ private extension ChatPeerListCoordinator {
 
     @MainActor
     func handleNetworkResetTimerFired() {
-        let activeMeshPeers = viewModel.meshService
-            .currentPeerSnapshots()
-            .filter { snapshot in
-                snapshot.isConnected || viewModel.meshService.isPeerReachable(snapshot.peerID)
-            }
+        let activeMeshPeerCount = context.activeMeshPeerCount()
 
-        if activeMeshPeers.isEmpty {
+        if activeMeshPeerCount == 0 {
             recentlySeenPeers.removeAll()
+            meshWasEmpty = true
             SecureLogger.debug("⏱️ Network notification window reset after quiet period", category: .session)
         } else {
             SecureLogger.debug(
-                "⏱️ Skipped network notification reset; still seeing \(activeMeshPeers.count) mesh peers",
+                "⏱️ Skipped network notification reset; still seeing \(activeMeshPeerCount) mesh peers",
                 category: .session
             )
         }
@@ -165,18 +239,15 @@ private extension ChatPeerListCoordinator {
 
     @MainActor
     func handleNetworkEmptyTimerFired() {
-        let activeMeshPeers = viewModel.meshService
-            .currentPeerSnapshots()
-            .filter { snapshot in
-                snapshot.isConnected || viewModel.meshService.isPeerReachable(snapshot.peerID)
-            }
+        let activeMeshPeerCount = context.activeMeshPeerCount()
 
-        if activeMeshPeers.isEmpty {
+        if activeMeshPeerCount == 0 {
             recentlySeenPeers.removeAll()
+            meshWasEmpty = true
             SecureLogger.debug("⏳ Mesh empty — notification state reset after confirmation", category: .session)
         } else {
             SecureLogger.debug(
-                "⏳ Mesh empty timer cancelled; \(activeMeshPeers.count) mesh peers detected again",
+                "⏳ Mesh empty timer cancelled; \(activeMeshPeerCount) mesh peers detected again",
                 category: .session
             )
         }

bitchat/ViewModels/ChatPublicConversationCoordinator.swift

@@ -7,16 +7,175 @@ import SwiftUI
 import UIKit
 #endif
 
+/// The narrow surface `ChatPublicConversationCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding an `unowned` back-ref
+/// to the whole `ChatViewModel`. This keeps the coordinator independently
+/// testable (see `ChatPublicConversationCoordinatorContextTests`) and makes
+/// its true dependencies explicit. The surface is intentionally large — it
+/// documents the coordinator's real coupling to the public timeline, the
+/// conversation stores, geohash participants, and the inbound public message
+/// pipeline.
+@MainActor
+protocol ChatPublicConversationContext: AnyObject {
+    // MARK: Channel state
+    var activeChannel: ChannelID { get }
+    var currentGeohash: String? { get }
+    var nickname: String { get }
+    var myPeerID: PeerID { get }
+    /// Publishes the public-timeline batching state (UI animation suppression).
+    /// (Single mutation path for the owner's `isBatchingPublic`; this
+    /// coordinator never reads it.)
+    func setPublicBatching(_ isBatching: Bool)
+    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
+    func notifyUIChanged()
+
+    // MARK: Public conversation store (single-writer intents)
+    /// Appends a public message in timestamp order. Returns `false` when a
+    /// message with the same ID is already in that conversation.
+    @discardableResult
+    func appendPublicMessage(_ message: BitchatMessage, to conversationID: ConversationID) -> Bool
+    /// Appends a geohash message if absent. Returns `true` when stored.
+    @discardableResult
+    func appendGeohashMessageIfAbsent(_ message: BitchatMessage, toGeohash geohash: String) -> Bool
+    func publicConversationContainsMessage(withID messageID: String, in conversationID: ConversationID) -> Bool
+    /// Removes a message by ID from whichever public conversation contains it.
+    @discardableResult
+    func removePublicMessage(withID messageID: String) -> BitchatMessage?
+    /// Removes every matching message from a geohash conversation (block purge).
+    func removePublicMessages(fromGeohash geohash: String, where predicate: (BitchatMessage) -> Bool)
+    /// Empties a public conversation's timeline (`/clear`).
+    func clearPublicConversation(_ conversationID: ConversationID)
+    /// Queues a system message for the next geohash channel visit.
+    func queueGeohashSystemMessage(_ content: String)
+
+    // MARK: Private chats (block cleanup & message removal)
+    /// Removes the peer's chat entirely, including unread state
+    /// (single-writer store intent; no-op for unknown peers).
+    func removePrivateChat(_ peerID: PeerID)
+    /// Removes a message by ID from every private chat containing it,
+    /// dropping chats that become empty. Returns the removed message.
+    @discardableResult
+    func removePrivateMessage(withID messageID: String) -> BitchatMessage?
+    func cleanupLocalFile(forMessage message: BitchatMessage)
+
+    // MARK: Geohash participants & presence
+    var geoNicknames: [String: String] { get }
+    var isTeleported: Bool { get }
+    var nostrKeyMapping: [PeerID: String] { get }
+    /// Drops every key mapping that resolves to the given (lowercased) Nostr pubkey.
+    func removeNostrKeyMappings(matchingPubkeyHexLowercased hex: String)
+    func visibleGeoPeople() -> [GeoPerson]
+    func geoParticipantCount(for geohash: String) -> Int
+    func removeGeoParticipant(pubkeyHex: String)
+
+    // MARK: Nostr identity & blocking (shared with the other contexts)
+    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
+    func isNostrBlocked(pubkeyHexLowercased: String) -> Bool
+    func setNostrBlocked(_ pubkeyHexLowercased: String, isBlocked: Bool)
+
+    // MARK: Mesh transport
+    func meshPeerNicknames() -> [PeerID: String]
+    func sendMeshMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date)
+
+    // MARK: Inbound public message processing
+    func processActionMessage(_ message: BitchatMessage) -> BitchatMessage
+    func isMessageBlocked(_ message: BitchatMessage) -> Bool
+    func allowPublicMessage(senderKey: String, contentKey: String) -> Bool
+    /// Buffers a visible-channel message for the batched (~80 ms) pipeline
+    /// flush, which commits it to `conversationID` in the store.
+    func enqueuePublicMessage(_ message: BitchatMessage, to conversationID: ConversationID)
+    func cachedStablePeerID(for shortPeerID: PeerID) -> PeerID?
+
+    // MARK: Content dedup & formatting
+    func normalizedContentKey(_ content: String) -> String
+    func contentTimestamp(forKey key: String) -> Date?
+    func recordContentKey(_ key: String, timestamp: Date)
+    /// Pre-renders the message so the formatting cache is warm before display.
+    func prewarmMessageFormatting(_ message: BitchatMessage)
+
+    // MARK: Notifications
+    /// Posts the you-were-mentioned local notification.
+    func notifyMention(from sender: String, message: String)
+}
+
+extension ChatViewModel: ChatPublicConversationContext {
+    // `unreadPrivateMessages`, `nostrKeyMapping`,
+    // `nickname`, `activeChannel`, `currentGeohash`, `geoNicknames`,
+    // `myPeerID`, `isTeleported`, `notifyUIChanged()`,
+    // `geoParticipantCount(for:)`, `isNostrBlocked(pubkeyHexLowercased:)`,
+    // `deriveNostrIdentity(forGeohash:)`, the public conversation store
+    // intents (`appendPublicMessage(_:to:)`,
+    // `appendGeohashMessageIfAbsent(_:toGeohash:)`,
+    // `publicConversationContainsMessage(withID:in:)`,
+    // `removePublicMessage(withID:)`,
+    // `removePublicMessages(fromGeohash:where:)`,
+    // `clearPublicConversation(_:)`, and `queueGeohashSystemMessage(_:)`)
+    // are shared requirements with `ChatDeliveryContext` /
+    // `ChatPrivateConversationContext` / `ChatNostrContext` or satisfied by
+    // existing `ChatViewModel` members. The members below flatten nested
+    // service accesses into intent-named calls.
+
+    func visibleGeoPeople() -> [GeoPerson] {
+        participantTracker.getVisiblePeople()
+    }
+
+    func removeGeoParticipant(pubkeyHex: String) {
+        participantTracker.removeParticipant(pubkeyHex: pubkeyHex)
+    }
+
+    func setNostrBlocked(_ pubkeyHexLowercased: String, isBlocked: Bool) {
+        identityManager.setNostrBlocked(pubkeyHexLowercased, isBlocked: isBlocked)
+    }
+
+    func meshPeerNicknames() -> [PeerID: String] {
+        meshService.getPeerNicknames()
+    }
+
+    func sendMeshMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date) {
+        meshService.sendMessage(content, mentions: mentions, messageID: messageID, timestamp: timestamp)
+    }
+
+    func allowPublicMessage(senderKey: String, contentKey: String) -> Bool {
+        publicRateLimiter.allow(senderKey: senderKey, contentKey: contentKey)
+    }
+
+    func enqueuePublicMessage(_ message: BitchatMessage, to conversationID: ConversationID) {
+        publicMessagePipeline.enqueue(message, to: conversationID)
+    }
+
+    func normalizedContentKey(_ content: String) -> String {
+        deduplicationService.normalizedContentKey(content)
+    }
+
+    func contentTimestamp(forKey key: String) -> Date? {
+        deduplicationService.contentTimestamp(forKey: key)
+    }
+
+    func recordContentKey(_ key: String, timestamp: Date) {
+        deduplicationService.recordContentKey(key, timestamp: timestamp)
+    }
+
+    func prewarmMessageFormatting(_ message: BitchatMessage) {
+        _ = formatMessageAsText(message, colorScheme: currentColorScheme)
+    }
+
+    func notifyMention(from sender: String, message: String) {
+        NotificationService.shared.sendMentionNotification(from: sender, message: message)
+    }
+}
+
 @MainActor
 final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
-    private unowned let viewModel: ChatViewModel
+    private unowned let context: any ChatPublicConversationContext
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    init(context: any ChatPublicConversationContext) {
+        self.context = context
     }
 
     func visibleGeohashPeople() -> [GeoPerson] {
-        viewModel.participantTracker.getVisiblePeople()
+        context.visibleGeoPeople()
     }
 
     func getVisibleGeoParticipants() -> [CommandGeoParticipant] {
@@ -24,7 +183,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func geohashParticipantCount(for geohash: String) -> Int {
-        viewModel.participantTracker.participantCount(for: geohash)
+        context.geoParticipantCount(for: geohash)
     }
 
     func displayNameForPubkey(_ pubkeyHex: String) -> String {
@@ -32,50 +191,36 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func isBlocked(_ pubkeyHexLowercased: String) -> Bool {
-        viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
+        context.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
     }
 
     func isGeohashUserBlocked(pubkeyHexLowercased: String) -> Bool {
-        viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
+        context.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
     }
 
     func blockGeohashUser(pubkeyHexLowercased: String, displayName: String) {
         let hex = pubkeyHexLowercased.lowercased()
-        viewModel.identityManager.setNostrBlocked(hex, isBlocked: true)
-        viewModel.participantTracker.removeParticipant(pubkeyHex: hex)
+        context.setNostrBlocked(hex, isBlocked: true)
+        context.removeGeoParticipant(pubkeyHex: hex)
 
-        if let gh = viewModel.currentGeohash {
-            let predicate: (BitchatMessage) -> Bool = { [unowned viewModel] message in
+        if let gh = context.currentGeohash {
+            let predicate: (BitchatMessage) -> Bool = { [unowned context] message in
                 guard let senderPeerID = message.senderPeerID,
                       senderPeerID.isGeoDM || senderPeerID.isGeoChat else {
                     return false
                 }
-                if let full = viewModel.nostrKeyMapping[senderPeerID]?.lowercased() {
+                if let full = context.nostrKeyMapping[senderPeerID]?.lowercased() {
                     return full == hex
                 }
                 return false
             }
-            viewModel.timelineStore.removeMessages(in: gh, where: predicate)
-            synchronizePublicConversationStore(forGeohash: gh)
-            if case .location = viewModel.activeChannel {
-                viewModel.messages.removeAll(where: predicate)
-            }
+            context.removePublicMessages(fromGeohash: gh, where: predicate)
         }
 
-        let conversationPeerID = PeerID(nostr_: hex)
-        if viewModel.privateChats[conversationPeerID] != nil {
-            var privateChats = viewModel.privateChats
-            privateChats.removeValue(forKey: conversationPeerID)
-            viewModel.privateChats = privateChats
+        // The store intent no-ops when no such chat exists.
+        context.removePrivateChat(PeerID(nostr_: hex))
 
-            var unread = viewModel.unreadPrivateMessages
-            unread.remove(conversationPeerID)
-            viewModel.unreadPrivateMessages = unread
-        }
-
-        for (key, value) in viewModel.nostrKeyMapping where value.lowercased() == hex {
-            viewModel.nostrKeyMapping.removeValue(forKey: key)
-        }
+        context.removeNostrKeyMappings(matchingPubkeyHexLowercased: hex)
 
         addSystemMessage(
             String(
@@ -90,7 +235,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func unblockGeohashUser(pubkeyHexLowercased: String, displayName: String) {
-        viewModel.identityManager.setNostrBlocked(pubkeyHexLowercased, isBlocked: false)
+        context.setNostrBlocked(pubkeyHexLowercased, isBlocked: false)
         addSystemMessage(
             String(
                 format: String(
@@ -105,104 +250,45 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
 
     func displayNameForNostrPubkey(_ pubkeyHex: String) -> String {
         let suffix = String(pubkeyHex.suffix(4))
-        if let geohash = viewModel.currentGeohash,
-           let myGeoIdentity = try? viewModel.idBridge.deriveIdentity(forGeohash: geohash),
+        if let geohash = context.currentGeohash,
+           let myGeoIdentity = try? context.deriveNostrIdentity(forGeohash: geohash),
            myGeoIdentity.publicKeyHex.lowercased() == pubkeyHex.lowercased() {
-            return viewModel.nickname + "#" + suffix
+            return context.nickname + "#" + suffix
         }
-        if let nick = viewModel.geoNicknames[pubkeyHex.lowercased()], !nick.isEmpty {
+        if let nick = context.geoNicknames[pubkeyHex.lowercased()], !nick.isEmpty {
             return nick + "#" + suffix
         }
         return "anon#\(suffix)"
     }
 
     func currentPublicSender() -> (name: String, peerID: PeerID) {
-        var displaySender = viewModel.nickname
-        var senderPeerID = viewModel.meshService.myPeerID
-        if case .location(let channel) = viewModel.activeChannel,
-           let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+        var displaySender = context.nickname
+        var senderPeerID = context.myPeerID
+        if case .location(let channel) = context.activeChannel,
+           let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
             let suffix = String(identity.publicKeyHex.suffix(4))
-            displaySender = viewModel.nickname + "#" + suffix
+            displaySender = context.nickname + "#" + suffix
             senderPeerID = PeerID(nostr: identity.publicKeyHex)
         }
         return (displaySender, senderPeerID)
     }
 
     func removeMessage(withID messageID: String, cleanupFile: Bool = false) {
-        var removedMessage: BitchatMessage?
+        var removedMessage = context.removePublicMessage(withID: messageID)
 
-        if let index = viewModel.messages.firstIndex(where: { $0.id == messageID }) {
-            removedMessage = viewModel.messages.remove(at: index)
+        if let removedPrivateMessage = context.removePrivateMessage(withID: messageID) {
+            removedMessage = removedMessage ?? removedPrivateMessage
         }
 
-        if let storeRemoved = viewModel.timelineStore.removeMessage(withID: messageID) {
-            removedMessage = removedMessage ?? storeRemoved
-            synchronizeAllPublicConversationStores()
-        }
-
-        var chats = viewModel.privateChats
-        for (peerID, items) in chats {
-            let filtered = items.filter { $0.id != messageID }
-            if filtered.count != items.count {
-                if filtered.isEmpty {
-                    chats.removeValue(forKey: peerID)
-                } else {
-                    chats[peerID] = filtered
-                }
-                if removedMessage == nil {
-                    removedMessage = items.first(where: { $0.id == messageID })
-                }
-            }
-        }
-        viewModel.privateChats = chats
-
         if cleanupFile, let removedMessage {
-            viewModel.cleanupLocalFile(forMessage: removedMessage)
+            context.cleanupLocalFile(forMessage: removedMessage)
         }
 
-        viewModel.objectWillChange.send()
-    }
-
-    func initializeConversationStore() {
-        viewModel.conversationStore.setActiveChannel(viewModel.activeChannel)
-        synchronizePublicConversationStore(for: viewModel.activeChannel)
-        viewModel.synchronizePrivateConversationStore()
-        viewModel.synchronizeConversationSelectionStore()
-    }
-
-    func synchronizePublicConversationStore(for channel: ChannelID) {
-        let publicMessages = viewModel.timelineStore.messages(for: channel)
-        viewModel.conversationStore.replaceMessages(publicMessages, for: channel)
-        if channel == viewModel.activeChannel {
-            viewModel.conversationStore.setActiveChannel(viewModel.activeChannel)
-        }
-    }
-
-    func synchronizePublicConversationStore(forGeohash geohash: String) {
-        let channel = ChannelID.location(GeohashChannel(level: .city, geohash: geohash))
-        let publicMessages = viewModel.timelineStore.messages(for: channel)
-        viewModel.conversationStore.replaceMessages(publicMessages, for: .geohash(geohash.lowercased()))
-    }
-
-    func synchronizeAllPublicConversationStores() {
-        synchronizePublicConversationStore(for: .mesh)
-        for geohash in viewModel.timelineStore.geohashKeys() {
-            synchronizePublicConversationStore(forGeohash: geohash)
-        }
-    }
-
-    func refreshVisibleMessages(from channel: ChannelID? = nil) {
-        let target = channel ?? viewModel.activeChannel
-        viewModel.messages = viewModel.timelineStore.messages(for: target)
-        viewModel.conversationStore.replaceMessages(viewModel.messages, for: target)
-        if target == viewModel.activeChannel {
-            viewModel.conversationStore.setActiveChannel(viewModel.activeChannel)
-        }
+        context.notifyUIChanged()
     }
 
     func clearCurrentPublicTimeline() {
-        viewModel.messages.removeAll()
-        viewModel.timelineStore.clear(channel: viewModel.activeChannel)
+        context.clearPublicConversation(ConversationID(channelID: context.activeChannel))
 
         Task.detached(priority: .utility) {
             do {
@@ -242,7 +328,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             timestamp: timestamp,
             isRelay: false
         )
-        viewModel.messages.append(systemMessage)
+        context.appendPublicMessage(systemMessage, to: ConversationID(channelID: context.activeChannel))
     }
 
     func addMeshOnlySystemMessage(_ content: String) {
@@ -252,11 +338,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             timestamp: Date(),
             isRelay: false
         )
-        viewModel.timelineStore.append(systemMessage, to: .mesh)
-        synchronizePublicConversationStore(for: .mesh)
-        refreshVisibleMessages()
-        viewModel.trimMessagesIfNeeded()
-        viewModel.objectWillChange.send()
+        context.appendPublicMessage(systemMessage, to: .mesh)
     }
 
     func addPublicSystemMessage(_ content: String) {
@@ -266,34 +348,31 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             timestamp: Date(),
             isRelay: false
         )
-        viewModel.timelineStore.append(systemMessage, to: viewModel.activeChannel)
-        refreshVisibleMessages(from: viewModel.activeChannel)
-        let contentKey = viewModel.deduplicationService.normalizedContentKey(systemMessage.content)
-        viewModel.deduplicationService.recordContentKey(contentKey, timestamp: systemMessage.timestamp)
-        viewModel.trimMessagesIfNeeded()
-        viewModel.objectWillChange.send()
+        context.appendPublicMessage(systemMessage, to: ConversationID(channelID: context.activeChannel))
+        let contentKey = context.normalizedContentKey(systemMessage.content)
+        context.recordContentKey(contentKey, timestamp: systemMessage.timestamp)
     }
 
     func addGeohashOnlySystemMessage(_ content: String) {
-        if case .location = viewModel.activeChannel {
+        if case .location = context.activeChannel {
             addPublicSystemMessage(content)
         } else {
-            viewModel.timelineStore.queueGeohashSystemMessage(content)
+            context.queueGeohashSystemMessage(content)
         }
     }
 
     func sendPublicRaw(_ content: String) {
-        if case .location(let channel) = viewModel.activeChannel {
-            Task { @MainActor [weak viewModel] in
-                guard let viewModel else { return }
+        if case .location(let channel) = context.activeChannel {
+            Task { @MainActor [weak context] in
+                guard let context else { return }
                 do {
-                    let identity = try viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash)
+                    let identity = try context.deriveNostrIdentity(forGeohash: channel.geohash)
                     let event = try NostrProtocol.createEphemeralGeohashEvent(
                         content: content,
                         geohash: channel.geohash,
                         senderIdentity: identity,
-                        nickname: viewModel.nickname,
-                        teleported: viewModel.locationManager.teleported
+                        nickname: context.nickname,
+                        teleported: context.isTeleported
                     )
                     let targetRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: channel.geohash, count: 5)
                     if targetRelays.isEmpty {
@@ -308,7 +387,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             return
         }
 
-        viewModel.meshService.sendMessage(
+        context.sendMeshMessage(
             content,
             mentions: [],
             messageID: UUID().uuidString,
@@ -317,61 +396,73 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func handlePublicMessage(_ message: BitchatMessage) {
-        let finalMessage = viewModel.processActionMessage(message)
-        if viewModel.isMessageBlocked(finalMessage) { return }
+        let finalMessage = context.processActionMessage(message)
+        if context.isMessageBlocked(finalMessage) { return }
 
         let isGeo = finalMessage.senderPeerID?.isGeoChat == true
-        let shouldRateLimit = finalMessage.sender != "system" || finalMessage.senderPeerID != nil
+        let isSystem = finalMessage.sender == "system"
+        let shouldRateLimit = !isSystem || finalMessage.senderPeerID != nil
         if shouldRateLimit {
             let senderKey = normalizedSenderKey(for: finalMessage)
-            let contentKey = viewModel.deduplicationService.normalizedContentKey(finalMessage.content)
-            if !viewModel.publicRateLimiter.allow(senderKey: senderKey, contentKey: contentKey) {
+            let contentKey = context.normalizedContentKey(finalMessage.content)
+            if !context.allowPublicMessage(senderKey: senderKey, contentKey: contentKey) {
                 return
             }
         }
 
-        if finalMessage.sender != "system" && finalMessage.content.count > 16000 { return }
+        if !isSystem && finalMessage.content.count > 16000 { return }
+        // Empty content never rendered before (the old visible-array enqueue
+        // filtered it); with the store as the sole timeline it is dropped
+        // outright instead of lingering invisibly in a backing buffer.
+        guard !finalMessage.content.trimmed.isEmpty else { return }
 
-        if !isGeo && finalMessage.sender != "system" {
-            viewModel.timelineStore.append(finalMessage, to: .mesh)
-            synchronizePublicConversationStore(for: .mesh)
+        // Resolve the destination conversation. System messages surface on
+        // the active channel (matching their old visible-only routing); geo
+        // messages require a current geohash, mesh messages always land in
+        // the mesh conversation.
+        let destination: ConversationID?
+        if isSystem {
+            destination = ConversationID(channelID: context.activeChannel)
+        } else if isGeo {
+            destination = context.currentGeohash.map { .geohash($0.lowercased()) }
+        } else {
+            destination = .mesh
         }
+        guard let destination else { return }
 
-        if isGeo && finalMessage.sender != "system",
-           let geohash = viewModel.currentGeohash,
-           viewModel.timelineStore.appendIfAbsent(finalMessage, toGeohash: geohash) {
-            synchronizePublicConversationStore(forGeohash: geohash)
-        }
-
-        let isSystem = finalMessage.sender == "system"
         let channelMatches: Bool = {
-            switch viewModel.activeChannel {
+            switch context.activeChannel {
             case .mesh: return !isGeo || isSystem
             case .location: return isGeo || isSystem
             }
         }()
 
-        guard channelMatches else { return }
-
-        if !finalMessage.content.trimmed.isEmpty,
-           !viewModel.messages.contains(where: { $0.id == finalMessage.id }) {
-            viewModel.publicMessagePipeline.enqueue(finalMessage)
+        if channelMatches {
+            // Visible-channel arrivals are batched: the pipeline's ~80 ms
+            // flush commits them to the store (which dedups by ID), keeping
+            // the deliberate UI flush cadence.
+            guard !context.publicConversationContainsMessage(withID: finalMessage.id, in: destination) else { return }
+            context.enqueuePublicMessage(finalMessage, to: destination)
+        } else {
+            // Background-channel arrivals have no rendering observers to
+            // batch for; they land in the store immediately.
+            context.appendPublicMessage(finalMessage, to: destination)
         }
     }
 
     func checkForMentions(_ message: BitchatMessage) {
-        var myTokens: Set<String> = [viewModel.nickname]
-        let meshPeers = viewModel.meshService.getPeerNicknames()
-        let collisions = meshPeers.values.filter { $0.hasPrefix(viewModel.nickname + "#") }
+        var myTokens: Set<String> = [context.nickname]
+        let meshPeers = context.meshPeerNicknames()
+        let collisions = meshPeers.values.filter { $0.hasPrefix(context.nickname + "#") }
         if !collisions.isEmpty {
-            let suffix = "#" + String(viewModel.meshService.myPeerID.id.prefix(4))
-            myTokens = [viewModel.nickname + suffix]
+            let suffix = "#" + String(context.myPeerID.id.prefix(4))
+            myTokens = [context.nickname + suffix]
         }
         let isMentioned = message.mentions?.contains(where: myTokens.contains) ?? false
 
-        if isMentioned && message.sender != viewModel.nickname {
+        if isMentioned && message.sender != context.nickname {
             SecureLogger.info("🔔 Mention from \(message.sender)", category: .session)
-            NotificationService.shared.sendMentionNotification(from: message.sender, message: message.content)
+            context.notifyMention(from: message.sender, message: message.content)
         }
     }
 
@@ -379,11 +470,11 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
         #if os(iOS)
         guard UIApplication.shared.applicationState == .active else { return }
 
-        var tokens: [String] = [viewModel.nickname]
-        switch viewModel.activeChannel {
+        var tokens: [String] = [context.nickname]
+        switch context.activeChannel {
         case .location(let channel):
-            if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
-                tokens.append(viewModel.nickname + "#" + String(identity.publicKeyHex.suffix(4)))
+            if let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
+                tokens.append(context.nickname + "#" + String(identity.publicKeyHex.suffix(4)))
             }
         case .mesh:
             break
@@ -394,7 +485,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
         let isHugForMe = message.content.contains("🫂") && hugsMe
         let isSlapForMe = message.content.contains("🐟") && slapsMe
 
-        if isHugForMe && message.sender != viewModel.nickname {
+        if isHugForMe && message.sender != context.nickname {
             let impactFeedback = UIImpactFeedbackGenerator(style: .medium)
             impactFeedback.prepare()
 
@@ -405,7 +496,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
                     impactFeedback.impactOccurred()
                 }
             }
-        } else if isSlapForMe && message.sender != viewModel.nickname {
+        } else if isSlapForMe && message.sender != context.nickname {
             let impactFeedback = UIImpactFeedbackGenerator(style: .heavy)
             impactFeedback.prepare()
             impactFeedback.impactOccurred()
@@ -413,36 +504,28 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
         #endif
     }
 
-    func pipelineCurrentMessages(_ pipeline: PublicMessagePipeline) -> [BitchatMessage] {
-        viewModel.messages
-    }
-
-    func pipeline(_ pipeline: PublicMessagePipeline, setMessages messages: [BitchatMessage]) {
-        viewModel.messages = messages
-    }
-
     func pipeline(_ pipeline: PublicMessagePipeline, normalizeContent content: String) -> String {
-        viewModel.deduplicationService.normalizedContentKey(content)
+        context.normalizedContentKey(content)
     }
 
     func pipeline(_ pipeline: PublicMessagePipeline, contentTimestampForKey key: String) -> Date? {
-        viewModel.deduplicationService.contentTimestamp(forKey: key)
+        context.contentTimestamp(forKey: key)
     }
 
     func pipeline(_ pipeline: PublicMessagePipeline, recordContentKey key: String, timestamp: Date) {
-        viewModel.deduplicationService.recordContentKey(key, timestamp: timestamp)
+        context.recordContentKey(key, timestamp: timestamp)
     }
 
-    func pipelineTrimMessages(_ pipeline: PublicMessagePipeline) {
-        viewModel.trimMessagesIfNeeded()
+    func pipeline(_ pipeline: PublicMessagePipeline, commit message: BitchatMessage, to conversationID: ConversationID) -> Bool {
+        context.appendPublicMessage(message, to: conversationID)
     }
 
     func pipelinePrewarmMessage(_ pipeline: PublicMessagePipeline, message: BitchatMessage) {
-        _ = viewModel.formatMessageAsText(message, colorScheme: viewModel.currentColorScheme)
+        context.prewarmMessageFormatting(message)
     }
 
     func pipelineSetBatchingState(_ pipeline: PublicMessagePipeline, isBatching: Bool) {
-        viewModel.isBatchingPublic = isBatching
+        context.setPublicBatching(isBatching)
     }
 }
 
@@ -450,10 +533,10 @@ private extension ChatPublicConversationCoordinator {
     func normalizedSenderKey(for message: BitchatMessage) -> String {
         if let senderPeerID = message.senderPeerID {
             if senderPeerID.isGeoChat || senderPeerID.isGeoDM {
-                let full = (viewModel.nostrKeyMapping[senderPeerID] ?? senderPeerID.bare).lowercased()
+                let full = (context.nostrKeyMapping[senderPeerID] ?? senderPeerID.bare).lowercased()
                 return "nostr:" + full
             } else if senderPeerID.id.count == 16,
-                      let full = viewModel.cachedStablePeerID(for: senderPeerID)?.id.lowercased() {
+                      let full = context.cachedStablePeerID(for: senderPeerID)?.id.lowercased() {
                 return "noise:" + full
             } else {
                 return "mesh:" + senderPeerID.id.lowercased()

bitchat/ViewModels/ChatTransportEventCoordinator.swift

@@ -2,26 +2,155 @@ import BitFoundation
 import BitLogger
 import Foundation
 
-final class ChatTransportEventCoordinator {
-    private unowned let viewModel: ChatViewModel
+/// The narrow surface `ChatTransportEventCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding an `unowned` back-ref
+/// to the whole `ChatViewModel`. This keeps the coordinator independently
+/// testable (see `ChatTransportEventCoordinatorContextTests`) and makes its
+/// true dependencies explicit.
+@MainActor
+protocol ChatTransportEventContext: AnyObject {
+    // MARK: Connection & chat state
+    var isConnected: Bool { get set }
+    var nickname: String { get }
+    var myPeerID: PeerID { get }
+    /// A single private chat's timeline (store-direct lookup on
+    /// `ChatViewModel`; no `privateChats` dictionary build).
+    func privateMessages(for peerID: PeerID) -> [BitchatMessage]
+    var unreadPrivateMessages: Set<PeerID> { get }
+    var selectedPrivateChatPeer: PeerID? { get set }
+    /// Appends a private message via the single-writer store intent;
+    /// returns `false` on duplicate message ID.
+    @discardableResult
+    func appendPrivateMessage(_ message: BitchatMessage, to peerID: PeerID) -> Bool
+    /// Removes the peer's chat entirely, including unread state.
+    func removePrivateChat(_ peerID: PeerID)
+    func markPrivateChatUnread(_ peerID: PeerID)
+    func markPrivateChatRead(_ peerID: PeerID)
+    /// Forgets that read receipts were sent for `ids` so READ acks can be
+    /// re-sent after the peer reconnects. (Single mutation path for the
+    /// owner's `sentReadReceipts`; this coordinator never reads the raw set.)
+    func unmarkReadReceiptsSent(_ ids: [String])
+    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
+    func notifyUIChanged()
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    // MARK: Inbound message handling
+    func isMessageBlocked(_ message: BitchatMessage) -> Bool
+    func handlePrivateMessage(_ message: BitchatMessage)
+    func handlePublicMessage(_ message: BitchatMessage)
+    func checkForMentions(_ message: BitchatMessage)
+    func sendHapticFeedback(for message: BitchatMessage)
+    func parseMentions(from content: String) -> [String]
+
+    // MARK: Peer identity & sessions
+    func isPeerBlocked(_ peerID: PeerID) -> Bool
+    /// The peer's current entry in the unified peer service, if known.
+    func unifiedPeer(for peerID: PeerID) -> BitchatPeer?
+    func resolveNickname(for peerID: PeerID) -> String
+    func registerEphemeralSession(peerID: PeerID)
+    func removeEphemeralSession(peerID: PeerID)
+    /// Resolves the peer's Noise static key from the active Noise session, if any.
+    func noiseSessionPublicKeyData(for peerID: PeerID) -> Data?
+    func cacheStablePeerID(_ stablePeerID: PeerID, for shortPeerID: PeerID)
+    func cachedStablePeerID(for shortPeerID: PeerID) -> PeerID?
+
+    // MARK: Routing & acknowledgements
+    func flushRouterOutbox(for peerID: PeerID)
+    /// Offer queued mail for *other* peers to this newly connected courier.
+    func retryCourierDeposits(via peerID: PeerID)
+    func sendMeshDeliveryAck(for messageID: String, to peerID: PeerID)
+
+    // MARK: Delivery status
+    /// Applies the status to every known location of the message.
+    /// Returns `false` when no message with that ID was updated.
+    @discardableResult
+    func applyMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool
+    func deliveryStatus(for messageID: String) -> DeliveryStatus?
+
+    // MARK: Verification payloads
+    func handleVerifyChallengePayload(from peerID: PeerID, payload: Data)
+    func handleVerifyResponsePayload(from peerID: PeerID, payload: Data)
+}
+
+extension ChatViewModel: ChatTransportEventContext {
+    // `isConnected`, `nickname`, `myPeerID`, `privateMessages(for:)`,
+    // `unreadPrivateMessages`, `selectedPrivateChatPeer`, `notifyUIChanged()`,
+    // the inbound message handlers, `isPeerBlocked(_:)`,
+    // `parseMentions(from:)`, `resolveNickname(for:)`,
+    // `cacheStablePeerID(_:for:)`, and `cachedStablePeerID(for:)` are shared
+    // requirements with the other contexts or satisfied by existing
+    // `ChatViewModel` members. The single-writer intent op
+    // `unmarkReadReceiptsSent(_:)` lives next to its backing state in
+    // `ChatViewModel`. The members below flatten nested service accesses into
+    // intent-named calls.
+
+    func unifiedPeer(for peerID: PeerID) -> BitchatPeer? {
+        unifiedPeerService.getPeer(by: peerID)
+    }
+
+    func registerEphemeralSession(peerID: PeerID) {
+        identityManager.registerEphemeralSession(peerID: peerID, handshakeState: .none)
+    }
+
+    func removeEphemeralSession(peerID: PeerID) {
+        identityManager.removeEphemeralSession(peerID: peerID)
+    }
+
+    func noiseSessionPublicKeyData(for peerID: PeerID) -> Data? {
+        meshService.noiseSessionPublicKeyData(for: peerID)
+    }
+
+    func flushRouterOutbox(for peerID: PeerID) {
+        messageRouter.flushOutbox(for: peerID)
+    }
+
+    func retryCourierDeposits(via peerID: PeerID) {
+        messageRouter.courierBecameAvailable(peerID)
+    }
+
+    func sendMeshDeliveryAck(for messageID: String, to peerID: PeerID) {
+        meshService.sendDeliveryAck(for: messageID, to: peerID)
+    }
+
+    @discardableResult
+    func applyMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool {
+        deliveryCoordinator.updateMessageDeliveryStatus(messageID, status: status)
+    }
+
+    func deliveryStatus(for messageID: String) -> DeliveryStatus? {
+        deliveryCoordinator.deliveryStatus(for: messageID)
+    }
+
+    func handleVerifyChallengePayload(from peerID: PeerID, payload: Data) {
+        verificationCoordinator.handleVerifyChallengePayload(from: peerID, payload: payload)
+    }
+
+    func handleVerifyResponsePayload(from peerID: PeerID, payload: Data) {
+        verificationCoordinator.handleVerifyResponsePayload(from: peerID, payload: payload)
+    }
+}
+
+final class ChatTransportEventCoordinator {
+    private unowned let context: any ChatTransportEventContext
+
+    init(context: any ChatTransportEventContext) {
+        self.context = context
     }
 
     func didReceiveMessage(_ message: BitchatMessage) {
-        runOnMain { viewModel in
-            guard !viewModel.isMessageBlocked(message) else { return }
+        runOnMain { context in
+            guard !context.isMessageBlocked(message) else { return }
             guard !message.content.trimmed.isEmpty || message.isPrivate else { return }
 
             if message.isPrivate {
-                viewModel.handlePrivateMessage(message)
+                context.handlePrivateMessage(message)
             } else {
-                viewModel.handlePublicMessage(message)
+                context.handlePublicMessage(message)
             }
 
-            viewModel.checkForMentions(message)
-            viewModel.sendHapticFeedback(for: message)
+            context.checkForMentions(message)
+            context.sendHapticFeedback(for: message)
         }
     }
 
@@ -32,9 +161,9 @@ final class ChatTransportEventCoordinator {
         timestamp: Date,
         messageID: String?
     ) {
-        runOnMain { viewModel in
+        runOnMain { context in
             let normalized = content.trimmed
-            let mentions = viewModel.parseMentions(from: normalized)
+            let mentions = context.parseMentions(from: normalized)
             let message = BitchatMessage(
                 id: messageID,
                 sender: nickname,
@@ -48,9 +177,9 @@ final class ChatTransportEventCoordinator {
                 mentions: mentions.isEmpty ? nil : mentions
             )
 
-            viewModel.handlePublicMessage(message)
-            viewModel.checkForMentions(message)
-            viewModel.sendHapticFeedback(for: message)
+            context.handlePublicMessage(message)
+            context.checkForMentions(message)
+            context.sendHapticFeedback(for: message)
         }
     }
 
@@ -60,13 +189,13 @@ final class ChatTransportEventCoordinator {
         payload: Data,
         timestamp: Date
     ) {
-        runOnMain { [self] viewModel in
+        runOnMain { [self] context in
             handleNoisePayload(
                 from: peerID,
                 type: type,
                 payload: payload,
                 timestamp: timestamp,
-                in: viewModel
+                in: context
             )
         }
     }
@@ -74,60 +203,60 @@ final class ChatTransportEventCoordinator {
     func didConnectToPeer(_ peerID: PeerID) {
         SecureLogger.debug("🤝 Peer connected: \(peerID)", category: .session)
 
-        runOnMain { viewModel in
-            viewModel.isConnected = true
-            viewModel.identityManager.registerEphemeralSession(peerID: peerID, handshakeState: .none)
-            viewModel.objectWillChange.send()
+        runOnMain { context in
+            context.isConnected = true
+            context.registerEphemeralSession(peerID: peerID)
+            context.notifyUIChanged()
 
-            if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
+            if let peer = context.unifiedPeer(for: peerID) {
                 let stablePeerID = PeerID(hexData: peer.noisePublicKey)
-                viewModel.cacheStablePeerID(stablePeerID, for: peerID)
+                context.cacheStablePeerID(stablePeerID, for: peerID)
             }
 
-            viewModel.messageRouter.flushOutbox(for: peerID)
+            context.flushRouterOutbox(for: peerID)
+            context.retryCourierDeposits(via: peerID)
         }
     }
 
     func didDisconnectFromPeer(_ peerID: PeerID) {
         SecureLogger.debug("👋 Peer disconnected: \(peerID)", category: .session)
 
-        runOnMain { viewModel in
-            viewModel.identityManager.removeEphemeralSession(peerID: peerID)
+        runOnMain { context in
+            context.removeEphemeralSession(peerID: peerID)
 
-            var stablePeerID = viewModel.cachedStablePeerID(for: peerID)
+            var stablePeerID = context.cachedStablePeerID(for: peerID)
             if stablePeerID == nil,
-               let key = viewModel.meshService.getNoiseService().getPeerPublicKeyData(peerID) {
+               let key = context.noiseSessionPublicKeyData(for: peerID) {
                 let derivedPeerID = PeerID(hexData: key)
-                viewModel.cacheStablePeerID(derivedPeerID, for: peerID)
+                context.cacheStablePeerID(derivedPeerID, for: peerID)
                 stablePeerID = derivedPeerID
             }
 
-            if let currentPeerID = viewModel.selectedPrivateChatPeer,
+            if let currentPeerID = context.selectedPrivateChatPeer,
                currentPeerID == peerID,
                let stablePeerID {
                 self.migrateSelectedConversationIfNeeded(
                     from: peerID,
                     to: stablePeerID,
-                    in: viewModel
+                    in: context
                 )
             }
 
-            if let messages = viewModel.privateChats[peerID] {
-                for message in messages where message.senderPeerID == peerID {
-                    viewModel.sentReadReceipts.remove(message.id)
-                }
-            }
+            let receiptIDs = context.privateMessages(for: peerID)
+                .filter { $0.senderPeerID == peerID }
+                .map(\.id)
+            context.unmarkReadReceiptsSent(receiptIDs)
 
-            viewModel.objectWillChange.send()
+            context.notifyUIChanged()
         }
     }
 }
 
 private extension ChatTransportEventCoordinator {
-    func runOnMain(_ action: @escaping @MainActor (ChatViewModel) -> Void) {
-        Task { @MainActor [weak viewModel = self.viewModel] in
-            guard let viewModel else { return }
-            action(viewModel)
+    func runOnMain(_ action: @escaping @MainActor (any ChatTransportEventContext) -> Void) {
+        Task { @MainActor [weak context = self.context] in
+            guard let context else { return }
+            action(context)
         }
     }
 
@@ -135,15 +264,15 @@ private extension ChatTransportEventCoordinator {
     func migrateSelectedConversationIfNeeded(
         from shortPeerID: PeerID,
         to stablePeerID: PeerID,
-        in viewModel: ChatViewModel
+        in context: any ChatTransportEventContext
     ) {
-        if let messages = viewModel.privateChats[shortPeerID] {
-            if viewModel.privateChats[stablePeerID] == nil {
-                viewModel.privateChats[stablePeerID] = []
-            }
+        let hadUnread = context.unreadPrivateMessages.contains(shortPeerID)
 
-            let existingIDs = Set(viewModel.privateChats[stablePeerID]?.map(\.id) ?? [])
-            for message in messages where !existingIDs.contains(message.id) {
+        let shortPeerMessages = context.privateMessages(for: shortPeerID)
+        if !shortPeerMessages.isEmpty {
+            for message in shortPeerMessages {
+                // Rewrite senderPeerID to the stable key so read receipts
+                // keep working; store append dedups by ID and keeps order.
                 let migrated = BitchatMessage(
                     id: message.id,
                     sender: message.sender,
@@ -153,25 +282,24 @@ private extension ChatTransportEventCoordinator {
                     originalSender: message.originalSender,
                     isPrivate: message.isPrivate,
                     recipientNickname: message.recipientNickname,
-                    senderPeerID: message.senderPeerID == viewModel.meshService.myPeerID
-                        ? viewModel.meshService.myPeerID
+                    senderPeerID: message.senderPeerID == context.myPeerID
+                        ? context.myPeerID
                         : stablePeerID,
                     mentions: message.mentions,
                     deliveryStatus: message.deliveryStatus
                 )
-                viewModel.privateChats[stablePeerID]?.append(migrated)
+                context.appendPrivateMessage(migrated, to: stablePeerID)
             }
 
-            viewModel.privateChats[stablePeerID]?.sort { $0.timestamp < $1.timestamp }
-            viewModel.privateChats.removeValue(forKey: shortPeerID)
+            context.removePrivateChat(shortPeerID)
         }
 
-        if viewModel.unreadPrivateMessages.contains(shortPeerID) {
-            viewModel.unreadPrivateMessages.remove(shortPeerID)
-            viewModel.unreadPrivateMessages.insert(stablePeerID)
+        if hadUnread {
+            context.markPrivateChatRead(shortPeerID)
+            context.markPrivateChatUnread(stablePeerID)
         }
 
-        viewModel.selectedPrivateChatPeer = stablePeerID
+        context.selectedPrivateChatPeer = stablePeerID
     }
 
     @MainActor
@@ -180,19 +308,19 @@ private extension ChatTransportEventCoordinator {
         type: NoisePayloadType,
         payload: Data,
         timestamp: Date,
-        in viewModel: ChatViewModel
+        in context: any ChatTransportEventContext
     ) {
         switch type {
         case .privateMessage:
             guard let packet = PrivateMessagePacket.decode(from: payload) else { return }
 
-            guard !viewModel.isPeerBlocked(peerID) else {
+            guard !context.isPeerBlocked(peerID) else {
                 SecureLogger.debug("🚫 Ignoring Noise payload from blocked peer: \(peerID)", category: .security)
                 return
             }
 
-            let senderName = viewModel.unifiedPeerService.getPeer(by: peerID)?.nickname ?? "Unknown"
-            let mentions = viewModel.parseMentions(from: packet.content)
+            let senderName = context.unifiedPeer(for: peerID)?.nickname ?? "Unknown"
+            let mentions = context.parseMentions(from: packet.content)
             let message = BitchatMessage(
                 id: packet.messageID,
                 sender: senderName,
@@ -201,24 +329,24 @@ private extension ChatTransportEventCoordinator {
                 isRelay: false,
                 originalSender: nil,
                 isPrivate: true,
-                recipientNickname: viewModel.nickname,
+                recipientNickname: context.nickname,
                 senderPeerID: peerID,
                 mentions: mentions.isEmpty ? nil : mentions
             )
-            viewModel.handlePrivateMessage(message)
-            viewModel.meshService.sendDeliveryAck(for: packet.messageID, to: peerID)
+            context.handlePrivateMessage(message)
+            context.sendMeshDeliveryAck(for: packet.messageID, to: peerID)
 
         case .delivered:
             guard let messageID = String(data: payload, encoding: .utf8) else { return }
 
-            let name = deliveryStatusName(for: peerID, in: viewModel)
-            let didUpdate = viewModel.deliveryCoordinator.updateMessageDeliveryStatus(
+            let name = deliveryStatusName(for: peerID, in: context)
+            let didUpdate = context.applyMessageDeliveryStatus(
                 messageID,
                 status: .delivered(to: name, at: Date())
             )
 
             if !didUpdate {
-                if case .read? = viewModel.deliveryCoordinator.deliveryStatus(for: messageID) {
+                if case .read? = context.deliveryStatus(for: messageID) {
                     SecureLogger.debug("📬 Ignored stale delivered ACK for already-read message id=\(messageID.prefix(8))… from \(peerID.id.prefix(8))…", category: .session)
                 } else {
                     SecureLogger.debug("📬 Delivered ACK for unknown message id=\(messageID.prefix(8))… from \(peerID.id.prefix(8))…", category: .session)
@@ -228,8 +356,8 @@ private extension ChatTransportEventCoordinator {
         case .readReceipt:
             guard let messageID = String(data: payload, encoding: .utf8) else { return }
 
-            let name = deliveryStatusName(for: peerID, in: viewModel)
-            let didUpdate = viewModel.deliveryCoordinator.updateMessageDeliveryStatus(
+            let name = deliveryStatusName(for: peerID, in: context)
+            let didUpdate = context.applyMessageDeliveryStatus(
                 messageID,
                 status: .read(by: name, at: Date())
             )
@@ -239,15 +367,20 @@ private extension ChatTransportEventCoordinator {
             }
 
         case .verifyChallenge:
-            viewModel.verificationCoordinator.handleVerifyChallengePayload(from: peerID, payload: payload)
+            context.handleVerifyChallengePayload(from: peerID, payload: payload)
 
         case .verifyResponse:
-            viewModel.verificationCoordinator.handleVerifyResponsePayload(from: peerID, payload: payload)
+            context.handleVerifyResponsePayload(from: peerID, payload: payload)
+
+        case .bulkTransferOffer, .bulkTransferResponse:
+            // Wi-Fi bulk negotiation is consumed inside the mesh transport
+            // (BLEService); it never reaches the UI layer.
+            break
         }
     }
 
     @MainActor
-    func deliveryStatusName(for peerID: PeerID, in viewModel: ChatViewModel) -> String {
-        viewModel.unifiedPeerService.getPeer(by: peerID)?.nickname ?? viewModel.resolveNickname(for: peerID)
+    func deliveryStatusName(for peerID: PeerID, in context: any ChatTransportEventContext) -> String {
+        context.unifiedPeer(for: peerID)?.nickname ?? context.resolveNickname(for: peerID)
     }
 }

bitchat/ViewModels/ChatVerificationCoordinator.swift

@@ -3,6 +3,124 @@ import BitLogger
 import Foundation
 import Security
 
+/// The narrow surface `ChatVerificationCoordinator` needs from its owner.
+///
+/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
+/// minimal context it actually uses instead of holding an `unowned` back-ref
+/// to the whole `ChatViewModel`. This keeps the coordinator independently
+/// testable (see `ChatVerificationCoordinatorContextTests`) and makes its true
+/// dependencies explicit.
+@MainActor
+protocol ChatVerificationContext: AnyObject {
+    // MARK: Fingerprints & verification state
+    func getFingerprint(for peerID: PeerID) -> String?
+    /// The UI-facing verified-fingerprint set (peer identity store backed).
+    var verifiedFingerprints: Set<String> { get set }
+    /// The persisted verified-fingerprint set from the identity manager.
+    func persistedVerifiedFingerprints() -> Set<String>
+    /// Persists the verified flag in the identity manager.
+    func setIdentityVerified(fingerprint: String, verified: Bool)
+    /// Updates the UI-facing verified flag in the peer identity store.
+    func setStoredVerified(_ fingerprint: String, verified: Bool)
+    func isVerifiedFingerprint(_ fingerprint: String) -> Bool
+    func saveIdentityState()
+
+    // MARK: Encryption status
+    func setEncryptionStatus(_ status: EncryptionStatus?, for peerID: PeerID)
+    func updateEncryptionStatus(for peerID: PeerID)
+    func invalidateEncryptionCache(for peerID: PeerID?)
+    /// Signals that verification state changed so observers refresh (e.g. `objectWillChange.send()`).
+    func notifyUIChanged()
+
+    // MARK: Peers
+    var unifiedPeers: [BitchatPeer] { get }
+    var unifiedFavorites: [BitchatPeer] { get }
+    /// The peer's current entry in the unified peer service, if known.
+    func unifiedPeer(for peerID: PeerID) -> BitchatPeer?
+    func unifiedFingerprint(for peerID: PeerID) -> String?
+    func resolveNickname(for peerID: PeerID) -> String
+    func cachedStablePeerID(for shortPeerID: PeerID) -> PeerID?
+    func cacheStablePeerID(_ stablePeerID: PeerID, for shortPeerID: PeerID)
+
+    // MARK: Noise sessions & verification transport
+    /// Installs the Noise service's session callbacks (single registration point).
+    func installNoiseSessionCallbacks(
+        onPeerAuthenticated: @escaping (PeerID, String) -> Void,
+        onHandshakeRequired: @escaping (PeerID) -> Void
+    )
+    /// Resolves the peer's Noise static key from the active Noise session, if any.
+    func noiseSessionPublicKeyData(for peerID: PeerID) -> Data?
+    /// Our own Noise static public key.
+    func noiseStaticPublicKeyData() -> Data
+    func hasEstablishedNoiseSession(with peerID: PeerID) -> Bool
+    func triggerHandshake(with peerID: PeerID)
+    func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data)
+    func sendVerifyResponse(to peerID: PeerID, noiseKeyHex: String, nonceA: Data)
+
+    // MARK: Notifications (shared with `ChatNostrContext`)
+    /// Posts a generic local user notification.
+    func postLocalNotification(title: String, body: String, identifier: String)
+}
+
+extension ChatViewModel: ChatVerificationContext {
+    // `getFingerprint(for:)`, `verifiedFingerprints`, `saveIdentityState()`,
+    // `updateEncryptionStatus(for:)`, `invalidateEncryptionCache(for:)`,
+    // `notifyUIChanged()`, `unifiedPeer(for:)`, `unifiedFingerprint(for:)`,
+    // `isVerifiedFingerprint(_:)`, `setEncryptionStatus(_:for:)`,
+    // `resolveNickname(for:)`, `cachedStablePeerID(for:)`,
+    // `cacheStablePeerID(_:for:)`, `noiseSessionPublicKeyData(for:)`,
+    // `hasEstablishedNoiseSession(with:)`, and `triggerHandshake(with:)` are
+    // shared requirements with the other contexts or satisfied by existing
+    // `ChatViewModel` members. The members below flatten nested service
+    // accesses into intent-named calls.
+
+    func persistedVerifiedFingerprints() -> Set<String> {
+        identityManager.getVerifiedFingerprints()
+    }
+
+    func setIdentityVerified(fingerprint: String, verified: Bool) {
+        identityManager.setVerified(fingerprint: fingerprint, verified: verified)
+    }
+
+    func setStoredVerified(_ fingerprint: String, verified: Bool) {
+        peerIdentityStore.setVerified(fingerprint, verified: verified)
+    }
+
+    var unifiedPeers: [BitchatPeer] {
+        unifiedPeerService.peers
+    }
+
+    var unifiedFavorites: [BitchatPeer] {
+        unifiedPeerService.favorites
+    }
+
+    func installNoiseSessionCallbacks(
+        onPeerAuthenticated: @escaping (PeerID, String) -> Void,
+        onHandshakeRequired: @escaping (PeerID) -> Void
+    ) {
+        meshService.installNoiseSessionCallbacks(
+            onPeerAuthenticated: onPeerAuthenticated,
+            onHandshakeRequired: onHandshakeRequired
+        )
+    }
+
+    func noiseStaticPublicKeyData() -> Data {
+        meshService.noiseStaticPublicKeyData()
+    }
+
+    func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {
+        meshService.sendVerifyChallenge(to: peerID, noiseKeyHex: noiseKeyHex, nonceA: nonceA)
+    }
+
+    func sendVerifyResponse(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {
+        meshService.sendVerifyResponse(to: peerID, noiseKeyHex: noiseKeyHex, nonceA: nonceA)
+    }
+
+    func postLocalNotification(title: String, body: String, identifier: String) {
+        NotificationService.shared.sendLocalNotification(title: title, body: body, identifier: identifier)
+    }
+}
+
 @MainActor
 final class ChatVerificationCoordinator {
     struct PendingVerification {
@@ -13,44 +131,44 @@ final class ChatVerificationCoordinator {
         var sent: Bool
     }
 
-    private unowned let viewModel: ChatViewModel
+    private unowned let context: any ChatVerificationContext
     private var pendingQRVerifications: [PeerID: PendingVerification] = [:]
     private var lastVerifyNonceByPeer: [PeerID: Data] = [:]
     private var lastInboundVerifyChallengeAt: [String: Date] = [:]
     private var lastMutualToastAt: [String: Date] = [:]
 
-    init(viewModel: ChatViewModel) {
-        self.viewModel = viewModel
+    init(context: any ChatVerificationContext) {
+        self.context = context
     }
 
     func verifyFingerprint(for peerID: PeerID) {
-        guard let fingerprint = viewModel.getFingerprint(for: peerID) else { return }
+        guard let fingerprint = context.getFingerprint(for: peerID) else { return }
 
-        viewModel.identityManager.setVerified(fingerprint: fingerprint, verified: true)
-        viewModel.saveIdentityState()
-        viewModel.peerIdentityStore.setVerified(fingerprint, verified: true)
-        viewModel.updateEncryptionStatus(for: peerID)
+        context.setIdentityVerified(fingerprint: fingerprint, verified: true)
+        context.saveIdentityState()
+        context.setStoredVerified(fingerprint, verified: true)
+        context.updateEncryptionStatus(for: peerID)
     }
 
     func unverifyFingerprint(for peerID: PeerID) {
-        guard let fingerprint = viewModel.getFingerprint(for: peerID) else { return }
-        viewModel.identityManager.setVerified(fingerprint: fingerprint, verified: false)
-        viewModel.saveIdentityState()
-        viewModel.peerIdentityStore.setVerified(fingerprint, verified: false)
-        viewModel.updateEncryptionStatus(for: peerID)
+        guard let fingerprint = context.getFingerprint(for: peerID) else { return }
+        context.setIdentityVerified(fingerprint: fingerprint, verified: false)
+        context.saveIdentityState()
+        context.setStoredVerified(fingerprint, verified: false)
+        context.updateEncryptionStatus(for: peerID)
     }
 
     func loadVerifiedFingerprints() {
-        viewModel.peerIdentityStore.setVerifiedFingerprints(viewModel.identityManager.getVerifiedFingerprints())
-        let sample = Array(viewModel.peerIdentityStore.verifiedFingerprints.prefix(TransportConfig.uiFingerprintSampleCount))
+        context.verifiedFingerprints = context.persistedVerifiedFingerprints()
+        let sample = Array(context.verifiedFingerprints.prefix(TransportConfig.uiFingerprintSampleCount))
             .map { $0.prefix(8) }
             .joined(separator: ", ")
-        SecureLogger.info("🔐 Verified loaded: \(viewModel.peerIdentityStore.verifiedFingerprints.count) [\(sample)]", category: .security)
+        SecureLogger.info("🔐 Verified loaded: \(context.verifiedFingerprints.count) [\(sample)]", category: .security)
 
-        let offlineFavorites = viewModel.unifiedPeerService.favorites.filter { !$0.isConnected }
+        let offlineFavorites = context.unifiedFavorites.filter { !$0.isConnected }
         for favorite in offlineFavorites {
-            let fingerprint = viewModel.unifiedPeerService.getFingerprint(for: favorite.peerID)
-            let isVerified = fingerprint.flatMap { viewModel.peerIdentityStore.isVerified($0) } ?? false
+            let fingerprint = context.unifiedFingerprint(for: favorite.peerID)
+            let isVerified = fingerprint.flatMap { context.isVerifiedFingerprint($0) } ?? false
             let shortFingerprint = fingerprint?.prefix(8) ?? "nil"
             SecureLogger.info(
                 "⭐️ Favorite offline: \(favorite.nickname) fp=\(shortFingerprint) verified=\(isVerified)",
@@ -58,62 +176,61 @@ final class ChatVerificationCoordinator {
             )
         }
 
-        viewModel.invalidateEncryptionCache()
-        viewModel.objectWillChange.send()
+        context.invalidateEncryptionCache(for: nil)
+        context.notifyUIChanged()
     }
 
     func setupNoiseCallbacks() {
-        let noiseService = viewModel.meshService.getNoiseService()
+        context.installNoiseSessionCallbacks(
+            onPeerAuthenticated: { [weak self] peerID, fingerprint in
+                DispatchQueue.main.async { [weak self] in
+                    guard let self else { return }
 
-        noiseService.onPeerAuthenticated = { [weak self] peerID, fingerprint in
-            DispatchQueue.main.async {
-                guard let self else { return }
+                    SecureLogger.debug("🔐 Authenticated: \(peerID)", category: .security)
 
-                SecureLogger.debug("🔐 Authenticated: \(peerID)", category: .security)
+                    if self.context.isVerifiedFingerprint(fingerprint) {
+                        self.context.setEncryptionStatus(.noiseVerified, for: peerID)
+                    } else {
+                        self.context.setEncryptionStatus(.noiseSecured, for: peerID)
+                    }
 
-                if self.viewModel.peerIdentityStore.isVerified(fingerprint) {
-                    self.viewModel.peerIdentityStore.setEncryptionStatus(.noiseVerified, for: peerID)
-                } else {
-                    self.viewModel.peerIdentityStore.setEncryptionStatus(.noiseSecured, for: peerID)
+                    self.context.invalidateEncryptionCache(for: peerID)
+
+                    if self.context.cachedStablePeerID(for: peerID) == nil,
+                       let keyData = self.context.noiseSessionPublicKeyData(for: peerID) {
+                        let stablePeerID = PeerID(hexData: keyData)
+                        self.context.cacheStablePeerID(stablePeerID, for: peerID)
+                        SecureLogger.debug(
+                            "🗺️ Mapped short peerID to Noise key for header continuity: \(peerID) -> \(stablePeerID.id.prefix(8))…",
+                            category: .session
+                        )
+                    }
+
+                    if var pending = self.pendingQRVerifications[peerID], pending.sent == false {
+                        self.context.sendVerifyChallenge(
+                            to: peerID,
+                            noiseKeyHex: pending.noiseKeyHex,
+                            nonceA: pending.nonceA
+                        )
+                        pending.sent = true
+                        self.pendingQRVerifications[peerID] = pending
+                        SecureLogger.debug("📤 Sent deferred verify challenge to \(peerID) after handshake", category: .security)
+                    }
                 }
-
-                self.viewModel.invalidateEncryptionCache(for: peerID)
-
-                if self.viewModel.cachedStablePeerID(for: peerID) == nil,
-                   let keyData = self.viewModel.meshService.getNoiseService().getPeerPublicKeyData(peerID) {
-                    let stablePeerID = PeerID(hexData: keyData)
-                    self.viewModel.cacheStablePeerID(stablePeerID, for: peerID)
-                    SecureLogger.debug(
-                        "🗺️ Mapped short peerID to Noise key for header continuity: \(peerID) -> \(stablePeerID.id.prefix(8))…",
-                        category: .session
-                    )
-                }
-
-                if var pending = self.pendingQRVerifications[peerID], pending.sent == false {
-                    self.viewModel.meshService.sendVerifyChallenge(
-                        to: peerID,
-                        noiseKeyHex: pending.noiseKeyHex,
-                        nonceA: pending.nonceA
-                    )
-                    pending.sent = true
-                    self.pendingQRVerifications[peerID] = pending
-                    SecureLogger.debug("📤 Sent deferred verify challenge to \(peerID) after handshake", category: .security)
+            },
+            onHandshakeRequired: { [weak self] peerID in
+                DispatchQueue.main.async { [weak self] in
+                    guard let self else { return }
+                    self.context.setEncryptionStatus(.noiseHandshaking, for: peerID)
+                    self.context.invalidateEncryptionCache(for: peerID)
                 }
             }
-        }
-
-        noiseService.onHandshakeRequired = { [weak self] peerID in
-            DispatchQueue.main.async {
-                guard let self else { return }
-                self.viewModel.peerIdentityStore.setEncryptionStatus(.noiseHandshaking, for: peerID)
-                self.viewModel.invalidateEncryptionCache(for: peerID)
-            }
-        }
+        )
     }
 
     func beginQRVerification(with qr: VerificationService.VerificationQR) -> Bool {
         let targetNoise = qr.noiseKeyHex.lowercased()
-        guard let peer = viewModel.unifiedPeerService.peers.first(where: {
+        guard let peer = context.unifiedPeers.first(where: {
             $0.noisePublicKey.hexEncodedString().lowercased() == targetNoise
         }) else {
             return false
@@ -135,13 +252,12 @@ final class ChatVerificationCoordinator {
         )
         pendingQRVerifications[peerID] = pending
 
-        let noise = viewModel.meshService.getNoiseService()
-        if noise.hasEstablishedSession(with: peerID) {
-            viewModel.meshService.sendVerifyChallenge(to: peerID, noiseKeyHex: qr.noiseKeyHex, nonceA: nonce)
+        if context.hasEstablishedNoiseSession(with: peerID) {
+            context.sendVerifyChallenge(to: peerID, noiseKeyHex: qr.noiseKeyHex, nonceA: nonce)
             pending.sent = true
             pendingQRVerifications[peerID] = pending
         } else {
-            viewModel.meshService.triggerHandshake(with: peerID)
+            context.triggerHandshake(with: peerID)
         }
 
         return true
@@ -150,9 +266,7 @@ final class ChatVerificationCoordinator {
     func handleVerifyChallengePayload(from peerID: PeerID, payload: Data) {
         guard let challenge = VerificationService.shared.parseVerifyChallenge(payload) else { return }
 
-        let myNoiseHex = viewModel.meshService
-            .getNoiseService()
-            .getStaticPublicKeyData()
+        let myNoiseHex = context.noiseStaticPublicKeyData()
             .hexEncodedString()
             .lowercased()
         guard challenge.noiseKeyHex.lowercased() == myNoiseHex else { return }
@@ -160,22 +274,22 @@ final class ChatVerificationCoordinator {
 
         lastVerifyNonceByPeer[peerID] = challenge.nonceA
 
-        if let fingerprint = viewModel.getFingerprint(for: peerID) {
+        if let fingerprint = context.getFingerprint(for: peerID) {
             lastInboundVerifyChallengeAt[fingerprint] = Date()
 
-            if viewModel.peerIdentityStore.isVerified(fingerprint) {
+            if context.isVerifiedFingerprint(fingerprint) {
                 maybeSendMutualVerificationNotification(
                     fingerprint: fingerprint,
                     peerID: peerID,
                     title: "Mutual verification",
-                    bodyName: viewModel.unifiedPeerService.getPeer(by: peerID)?.nickname
-                        ?? viewModel.resolveNickname(for: peerID),
+                    bodyName: context.unifiedPeer(for: peerID)?.nickname
+                        ?? context.resolveNickname(for: peerID),
                     notificationPrefix: "verify-mutual"
                 )
             }
         }
 
-        viewModel.meshService.sendVerifyResponse(
+        context.sendVerifyResponse(
             to: peerID,
             noiseKeyHex: challenge.noiseKeyHex,
             nonceA: challenge.nonceA
@@ -198,17 +312,17 @@ final class ChatVerificationCoordinator {
 
         pendingQRVerifications.removeValue(forKey: peerID)
 
-        guard let fingerprint = viewModel.getFingerprint(for: peerID) else { return }
+        guard let fingerprint = context.getFingerprint(for: peerID) else { return }
 
         let shortFingerprint = fingerprint.prefix(8)
         SecureLogger.info("🔐 Marking verified fingerprint: \(shortFingerprint)", category: .security)
-        viewModel.identityManager.setVerified(fingerprint: fingerprint, verified: true)
-        viewModel.saveIdentityState()
-        viewModel.peerIdentityStore.setVerified(fingerprint, verified: true)
+        context.setIdentityVerified(fingerprint: fingerprint, verified: true)
+        context.saveIdentityState()
+        context.setStoredVerified(fingerprint, verified: true)
 
-        let peerName = viewModel.unifiedPeerService.getPeer(by: peerID)?.nickname
-            ?? viewModel.resolveNickname(for: peerID)
-        NotificationService.shared.sendLocalNotification(
+        let peerName = context.unifiedPeer(for: peerID)?.nickname
+            ?? context.resolveNickname(for: peerID)
+        context.postLocalNotification(
             title: "Verified",
             body: "You verified \(peerName)",
             identifier: "verify-success-\(peerID)-\(UUID().uuidString)"
@@ -225,7 +339,7 @@ final class ChatVerificationCoordinator {
             )
         }
 
-        viewModel.updateEncryptionStatus(for: peerID)
+        context.updateEncryptionStatus(for: peerID)
     }
 }
 
@@ -242,7 +356,7 @@ private extension ChatVerificationCoordinator {
         guard now.timeIntervalSince(lastToast) > 60 else { return }
 
         lastMutualToastAt[fingerprint] = now
-        NotificationService.shared.sendLocalNotification(
+        context.postLocalNotification(
             title: title,
             body: "You and \(bodyName) verified each other",
             identifier: "\(notificationPrefix)-\(peerID)-\(UUID().uuidString)"

bitchat/ViewModels/ChatViewModel.swift

@@ -119,9 +119,27 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
 
     // MARK: - Published Properties
 
-    @Published var messages: [BitchatMessage] = []
+    /// Read-only derived view of the ACTIVE public channel's conversation in
+    /// the single-writer `ConversationStore`. SwiftUI renders through
+    /// `PublicChatModel` (which observes the `Conversation` object directly);
+    /// this view serves the coordinators/commands that need "the visible
+    /// timeline" plus tests. Hot enough that the array is cached and
+    /// invalidated from the store's `changes` subject (filtered to the
+    /// active conversation) and on channel switches. `objectWillChange`
+    /// fires on every store change via the sink in `init`.
+    @MainActor
+    var messages: [BitchatMessage] {
+        if let cached = visibleMessagesCache { return cached }
+        // Read-only lookup (never creates the conversation): this getter
+        // runs during SwiftUI renders, where mutating the store's
+        // `@Published` collections would publish mid-view-update.
+        let current = conversations.conversationsByID[ConversationID(channelID: activeChannel)]?.messages ?? []
+        visibleMessagesCache = current
+        return current
+    }
+    private var visibleMessagesCache: [BitchatMessage]?
     @Published var currentColorScheme: ColorScheme = .light
-    private let maxMessages = TransportConfig.meshTimelineCap // Maximum messages before oldest are removed
+    @Published var currentTheme: AppTheme = .matrix
     @Published var isConnected = false
     @Published var nickname: String = "" {
         didSet {
@@ -146,31 +164,39 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     let unifiedPeerService: UnifiedPeerService
     let autocompleteService: AutocompleteService
     let deduplicationService: MessageDeduplicationService  // internal for test access
-    private lazy var outgoingCoordinator = ChatOutgoingCoordinator(viewModel: self)
-    private lazy var lifecycleCoordinator = ChatLifecycleCoordinator(viewModel: self)
-    private lazy var transportEventCoordinator = ChatTransportEventCoordinator(viewModel: self)
-    private lazy var peerListCoordinator = ChatPeerListCoordinator(viewModel: self)
+    private lazy var outgoingCoordinator = ChatOutgoingCoordinator(context: self)
+    private lazy var lifecycleCoordinator = ChatLifecycleCoordinator(context: self)
+    private lazy var transportEventCoordinator = ChatTransportEventCoordinator(context: self)
+    private lazy var peerListCoordinator = ChatPeerListCoordinator(context: self)
     private lazy var messageFormatter = ChatMessageFormatter(viewModel: self)
-    lazy var peerIdentityCoordinator = ChatPeerIdentityCoordinator(viewModel: self)
-    lazy var deliveryCoordinator = ChatDeliveryCoordinator(viewModel: self)
-    lazy var composerCoordinator = ChatComposerCoordinator(viewModel: self)
-    lazy var publicConversationCoordinator = ChatPublicConversationCoordinator(viewModel: self)
-    lazy var privateConversationCoordinator = ChatPrivateConversationCoordinator(viewModel: self)
-    lazy var nostrCoordinator = ChatNostrCoordinator(viewModel: self)
-    lazy var mediaTransferCoordinator = ChatMediaTransferCoordinator(viewModel: self)
-    lazy var verificationCoordinator = ChatVerificationCoordinator(viewModel: self)
+    lazy var peerIdentityCoordinator = ChatPeerIdentityCoordinator(context: self)
+    lazy var deliveryCoordinator = ChatDeliveryCoordinator(context: self)
+    lazy var composerCoordinator = ChatComposerCoordinator(context: self)
+    lazy var publicConversationCoordinator = ChatPublicConversationCoordinator(context: self)
+    lazy var privateConversationCoordinator = ChatPrivateConversationCoordinator(context: self)
+    lazy var nostrCoordinator = ChatNostrCoordinator(context: self)
+    lazy var mediaTransferCoordinator = ChatMediaTransferCoordinator(context: self)
+    lazy var verificationCoordinator = ChatVerificationCoordinator(context: self)
 
     // Computed properties for compatibility
     @MainActor
     var connectedPeers: Set<PeerID> { unifiedPeerService.connectedPeerIDs }
     @Published var allPeers: [BitchatPeer] = []
+
+    /// Read-only derived view of all direct conversations in the
+    /// `ConversationStore`, keyed by routing peer ID. Serves the coordinator
+    /// reads that genuinely need the whole dictionary (migration scans,
+    /// unread resolution); simple per-peer reads go through
+    /// `privateMessages(for:)` instead. All mutations go through the
+    /// private-chat intent ops below. Rebuilt per access —
+    /// O(#conversations) thanks to COW message arrays; measured equal to a
+    /// change-invalidated cache on `pipeline.privateIngest`, so the simpler
+    /// form wins.
+    @MainActor
     var privateChats: [PeerID: [BitchatMessage]] {
-        get { privateChatManager.privateChats }
-        set {
-            privateChatManager.privateChats = newValue
-            synchronizePrivateConversationStore()
-        }
+        conversations.directMessagesByRoutingPeerID()
     }
+    @MainActor
     var selectedPrivateChatPeer: PeerID? {
         get { privateChatManager.selectedPeer }
         set {
@@ -179,19 +205,17 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
             } else {
                 privateChatManager.endChat()
             }
-            synchronizePrivateConversationStore()
-            synchronizeConversationSelectionStore()
         }
     }
+    /// Read-only derived view of the store's unread direct conversations.
+    /// Mutate via `markPrivateChatUnread(_:)` / `markPrivateChatRead(_:)`.
+    @MainActor
     var unreadPrivateMessages: Set<PeerID> {
-        get { privateChatManager.unreadMessages }
-        set {
-            privateChatManager.unreadMessages = newValue
-            synchronizePrivateConversationStore()
-        }
+        conversations.unreadDirectRoutingPeerIDs()
     }
 
     /// Check if there are any unread messages (including from temporary Nostr peer IDs)
+    @MainActor
     var hasAnyUnreadMessages: Bool {
         !unreadPrivateMessages.isEmpty
     }
@@ -219,7 +243,7 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         if let mapped = peerIdentityStore.stablePeerID(forShortID: shortPeerID) { return mapped }
         // Fallback: derive from active Noise session if available
         if shortPeerID.id.count == 16,
-           let key = meshService.getNoiseService().getPeerPublicKeyData(shortPeerID) {
+           let key = meshService.noiseSessionPublicKeyData(for: shortPeerID) {
             let stable = PeerID(hexData: key)
             peerIdentityStore.setStablePeerID(stable, forShortID: shortPeerID)
             return stable
@@ -270,8 +294,10 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     let meshService: Transport
     let idBridge: NostrIdentityBridge
     let identityManager: SecureIdentityStateManagerProtocol
-    let conversationStore: ConversationStore
-    let identityResolver: IdentityResolver
+    /// Single source of truth for conversation message state and selection
+    /// (docs/CONVERSATION-STORE-DESIGN.md). Owned by `AppRuntime` and passed
+    /// through.
+    let conversations: ConversationStore
     let peerIdentityStore: PeerIdentityStore
     let locationPresenceStore: LocationPresenceStore
     let locationManager: LocationChannelManager
@@ -282,18 +308,17 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     private let nicknameKey = "bitchat.nickname"
     // Location channel state (macOS supports manual geohash selection)
     var activeChannel: ChannelID {
-        get { conversationStore.activeChannel }
+        get { conversations.activeChannel }
         set {
-            guard conversationStore.activeChannel != newValue else { return }
-            publicMessagePipeline.updateActiveChannel(newValue)
-            conversationStore.setActiveChannel(newValue)
-            synchronizePublicConversationStore(for: newValue)
-            synchronizeConversationSelectionStore()
+            guard conversations.activeChannel != newValue else { return }
+            conversations.setActiveChannel(newValue)
+            visibleMessagesCache = nil
             objectWillChange.send()
         }
     }
-    var geoSubscriptionID: String? = nil
-    var geoDmSubscriptionID: String? = nil
+    // Single-writer: mutate only via `setGeoChatSubscriptionID(_:)` / `setGeoDmSubscriptionID(_:)` below.
+    private(set) var geoSubscriptionID: String? = nil
+    private(set) var geoDmSubscriptionID: String? = nil
     var currentGeohash: String? {
         get { locationPresenceStore.currentGeohash }
         set { locationPresenceStore.setCurrentGeohash(newValue) }
@@ -338,11 +363,6 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     @Published var bluetoothAlertMessage = ""
     @Published var bluetoothState: CBManagerState = .unknown
 
-    var timelineStore = PublicTimelineStore(
-        meshCap: TransportConfig.meshTimelineCap,
-        geohashCap: TransportConfig.geoTimelineCap
-    )
-
     private func performDeliveryUpdate(_ update: @escaping @MainActor (ChatDeliveryCoordinator) -> Void) {
         if Thread.isMainThread {
             MainActor.assumeIsolated {
@@ -366,7 +386,8 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         set { locationPresenceStore.replaceTeleportedGeo(newValue) }
     }  // lowercased pubkey hex
     // Sampling subscriptions for multiple geohashes (when channel sheet is open)
-    var geoSamplingSubs: [String: String] = [:] // subID -> geohash
+    // Single-writer: mutate only via `addGeoSamplingSub` / `removeGeoSamplingSub` / `clearGeoSamplingSubs` below.
+    private(set) var geoSamplingSubs: [String: String] = [:] // subID -> geohash
     var lastGeoNotificationAt: [String: Date] = [:] // geohash -> last notify time
 
     // MARK: - Message Delivery Tracking
@@ -383,7 +404,25 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
 
     // MARK: - Public message batching (UI perf)
     let publicMessagePipeline: PublicMessagePipeline
-    @Published var isBatchingPublic: Bool = false
+    // Single-writer: mutate only via `setPublicBatching(_:)` below.
+    @Published private(set) var isBatchingPublic: Bool = false
+
+    // Backing store for `sentReadReceipts` persistence. `.standard` in
+    // production; injectable so tests can use a scratch suite that does not
+    // leak state between runs.
+    let readReceiptsDefaults: UserDefaults
+
+    /// Default read-receipt persistence store. Production uses `.standard`.
+    /// Under test, a dedicated scratch suite is used instead — wiped at first
+    /// use per process — so back-to-back local test runs never see each
+    /// other's persisted receipts (and tests never pollute `.standard`).
+    static let defaultReadReceiptsDefaults: UserDefaults = {
+        guard TestEnvironment.isRunningTests else { return .standard }
+        let suiteName = "chat.bitchat.tests.readReceipts"
+        guard let scratch = UserDefaults(suiteName: suiteName) else { return .standard }
+        scratch.removePersistentDomain(forName: suiteName)
+        return scratch
+    }()
 
     // Track sent read receipts to avoid duplicates (persisted across launches)
     // Note: Persistence happens automatically in didSet, no lifecycle observers needed
@@ -392,9 +431,9 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
             // Only persist if there are changes
             guard oldValue != sentReadReceipts else { return }
 
-            // Persist to UserDefaults whenever it changes (no manual synchronize/verify re-read)
+            // Persist whenever it changes (no manual synchronize/verify re-read)
             if let data = try? JSONEncoder().encode(Array(sentReadReceipts)) {
-                UserDefaults.standard.set(data, forKey: "sentReadReceipts")
+                readReceiptsDefaults.set(data, forKey: "sentReadReceipts")
             } else {
                 SecureLogger.error("❌ Failed to encode read receipts for persistence", category: .session)
             }
@@ -402,15 +441,316 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     }
 
     // Track which GeoDM messages we've already sent a delivery ACK for (by messageID)
-    var sentGeoDeliveryAcks: Set<String> = []
+    // Single-writer: mutate only via `markGeoDeliveryAckSent(_:)` below.
+    private(set) var sentGeoDeliveryAcks: Set<String> = []
 
     // Track app startup phase to prevent marking old messages as unread
     var isStartupPhase = true
+
+    // ConversationStore field audit bookkeeping (see auditConversationStore()):
+    // runs on the read-receipt cleanup cadence, heartbeat sampled first +
+    // every `TransportConfig.conversationStoreAuditLogInterval`th audit.
+    private var storeAuditCount = 0
+    private var storeAuditLastAppendCount = 0
     // Announce Tor initial readiness once per launch to avoid duplicates
     var torInitialReadyAnnounced: Bool = false
 
     // Track Nostr pubkey mappings for unknown senders
-    var nostrKeyMapping: [PeerID: String] = [:]  // senderPeerID -> nostrPubkey
+    // Single-writer: mutate only via `registerNostrKeyMapping` / `removeNostrKeyMappings` below.
+    private(set) var nostrKeyMapping: [PeerID: String] = [:]  // senderPeerID -> nostrPubkey
+
+    // MARK: - Single-Writer Intent Operations
+    // Owner-side mutation paths for state the coordinator contexts may read
+    // but not write directly. Each op is the sole way to mutate its backing
+    // state, so check-then-mutate races between coordinators cannot occur.
+
+    /// Records the Nostr pubkey behind a (possibly virtual) peer ID.
+    @MainActor
+    func registerNostrKeyMapping(_ pubkey: String, for peerID: PeerID) {
+        nostrKeyMapping[peerID] = pubkey
+    }
+
+    /// Drops every key mapping that resolves to the given (lowercased) Nostr pubkey.
+    @MainActor
+    func removeNostrKeyMappings(matchingPubkeyHexLowercased hex: String) {
+        for (key, value) in nostrKeyMapping where value.lowercased() == hex {
+            nostrKeyMapping.removeValue(forKey: key)
+        }
+    }
+
+    /// Records that a read receipt is being sent for `messageID`.
+    /// Returns `false` when one was already recorded — the caller must skip sending.
+    @MainActor
+    @discardableResult
+    func markReadReceiptSent(_ messageID: String) -> Bool {
+        sentReadReceipts.insert(messageID).inserted
+    }
+
+    /// Records that a GeoDM delivery ACK is being sent for `messageID`.
+    /// Returns `false` when one was already recorded — the caller must skip sending.
+    @MainActor
+    @discardableResult
+    func markGeoDeliveryAckSent(_ messageID: String) -> Bool {
+        sentGeoDeliveryAcks.insert(messageID).inserted
+    }
+
+    /// Forgets that read receipts were sent for `ids` so READ acks can be
+    /// re-sent after the peer reconnects.
+    @MainActor
+    func unmarkReadReceiptsSent(_ ids: [String]) {
+        sentReadReceipts.subtract(ids)
+    }
+
+    /// Marks read receipts as sent for own messages already delivered/read in
+    /// `peerID`'s chat, syncing the chat manager's tracking with the persisted
+    /// set. (Wraps the manager's `inout` sync so the raw set never leaks.)
+    @MainActor
+    func syncReadReceiptsForSentMessages(for peerID: PeerID) {
+        privateChatManager.syncReadReceiptsForSentMessages(
+            peerID: peerID,
+            nickname: nickname,
+            externalReceipts: &sentReadReceipts
+        )
+    }
+
+    /// Drops every recorded read receipt whose message ID is no longer valid.
+    /// Returns the number of receipts removed.
+    @MainActor
+    func pruneSentReadReceipts(keeping validMessageIDs: Set<String>) -> Int {
+        let oldCount = sentReadReceipts.count
+        sentReadReceipts = sentReadReceipts.intersection(validMessageIDs)
+        return oldCount - sentReadReceipts.count
+    }
+
+    /// Publishes the public-timeline batching state (UI animation suppression).
+    @MainActor
+    func setPublicBatching(_ isBatching: Bool) {
+        isBatchingPublic = isBatching
+    }
+
+    @MainActor
+    func setGeoChatSubscriptionID(_ id: String?) {
+        geoSubscriptionID = id
+    }
+
+    @MainActor
+    func setGeoDmSubscriptionID(_ id: String?) {
+        geoDmSubscriptionID = id
+    }
+
+    @MainActor
+    func addGeoSamplingSub(_ subID: String, forGeohash geohash: String) {
+        geoSamplingSubs[subID] = geohash
+    }
+
+    @MainActor
+    func removeGeoSamplingSub(_ subID: String) {
+        geoSamplingSubs.removeValue(forKey: subID)
+    }
+
+    /// Clears all sampling subscriptions and returns the removed subscription IDs
+    /// so the caller can unsubscribe them from the relay manager.
+    @MainActor
+    func clearGeoSamplingSubs() -> [String] {
+        let subIDs = Array(geoSamplingSubs.keys)
+        geoSamplingSubs.removeAll()
+        return subIDs
+    }
+
+    /// Moves the open private chat to `newPeerID` when the current selection is
+    /// one of the peer IDs being migrated away (side-effectful: re-targets the
+    /// private chat session — fingerprint refresh, read receipts).
+    ///
+    /// Note: when this runs after a store `migrateConversation`, the store has
+    /// already handed the selection itself off to `newPeerID` (and the manager
+    /// mirrors it), so a selection that reads `newPeerID` is also re-targeted
+    /// to run the session side effects. Selections on unrelated peers are
+    /// untouched.
+    @MainActor
+    func handOffSelectedPrivateChat(from oldPeerIDs: [PeerID], to newPeerID: PeerID) {
+        guard oldPeerIDs.contains(where: { selectedPrivateChatPeer == $0 })
+                || selectedPrivateChatPeer == newPeerID else { return }
+        selectedPrivateChatPeer = newPeerID
+    }
+
+    // MARK: - Private Conversation Store Intents
+    // The sole mutation paths for private (direct) message state. Each op
+    // forwards to the single-writer `ConversationStore`
+    // (docs/CONVERSATION-STORE-DESIGN.md); the read-only `privateChats` /
+    // `unreadPrivateMessages` views above are derived from the same store.
+
+    /// Appends a private message in timestamp order. Returns `false` when a
+    /// message with the same ID is already in that chat (O(1) dedup via the
+    /// conversation's ID index).
+    @MainActor
+    @discardableResult
+    func appendPrivateMessage(_ message: BitchatMessage, to peerID: PeerID) -> Bool {
+        conversations.append(message, to: .directPeer(peerID))
+    }
+
+    /// Replace-or-append a private message by ID (media progress, mirrored
+    /// copies); an existing message keeps its timeline position.
+    @MainActor
+    func upsertPrivateMessage(_ message: BitchatMessage, in peerID: PeerID) {
+        conversations.upsertByID(message, in: .directPeer(peerID))
+    }
+
+    /// Applies a delivery status to a private message by ID. Returns `false`
+    /// when the message is unknown or the update would downgrade the status
+    /// (read beats delivered beats sent).
+    @MainActor
+    @discardableResult
+    func setPrivateDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String, peerID: PeerID) -> Bool {
+        conversations.setDeliveryStatus(status, forMessageID: messageID, in: .directPeer(peerID))
+    }
+
+    /// Flags the peer's chat as unread (store unread state).
+    @MainActor
+    func markPrivateChatUnread(_ peerID: PeerID) {
+        conversations.markUnread(.directPeer(peerID))
+    }
+
+    /// Clears the peer's unread flag (store unread state only; read-receipt
+    /// sending stays in `PrivateChatManager.markAsRead`).
+    @MainActor
+    func markPrivateChatRead(_ peerID: PeerID) {
+        conversations.markRead(.directPeer(peerID))
+    }
+
+    /// Empties the peer's chat but keeps the conversation alive (`/clear`).
+    @MainActor
+    func clearPrivateChat(_ peerID: PeerID) {
+        conversations.clear(.directPeer(peerID))
+    }
+
+    /// Removes the peer's chat entirely, including unread state.
+    @MainActor
+    func removePrivateChat(_ peerID: PeerID) {
+        conversations.removeConversation(.directPeer(peerID))
+    }
+
+    /// Moves all messages from `oldPeerID`'s chat into `newPeerID`'s chat
+    /// (ephemeral↔stable peer-ID handoff): dedups by ID, preserves order,
+    /// carries unread state, removes the old chat.
+    @MainActor
+    func migratePrivateChat(from oldPeerID: PeerID, to newPeerID: PeerID) {
+        conversations.migrateConversation(from: .directPeer(oldPeerID), to: .directPeer(newPeerID))
+    }
+
+    /// A single private chat's timeline, read straight from the store —
+    /// an O(1) lookup that skips the `privateChats` dictionary build. The
+    /// context protocols' simple per-peer reads dispatch here.
+    @MainActor
+    func privateMessages(for peerID: PeerID) -> [BitchatMessage] {
+        conversations.conversationsByID[.directPeer(peerID)]?.messages ?? []
+    }
+
+    /// `true` when any private chat contains a message with `messageID`
+    /// (O(1) per conversation via the store's ID indexes).
+    @MainActor
+    func privateChatsContainMessage(withID messageID: String) -> Bool {
+        conversations.directConversationsContainMessage(withID: messageID)
+    }
+
+    /// `true` when `peerID`'s chat contains a message with `messageID`.
+    @MainActor
+    func privateChat(_ peerID: PeerID, containsMessageWithID messageID: String) -> Bool {
+        conversations.conversationsByID[.directPeer(peerID)]?.containsMessage(withID: messageID) ?? false
+    }
+
+    /// Removes a message by ID from every private chat that contains it,
+    /// dropping chats that become empty. Returns the removed message, if any.
+    @MainActor
+    @discardableResult
+    func removePrivateMessage(withID messageID: String) -> BitchatMessage? {
+        var removed: BitchatMessage?
+        for (id, conversation) in conversations.conversationsByID {
+            guard case .direct = id, conversation.containsMessage(withID: messageID) else { continue }
+            let message = conversations.removeMessage(withID: messageID, from: id)
+            removed = removed ?? message
+            if conversation.messages.isEmpty {
+                conversations.removeConversation(id)
+            }
+        }
+        return removed
+    }
+
+    // MARK: - Public Conversation Store Intents
+    // The sole mutation paths for public (mesh/geohash) message state,
+    // mirroring the private intents above. The store's per-conversation cap
+    // and timestamp-ordered insert replace `PublicTimelineStore`'s trim and
+    // the pipeline's late-insert positioning; the read-only `messages` shim
+    // above is derived from the same store.
+
+    /// Appends a public message in timestamp order. Returns `false` when a
+    /// message with the same ID is already in that conversation (O(1) dedup
+    /// via the conversation's ID index).
+    @MainActor
+    @discardableResult
+    func appendPublicMessage(_ message: BitchatMessage, to conversationID: ConversationID) -> Bool {
+        conversations.append(message, to: conversationID)
+    }
+
+    /// Appends a geohash message if absent. Returns `true` when stored
+    /// (the legacy `PublicTimelineStore.appendIfAbsent` contract).
+    @MainActor
+    @discardableResult
+    func appendGeohashMessageIfAbsent(_ message: BitchatMessage, toGeohash geohash: String) -> Bool {
+        conversations.append(message, to: .geohash(geohash.lowercased()))
+    }
+
+    /// A public (mesh/geohash) channel's full timeline.
+    @MainActor
+    func publicMessages(for channel: ChannelID) -> [BitchatMessage] {
+        conversations.conversation(for: ConversationID(channelID: channel)).messages
+    }
+
+    /// `true` when the conversation contains a message with `messageID`.
+    @MainActor
+    func publicConversationContainsMessage(withID messageID: String, in conversationID: ConversationID) -> Bool {
+        conversations.conversationsByID[conversationID]?.containsMessage(withID: messageID) ?? false
+    }
+
+    /// Removes a message by ID from whichever public conversation contains
+    /// it. Returns the removed message, if any.
+    @MainActor
+    @discardableResult
+    func removePublicMessage(withID messageID: String) -> BitchatMessage? {
+        conversations.removePublicMessage(withID: messageID)
+    }
+
+    /// Removes every message matching `predicate` from a geohash
+    /// conversation (block-user purge).
+    @MainActor
+    func removePublicMessages(fromGeohash geohash: String, where predicate: (BitchatMessage) -> Bool) {
+        conversations.removeMessages(from: .geohash(geohash.lowercased()), where: predicate)
+    }
+
+    /// Empties a public conversation's timeline (`/clear`).
+    @MainActor
+    func clearPublicConversation(_ conversationID: ConversationID) {
+        conversations.clear(conversationID)
+    }
+
+    /// Queues a system message for the next geohash channel visit. (Tiny
+    /// UI-flow queue formerly on `PublicTimelineStore`; it is notice text,
+    /// not conversation state, so it stays on the owner.)
+    @MainActor
+    func queueGeohashSystemMessage(_ content: String) {
+        pendingGeohashSystemMessages.append(content)
+    }
+
+    /// Drains the queued geohash system messages (single consumer:
+    /// `GeohashSubscriptionManager.switchLocationChannel`).
+    @MainActor
+    func drainPendingGeohashSystemMessages() -> [String] {
+        defer { pendingGeohashSystemMessages.removeAll(keepingCapacity: false) }
+        return pendingGeohashSystemMessages
+    }
+
+    // Single-writer: mutate only via `queueGeohashSystemMessage(_:)` /
+    // `drainPendingGeohashSystemMessages()` above.
+    private var pendingGeohashSystemMessages: [String] = []
 
     // MARK: - Initialization
 
@@ -419,24 +759,24 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         keychain: KeychainManagerProtocol,
         idBridge: NostrIdentityBridge,
         identityManager: SecureIdentityStateManagerProtocol,
-        conversationStore: ConversationStore? = nil,
-        identityResolver: IdentityResolver? = nil,
+        conversations: ConversationStore? = nil,
         peerIdentityStore: PeerIdentityStore? = nil,
         locationPresenceStore: LocationPresenceStore? = nil,
         locationManager: LocationChannelManager = .shared
     ) {
-        let conversationStore = conversationStore ?? ConversationStore()
-        let identityResolver = identityResolver ?? IdentityResolver()
+        let meshService = BLEService(keychain: keychain, idBridge: idBridge, identityManager: identityManager)
+        meshService.sfMetrics = .shared
         self.init(
             keychain: keychain,
             idBridge: idBridge,
             identityManager: identityManager,
-            transport: BLEService(keychain: keychain, idBridge: idBridge, identityManager: identityManager),
-            conversationStore: conversationStore,
-            identityResolver: identityResolver,
+            transport: meshService,
+            conversations: conversations,
             peerIdentityStore: peerIdentityStore ?? PeerIdentityStore(),
             locationPresenceStore: locationPresenceStore ?? LocationPresenceStore(),
-            locationManager: locationManager
+            locationManager: locationManager,
+            outboxStore: MessageOutboxStore(keychain: keychain),
+            sfMetrics: .shared
         )
     }
 
@@ -448,28 +788,30 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         idBridge: NostrIdentityBridge,
         identityManager: SecureIdentityStateManagerProtocol,
         transport: Transport,
-        conversationStore: ConversationStore? = nil,
-        identityResolver: IdentityResolver? = nil,
+        conversations: ConversationStore? = nil,
         peerIdentityStore: PeerIdentityStore? = nil,
         locationPresenceStore: LocationPresenceStore? = nil,
-        locationManager: LocationChannelManager = .shared
+        locationManager: LocationChannelManager = .shared,
+        readReceiptsDefaults: UserDefaults? = nil,
+        outboxStore: MessageOutboxStore? = nil,
+        sfMetrics: StoreAndForwardMetrics? = nil
     ) {
-        let conversationStore = conversationStore ?? ConversationStore()
-        let identityResolver = identityResolver ?? IdentityResolver()
+        let conversations = conversations ?? ConversationStore()
         let peerIdentityStore = peerIdentityStore ?? PeerIdentityStore()
         let locationPresenceStore = locationPresenceStore ?? LocationPresenceStore()
         let services = ChatViewModelServiceBundle(
             keychain: keychain,
             idBridge: idBridge,
             identityManager: identityManager,
-            meshService: transport
+            meshService: transport,
+            outboxStore: outboxStore,
+            sfMetrics: sfMetrics
         )
 
         self.keychain = keychain
         self.idBridge = idBridge
         self.identityManager = identityManager
-        self.conversationStore = conversationStore
-        self.identityResolver = identityResolver
+        self.conversations = conversations
         self.peerIdentityStore = peerIdentityStore
         self.locationPresenceStore = locationPresenceStore
         self.locationManager = locationManager
@@ -481,10 +823,27 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         self.autocompleteService = services.autocompleteService
         self.deduplicationService = services.deduplicationService
         self.publicMessagePipeline = services.publicMessagePipeline
-        self.sentReadReceipts = ChatViewModelBootstrapper.loadPersistedReadReceipts()
+        let readReceiptsDefaults = readReceiptsDefaults ?? Self.defaultReadReceiptsDefaults
+        self.readReceiptsDefaults = readReceiptsDefaults
+        self.sentReadReceipts = ChatViewModelBootstrapper.loadPersistedReadReceipts(userDefaults: readReceiptsDefaults)
+
+        // Republish on every store change so SwiftUI observers of the
+        // view model refresh. This replaces the UI-update role of the old
+        // `PrivateChatManager.@Published` dictionaries and the old
+        // `@Published var messages`. Changes touching the ACTIVE public
+        // conversation also invalidate the derived `messages` cache before
+        // observers re-read it.
+        conversations.changes
+            .sink { [weak self] change in
+                guard let self else { return }
+                if self.changeAffectsActivePublicConversation(change) {
+                    self.visibleMessagesCache = nil
+                }
+                self.objectWillChange.send()
+            }
+            .store(in: &cancellables)
 
         ChatViewModelBootstrapper(viewModel: self).configure()
-        initializeConversationStore()
     }
 
     // MARK: - Deinitialization
@@ -637,6 +996,48 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         )
     }
 
+    // Mesh (Noise identity) block helpers. Unlike the `/block <nickname>`
+    // command, these resolve and persist the block by the peer's stable
+    // fingerprint (derived from `peerID`), so the exact tapped peer is
+    // (un)blocked — unambiguous across nickname collisions and functional for
+    // offline peers that can no longer be resolved through the mesh service.
+    @MainActor
+    func blockMeshPeer(peerID: PeerID, displayName: String) {
+        setMeshPeerBlocked(peerID, blocked: true, displayName: displayName)
+    }
+
+    @MainActor
+    func unblockMeshPeer(peerID: PeerID, displayName: String) {
+        setMeshPeerBlocked(peerID, blocked: false, displayName: displayName)
+    }
+
+    @MainActor
+    private func setMeshPeerBlocked(_ peerID: PeerID, blocked: Bool, displayName: String) {
+        guard unifiedPeerService.setBlocked(peerID, blocked: blocked) != nil else {
+            addCommandOutput(
+                String(
+                    format: String(
+                        localized: blocked ? "system.mesh.block_failed" : "system.mesh.unblock_failed",
+                        comment: "System message shown when a mesh peer cannot be blocked or unblocked"
+                    ),
+                    locale: .current,
+                    displayName
+                )
+            )
+            return
+        }
+        addCommandOutput(
+            String(
+                format: String(
+                    localized: blocked ? "system.mesh.blocked" : "system.mesh.unblocked",
+                    comment: "System message shown when a mesh peer is blocked or unblocked"
+                ),
+                locale: .current,
+                displayName
+            )
+        )
+    }
+
     func displayNameForNostrPubkey(_ pubkeyHex: String) -> String {
         publicConversationCoordinator.displayNameForNostrPubkey(pubkeyHex)
     }
@@ -676,8 +1077,7 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
             recipientNickname: meshService.peerNickname(peerID: peerID),
             senderPeerID: meshService.myPeerID
         )
-        if privateChats[peerID] == nil { privateChats[peerID] = [] }
-        privateChats[peerID]?.append(systemMessage)
+        appendPrivateMessage(systemMessage, to: peerID)
         objectWillChange.send()
     }
 
@@ -766,14 +1166,11 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     func panicClearAllData() {
         // Messages are processed immediately - nothing to flush
 
-        // Clear all messages
-        messages.removeAll()
-        timelineStore = PublicTimelineStore(
-            meshCap: TransportConfig.meshTimelineCap,
-            geohashCap: TransportConfig.geoTimelineCap
-        )
-        privateChatManager.privateChats.removeAll()
-        privateChatManager.unreadMessages.removeAll()
+        // Clear all messages (public timelines and private chats live in the
+        // single-writer ConversationStore; the derived `messages` view and
+        // the legacy mirror empty with it)
+        conversations.clearAll()
+        pendingGeohashSystemMessages.removeAll()
 
         // Delete all keychain data (including Noise and Nostr keys)
         _ = keychain.deleteAllKeychainData()
@@ -782,6 +1179,11 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         userDefaults.removeObject(forKey: "bitchat.noiseIdentityKey")
         userDefaults.removeObject(forKey: "bitchat.messageRetentionKey")
 
+        // Wipe persisted location state (selected channel, teleport set,
+        // bookmarks). For an activist-safety wipe, where the user has been is
+        // exactly the data an adversary inspecting the device wants.
+        LocationStateManager.shared.panicWipe()
+
         // Reset nickname to anonymous
         nickname = "anon\(Int.random(in: 1000...9999))"
         saveNickname()
@@ -795,6 +1197,14 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         // Clear persistent favorites from keychain
         FavoritesPersistenceService.shared.clearAllFavorites()
 
+        // Drop courier mail carried for third parties (memory and disk),
+        // our own queued outbox, the carried public history, and the
+        // counters describing all of it
+        CourierStore.shared.wipe()
+        messageRouter.wipeOutbox()
+        GossipMessageArchive.wipeDefault()
+        StoreAndForwardMetrics.shared.reset()
+
         // Identity manager has cleared persisted identity data above
 
         // Clear autocomplete state
@@ -806,13 +1216,25 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         // Clear selected private chat
         selectedPrivateChatPeer = nil
 
+        // Clear live location/geohash session state. Persisted location state
+        // was wiped above, but the running view model can still be scoped to a
+        // geohash channel and hold subscriptions tied to the old Nostr identity.
+        activeChannel = .mesh
+        setGeoChatSubscriptionID(nil)
+        setGeoDmSubscriptionID(nil)
+        _ = clearGeoSamplingSubs()
+        cachedGeohashIdentity = nil
+        nostrKeyMapping.removeAll()
+
         // Clear read receipt tracking
         sentReadReceipts.removeAll()
         deduplicationService.clearAll()
 
         // IMPORTANT: Clear Nostr-related state
-        // Disconnect from Nostr relays and clear subscriptions
-        nostrRelayManager?.disconnect()
+        // Drop relay subscriptions, handlers, pending sends, and replay state.
+        // Geohash DM handlers can capture pre-wipe Nostr identities, so a plain
+        // disconnect is not enough here.
+        NostrRelayManager.shared.resetForPanicWipe()
         nostrRelayManager = nil
 
         // Clear Nostr identity associations
@@ -825,20 +1247,28 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
             bleService.resetIdentityForPanic(currentNickname: nickname)
         }
 
-        initializeConversationStore()
-
         // No need to force UserDefaults synchronization
 
         // Reinitialize Nostr with new identity
-        // This will generate new Nostr keys derived from new Noise keys
-        Task { @MainActor in
-            // Small delay to ensure cleanup completes
-            try? await Task.sleep(nanoseconds: TransportConfig.uiAsyncShortSleepNs) // 0.1 seconds
+        // This will generate new Nostr keys derived from new Noise keys.
+        // Skipped under tests: connecting the shared relay singleton starts
+        // real network/reconnect work that never completes and would keep the
+        // test process alive (the singleton, unlike a discardable instance, is
+        // never deallocated to cancel it).
+        if !TestEnvironment.isRunningTests {
+            Task { @MainActor in
+                // Small delay to ensure cleanup completes
+                try? await Task.sleep(nanoseconds: TransportConfig.uiAsyncShortSleepNs) // 0.1 seconds
 
-            // Reinitialize Nostr relay manager with new identity
-            nostrRelayManager = NostrRelayManager()
-            setupNostrMessageHandling()
-            nostrRelayManager?.connect()
+                // Reinitialize Nostr relay manager with new identity. Reuse the
+                // shared singleton — every other component (NostrTransport, geohash
+                // subscriptions, AppRuntime observers) is bound to `.shared`, so
+                // creating a fresh instance here would split relay state and leave
+                // sends running against a disconnected manager.
+                nostrRelayManager = NostrRelayManager.shared
+                setupNostrMessageHandling()
+                nostrRelayManager?.connect()
+            }
         }
 
         // Delete ALL media files (incoming and outgoing) in background
@@ -913,13 +1343,13 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     // MARK: - Message Formatting
 
     @MainActor
-    func formatMessageAsText(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
-        messageFormatter.formatMessageAsText(message, colorScheme: colorScheme)
+    func formatMessageAsText(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme? = nil) -> AttributedString {
+        messageFormatter.formatMessageAsText(message, colorScheme: colorScheme, theme: theme ?? currentTheme)
     }
 
     @MainActor
-    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
-        messageFormatter.formatMessageHeader(message, colorScheme: colorScheme)
+    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme? = nil) -> AttributedString {
+        messageFormatter.formatMessageHeader(message, colorScheme: colorScheme, theme: theme ?? currentTheme)
     }
 
     // MARK: - Noise Protocol Support
@@ -947,53 +1377,34 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
 
     // MARK: - Message Handling
 
-    @MainActor
-    func initializeConversationStore() {
-        publicConversationCoordinator.initializeConversationStore()
-    }
-
-    @MainActor
-    func synchronizePublicConversationStore(for channel: ChannelID) {
-        publicConversationCoordinator.synchronizePublicConversationStore(for: channel)
-    }
-
-    @MainActor
-    func synchronizePublicConversationStore(forGeohash geohash: String) {
-        publicConversationCoordinator.synchronizePublicConversationStore(forGeohash: geohash)
-    }
-
-    @MainActor
-    func synchronizeAllPublicConversationStores() {
-        publicConversationCoordinator.synchronizeAllPublicConversationStores()
-    }
-
-    @MainActor
-    func synchronizePrivateConversationStore() {
-        conversationStore.synchronizePrivateChats(
-            privateChatManager.privateChats,
-            unreadPeerIDs: privateChatManager.unreadMessages,
-            identityResolver: identityResolver
-        )
-    }
-
-    @MainActor
-    func synchronizeConversationSelectionStore() {
-        conversationStore.setSelectedPeerID(
-            privateChatManager.selectedPeer,
-            activeChannel: activeChannel,
-            identityResolver: identityResolver
-        )
-    }
-
-    func trimMessagesIfNeeded() {
-        if messages.count > maxMessages {
-            messages = Array(messages.suffix(maxMessages))
-        }
-    }
-
+    /// Invalidates the derived `messages` cache and notifies observers.
+    /// (Formerly pulled the channel's timeline into a stored `messages`
+    /// array; `messages` is now derived from the `ConversationStore`, so
+    /// only the invalidation remains. The `channel` parameter is kept for
+    /// call-site compatibility — every caller passes the active channel.)
     @MainActor
     func refreshVisibleMessages(from channel: ChannelID? = nil) {
-        publicConversationCoordinator.refreshVisibleMessages(from: channel)
+        visibleMessagesCache = nil
+        objectWillChange.send()
+    }
+
+    /// `true` when a store change touches the active public conversation
+    /// (so the derived `messages` cache must be invalidated).
+    @MainActor
+    private func changeAffectsActivePublicConversation(_ change: ConversationChange) -> Bool {
+        let activeID = ConversationID(channelID: activeChannel)
+        switch change {
+        case .appended(let id, _),
+             .updated(let id, _),
+             .statusChanged(let id, _, _),
+             .messageRemoved(let id, _),
+             .cleared(let id),
+             .removed(let id),
+             .unreadChanged(let id, _):
+            return id == activeID
+        case .migrated(let source, let destination):
+            return source == activeID || destination == activeID
+        }
     }
 
     @MainActor
@@ -1035,15 +1446,6 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         publicConversationCoordinator.clearCurrentPublicTimeline()
     }
 
-    // MARK: - Message Management
-
-    private func addMessage(_ message: BitchatMessage) {
-        // Check for duplicates
-        guard !messages.contains(where: { $0.id == message.id }) else { return }
-        messages.append(message)
-        trimMessagesIfNeeded()
-    }
-
     // MARK: - Peer Lookup Helpers
 
     func getPeer(byID peerID: PeerID) -> BitchatPeer? {
@@ -1091,7 +1493,7 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
 
     /// Processes IRC-style commands starting with '/'.
     /// - Parameter command: The full command string including the leading slash
-    /// - Note: Supports commands like /nick, /msg, /who, /slap, /clear, /help
+    /// - Note: Supports commands like /msg, /who, /slap, /clear, /help
     @MainActor
     func handleCommand(_ command: String) {
         let result = commandProcessor.process(command)
@@ -1099,16 +1501,29 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         switch result {
         case .success(let message):
             if let msg = message {
-                addSystemMessage(msg)
+                addCommandOutput(msg)
             }
         case .error(let message):
-            addSystemMessage(message)
+            addCommandOutput(message)
         case .handled:
             // Command was handled, no message needed
             break
         }
     }
 
+    /// Command output belongs in the conversation where the user typed the
+    /// command; the public timeline is invisible while a DM is open. The DM
+    /// selection is read *after* processing so commands that switch chats
+    /// (`/msg`) print into the conversation they just opened.
+    @MainActor
+    private func addCommandOutput(_ content: String) {
+        if let peerID = selectedPrivateChatPeer {
+            addLocalPrivateSystemMessage(content, to: peerID)
+        } else {
+            addSystemMessage(content)
+        }
+    }
+
     // MARK: - Message Reception
 
     @MainActor
@@ -1172,6 +1587,35 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     @MainActor
     func cleanupOldReadReceipts() {
         deliveryCoordinator.cleanupOldReadReceipts()
+        auditConversationStore()
+    }
+
+    /// Periodic on-device verification of the `ConversationStore`'s
+    /// correctness invariants, piggybacked on the read-receipt cleanup
+    /// cadence (peer-list updates) so no extra timer exists. Loud on
+    /// violation (one error line each), near-silent when healthy (sampled
+    /// heartbeat: first + every Nth audit). The audit is O(total messages)
+    /// and allocation-free while healthy — measured ~0.5 ms at 5k messages
+    /// (see `PerformanceBaselineTests.testConversationStoreAudit`), cheap
+    /// relative to its cadence, so it always runs.
+    @MainActor
+    private func auditConversationStore() {
+        storeAuditCount += 1
+        let violations = conversations.auditInvariants()
+        guard violations.isEmpty else {
+            for violation in violations {
+                SecureLogger.error("🚨 ConversationStore invariant violated: \(violation)", category: .session)
+            }
+            return
+        }
+        let appendCount = conversations.appendCount
+        if storeAuditCount == 1 || storeAuditCount.isMultiple(of: TransportConfig.conversationStoreAuditLogInterval) {
+            SecureLogger.debug(
+                "Store audit OK: \(conversations.conversationsByID.count) conversations, \(conversations.totalMessageCount) messages, map=\(conversations.messageIDMapCount), appends since last audit=\(appendCount - storeAuditLastAppendCount)",
+                category: .session
+            )
+        }
+        storeAuditLastAppendCount = appendCount
     }
 
     func parseMentions(from content: String) -> [String] {

bitchat/ViewModels/ChatViewModelBootstrapper.swift

@@ -17,7 +17,9 @@ struct ChatViewModelServiceBundle {
         keychain: KeychainManagerProtocol,
         idBridge: NostrIdentityBridge,
         identityManager: SecureIdentityStateManagerProtocol,
-        meshService: Transport
+        meshService: Transport,
+        outboxStore: MessageOutboxStore? = nil,
+        sfMetrics: StoreAndForwardMetrics? = nil
     ) {
         let commandProcessor = CommandProcessor(identityManager: identityManager)
         let privateChatManager = PrivateChatManager(meshService: meshService)
@@ -28,7 +30,11 @@ struct ChatViewModelServiceBundle {
         )
         let nostrTransport = NostrTransport(keychain: keychain, idBridge: idBridge)
         nostrTransport.senderPeerID = meshService.myPeerID
-        let messageRouter = MessageRouter(transports: [meshService, nostrTransport])
+        let messageRouter = MessageRouter(
+            transports: [meshService, nostrTransport],
+            outboxStore: outboxStore,
+            metrics: sfMetrics
+        )
 
         self.commandProcessor = commandProcessor
         self.messageRouter = messageRouter
@@ -74,9 +80,54 @@ final class ChatViewModelBootstrapper {
 
 private extension ChatViewModelBootstrapper {
     func wireServiceGraph() {
+        viewModel.privateChatManager.conversationStore = viewModel.conversations
         viewModel.privateChatManager.messageRouter = viewModel.messageRouter
         viewModel.privateChatManager.unifiedPeerService = viewModel.unifiedPeerService
         viewModel.unifiedPeerService.messageRouter = viewModel.messageRouter
+        // Surface silent outbox drops (attempt cap, TTL expiry, overflow
+        // eviction) as a visible failure. The store's no-downgrade rule does
+        // not cover `.failed` over confirmed receipts, so guard here: a drop
+        // of an already-delivered/read message (e.g. a stale retained copy)
+        // must not downgrade its status.
+        viewModel.messageRouter.onMessageDropped = { [weak viewModel] messageID, peerID in
+            guard let viewModel else { return }
+            switch viewModel.conversations.deliveryStatus(forMessageID: messageID) {
+            case .delivered, .read:
+                // Field proof of the no-downgrade guard: the drop arrived
+                // after a confirmed receipt, so the `.failed` write is
+                // deliberately skipped.
+                SecureLogger.warning(
+                    "📤 Router dropped message \(messageID.prefix(8))… for \(peerID.id.prefix(8))… → .failed skipped (already delivered/read)",
+                    category: .session
+                )
+            default:
+                SecureLogger.warning(
+                    "📤 Router dropped message \(messageID.prefix(8))… for \(peerID.id.prefix(8))… → marked failed",
+                    category: .session
+                )
+                viewModel.conversations.setDeliveryStatus(
+                    .failed(reason: String(localized: "content.delivery.reason.not_delivered", comment: "Failure reason shown when the router gave up delivering a message")),
+                    forMessageID: messageID
+                )
+            }
+        }
+        // A message with no reachable transport that was handed to a courier
+        // shows a distinct "carried" state instead of sitting in "sending"
+        // forever. Never downgrade a confirmed receipt: the courier copy can
+        // race direct delivery when the peer reappears.
+        viewModel.messageRouter.onMessageCarried = { [weak viewModel] messageID, peerID in
+            guard let viewModel else { return }
+            switch viewModel.conversations.deliveryStatus(forMessageID: messageID) {
+            case .delivered, .read:
+                break
+            default:
+                SecureLogger.debug(
+                    "📦 Message \(messageID.prefix(8))… for \(peerID.id.prefix(8))… handed to courier → marked carried",
+                    category: .session
+                )
+                viewModel.conversations.setDeliveryStatus(.carried, forMessageID: messageID)
+            }
+        }
         viewModel.commandProcessor.contextProvider = viewModel
         viewModel.commandProcessor.meshService = viewModel.meshService
         viewModel.participantTracker.configure(context: viewModel)
@@ -89,33 +140,10 @@ private extension ChatViewModelBootstrapper {
             }
             .store(in: &viewModel.cancellables)
 
-        viewModel.privateChatManager.$privateChats
-            .receive(on: DispatchQueue.main)
-            .sink { [weak viewModel] _ in
-                Task { @MainActor [weak viewModel] in
-                    viewModel?.synchronizePrivateConversationStore()
-                }
-            }
-            .store(in: &viewModel.cancellables)
-
-        viewModel.privateChatManager.$unreadMessages
-            .receive(on: DispatchQueue.main)
-            .sink { [weak viewModel] _ in
-                Task { @MainActor [weak viewModel] in
-                    viewModel?.synchronizePrivateConversationStore()
-                }
-            }
-            .store(in: &viewModel.cancellables)
-
-        viewModel.privateChatManager.$selectedPeer
-            .receive(on: DispatchQueue.main)
-            .sink { [weak viewModel] _ in
-                Task { @MainActor [weak viewModel] in
-                    viewModel?.synchronizeConversationSelectionStore()
-                }
-            }
-            .store(in: &viewModel.cancellables)
-
+        // Private message state flows through the single-writer
+        // `ConversationStore` intents and its `changes` subject; selection
+        // is owned by the store too (`PrivateChatManager.selectedPeer` is a
+        // read-only mirror), so no selection bridge is needed here.
         viewModel.participantTracker.objectWillChange
             .sink { [weak viewModel] _ in
                 viewModel?.objectWillChange.send()
@@ -144,7 +172,6 @@ private extension ChatViewModelBootstrapper {
         viewModel.meshService.startServices()
 
         viewModel.publicMessagePipeline.delegate = viewModel.publicConversationCoordinator
-        viewModel.publicMessagePipeline.updateActiveChannel(viewModel.activeChannel)
 
         DispatchQueue.main.asyncAfter(deadline: .now() + 0.1) { [weak viewModel] in
             guard let viewModel,
@@ -173,7 +200,6 @@ private extension ChatViewModelBootstrapper {
                     guard let viewModel else { return }
 
                     viewModel.allPeers = peers
-                    viewModel.identityResolver.register(peers: peers)
 
                     var uniquePeers: [PeerID: BitchatPeer] = [:]
                     for peer in peers {
@@ -191,9 +217,6 @@ private extension ChatViewModelBootstrapper {
                     if viewModel.hasTrackedPrivateChatSelection {
                         viewModel.updatePrivateChatPeerIfNeeded()
                     }
-
-                    viewModel.synchronizePrivateConversationStore()
-                    viewModel.synchronizeConversationSelectionStore()
                 }
             }
             .store(in: &viewModel.cancellables)
@@ -217,15 +240,7 @@ private extension ChatViewModelBootstrapper {
     func configureGeoChannels() {
         viewModel.geoChannelCoordinator = GeoChannelCoordinator(
             locationManager: viewModel.locationManager,
-            onChannelSwitch: { [weak viewModel] channel in
-                viewModel?.switchLocationChannel(to: channel)
-            },
-            beginSampling: { [weak viewModel] geohashes in
-                viewModel?.beginGeohashSampling(for: geohashes)
-            },
-            endSampling: { [weak viewModel] in
-                viewModel?.endGeohashSampling()
-            }
+            context: viewModel
         )
     }
 

bitchat/ViewModels/Extensions/ChatViewModel+Nostr.swift

@@ -12,86 +12,86 @@ extension ChatViewModel {
 
     @MainActor
     func resubscribeCurrentGeohash() {
-        nostrCoordinator.resubscribeCurrentGeohash()
+        nostrCoordinator.subscriptions.resubscribeCurrentGeohash()
     }
 
     @MainActor
     func subscribeNostrEvent(_ event: NostrEvent) {
-        nostrCoordinator.subscribeNostrEvent(event)
+        nostrCoordinator.inbound.subscribeNostrEvent(event)
     }
 
     @MainActor
     func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        nostrCoordinator.subscribeGiftWrap(giftWrap, id: id)
+        nostrCoordinator.inbound.subscribeGiftWrap(giftWrap, id: id)
     }
 
     @MainActor
     func switchLocationChannel(to channel: ChannelID) {
-        nostrCoordinator.switchLocationChannel(to: channel)
+        nostrCoordinator.subscriptions.switchLocationChannel(to: channel)
     }
 
     @MainActor
     func handleNostrEvent(_ event: NostrEvent) {
-        nostrCoordinator.handleNostrEvent(event)
+        nostrCoordinator.inbound.handleNostrEvent(event)
     }
 
     @MainActor
     func subscribeToGeoChat(_ ch: GeohashChannel) {
-        nostrCoordinator.subscribeToGeoChat(ch)
+        nostrCoordinator.subscriptions.subscribeToGeoChat(ch)
     }
 
     @MainActor
     func handleGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        nostrCoordinator.handleGiftWrap(giftWrap, id: id)
+        nostrCoordinator.inbound.handleGiftWrap(giftWrap, id: id)
     }
 
     @MainActor
     func sendGeohash(context: GeoOutgoingContext) {
-        nostrCoordinator.sendGeohash(context: context)
+        nostrCoordinator.subscriptions.sendGeohash(context: context)
     }
 
     @MainActor
     func beginGeohashSampling(for geohashes: [String]) {
-        nostrCoordinator.beginGeohashSampling(for: geohashes)
+        nostrCoordinator.subscriptions.beginGeohashSampling(for: geohashes)
     }
 
     @MainActor
     func subscribe(_ gh: String) {
-        nostrCoordinator.subscribe(gh)
+        nostrCoordinator.subscriptions.subscribe(gh)
     }
 
     @MainActor
     func subscribeNostrEvent(_ event: NostrEvent, gh: String) {
-        nostrCoordinator.subscribeNostrEvent(event, gh: gh)
+        nostrCoordinator.presence.subscribeNostrEvent(event, gh: gh)
     }
 
     @MainActor
     func cooldownPerGeohash(_ gh: String, content: String, event: NostrEvent) {
-        nostrCoordinator.cooldownPerGeohash(gh, content: content, event: event)
+        nostrCoordinator.presence.cooldownPerGeohash(gh, content: content, event: event)
     }
 
     @MainActor
     func endGeohashSampling() {
-        nostrCoordinator.endGeohashSampling()
+        nostrCoordinator.subscriptions.endGeohashSampling()
     }
 
     @MainActor
     func setupNostrMessageHandling() {
-        nostrCoordinator.setupNostrMessageHandling()
+        nostrCoordinator.subscriptions.setupNostrMessageHandling()
     }
 
     @MainActor
     func handleNostrMessage(_ giftWrap: NostrEvent) {
-        nostrCoordinator.handleNostrMessage(giftWrap)
+        nostrCoordinator.inbound.handleNostrMessage(giftWrap)
     }
 
     func processNostrMessage(_ giftWrap: NostrEvent) async {
-        await nostrCoordinator.processNostrMessage(giftWrap)
+        await nostrCoordinator.inbound.processNostrMessage(giftWrap)
     }
 
     @MainActor
     func findNoiseKey(for nostrPubkey: String) -> Data? {
-        nostrCoordinator.findNoiseKey(for: nostrPubkey)
+        nostrCoordinator.inbound.findNoiseKey(for: nostrPubkey)
     }
 
     @MainActor
@@ -109,11 +109,6 @@ extension ChatViewModel {
         )
     }
 
-    @MainActor
-    func handleFavoriteNotification(content: String, from nostrPubkey: String) {
-        nostrCoordinator.handleFavoriteNotification(content: content, from: nostrPubkey)
-    }
-
     @MainActor
     func sendFavoriteNotificationViaNostr(noisePublicKey: Data, isFavorite: Bool) {
         nostrCoordinator.sendFavoriteNotificationViaNostr(noisePublicKey: noisePublicKey, isFavorite: isFavorite)