Bind Noise sessions to claimed peer identities

Add Persian (fa) localization and an in-app language picker (#1443 )
* Add Persian (fa) localization and an in-app language picker Persian was the one notable gap in the 29-language catalog. Translate all 381 strings (plus the share extension) with proper plural substitutions, and register fa in knownRegions. Settings gains a LANGUAGE section: a picker over every language the bundle ships (native names via Locale), backed by an AppleLanguages override so users can run bitchat in a language different from the device's. Localization resolves at process start, so the picker surfaces a restart note. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Remove unused AppLanguageSettings.currentOverride (Periphery) AppInfoView reads the override via @AppStorage, so the accessor was dead code and failed the Periphery CI scan. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: jack <jackjackbits@users.noreply.github.com> Co-authored-by: jack <212554440+jackjackbits@users.noreply.github.com>
2026-07-25 16:05:19 +00:00 · 2026-07-25 16:54:50 +02:00 · 2026-07-25 15:42:17 +02:00 · 2026-07-25 12:25:46 +02:00
39 changed files with 4264 additions and 1237 deletions
@@ -1,228 +1,42 @@
-name: Propose GeoRelay Data Update
+name: Fetch GeoRelays Data

 on:
  schedule:
-    - cron: "0 6 * * 0"
+    - cron: '0 6 * * 0'
  workflow_dispatch:

-# Default to read-only. The publishing job receives only the scopes required
-# to push its branch and publish either a PR or a tracking issue.
 permissions:
-  contents: read
-
-concurrency:
-  group: georelay-data-update
-  cancel-in-progress: false
-
-env:
-  SOURCE_REPOSITORY: https://github.com/permissionlesstech/georelays.git
-  UPDATE_BRANCH: automation/georelay-data
-  TRACKING_ISSUE_TITLE: GeoRelay update awaiting pull request
+  contents: write
+  pull-requests: write

 jobs:
-  propose-relay-data:
-    name: Validate and propose relay data
+  update-relay-data:
    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: write
-      pull-requests: write
-      issues: write

    steps:
-      - name: Checkout reviewed base
-        # Pinned actions/checkout v5 so a mutable action tag cannot change the
-        # code that receives this job's write-capable token.
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+      - name: Checkout repository
+        uses: actions/checkout@v4
        with:
-          ref: main
+          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0
-          # Do not expose the write token to fetch/validation subprocesses.
-          persist-credentials: false

-      - name: Test GeoRelay validator
+      - name: Fetch GeoRelays
        run: |
-          set -euo pipefail
-          python3 -m unittest discover -s scripts/tests -p "test_*.py" -v
+          wget -q https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv
+          mv nostr_relays.csv ./relays/online_relays_gps.csv

-      - name: Fetch candidate over pinned HTTPS policy
-        id: upstream
+      - name: Check for changes
+        id: git-check
        run: |
-          set -euo pipefail
-          source_commit=$(git ls-remote --refs "$SOURCE_REPOSITORY" refs/heads/main | awk 'NR == 1 { print $1 }')
-          if [[ ! "$source_commit" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "::error::Could not resolve an immutable upstream commit"
-            exit 1
-          fi
-          source_url="https://raw.githubusercontent.com/permissionlesstech/georelays/$source_commit/nostr_relays.csv"
-          effective_url=$(curl --fail --show-error --silent --location --proto "=https" --proto-redir "=https" --tlsv1.2 --max-time 60 --retry 3 --retry-all-errors --output "$RUNNER_TEMP/georelays-candidate.csv" --write-out "%{url_effective}" "$source_url")
-          if [[ "$effective_url" != "$source_url" ]]; then
-            echo "::error::Unexpected GeoRelay redirect target: $effective_url"
-            exit 1
-          fi
-          echo "source_commit=$source_commit" >> "$GITHUB_OUTPUT"
-          echo "source_url=$source_url" >> "$GITHUB_OUTPUT"
-
-      - name: Validate candidate against reviewed baseline
-        id: validation
+          git diff --exit-code || echo "changes=true" >> $GITHUB_OUTPUT
+    
+      - name: Commit and push changes
+        if: steps.git-check.outputs.changes == 'true'
        run: |
-          set -euo pipefail
-          python3 scripts/validate_georelays.py --input "$RUNNER_TEMP/georelays-candidate.csv" --baseline relays/online_relays_gps.csv --output relays/online_relays_gps.csv --github-output "$GITHUB_OUTPUT"
-
-      - name: Check for a reviewed-file change
-        id: changes
-        run: |
-          set -euo pipefail
-          if git diff --quiet -- relays/online_relays_gps.csv; then
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-            echo "Upstream GeoRelay data already matches main." >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-            git diff --stat -- relays/online_relays_gps.csv
-          fi
-
-      - name: Push automation branch and publish review request
-        if: steps.changes.outputs.changed == 'true'
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+          git add relays/online_relays_gps.csv
+          git commit -m "Automated update of relay data - $(date -u)"
+          git push
        env:
-          GH_TOKEN: ${{ github.token }}
-          SOURCE_COMMIT: ${{ steps.upstream.outputs.source_commit }}
-          SOURCE_URL: ${{ steps.upstream.outputs.source_url }}
-          DATA_ROWS: ${{ steps.validation.outputs.data_rows }}
-          UNIQUE_RELAYS: ${{ steps.validation.outputs.unique_relays }}
-          DATA_SHA256: ${{ steps.validation.outputs.sha256 }}
-        run: |
-          set -euo pipefail
-
-          # Scope credential exposure to this final publishing step.
-          gh auth setup-git
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-          git switch -C "$UPDATE_BRANCH"
-          git add -- relays/online_relays_gps.csv
-          git diff --cached --quiet && {
-            echo "::error::Expected a staged GeoRelay data change"
-            exit 1
-          }
-          git commit -m "Update reviewed georelay directory" -m "Upstream-commit: $SOURCE_COMMIT"
-
-          remote_ref="refs/remotes/origin/$UPDATE_BRANCH"
-          if git fetch --no-tags origin "+refs/heads/$UPDATE_BRANCH:$remote_ref" 2>/dev/null; then
-            remote_sha=$(git rev-parse "$remote_ref")
-            git push --force-with-lease="refs/heads/$UPDATE_BRANCH:$remote_sha" origin "HEAD:refs/heads/$UPDATE_BRANCH"
-          else
-            git push origin "HEAD:refs/heads/$UPDATE_BRANCH"
-          fi
-
-          body_file="$RUNNER_TEMP/georelay-pr-body.md"
-          {
-            echo "## Automated GeoRelay data proposal"
-            echo
-            echo "- Source: $SOURCE_URL"
-            echo "- Upstream commit: $SOURCE_COMMIT"
-            echo "- Data rows: $DATA_ROWS"
-            echo "- Unique normalized relays: $UNIQUE_RELAYS"
-            echo "- SHA-256: $DATA_SHA256"
-            echo
-            echo "The candidate passed strict UTF-8, schema, size, row-count, secure-host, coordinate, duplicate-conflict, and baseline-delta validation."
-            echo
-            echo "This PR is intentionally not auto-merged. Review the relay additions/removals before merging."
-          } > "$body_file"
-
-          existing_pr=$(gh pr list --repo "$GITHUB_REPOSITORY" --state open --base main --head "$UPDATE_BRANCH" --json number --jq '.[0].number // empty')
-          pr_error="$RUNNER_TEMP/georelay-pr-error.txt"
-          pr_url=""
-          if [[ -n "$existing_pr" ]]; then
-            if gh pr edit "$existing_pr" --repo "$GITHUB_REPOSITORY" --title "Update reviewed GeoRelay directory" --body-file "$body_file" 2> "$pr_error"; then
-              pr_url=$(gh pr view "$existing_pr" --repo "$GITHUB_REPOSITORY" --json url --jq .url)
-            fi
-          else
-            if created_pr_url=$(gh pr create --repo "$GITHUB_REPOSITORY" --base main --head "$UPDATE_BRANCH" --title "Update reviewed GeoRelay directory" --body-file "$body_file" 2> "$pr_error"); then
-              pr_url="$created_pr_url"
-            fi
-          fi
-
-          tracking_issue_numbers=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "\"$TRACKING_ISSUE_TITLE\" in:title" --limit 100 --json number,title --jq ".[] | select(.title == \"$TRACKING_ISSUE_TITLE\") | .number")
-          tracking_issues=()
-          if [[ -n "$tracking_issue_numbers" ]]; then
-            mapfile -t tracking_issues <<< "$tracking_issue_numbers"
-          fi
-
-          if [[ -n "$pr_url" ]]; then
-            for issue_number in "${tracking_issues[@]}"; do
-              gh issue close "$issue_number" --repo "$GITHUB_REPOSITORY" --comment "A pull request is now available at $pr_url; closing this fallback tracking issue."
-            done
-            echo "Published GeoRelay review PR: $pr_url" >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          echo "::warning::GITHUB_TOKEN could not create or update the GeoRelay pull request; publishing the issues-write fallback."
-          if [[ -s "$pr_error" ]]; then
-            cat "$pr_error" >&2
-          fi
-
-          compare_url="https://github.com/${GITHUB_REPOSITORY}/compare/main...${UPDATE_BRANCH}?expand=1"
-          issue_body_file="$RUNNER_TEMP/georelay-tracking-issue-body.md"
-          {
-            echo "## Validated GeoRelay update awaiting review"
-            echo
-            echo "The automation branch was updated, but this workflow token could not create or update the pull request. Use the compare link below to create it manually."
-            echo
-            echo "- Compare and create PR: $compare_url"
-            echo "- Automation branch: $UPDATE_BRANCH"
-            echo "- Source: $SOURCE_URL"
-            echo "- Upstream commit: $SOURCE_COMMIT"
-            echo "- Data rows: $DATA_ROWS"
-            echo "- Unique normalized relays: $UNIQUE_RELAYS"
-            echo "- SHA-256: $DATA_SHA256"
-            echo
-            echo "The snapshot passed the repository's strict validator before the branch was pushed."
-          } > "$issue_body_file"
-
-          if (( ${#tracking_issues[@]} > 0 )); then
-            primary_issue="${tracking_issues[0]}"
-            gh issue edit "$primary_issue" --repo "$GITHUB_REPOSITORY" --title "$TRACKING_ISSUE_TITLE" --body-file "$issue_body_file"
-            issue_url=$(gh issue view "$primary_issue" --repo "$GITHUB_REPOSITORY" --json url --jq .url)
-            for duplicate_issue in "${tracking_issues[@]:1}"; do
-              gh issue close "$duplicate_issue" --repo "$GITHUB_REPOSITORY" --comment "Closing duplicate GeoRelay automation tracking issue; #$primary_issue is canonical."
-            done
-          else
-            issue_url=$(gh issue create --repo "$GITHUB_REPOSITORY" --title "$TRACKING_ISSUE_TITLE" --body-file "$issue_body_file")
-          fi
-
-          # Do not claim success until the fallback issue was confirmed.
-          [[ -n "$issue_url" ]]
-          echo "Published GeoRelay tracking issue fallback: $issue_url" >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Clean obsolete automation review state
-        if: steps.changes.outputs.changed == 'false'
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          gh auth setup-git
-
-          existing_pr=$(gh pr list --repo "$GITHUB_REPOSITORY" --state open --base main --head "$UPDATE_BRANCH" --json number --jq '.[0].number // empty')
-          if [[ -n "$existing_pr" ]]; then
-            gh pr close "$existing_pr" --repo "$GITHUB_REPOSITORY" --comment "Upstream now matches the reviewed file on main; closing this obsolete automation proposal."
-            echo "Closed obsolete PR #$existing_pr." >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-          tracking_issue_numbers=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "\"$TRACKING_ISSUE_TITLE\" in:title" --limit 100 --json number,title --jq ".[] | select(.title == \"$TRACKING_ISSUE_TITLE\") | .number")
-          if [[ -n "$tracking_issue_numbers" ]]; then
-            while IFS= read -r issue_number; do
-              gh issue close "$issue_number" --repo "$GITHUB_REPOSITORY" --comment "Upstream now matches the reviewed file on main; closing this obsolete automation tracker."
-              echo "Closed obsolete tracking issue #$issue_number." >> "$GITHUB_STEP_SUMMARY"
-            done <<< "$tracking_issue_numbers"
-          fi
-
-          if git ls-remote --exit-code --heads origin "refs/heads/$UPDATE_BRANCH" > /dev/null; then
-            git push origin --delete "$UPDATE_BRANCH"
-            echo "Deleted obsolete automation branch $UPDATE_BRANCH." >> "$GITHUB_STEP_SUMMARY"
-          else
-            ls_remote_status=$?
-            if (( ls_remote_status != 2 )); then
-              echo "::error::Could not inspect the obsolete automation branch"
-              exit "$ls_remote_status"
-            fi
-          fi
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -337,6 +337,7 @@
 				es,
 				ar,
 				de,
+				fa,
 				fr,
 				he,
 				id,
@@ -7,45 +7,146 @@ final class LocationPresenceStore: ObservableObject {
    @Published private(set) var geoNicknames: [String: String] = [:]
    @Published private(set) var teleportedGeo: Set<String> = []

+    private let teleportedGeoCapacity: Int
+    private var teleportedGeoOrder: [String] = []
+    private let geoNicknameCapacity: Int
+    private var geoNicknameOrder: [String] = []
+
+    init(
+        teleportedGeoCapacity: Int = TransportConfig.geoTeleportedParticipantsCap,
+        geoNicknameCapacity: Int = TransportConfig.geoNicknameParticipantsCap
+    ) {
+        self.teleportedGeoCapacity = max(0, teleportedGeoCapacity)
+        self.geoNicknameCapacity = max(0, geoNicknameCapacity)
+    }
+
    func setCurrentGeohash(_ geohash: String?) {
-        currentGeohash = geohash?.lowercased()
+        let normalized = geohash?.lowercased()
+        if currentGeohash != normalized {
+            // Presence markers are scoped to the active geohash channel.
+            clearTeleportedGeo()
+            clearGeoNicknames()
+        }
+        currentGeohash = normalized
    }

    func setNickname(_ nickname: String, for pubkeyHex: String) {
-        geoNicknames[pubkeyHex.lowercased()] = nickname
+        guard geoNicknameCapacity > 0 else {
+            clearGeoNicknames()
+            return
+        }
+
+        let key = pubkeyHex.lowercased()
+        if geoNicknames[key] != nil {
+            geoNicknames[key] = nickname
+            return
+        }
+
+        while geoNicknameOrder.count >= geoNicknameCapacity, let oldest = geoNicknameOrder.first {
+            geoNicknameOrder.removeFirst()
+            geoNicknames.removeValue(forKey: oldest)
+        }
+
+        geoNicknames[key] = nickname
+        geoNicknameOrder.append(key)
    }

    func replaceGeoNicknames(_ nicknames: [String: String]) {
-        geoNicknames = Dictionary(
-            uniqueKeysWithValues: nicknames.map { key, value in
-                (key.lowercased(), value)
-            }
-        )
+        guard geoNicknameCapacity > 0 else {
+            clearGeoNicknames()
+            return
+        }
+
+        var seen: Set<String> = []
+        var ordered: [String] = []
+        var normalized: [String: String] = [:]
+        for (key, value) in nicknames {
+            let lower = key.lowercased()
+            guard seen.insert(lower).inserted else { continue }
+            ordered.append(lower)
+            normalized[lower] = value
+        }
+        if ordered.count > geoNicknameCapacity {
+            let kept = Array(ordered.suffix(geoNicknameCapacity))
+            ordered = kept
+            normalized = Dictionary(uniqueKeysWithValues: kept.compactMap { key in
+                normalized[key].map { (key, $0) }
+            })
+        }
+        geoNicknameOrder = ordered
+        geoNicknames = normalized
    }

    func clearGeoNicknames() {
        geoNicknames.removeAll()
+        geoNicknameOrder.removeAll()
+    }
+
+    func retainGeoNicknames(keeping pubkeys: Set<String>) {
+        let allowed = Set(pubkeys.map { $0.lowercased() })
+        geoNicknameOrder = geoNicknameOrder.filter { allowed.contains($0) }
+        geoNicknames = geoNicknames.filter { allowed.contains($0.key) }
    }

    func markTeleported(_ pubkeyHex: String) {
-        teleportedGeo.insert(pubkeyHex.lowercased())
+        guard teleportedGeoCapacity > 0 else {
+            clearTeleportedGeo()
+            return
+        }
+
+        let key = pubkeyHex.lowercased()
+        guard !teleportedGeo.contains(key) else { return }
+
+        while teleportedGeoOrder.count >= teleportedGeoCapacity, let oldest = teleportedGeoOrder.first {
+            teleportedGeoOrder.removeFirst()
+            teleportedGeo.remove(oldest)
+        }
+
+        teleportedGeo.insert(key)
+        teleportedGeoOrder.append(key)
    }

    func clearTeleported(_ pubkeyHex: String) {
-        teleportedGeo.remove(pubkeyHex.lowercased())
+        let key = pubkeyHex.lowercased()
+        teleportedGeo.remove(key)
+        teleportedGeoOrder.removeAll { $0 == key }
    }

    func replaceTeleportedGeo(_ pubkeys: Set<String>) {
-        teleportedGeo = Set(pubkeys.map { $0.lowercased() })
+        guard teleportedGeoCapacity > 0 else {
+            clearTeleportedGeo()
+            return
+        }
+
+        var seen: Set<String> = []
+        var ordered: [String] = []
+        for key in pubkeys.map({ $0.lowercased() }) where !seen.contains(key) {
+            seen.insert(key)
+            ordered.append(key)
+        }
+        if ordered.count > teleportedGeoCapacity {
+            ordered = Array(ordered.suffix(teleportedGeoCapacity))
+        }
+        teleportedGeoOrder = ordered
+        teleportedGeo = Set(ordered)
+    }
+
+    func retainTeleportedGeo(keeping pubkeys: Set<String>) {
+        let allowed = Set(pubkeys.map { $0.lowercased() })
+        teleportedGeoOrder = teleportedGeoOrder.filter { allowed.contains($0) }
+        teleportedGeo = teleportedGeo.intersection(allowed)
    }

    func clearTeleportedGeo() {
        teleportedGeo.removeAll()
+        teleportedGeoOrder.removeAll()
    }

    func reset() {
        currentGeohash = nil
        geoNicknames.removeAll()
+        geoNicknameOrder.removeAll()
        teleportedGeo.removeAll()
+        teleportedGeoOrder.removeAll()
    }
 }
@@ -14,6 +14,9 @@ enum NoiseSecurityConstants {
    
    // Maximum handshake message size
    static let maxHandshakeMessageSize = 2048 // 2KB to accommodate XX pattern
+
+    // Noise XX message 1 contains only the initiator's 32-byte ephemeral key.
+    static let xxInitialMessageSize = 32
    
    // Session timeout - sessions older than this should be renegotiated
    static let sessionTimeout: TimeInterval = 86400 // 24 hours
@@ -66,7 +66,10 @@ class NoiseSession {
            
            // Only initiator writes the first message
            if role == .initiator {
-                let message = try handshakeState!.writeMessage()
+                guard let handshake = handshakeState else {
+                    throw NoiseSessionError.invalidState
+                }
+                let message = try handshake.writeMessage()
                sentHandshakeMessages.append(message)
                return message
            } else {
@@ -11,4 +11,5 @@ enum NoiseSessionError: Error, Equatable {
    case notEstablished
    case sessionNotFound
    case alreadyEstablished
+    case peerIdentityMismatch
 }
@@ -13,6 +13,11 @@ import BitFoundation

 final class NoiseSessionManager {
    private var sessions: [PeerID: NoiseSession] = [:]
+    /// A responder rehandshake must not evict a working transport session
+    /// before the candidate proves that its authenticated static key belongs
+    /// to the claimed wire ID. Candidates therefore live outside `sessions`
+    /// until the XX handshake completes and the binding is validated.
+    private var responderCandidates: [PeerID: NoiseSession] = [:]
    private let sessionFactory: (PeerID, NoiseRole) -> NoiseSession
    private let managerQueue = DispatchQueue(label: "chat.bitchat.noise.manager", attributes: .concurrent)
    
@@ -54,6 +59,9 @@ final class NoiseSessionManager {
            if let session = sessions.removeValue(forKey: peerID) {
                session.reset() // Clear sensitive data before removing
            }
+            if let candidate = responderCandidates.removeValue(forKey: peerID) {
+                candidate.reset()
+            }
        }
    }

@@ -62,7 +70,11 @@ final class NoiseSessionManager {
            for (_, session) in sessions {
                session.reset()
            }
+            for (_, candidate) in responderCandidates {
+                candidate.reset()
+            }
            sessions.removeAll()
+            responderCandidates.removeAll()
        }
    }
    
@@ -79,6 +91,7 @@ final class NoiseSessionManager {
            // Remove any existing non-established session
            if let existingSession = sessions[peerID], !existingSession.isEstablished() {
                _ = sessions.removeValue(forKey: peerID)
+                existingSession.reset()
            }
            
            // Create new initiator session
@@ -91,6 +104,7 @@ final class NoiseSessionManager {
            } catch {
                // Clean up failed session
                _ = sessions.removeValue(forKey: peerID)
+                session.reset()
                SecureLogger.error(.handshakeFailed(peerID: peerID.id, error: error.localizedDescription))
                throw error
            }
@@ -100,39 +114,50 @@ final class NoiseSessionManager {
    func handleIncomingHandshake(from peerID: PeerID, message: Data) throws -> Data? {
        // Process everything within the synchronized block to prevent race conditions
        return try managerQueue.sync(flags: .barrier) {
-            var shouldCreateNew = false
-            var existingSession: NoiseSession? = nil
-            
-            if let existing = sessions[peerID] {
-                // If we have an established session, the peer must have cleared their session
-                // for a good reason (e.g., decryption failure, restart, etc.)
-                // We should accept the new handshake to re-establish encryption
-                if existing.isEstablished() {
-                    SecureLogger.info("Accepting handshake from \(peerID) despite existing session - peer likely cleared their session", category: .session)
-                    _ = sessions.removeValue(forKey: peerID)
-                    shouldCreateNew = true
+            let session: NoiseSession
+            let isReplacementCandidate: Bool
+
+            if let candidate = responderCandidates[peerID] {
+                // A fresh XX message 1 supersedes an incomplete candidate,
+                // but never the established session it is trying to replace.
+                if message.count == NoiseSecurityConstants.xxInitialMessageSize {
+                    candidate.reset()
+                    let replacement = sessionFactory(peerID, .responder)
+                    responderCandidates[peerID] = replacement
+                    session = replacement
                } else {
-                    // If we're in the middle of a handshake and receive a new initiation,
-                    // reset and start fresh (the other side may have restarted)
-                    if existing.getState() == .handshaking && message.count == 32 {
-                        _ = sessions.removeValue(forKey: peerID)
-                        shouldCreateNew = true
-                    } else {
-                        existingSession = existing
-                    }
+                    session = candidate
+                }
+                isReplacementCandidate = true
+            } else if let existing = sessions[peerID] {
+                if existing.isEstablished() {
+                    SecureLogger.info(
+                        "Validating replacement handshake from \(peerID) while preserving the established session",
+                        category: .session
+                    )
+                    let candidate = sessionFactory(peerID, .responder)
+                    responderCandidates[peerID] = candidate
+                    session = candidate
+                    isReplacementCandidate = true
+                } else if existing.getState() == .handshaking,
+                          message.count == NoiseSecurityConstants.xxInitialMessageSize {
+                    // No established transport state exists to preserve. A
+                    // fresh initiation replaces the incomplete handshake.
+                    _ = sessions.removeValue(forKey: peerID)
+                    existing.reset()
+                    let replacement = sessionFactory(peerID, .responder)
+                    sessions[peerID] = replacement
+                    session = replacement
+                    isReplacementCandidate = false
+                } else {
+                    session = existing
+                    isReplacementCandidate = false
                }
            } else {
-                shouldCreateNew = true
-            }
-            
-            // Get or create session
-            let session: NoiseSession
-            if shouldCreateNew {
                let newSession = sessionFactory(peerID, .responder)
                sessions[peerID] = newSession
                session = newSession
-            } else {
-                session = existingSession!
+                isReplacementCandidate = false
            }
            
            // Process the handshake message within the synchronized block
@@ -141,18 +166,40 @@ final class NoiseSessionManager {
                
                // Check if session is established after processing
                if session.isEstablished() {
-                    if let remoteKey = session.getRemoteStaticPublicKey() {
-                        // Schedule callback outside the synchronized block to prevent deadlock
-                        DispatchQueue.global().async { [weak self] in
-                            self?.onSessionEstablished?(peerID, remoteKey)
+                    guard let remoteKey = session.getRemoteStaticPublicKey(),
+                          authenticatedRemoteKey(remoteKey, matches: peerID) else {
+                        throw NoiseSessionError.peerIdentityMismatch
+                    }
+
+                    if isReplacementCandidate {
+                        _ = responderCandidates.removeValue(forKey: peerID)
+                        let previous = sessions.updateValue(session, forKey: peerID)
+                        if let previous, previous !== session {
+                            previous.reset()
                        }
                    }
+
+                    // Schedule callback outside the synchronized block to prevent deadlock
+                    DispatchQueue.global().async { [weak self] in
+                        self?.onSessionEstablished?(peerID, remoteKey)
+                    }
                }
                
                return response
            } catch {
-                // Reset the session on handshake failure so next attempt can start fresh
-                _ = sessions.removeValue(forKey: peerID)
+                // A failed candidate is discarded without touching the
+                // established session. Ordinary failed handshakes retain the
+                // historical cleanup behavior.
+                if isReplacementCandidate {
+                    if let storedCandidate = responderCandidates[peerID],
+                       storedCandidate === session {
+                        _ = responderCandidates.removeValue(forKey: peerID)
+                    }
+                } else if let storedSession = sessions[peerID],
+                          storedSession === session {
+                    _ = sessions.removeValue(forKey: peerID)
+                }
+                session.reset()
                
                // Schedule callback outside the synchronized block to prevent deadlock
                DispatchQueue.global().async { [weak self] in
@@ -164,6 +211,24 @@ final class NoiseSessionManager {
            }
        }
    }
+
+    /// Mesh handshakes normally use a 16-hex wire ID. Full Noise-key IDs are
+    /// also accepted by internal callers when they exactly match the static
+    /// key. Non-wire identifiers remain available to protocol test harnesses;
+    /// BLE packet ingress always supplies a short hexadecimal ID.
+    private func authenticatedRemoteKey(
+        _ remoteKey: Curve25519.KeyAgreement.PublicKey,
+        matches claimedPeerID: PeerID
+    ) -> Bool {
+        let rawKey = remoteKey.rawRepresentation
+        if claimedPeerID.isShort {
+            return PeerID(publicKey: rawKey) == claimedPeerID
+        }
+        if let claimedNoiseKey = claimedPeerID.noiseKey {
+            return claimedNoiseKey == rawKey
+        }
+        return true
+    }
    
    // MARK: - Encryption/Decryption
    
@@ -32,23 +32,6 @@ struct GeoRelayDirectoryDependencies {
    var retrySleep: (TimeInterval) async -> Void
    var activeNotificationName: Notification.Name?
    var autoStart: Bool
-    var validationPolicy: GeoRelayDirectoryValidationPolicy
-}
-
-struct GeoRelayDirectoryValidationPolicy: Sendable {
-    let maximumBytes: Int
-    let maximumRows: Int
-    let maximumEntries: Int
-    let minimumRemoteEntries: Int
-    let minimumRetainedFraction: Double
-
-    static let live = GeoRelayDirectoryValidationPolicy(
-        maximumBytes: 512 * 1024,
-        maximumRows: 5_000,
-        maximumEntries: 5_000,
-        minimumRemoteEntries: 50,
-        minimumRetainedFraction: 0.5
-    )
 }

 private extension GeoRelayDirectoryDependencies {
@@ -61,16 +44,12 @@ private extension GeoRelayDirectoryDependencies {
 #else
        let activeNotificationName: Notification.Name? = nil
 #endif
-        let validationPolicy = GeoRelayDirectoryValidationPolicy.live

        return Self(
            userDefaults: .standard,
            notificationCenter: .default,
            now: Date.init,
-            // Runtime refreshes only from bitchat's reviewed copy. Upstream
-            // georelays/main is imported by a validator-backed pull request,
-            // so an upstream mutation cannot immediately retarget clients.
-            remoteURL: URL(string: "https://raw.githubusercontent.com/permissionlesstech/bitchat/refs/heads/main/relays/online_relays_gps.csv")!,
+            remoteURL: URL(string: "https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv")!,
            fetchInterval: TransportConfig.geoRelayFetchIntervalSeconds,
            refreshCheckInterval: TransportConfig.geoRelayRefreshCheckIntervalSeconds,
            retryInitialSeconds: TransportConfig.geoRelayRetryInitialSeconds,
@@ -79,27 +58,7 @@ private extension GeoRelayDirectoryDependencies {
            makeFetchData: {
                let session = TorURLSession.shared.session
                return { request in
-                    let (bytes, response) = try await session.bytes(for: request)
-                    guard let response = response as? HTTPURLResponse,
-                          (200...299).contains(response.statusCode),
-                          response.url == request.url else {
-                        throw URLError(.badServerResponse)
-                    }
-
-                    let maximumBytes = validationPolicy.maximumBytes
-                    guard response.expectedContentLength <= Int64(maximumBytes) else {
-                        throw URLError(.dataLengthExceedsMaximum)
-                    }
-                    var data = Data()
-                    if response.expectedContentLength > 0 {
-                        data.reserveCapacity(Int(response.expectedContentLength))
-                    }
-                    for try await byte in bytes {
-                        guard data.count < maximumBytes else {
-                            throw URLError(.dataLengthExceedsMaximum)
-                        }
-                        data.append(byte)
-                    }
+                    let (data, _) = try await session.data(for: request)
                    return data
                }
            },
@@ -117,11 +76,7 @@ private extension GeoRelayDirectoryDependencies {
                    )
                    let dir = base.appendingPathComponent("bitchat", isDirectory: true)
                    try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
-                    // v2 ignores caches populated from the old direct-upstream
-                    // trust path and subjects every load to strict validation.
-                    let legacyCache = dir.appendingPathComponent("georelays_cache.csv")
-                    try? FileManager.default.removeItem(at: legacyCache)
-                    return dir.appendingPathComponent("georelays_cache_v2.csv")
+                    return dir.appendingPathComponent("georelays_cache.csv")
                } catch {
                    return nil
                }
@@ -139,8 +94,7 @@ private extension GeoRelayDirectoryDependencies {
                try? await Task.sleep(nanoseconds: nanoseconds)
            },
            activeNotificationName: activeNotificationName,
-            autoStart: true,
-            validationPolicy: validationPolicy
+            autoStart: true
        )
    }
 }
@@ -171,7 +125,7 @@ final class GeoRelayDirectory {
    }

    private enum DetachedFetchOutcome: Sendable {
-        case success(entries: [Entry], csv: Data)
+        case success(entries: [Entry], csv: String)
        case torNotReady
        case invalidData
        case network(String)
@@ -258,8 +212,6 @@ final class GeoRelayDirectory {
        )
        let awaitTorReady = dependencies.awaitTorReady
        let fetchData = dependencies.makeFetchData()
-        let validationPolicy = dependencies.validationPolicy
-        let baselineEntries = Set(entries)

        Task { [weak self] in
            guard let self else { return }
@@ -267,9 +219,7 @@ final class GeoRelayDirectory {
            let outcome = await Self.fetchRemoteOutcome(
                request: request,
                awaitTorReady: awaitTorReady,
-                fetchData: fetchData,
-                validationPolicy: validationPolicy,
-                baselineEntries: baselineEntries
+                fetchData: fetchData
            )

            switch outcome {
@@ -288,9 +238,7 @@ final class GeoRelayDirectory {
    nonisolated private static func fetchRemoteOutcome(
        request: URLRequest,
        awaitTorReady: @escaping @Sendable () async -> Bool,
-        fetchData: @escaping @Sendable (URLRequest) async throws -> Data,
-        validationPolicy: GeoRelayDirectoryValidationPolicy,
-        baselineEntries: Set<Entry>
+        fetchData: @escaping @Sendable (URLRequest) async throws -> Data
    ) async -> DetachedFetchOutcome {
        await Task.detached(priority: .utility) {
            let ready = await awaitTorReady()
@@ -298,16 +246,16 @@ final class GeoRelayDirectory {

            do {
                let data = try await fetchData(request)
-                guard let parsed = Self.validatedEntries(
-                    from: data,
-                    policy: validationPolicy,
-                    minimumEntries: validationPolicy.minimumRemoteEntries,
-                    baselineEntries: baselineEntries
-                ) else {
+                guard let text = String(data: data, encoding: .utf8) else {
                    return .invalidData
                }

-                return .success(entries: parsed, csv: data)
+                let parsed = Self.parseCSV(text)
+                guard !parsed.isEmpty else {
+                    return .invalidData
+                }
+
+                return .success(entries: parsed, csv: text)
            } catch {
                return .network(error.localizedDescription)
            }
@@ -321,7 +269,7 @@ final class GeoRelayDirectory {
    }

    @MainActor
-    private func handleFetchSuccess(entries parsed: [Entry], csv: Data) {
+    private func handleFetchSuccess(entries parsed: [Entry], csv: String) {
        entries = parsed
        persistCache(csv)
        dependencies.userDefaults.set(dependencies.now(), forKey: lastFetchKey)
@@ -373,8 +321,9 @@ final class GeoRelayDirectory {
        cleanupState.retryTask = nil
    }

-    private func persistCache(_ data: Data) {
+    private func persistCache(_ text: String) {
        guard let url = dependencies.cacheURL() else { return }
+        guard let data = text.data(using: .utf8) else { return }
        do {
            try dependencies.writeData(data, url)
        } catch {
@@ -387,12 +336,9 @@ final class GeoRelayDirectory {
        // Prefer cached file if present
        if let cache = dependencies.cacheURL(),
           let data = dependencies.readData(cache),
-           let entries = Self.validatedEntries(
-               from: data,
-               policy: dependencies.validationPolicy,
-               minimumEntries: 1
-           ) {
-            return entries
+           let text = String(data: data, encoding: .utf8) {
+            let arr = Self.parseCSV(text)
+            if !arr.isEmpty { return arr }
        }

        // Try bundled resource(s)
@@ -400,157 +346,36 @@ final class GeoRelayDirectory {

        for url in bundleCandidates {
            if let data = dependencies.readData(url),
-               let entries = Self.validatedEntries(
-                   from: data,
-                   policy: dependencies.validationPolicy,
-                   minimumEntries: 1
-               ) {
-                return entries
+               let text = String(data: data, encoding: .utf8) {
+                let arr = Self.parseCSV(text)
+                if !arr.isEmpty { return arr }
            }
        }

        // Try filesystem path (development/test)
        if let cwd = dependencies.currentDirectoryPath(),
           let data = dependencies.readData(URL(fileURLWithPath: cwd).appendingPathComponent("relays/online_relays_gps.csv")),
-           let entries = Self.validatedEntries(
-               from: data,
-               policy: dependencies.validationPolicy,
-               minimumEntries: 1
-           ) {
-            return entries
+           let text = String(data: data, encoding: .utf8) {
+            return Self.parseCSV(text)
        }

        SecureLogger.warning("GeoRelayDirectory: no local CSV found; entries empty", category: .session)
        return []
    }

-    /// Parses the fixed three-column format as an all-or-nothing trust unit.
-    /// One malformed or conflicting row rejects the complete dataset rather
-    /// than silently shrinking or partially replacing the current directory.
-    nonisolated static func validatedEntries(
-        from data: Data,
-        policy: GeoRelayDirectoryValidationPolicy,
-        minimumEntries: Int,
-        baselineEntries: Set<Entry>? = nil
-    ) -> [Entry]? {
-        guard !data.isEmpty, data.count <= policy.maximumBytes,
-              let text = String(data: data, encoding: .utf8),
-              !text.hasPrefix("\u{feff}") else {
-            return nil
-        }
-
+    nonisolated static func parseCSV(_ text: String) -> [Entry] {
+        var result: Set<Entry> = []
        let lines = text.split(whereSeparator: { $0.isNewline })
-            .map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
-            .filter { !$0.isEmpty }
-        guard let header = lines.first,
-              lines.count - 1 <= policy.maximumRows else {
-            return nil
+        for (idx, raw) in lines.enumerated() {
+            guard let line = raw.trimmedOrNilIfEmpty else { continue }
+            if idx == 0 && line.lowercased().contains("relay url") { continue }
+            let parts = line.split(separator: ",").map { $0.trimmed }
+            guard parts.count >= 3 else { continue }
+            guard let host = NostrRelayURL.directoryAddress(parts[0]) else { continue }
+            guard let lat = Double(parts[1]), let lon = Double(parts[2]) else { continue }
+            result.insert(Entry(host: host, lat: lat, lon: lon))
        }
-
-        let headerParts = header
-            .split(separator: ",", omittingEmptySubsequences: false)
-            .map { $0.trimmingCharacters(in: .whitespacesAndNewlines).lowercased() }
-        let supportedHeaders = [
-            ["relay url", "latitude", "longitude"],
-            ["relay url", "lat", "lon"]
-        ]
-        guard supportedHeaders.contains(headerParts) else {
-            return nil
-        }
-
-        var entriesByHost: [String: Entry] = [:]
-        for line in lines.dropFirst() {
-            let parts = line
-                .split(separator: ",", omittingEmptySubsequences: false)
-                .map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
-            guard parts.count == 3,
-                  let host = validatedDirectoryAddress(parts[0]),
-                  let latitude = Double(parts[1]), latitude.isFinite,
-                  (-90.0...90.0).contains(latitude),
-                  let longitude = Double(parts[2]), longitude.isFinite,
-                  (-180.0...180.0).contains(longitude) else {
-                return nil
-            }
-
-            let entry = Entry(host: host, lat: latitude, lon: longitude)
-            if let existing = entriesByHost[host], existing != entry {
-                // One endpoint cannot truthfully occupy two coordinates. Do
-                // not let row ordering choose which location clients trust.
-                return nil
-            }
-            entriesByHost[host] = entry
-            guard entriesByHost.count <= policy.maximumEntries else { return nil }
-        }
-
-        let parsedEntries = Set(entriesByHost.values)
-        guard parsedEntries.count >= minimumEntries else { return nil }
-
-        if let baselineEntries {
-            guard (0...1).contains(policy.minimumRetainedFraction) else { return nil }
-            let requiredOverlap = Int(
-                ceil(Double(baselineEntries.count) * policy.minimumRetainedFraction)
-            )
-            guard parsedEntries.intersection(baselineEntries).count >= requiredOverlap else {
-                return nil
-            }
-        }
-
-        return parsedEntries.sorted {
-            ($0.host, $0.lat, $0.lon) < ($1.host, $1.lat, $1.lon)
-        }
-    }
-
-    nonisolated private static func validatedDirectoryAddress(_ rawValue: String) -> String? {
-        let value = rawValue.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !value.isEmpty,
-              value.unicodeScalars.allSatisfy({
-                  $0.isASCII && !CharacterSet.controlCharacters.contains($0)
-              }) else {
-            return nil
-        }
-
-        let candidate = value.contains("://") ? value : "wss://\(value)"
-        guard let components = URLComponents(string: candidate),
-              let scheme = components.scheme?.lowercased(),
-              scheme == "wss" || scheme == "https",
-              components.user == nil,
-              components.password == nil,
-              components.query == nil,
-              components.fragment == nil,
-              components.path.isEmpty || components.path == "/",
-              let rawHost = components.host else {
-            return nil
-        }
-
-        let host = rawHost.lowercased()
-        guard !host.isEmpty, host.count <= 253,
-              host.unicodeScalars.allSatisfy({ $0.isASCII }),
-              !host.hasSuffix("."),
-              host != "localhost",
-              !host.hasSuffix(".localhost"),
-              !host.hasSuffix(".local"),
-              !host.hasSuffix(".internal") else {
-            return nil
-        }
-
-        let labels = host.split(separator: ".", omittingEmptySubsequences: false)
-        let allowed = CharacterSet(charactersIn: "abcdefghijklmnopqrstuvwxyz0123456789-")
-        guard labels.count >= 2,
-              !labels.allSatisfy({ $0.allSatisfy(\.isNumber) }),
-              labels.allSatisfy({ label in
-                  (1...63).contains(label.count) &&
-                  label.first != "-" &&
-                  label.last != "-" &&
-                  label.unicodeScalars.allSatisfy { allowed.contains($0) }
-              }) else {
-            return nil
-        }
-
-        if let port = components.port {
-            guard (1...65_535).contains(port) else { return nil }
-            if port != 443 { return "\(host):\(port)" }
-        }
-        return host
+        return Array(result)
    }

    // MARK: - Observers & Timers
@@ -700,6 +700,10 @@ struct NostrEvent: Codable {
              let content = dict["content"] as? String else {
            throw NostrError.invalidEvent
        }
+
+        guard Self.isWithinInboundTagLimits(tags) else {
+            throw NostrError.invalidEvent
+        }
        
        self.id = dict["id"] as? String ?? ""
        self.pubkey = pubkey
@@ -709,6 +713,21 @@ struct NostrEvent: Codable {
        self.content = content
        self.sig = dict["sig"] as? String
    }
+
+    /// Bounds untrusted relay tag arrays so attackers cannot force large
+    /// allocations or expensive joins on the inbound hot path.
+    static func isWithinInboundTagLimits(_ tags: [[String]]) -> Bool {
+        guard tags.count <= TransportConfig.nostrMaxEventTags else { return false }
+
+        for tag in tags {
+            guard tag.count <= TransportConfig.nostrMaxEventTagValues else { return false }
+            guard tag.allSatisfy({ $0.utf8.count <= TransportConfig.nostrMaxEventTagValueBytes }) else {
+                return false
+            }
+        }
+
+        return true
+    }
    
    func sign(with key: P256K.Schnorr.PrivateKey) throws -> NostrEvent {
        let (eventId, eventIdHash) = try calculateEventId()
@@ -1480,7 +1480,7 @@ private enum ParsedInbound {
    case notice(String)
    
    init?(_ message: URLSessionWebSocketTask.Message) {
-        guard let data = message.data,
+        guard let data = message.dataWithinInboundLimit,
              let array = try? JSONSerialization.jsonObject(with: data) as? [Any],
              array.count >= 2,
              let type = array[0] as? String else {
@@ -1525,11 +1525,19 @@ private enum ParsedInbound {
 }

 private extension URLSessionWebSocketTask.Message {
-    var data: Data? {
+    /// Prefer rejecting oversized frames before UTF-8/Data materialization
+    /// where we can (string length), and always before JSON parse.
+    var dataWithinInboundLimit: Data? {
+        let maxBytes = TransportConfig.nostrMaxInboundMessageBytes
        switch self {
-        case .string(let text): text.data(using: .utf8)
-        case .data(let data):   data
-        @unknown default:       nil
+        case .string(let text):
+            guard text.utf8.count <= maxBytes else { return nil }
+            return text.data(using: .utf8)
+        case .data(let data):
+            guard data.count <= maxBytes else { return nil }
+            return data
+        @unknown default:
+            return nil
        }
    }
 }
@@ -39,4 +39,13 @@ enum NostrRelayURL {

        return components.string
    }
+
+    static func directoryAddress(_ rawValue: String) -> String? {
+        guard var normalized = normalized(rawValue, defaultScheme: "wss") else { return nil }
+        for prefix in ["wss://", "ws://"] where normalized.hasPrefix(prefix) {
+            normalized.removeFirst(prefix.count)
+            break
+        }
+        return normalized
+    }
 }
@@ -49,7 +49,11 @@ final class BLENoisePacketHandler {
        self.environment = environment
    }

-    func handleHandshake(_ packet: BitchatPacket, from peerID: PeerID) {
+    /// Returns true when the handshake message was processed successfully.
+    /// Callers use this to distinguish an authenticated replacement completion
+    /// from a rejected candidate while an older session remains established.
+    @discardableResult
+    func handleHandshake(_ packet: BitchatPacket, from peerID: PeerID) -> Bool {
        let env = environment
        // Use NoiseEncryptionService for handshake processing
        if PeerID(hexData: packet.recipientID) == env.localPeerID() {
@@ -72,14 +76,26 @@ final class BLENoisePacketHandler {

                // Session establishment will trigger onPeerAuthenticated callback
                // which will send any pending messages at the right time
+                return true
+            } catch NoiseSessionError.peerIdentityMismatch {
+                // The candidate was already discarded by the session manager.
+                // Do not let a spoofed claimed ID trigger a fresh outbound
+                // handshake or recreate state for the attacker-selected ID.
+                SecureLogger.warning(
+                    "Rejected Noise handshake whose static key does not match \(peerID.id.prefix(8))…",
+                    category: .security
+                )
+                return false
            } catch {
                SecureLogger.error("Failed to process handshake: \(error)")
                // Try initiating a new handshake
                if !env.hasNoiseSession(peerID) {
                    env.initiateHandshake(peerID)
                }
+                return false
            }
        }
+        return false
    }

    func handleEncrypted(_ packet: BitchatPacket, from peerID: PeerID) {
@@ -1618,7 +1618,44 @@ final class BLEService: NSObject {
        }
    }

-    private func handleLeave(_: BitchatPacket, from peerID: PeerID) {
+    /// Accept a leave only when the claimed sender proves possession of the
+    /// signing key bound by a verified announce. The persisted identity cache
+    /// keeps delayed/relayed leaves verifiable after the live registry entry
+    /// has aged out.
+    private func handleLeave(_ packet: BitchatPacket, from peerID: PeerID) -> Bool {
+        let registrySigningKey = collectionsQueue.sync {
+            peerRegistry.info(for: peerID)?.signingPublicKey
+        }
+        let verifiedViaRegistry = registrySigningKey.map {
+            noiseService.verifyPacketSignature(packet, publicKey: $0)
+        } ?? false
+        let verifiedViaPersistedIdentity = !verifiedViaRegistry
+            && identityManager.getCryptoIdentitiesByPeerIDPrefix(peerID).contains { identity in
+                PeerID(publicKey: identity.publicKey) == peerID
+                    && identity.signingPublicKey.map {
+                        noiseService.verifyPacketSignature(packet, publicKey: $0)
+                    } == true
+            }
+
+        guard verifiedViaRegistry || verifiedViaPersistedIdentity else {
+            SecureLogger.warning(
+                "🚫 Dropping leave with missing/invalid signature for claimed sender \(peerID.id.prefix(8))…",
+                category: .security
+            )
+            return false
+        }
+
+        // A valid departure retires transport state too; otherwise
+        // canDeliverSecurely could remain true for a peer we just removed.
+        noiseService.clearSession(for: peerID)
+        readLinkState { _ in
+            let departedLinks = noiseAuthenticatedLinkOwners.compactMap { link, owner in
+                owner == peerID ? link : nil
+            }
+            for link in departedLinks {
+                noiseAuthenticatedLinkOwners.removeValue(forKey: link)
+            }
+        }
        _ = collectionsQueue.sync(flags: .barrier) {
            // Remove the peer when they leave
            peerRegistry.remove(peerID)
@@ -1635,6 +1672,7 @@ final class BLEService: NSObject {
            self.deliverTransportEvent(.peerDisconnected(peerID))
            self.deliverTransportEvent(.peerListUpdated(currentPeerIDs))
        }
+        return true
    }
    private func sendAnnounce(forceSend: Bool = false) {
        // Throttle announces to prevent flooding
@@ -2336,6 +2374,12 @@ extension BLEService {
        }
    }

+    func _test_isNoiseAuthenticatedCentral(_ centralUUID: String, for peerID: PeerID) -> Bool {
+        bleQueue.sync {
+            noiseAuthenticatedLinkOwners[.central(centralUUID)] == peerID
+        }
+    }
+
    func _test_seedConnectedPeer(_ peerID: PeerID, nickname: String) {
        collectionsQueue.sync(flags: .barrier) {
            peerRegistry.upsert(BLEPeerInfo(
@@ -4785,7 +4829,9 @@ extension BLEService {
            handleMeshPong(packet, from: senderID)

        case .leave:
-            handleLeave(packet, from: senderID)
+            // A forged leave must neither evict the claimed peer nor spread
+            // to downstream nodes.
+            guard handleLeave(packet, from: senderID) else { return }

        case .none:
            SecureLogger.warning("⚠️ Unknown message type: \(packet.type)", category: .session)
@@ -5426,8 +5472,14 @@ extension BLEService {

    private func handleNoiseHandshake(_ packet: BitchatPacket, from peerID: PeerID) {
        let wasEstablished = noiseService.hasEstablishedSession(with: peerID)
-        noisePacketHandler.handleHandshake(packet, from: peerID)
-        if !wasEstablished, noiseService.hasEstablishedSession(with: peerID) {
+        let processed = noisePacketHandler.handleHandshake(packet, from: peerID)
+        let isEstablished = noiseService.hasEstablishedSession(with: peerID)
+        // XX message 1 is exactly the unauthenticated 32-byte ephemeral key.
+        // While replacing an existing session, do not authenticate its ingress
+        // link until a later message completes and validates the candidate.
+        let completedAuthenticatedHandshake = !wasEstablished
+            || packet.payload.count != NoiseSecurityConstants.xxInitialMessageSize
+        if processed, isEstablished, completedAuthenticatedHandshake {
            markNoiseAuthenticatedIngressLink(for: packet, peerID: peerID)
        }
    }
@@ -251,9 +251,9 @@ final class MessageFormattingEngine {
        isSelf: Bool,
        isMentioned: Bool
    ) -> AttributedString {
-        // For very long content without special tokens, use plain formatting
-        let containsCashu = containsCashuToken(content)
-        if (content.count > 4000 || content.hasVeryLongToken(threshold: 1024)) && !containsCashu {
+        // For very long content, use plain formatting to avoid expensive
+        // regex/detector work. Cashu presence must not disable this guard.
+        if content.isOversizedForRichFormatting() {
            return formatPlainContent(content, baseColor: baseColor, isSelf: isSelf)
        }

@@ -46,6 +46,7 @@ enum TransportConfig {
    static let privateChatCap: Int = 1337
    static let meshTimelineCap: Int = 1337
    static let geoTimelineCap: Int = 1337
+    static let geoNicknameParticipantsCap: Int = 1337
    static let contentLRUCap: Int = 2000
    static let geoSamplingEventLRUCap: Int = 2000

@@ -81,6 +82,11 @@ enum TransportConfig {
    static let nostrDuplicateEventLogInterval: Int = 50
    // Sample interval for per-event debug logs on the inbound hot path.
    static let nostrInboundEventLogInterval: Int = 100
+    // Reject oversized/untrusted relay frames before JSON parse / store.
+    static let nostrMaxInboundMessageBytes: Int = 256 * 1024
+    static let nostrMaxEventTags: Int = 64
+    static let nostrMaxEventTagValues: Int = 16
+    static let nostrMaxEventTagValueBytes: Int = 1024

    // Conversation store diagnostics (field observability)
    // Sample interval for the periodic store-audit "OK" heartbeat line
@@ -98,6 +104,12 @@ enum TransportConfig {
    static let uiSenderRateBucketRefillPerSec: Double = 1.0
    static let uiContentRateBucketCapacity: Double = 3
    static let uiContentRateBucketRefillPerSec: Double = 0.5
+    // Bound attacker-keyed bucket maps (sender IDs / content digests).
+    static let uiSenderRateBucketMaxEntries: Int = 2000
+    static let uiContentRateBucketMaxEntries: Int = 2000
+    static let uiRateBucketIdleTTL: TimeInterval = 10 * 60
+    // Cap teleported-participant markers so remote events cannot grow the set.
+    static let geoTeleportedParticipantsCap: Int = 1337

    // UI sleeps/delays
    static let uiStartupInitialDelaySeconds: TimeInterval = 1.0
@@ -0,0 +1,40 @@
+import Foundation
+
+/// In-app override for the UI language, on top of the system per-app
+/// language. Apple resolves localization from the AppleLanguages default at
+/// process start, so a new choice takes effect on the next launch — callers
+/// surface a "restart to apply" note after changing it.
+enum AppLanguageSettings {
+    /// "" means no override: follow the device (or per-app system) language.
+    static let overrideKey = "app.languageOverride"
+    private static let appleLanguagesKey = "AppleLanguages"
+
+    /// Language codes the app ships translations for, straight from the
+    /// built bundle so this never drifts from the string catalog.
+    static var availableLanguages: [String] {
+        Bundle.main.localizations
+            .filter { $0 != "Base" }
+            .sorted { endonym(for: $0).localizedCaseInsensitiveCompare(endonym(for: $1)) == .orderedAscending }
+    }
+
+    /// The language's name in that language ("فارسی", "한국어") so every user
+    /// can find their own entry regardless of the current UI language.
+    static func endonym(for code: String) -> String {
+        let locale = Locale(identifier: code)
+        let name = locale.localizedString(forIdentifier: code) ?? code
+        return name.lowercased(with: locale)
+    }
+
+    /// Persists the override (nil clears it). AppleLanguages drives the
+    /// actual localization lookup on next launch.
+    static func setOverride(_ code: String?) {
+        let defaults = UserDefaults.standard
+        if let code, !code.isEmpty {
+            defaults.set(code, forKey: overrideKey)
+            defaults.set([code], forKey: appleLanguagesKey)
+        } else {
+            defaults.removeObject(forKey: overrideKey)
+            defaults.removeObject(forKey: appleLanguagesKey)
+        }
+    }
+}
@@ -71,12 +71,8 @@ final class ChatMessageFormatter {
            let content = message.content
            let nsContent = content as NSString
            let nsLen = nsContent.length
-            let containsCashuEarly: Bool = {
-                let regex = Patterns.quickCashuPresence
-                return regex.numberOfMatches(in: content, options: [], range: NSRange(location: 0, length: nsLen)) > 0
-            }()

-            if (content.count > 4000 || content.hasVeryLongToken(threshold: 1024)) && !containsCashuEarly {
+            if content.isOversizedForRichFormatting() {
                var plainStyle = AttributeContainer()
                plainStyle.foregroundColor = baseColor
                plainStyle.font = isSelf
@@ -1183,6 +1183,7 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
        identityManager.clearAllIdentityData()
        peerIdentityStore.clearAll()
        locationPresenceStore.reset()
+        publicRateLimiter.reset()

        // Clear persistent favorites from keychain
        FavoritesPersistenceService.shared.clearAllFavorites()
@@ -156,6 +156,17 @@ private extension ChatViewModelBootstrapper {
                viewModel?.objectWillChange.send()
            }
            .store(in: &viewModel.cancellables)
+
+        viewModel.participantTracker.$visiblePeople
+            .receive(on: DispatchQueue.main)
+            .sink { [weak viewModel] people in
+                Task { @MainActor [weak viewModel] in
+                    let visible = Set(people.map { $0.id })
+                    viewModel?.locationPresenceStore.retainTeleportedGeo(keeping: visible)
+                    viewModel?.locationPresenceStore.retainGeoNicknames(keeping: visible)
+                }
+            }
+            .store(in: &viewModel.cancellables)
    }

    func loadPersistedViewState() {
@@ -26,6 +26,10 @@ struct MessageRateLimiter {
            }
            return false
        }
+
+        func isIdle(since now: Date, idleTTL: TimeInterval) -> Bool {
+            now.timeIntervalSince(lastRefill) >= idleTTL
+        }
    }

    private var senderBuckets: [String: TokenBucket] = [:]
@@ -35,17 +39,26 @@ struct MessageRateLimiter {
    private let senderRefill: Double
    private let contentCapacity: Double
    private let contentRefill: Double
+    private let maxSenderBuckets: Int
+    private let maxContentBuckets: Int
+    private let bucketIdleTTL: TimeInterval

    init(
        senderCapacity: Double,
        senderRefillPerSec: Double,
        contentCapacity: Double,
-        contentRefillPerSec: Double
+        contentRefillPerSec: Double,
+        maxSenderBuckets: Int = TransportConfig.uiSenderRateBucketMaxEntries,
+        maxContentBuckets: Int = TransportConfig.uiContentRateBucketMaxEntries,
+        bucketIdleTTL: TimeInterval = TransportConfig.uiRateBucketIdleTTL
    ) {
        self.senderCapacity = senderCapacity
        self.senderRefill = senderRefillPerSec
        self.contentCapacity = contentCapacity
        self.contentRefill = contentRefillPerSec
+        self.maxSenderBuckets = max(1, maxSenderBuckets)
+        self.maxContentBuckets = max(1, maxContentBuckets)
+        self.bucketIdleTTL = bucketIdleTTL
    }

    /// - Parameter powBits: validated NIP-13 difficulty of the event
@@ -58,25 +71,83 @@ struct MessageRateLimiter {
        if powBits >= NostrPoW.rateLimitBypassBits {
            senderAllowed = true
        } else {
-            var senderBucket = senderBuckets[senderKey] ?? TokenBucket(
+            var senderBucket = Self.bucket(
+                for: senderKey,
+                in: &senderBuckets,
                capacity: senderCapacity,
-                tokens: senderCapacity,
                refillPerSec: senderRefill,
-                lastRefill: now
+                maxBuckets: maxSenderBuckets,
+                idleTTL: bucketIdleTTL,
+                now: now
            )
            senderAllowed = senderBucket.allow(now: now)
            senderBuckets[senderKey] = senderBucket
        }

-        var contentBucket = contentBuckets[contentKey] ?? TokenBucket(
+        // Rejected senders must not mint attacker-keyed content entries.
+        guard senderAllowed else { return false }
+
+        var contentBucket = Self.bucket(
+            for: contentKey,
+            in: &contentBuckets,
            capacity: contentCapacity,
-            tokens: contentCapacity,
            refillPerSec: contentRefill,
-            lastRefill: now
+            maxBuckets: maxContentBuckets,
+            idleTTL: bucketIdleTTL,
+            now: now
        )
        let contentAllowed = contentBucket.allow(now: now)
        contentBuckets[contentKey] = contentBucket

-        return senderAllowed && contentAllowed
+        return contentAllowed
+    }
+
+    mutating func reset() {
+        senderBuckets.removeAll()
+        contentBuckets.removeAll()
+    }
+
+    var bucketCountsForTesting: (sender: Int, content: Int) {
+        (senderBuckets.count, contentBuckets.count)
+    }
+
+    // Static so we can take `inout` on a stored dictionary without overlapping
+    // exclusive access through a mutating method on `self`.
+    private static func bucket(
+        for key: String,
+        in buckets: inout [String: TokenBucket],
+        capacity: Double,
+        refillPerSec: Double,
+        maxBuckets: Int,
+        idleTTL: TimeInterval,
+        now: Date
+    ) -> TokenBucket {
+        if let existing = buckets[key] {
+            return existing
+        }
+
+        evictIfNeeded(from: &buckets, maxBuckets: maxBuckets, idleTTL: idleTTL, now: now)
+        return TokenBucket(
+            capacity: capacity,
+            tokens: capacity,
+            refillPerSec: refillPerSec,
+            lastRefill: now
+        )
+    }
+
+    private static func evictIfNeeded(
+        from buckets: inout [String: TokenBucket],
+        maxBuckets: Int,
+        idleTTL: TimeInterval,
+        now: Date
+    ) {
+        guard buckets.count >= maxBuckets else { return }
+
+        buckets = buckets.filter { !$0.value.isIdle(since: now, idleTTL: idleTTL) }
+        guard buckets.count >= maxBuckets else { return }
+
+        if let oldestKey = buckets.min(by: { $0.value.lastRefill < $1.value.lastRefill })?.key {
+            buckets.removeValue(forKey: oldestKey)
+        }
    }
 }
@@ -196,7 +196,10 @@ final class NostrInboundPipeline {
        // Sampled: fires for every geo event and floods dev logs in busy geohashes.
        geoEventLogCount += 1
        if geoEventLogCount == 1 || geoEventLogCount.isMultiple(of: TransportConfig.nostrInboundEventLogInterval) {
-            SecureLogger.debug("GeoTeleport: recv #\(geoEventLogCount) pub=\(event.pubkey.prefix(8))… pow=\(powBits) tags=\(event.tags.map { "[" + $0.joined(separator: ",") + "]" }.joined(separator: ","))", category: .session)
+            SecureLogger.debug(
+                "GeoTeleport: recv #\(geoEventLogCount) pub=\(event.pubkey.prefix(8))… pow=\(powBits) tagCount=\(event.tags.count)",
+                category: .session
+            )
        }

        if context.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
@@ -26,6 +26,10 @@ struct AppInfoView: View {
    /// introduction), and afterwards the sheet reopens wherever it was left.
    @AppStorage("appInfo.selectedPane") private var selectedPane: Pane = .info
    @State private var showPanicConfirmation = false
+    @AppStorage(AppLanguageSettings.overrideKey) private var languageOverride = ""
+    /// The override changed this session; localization resolves at process
+    /// start, so surface the restart hint.
+    @State private var showLanguageRestartNote = false

    private enum Pane: String {
        case settings
@@ -55,6 +59,11 @@ struct AppInfoView: View {

            static let connectivityTitle = String(localized: "app_info.settings.connectivity.title", defaultValue: "CONNECTIVITY", comment: "Section header (uppercase) for the connectivity toggles: mesh bridge, internet gateway, tor routing")

+            static let languageTitle = String(localized: "app_info.settings.language.title", defaultValue: "LANGUAGE", comment: "Section header (uppercase) for the app language picker in settings")
+            static let languagePickerLabel = String(localized: "app_info.settings.language.picker_label", defaultValue: "app language", comment: "Label of the app language picker row in settings")
+            static let languageSystem = String(localized: "app_info.settings.language.system", defaultValue: "system default", comment: "Menu option that clears the in-app language override so the app follows the device language")
+            static let languageRestartNote = String(localized: "app_info.settings.language.restart_note", defaultValue: "restart bitchat to apply the new language", comment: "Caption shown after the user picks a different app language; the change takes effect on next launch")
+
            static let bridgeTitle = String(localized: "app_info.settings.bridge.title", defaultValue: "mesh bridge", comment: "Title of the mesh bridge toggle in settings")
            static let bridgeSubtitle = String(localized: "app_info.settings.bridge.subtitle", defaultValue: "joins nearby mesh islands over the internet: what you say in the mesh channel also reaches people in your area beyond radio range, and their messages appear here marked with the network glyph. while you have internet, your device also carries bridge and location-channel traffic for phones around you that have none.", comment: "Subtitle explaining what the mesh bridge toggle does")
            static func bridgeCell(_ cell: String) -> String {
@@ -313,6 +322,52 @@ struct AppInfoView: View {
                }
            }

+            // Language — an in-app override so the UI language can differ
+            // from the device language (takes effect on next launch).
+            VStack(alignment: .leading, spacing: 12) {
+                SectionHeader(verbatim: Strings.Settings.languageTitle)
+
+                settingsCard {
+                    Menu {
+                        Button {
+                            selectLanguage(nil)
+                        } label: {
+                            menuItemLabel(Strings.Settings.languageSystem, isSelected: languageOverride.isEmpty)
+                        }
+                        Divider()
+                        ForEach(AppLanguageSettings.availableLanguages, id: \.self) { code in
+                            Button {
+                                selectLanguage(code)
+                            } label: {
+                                menuItemLabel(AppLanguageSettings.endonym(for: code), isSelected: languageOverride == code)
+                            }
+                        }
+                    } label: {
+                        HStack {
+                            Text(Strings.Settings.languagePickerLabel)
+                                .bitchatFont(size: 12, weight: .semibold)
+                                .foregroundColor(textColor)
+                            Spacer()
+                            Text(languageOverride.isEmpty ? Strings.Settings.languageSystem : AppLanguageSettings.endonym(for: languageOverride))
+                                .bitchatFont(size: 12)
+                                .foregroundColor(palette.accent)
+                            Image(systemName: "chevron.up.chevron.down")
+                                .font(.system(size: 10))
+                                .foregroundColor(secondaryTextColor)
+                        }
+                        .contentShape(Rectangle())
+                    }
+                    .buttonStyle(.plain)
+
+                    if showLanguageRestartNote {
+                        Text(Strings.Settings.languageRestartNote)
+                            .bitchatFont(size: 11)
+                            .foregroundColor(secondaryTextColor)
+                            .fixedSize(horizontal: false, vertical: true)
+                    }
+                }
+            }
+
            // Voice — same card + IRC pill as every other toggle setting.
            VStack(alignment: .leading, spacing: 12) {
                SectionHeader(Strings.Voice.title)
@@ -458,6 +513,24 @@ struct AppInfoView: View {
        .padding()
    }

+    private func selectLanguage(_ code: String?) {
+        let previous = languageOverride
+        AppLanguageSettings.setOverride(code)
+        languageOverride = code ?? ""
+        if languageOverride != previous {
+            showLanguageRestartNote = true
+        }
+    }
+
+    private func menuItemLabel(_ title: String, isSelected: Bool) -> some View {
+        HStack {
+            Text(title)
+            if isSelected {
+                Image(systemName: "checkmark")
+            }
+        }
+    }
+
    private var bridgeToggleBinding: Binding<Bool> {
        Binding(
            get: { bridgeService.isEnabled },
@@ -41,7 +41,7 @@ struct TextMessageView: View {
            // first text line; a fixed top padding left the lock's solid body
            // hanging below the line's visual center.
            HStack(alignment: .firstTextBaseline, spacing: 0) {
-                let isLong = (message.content.count > TransportConfig.uiLongMessageLengthThreshold || message.content.hasVeryLongToken(threshold: TransportConfig.uiVeryLongTokenThreshold)) && cashuLinks.isEmpty
+                let isLong = message.content.isLongForDisplay()
                let isExpanded = expandedMessageIDs.contains(message.id)
                if message.isPrivate {
                    Image(systemName: "lock.fill")
@@ -103,7 +103,7 @@ struct TextMessageView: View {
            }
            
            // Expand/Collapse for very long messages
-            if (message.content.count > TransportConfig.uiLongMessageLengthThreshold || message.content.hasVeryLongToken(threshold: TransportConfig.uiVeryLongTokenThreshold)) && cashuLinks.isEmpty {
+            if message.content.isLongForDisplay() {
                let isExpanded = expandedMessageIDs.contains(message.id)
                let labelKey = isExpanded ? LocalizedStringKey("content.message.show_less") : LocalizedStringKey("content.message.show_more")
                Button(labelKey) {
@@ -21,6 +21,26 @@ extension String {
        return current >= threshold
    }

+    /// True when the message should collapse behind Show more in the UI.
+    /// Length alone decides this — embedding a Cashu-looking token must not
+    /// disable the guard (remote DoS via unbounded layout).
+    func isLongForDisplay(
+        lengthThreshold: Int = TransportConfig.uiLongMessageLengthThreshold,
+        tokenThreshold: Int = TransportConfig.uiVeryLongTokenThreshold
+    ) -> Bool {
+        count > lengthThreshold || hasVeryLongToken(threshold: tokenThreshold)
+    }
+
+    /// True when rich formatting (regex / link detectors) should be skipped.
+    /// Cashu presence used to exempt oversized content from the plain path;
+    /// that let untrusted input force expensive formatting work.
+    func isOversizedForRichFormatting(
+        lengthThreshold: Int = 4000,
+        tokenThreshold: Int = 1024
+    ) -> Bool {
+        count > lengthThreshold || hasVeryLongToken(threshold: tokenThreshold)
+    }
+
    // Extract up to `max` distinct Cashu tokens (cashuA/cashuB), as the bare
    // bearer strings. Allow dot '.' and shorter lengths. The `cashu:` URI
    // form matches too — the token embedded after the scheme is the match.
@@ -38,6 +38,12 @@
            "comment" : "Fallback title when saving a shared link"
          }
        },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "پیوند اشتراک‌گذاری‌شده"
+          }
+        },
        "fil" : {
          "stringUnit" : {
            "state" : "needs_review",
@@ -233,6 +239,12 @@
            "comment" : "Shown when the share payload cannot be encoded"
          }
        },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "کدگذاری پیوند ناموفق بود"
+          }
+        },
        "fil" : {
          "stringUnit" : {
            "state" : "needs_review",
@@ -428,6 +440,12 @@
            "comment" : "Shown when provided content cannot be shared"
          }
        },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "محتوای قابل اشتراک‌گذاری وجود ندارد"
+          }
+        },
        "fil" : {
          "stringUnit" : {
            "state" : "needs_review",
@@ -623,6 +641,12 @@
            "comment" : "Shown when the share extension receives no content"
          }
        },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "چیزی برای اشتراک‌گذاری نیست"
+          }
+        },
        "fil" : {
          "stringUnit" : {
            "state" : "needs_review",
@@ -818,6 +842,12 @@
            "comment" : "Confirmation after successfully sharing a link"
          }
        },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "✓ پیوند در bitchat به اشتراک گذاشته شد"
+          }
+        },
        "fil" : {
          "stringUnit" : {
            "state" : "needs_review",
@@ -1013,6 +1043,12 @@
            "comment" : "Confirmation after successfully sharing text"
          }
        },
+        "fa" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "✓ متن در bitchat به اشتراک گذاشته شد"
+          }
+        },
        "fil" : {
          "stringUnit" : {
            "state" : "needs_review",
@@ -147,6 +147,44 @@ struct AppArchitectureTests {
        #expect(store.teleportedGeo.isEmpty)
    }

+    @Test("LocationPresenceStore bounds and prunes teleported geohash participants")
+    @MainActor
+    func locationPresenceStoreBoundsTeleportedParticipants() {
+        let store = LocationPresenceStore(teleportedGeoCapacity: 2)
+
+        store.setCurrentGeohash("u4pruy")
+        store.markTeleported("AAAAAA")
+        store.markTeleported("BBBBBB")
+        store.markTeleported("CCCCCC")
+
+        #expect(store.teleportedGeo == Set(["bbbbbb", "cccccc"]))
+
+        store.retainTeleportedGeo(keeping: Set(["CCCCCC"]))
+        #expect(store.teleportedGeo == Set(["cccccc"]))
+
+        store.setCurrentGeohash("u4pruz")
+        #expect(store.teleportedGeo.isEmpty)
+    }
+
+    @Test("LocationPresenceStore bounds geohash nicknames and clears on channel switch")
+    @MainActor
+    func locationPresenceStoreBoundsGeoNicknames() {
+        let store = LocationPresenceStore(geoNicknameCapacity: 2)
+
+        store.setCurrentGeohash("u4pruy")
+        store.setNickname("alice", for: "AAAAAA")
+        store.setNickname("bob", for: "BBBBBB")
+        store.setNickname("carol", for: "CCCCCC")
+
+        #expect(store.geoNicknames == ["bbbbbb": "bob", "cccccc": "carol"])
+
+        store.retainGeoNicknames(keeping: Set(["CCCCCC"]))
+        #expect(store.geoNicknames == ["cccccc": "carol"])
+
+        store.setCurrentGeohash("u4pruz")
+        #expect(store.geoNicknames.isEmpty)
+    }
+
    @Test("PeerHandle equality and hashing use the canonical identity only")
    func peerHandleEqualityUsesCanonicalIdentity() {
        let first = PeerHandle(id: "noise:abc123", routingPeerID: PeerID(str: "peer-a"))
@@ -99,6 +99,95 @@ struct BLEServiceCoreTests {
        #expect(ble.currentPeerSnapshots().isEmpty)
    }

+    @Test
+    func unsignedAndBadSignatureLeaveDoNotEvictOrRelayClaimedPeer() async throws {
+        let ble = makeService()
+        let alice = NoiseEncryptionService(keychain: MockKeychain())
+        let mallory = NoiseEncryptionService(keychain: MockKeychain())
+        let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
+        let outbound = OutboundPacketTap()
+        ble._test_onOutboundPacket = outbound.record
+
+        let unsigned = makeLeavePacket(sender: alicePeerID, marker: "unsigned")
+        ble._test_handlePacket(
+            unsigned,
+            fromPeerID: alicePeerID,
+            signingPublicKey: alice.getSigningPublicKeyData()
+        )
+
+        let unsignedRelayed = await TestHelpers.waitUntil(
+            { outbound.count(ofType: .leave) > 0 },
+            timeout: TestConstants.shortTimeout
+        )
+        #expect(!unsignedRelayed)
+        #expect(ble.currentPeerSnapshots().contains { $0.peerID == alicePeerID })
+
+        let badSignature = try #require(
+            mallory.signPacket(makeLeavePacket(sender: alicePeerID, marker: "bad-signature"))
+        )
+        ble._test_handlePacket(
+            badSignature,
+            fromPeerID: alicePeerID,
+            signingPublicKey: alice.getSigningPublicKeyData()
+        )
+
+        let badSignatureRelayed = await TestHelpers.waitUntil(
+            { outbound.count(ofType: .leave) > 0 },
+            timeout: TestConstants.shortTimeout
+        )
+        #expect(!badSignatureRelayed)
+        #expect(ble.currentPeerSnapshots().contains { $0.peerID == alicePeerID })
+    }
+
+    @Test
+    func validSignedLeaveEvictsSessionAndRelays() async throws {
+        let ble = makeService()
+        let alice = NoiseEncryptionService(keychain: MockKeychain())
+        let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
+
+        // Establish a real session so the leave regression also verifies that
+        // stale secure-delivery state is retired, not just the peer-list row.
+        let message1 = try ble._test_noiseInitiateHandshake(with: alicePeerID)
+        let message2 = try #require(
+            try alice.processHandshakeMessage(from: ble.myPeerID, message: message1)
+        )
+        let message3 = try #require(
+            try ble._test_noiseProcessHandshakeMessage(from: alicePeerID, message: message2)
+        )
+        _ = try alice.processHandshakeMessage(from: ble.myPeerID, message: message3)
+        #expect(ble.canDeliverSecurely(to: alicePeerID))
+        let centralUUID = "central-valid-leave"
+        ble._test_bindCentral(centralUUID, to: alicePeerID)
+        ble._test_markNoiseAuthenticatedCentral(centralUUID, to: alicePeerID)
+        #expect(ble._test_isNoiseAuthenticatedCentral(centralUUID, for: alicePeerID))
+
+        let outbound = OutboundPacketTap()
+        ble._test_onOutboundPacket = outbound.record
+        let signedLeave = try #require(
+            alice.signPacket(makeLeavePacket(sender: alicePeerID, marker: "valid"))
+        )
+        ble._test_handlePacket(
+            signedLeave,
+            fromPeerID: alicePeerID,
+            signingPublicKey: alice.getSigningPublicKeyData()
+        )
+
+        let evicted = await TestHelpers.waitUntil(
+            {
+                !ble.currentPeerSnapshots().contains { $0.peerID == alicePeerID }
+                    && !ble.canDeliverSecurely(to: alicePeerID)
+                    && !ble._test_isNoiseAuthenticatedCentral(centralUUID, for: alicePeerID)
+            },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(evicted)
+        let relayed = await TestHelpers.waitUntil(
+            { outbound.count(ofType: .leave) == 1 },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(relayed)
+    }
+
    @Test
    func ingressAllowsRelayedSenderOnBoundLink() async throws {
        let ble = makeService()
@@ -690,6 +779,18 @@ private func makePublicPacket(content: String, sender: PeerID, timestamp: UInt64
    )
 }

+private func makeLeavePacket(sender: PeerID, marker: String) -> BitchatPacket {
+    BitchatPacket(
+        type: MessageType.leave.rawValue,
+        senderID: Data(hexString: sender.id) ?? Data(),
+        recipientID: nil,
+        timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
+        payload: Data(marker.utf8),
+        signature: nil,
+        ttl: TransportConfig.messageTTLDefault
+    )
+}
+
 private final class PublicCaptureDelegate: BitchatDelegate {
    private let lock = NSLock()
    private(set) var publicMessages: [BitchatMessage] = []
@@ -646,6 +646,25 @@ struct ChatViewModelFormattingTests {
        #expect(String(formatted.characters) == "<@Alice#a1b2> hello #mesh [\(message.formattedTimestamp)]")
    }

+    @Test @MainActor
+    func formatMessageAsText_longCashuFallsBackToPlain() async {
+        let (viewModel, _) = makeTestableViewModel()
+        let cashu = "cashuA" + String(repeating: "a", count: 40)
+        let longContent = "hi @bob " + cashu + " " + String(repeating: "x", count: 4_100)
+        let message = BitchatMessage(
+            id: "fmt-long-cashu",
+            sender: "Alice#a1b2",
+            content: longContent,
+            timestamp: Date(timeIntervalSince1970: 1_700_010_123),
+            isRelay: false,
+            senderPeerID: PeerID(str: "00000000000000b3")
+        )
+
+        let formatted = viewModel.formatMessageAsText(message, colorScheme: .light)
+
+        #expect(String(formatted.characters) == "<@Alice#a1b2> \(longContent) [\(message.formattedTimestamp)]")
+    }
+
    @Test @MainActor
    func formatMessageHeader_formatsSenderHeader() async {
        let (viewModel, _) = makeTestableViewModel()
@@ -323,6 +323,32 @@ struct MessageFormattingEngineTests {
        // Exactly at threshold DOES trigger (uses >= comparison)
        #expect(content.hasVeryLongToken(threshold: 50))
    }
+
+    @Test func isLongForDisplay_doesNotIgnoreCashuLinks() {
+        let cashu = "cashuA" + String(repeating: "a", count: 40)
+        let content = String(repeating: "a", count: TransportConfig.uiLongMessageLengthThreshold + 1) + " " + cashu
+
+        #expect(content.extractCashuLinks().count == 1)
+        #expect(content.isLongForDisplay())
+    }
+
+    @MainActor
+    @Test func formatMessage_longCashuMessageFallsBackToPlainContentPath() {
+        let context = MockMessageFormattingContext(nickname: "carol")
+        let cashu = "cashuA" + String(repeating: "a", count: 40)
+        let longContent = "hi @bob " + cashu + " " + String(repeating: "x", count: 4_100)
+        let message = BitchatMessage(
+            id: "long-cashu",
+            sender: "alice",
+            content: longContent,
+            timestamp: Date(timeIntervalSince1970: 1_700_000_999),
+            isRelay: false
+        )
+
+        let formatted = MessageFormattingEngine.formatMessage(message, context: context, colorScheme: .light)
+
+        #expect(String(formatted.characters) == "<@alice> \(longContent) [\(message.formattedTimestamp)]")
+    }
 }

@MainActor
@@ -116,4 +116,87 @@ struct MessageRateLimiterTests {
        #expect(plain)
        #expect(!plainExhausted)
    }
+
+    @Test("Content buckets do not grow when sender is rate limited")
+    func contentBucketsDoNotGrowAfterSenderLimit() {
+        var limiter = MessageRateLimiter(
+            senderCapacity: 1,
+            senderRefillPerSec: 0,
+            contentCapacity: 1,
+            contentRefillPerSec: 0,
+            maxSenderBuckets: 10,
+            maxContentBuckets: 10,
+            bucketIdleTTL: 60
+        )
+        let now = Date()
+
+        let first = limiter.allow(senderKey: "sender", contentKey: "content-0", now: now)
+        var rejected = true
+        for index in 1...100 {
+            if limiter.allow(senderKey: "sender", contentKey: "content-\(index)", now: now) {
+                rejected = false
+            }
+        }
+
+        #expect(first)
+        #expect(rejected)
+        #expect(limiter.bucketCountsForTesting.sender == 1)
+        #expect(limiter.bucketCountsForTesting.content == 1)
+    }
+
+    @Test("Bucket maps evict entries at configured caps")
+    func bucketMapsEvictAtConfiguredCaps() {
+        let maxEntries = 3
+        var limiter = MessageRateLimiter(
+            senderCapacity: 1,
+            senderRefillPerSec: 0,
+            contentCapacity: 1,
+            contentRefillPerSec: 0,
+            maxSenderBuckets: maxEntries,
+            maxContentBuckets: maxEntries,
+            bucketIdleTTL: 60
+        )
+        let now = Date()
+
+        for index in 0..<25 {
+            _ = limiter.allow(
+                senderKey: "sender-\(index)",
+                contentKey: "content-\(index)",
+                now: now.addingTimeInterval(TimeInterval(index))
+            )
+        }
+
+        #expect(limiter.bucketCountsForTesting.sender == maxEntries)
+        #expect(limiter.bucketCountsForTesting.content == maxEntries)
+    }
+
+    @Test("PoW bypass still creates content buckets under the cap")
+    func powBypassCreatesBoundedContentBuckets() {
+        let maxEntries = 3
+        var limiter = MessageRateLimiter(
+            senderCapacity: 1,
+            senderRefillPerSec: 0,
+            contentCapacity: 100,
+            contentRefillPerSec: 0,
+            maxSenderBuckets: maxEntries,
+            maxContentBuckets: maxEntries,
+            bucketIdleTTL: 60
+        )
+        let now = Date()
+
+        var allAllowed = true
+        for index in 0..<10 {
+            let allowed = limiter.allow(
+                senderKey: "sender",
+                contentKey: "content-\(index)",
+                powBits: NostrPoW.rateLimitBypassBits,
+                now: now.addingTimeInterval(TimeInterval(index))
+            )
+            if !allowed { allAllowed = false }
+        }
+
+        #expect(allAllowed)
+        #expect(limiter.bucketCountsForTesting.sender == 0)
+        #expect(limiter.bucketCountsForTesting.content == maxEntries)
+    }
 }
@@ -12,8 +12,15 @@ struct NoiseCoverageTests {
    private let bobStaticKey = Curve25519.KeyAgreement.PrivateKey()
    private let charlieStaticKey = Curve25519.KeyAgreement.PrivateKey()

-    private let alicePeerID = PeerID(str: "0011223344556677")
-    private let bobPeerID = PeerID(str: "8899aabbccddeeff")
+    // Manager test dictionaries are keyed by the remote peer. Keep the
+    // historical names, but derive each wire ID from the static key that the
+    // corresponding manager authenticates during the handshake.
+    private var alicePeerID: PeerID {
+        PeerID(publicKey: bobStaticKey.publicKey.rawRepresentation)
+    }
+    private var bobPeerID: PeerID {
+        PeerID(publicKey: aliceStaticKey.publicKey.rawRepresentation)
+    }
    private let charliePeerID = PeerID(str: "fedcba9876543210")

    @Test("Protocol metadata and handshake patterns expose expected values")
@@ -5,25 +5,19 @@ import XCTest

@MainActor
 final class GeoRelayDirectoryTests: XCTestCase {
-    private func parse(_ csv: String) -> [GeoRelayDirectory.Entry] {
-        GeoRelayDirectory.validatedEntries(
-            from: Data(csv.utf8),
-            policy: .live,
-            minimumEntries: 1
-        ) ?? []
-    }
-
-    func test_parseCSV_normalizesSecureRelaySchemesAndDeduplicatesEntries() {
+    func test_parseCSV_normalizesRelaySchemesAndDeduplicatesEntries() {
        let csv = """
        relay url,lat,lon
        wss://one.example/,10,20
        https://one.example,10,20
        wss://one.example:443/,10,20
-        two.example,11,21
+        http://two.example/,11,21
        wss://two.example:443,11,21
+        invalid row
+        ws://three.example,not-a-lat,22
        """

-        let parsed = Set(parse(csv))
+        let parsed = Set(GeoRelayDirectory.parseCSV(csv))

        XCTAssertEqual(
            parsed,
@@ -34,136 +28,6 @@ final class GeoRelayDirectoryTests: XCTestCase {
        )
    }

-    func test_parseCSV_rejectsWholeDatasetWhenAnyRowOrHeaderIsUnsafe() {
-        let invalidCSVs = [
-            "relay,lat,lon\nrelay.example,1,2\n",
-            "relay url,lat,lon\nrelay.example,1\n",
-            "relay url,lat,lon\nhttp://relay.example,1,2\n",
-            "relay url,lat,lon\nwss://user@relay.example,1,2\n",
-            "relay url,lat,lon\nwss://relay.example/path,1,2\n",
-            "relay url,lat,lon\nwss://relay.example?,1,2\n",
-            "relay url,lat,lon\nwss://relay.example#,1,2\n",
-            "relay url,lat,lon\nrelay.example:0,1,2\n",
-            "relay url,lat,lon\nrelay.example:99999,1,2\n",
-            "relay url,lat,lon\nlocalhost,1,2\n",
-            "relay url,lat,lon\nr\u{00e9}lay.example,1,2\n",
-            "relay url,lat,lon\nrelay\u{202e}.example,1,2\n",
-            "relay url,lat,lon\nrelay.example,NaN,2\n",
-            "relay url,lat,lon\nrelay.example,1_0,2\n",
-            "relay url,lat,lon\nrelay.example,\u{0661}\u{0660},2\n",
-            "relay url,lat,lon\nrelay.example,\u{ff11}\u{ff10},2\n",
-            "relay url,lat,lon\nrelay.example,91,2\n",
-            "relay url,lat,lon\nrelay.example,1,181\n",
-            "relay url,lat,lon\nrelay.example,1,2\nrelay.example,3,4\n"
-        ]
-
-        for csv in invalidCSVs {
-            XCTAssertTrue(parse(csv).isEmpty, csv)
-        }
-    }
-
-    func test_validatedEntries_enforcesByteRowEntryAndRetentionLimits() {
-        let restrictive = GeoRelayDirectoryValidationPolicy(
-            maximumBytes: 100,
-            maximumRows: 2,
-            maximumEntries: 2,
-            minimumRemoteEntries: 1,
-            minimumRetainedFraction: 0.5
-        )
-        let one = Data("relay url,lat,lon\none.example,1,2\n".utf8)
-        let three = Data("relay url,lat,lon\none.example,1,2\ntwo.example,3,4\nthree.example,5,6\n".utf8)
-
-        XCTAssertNil(GeoRelayDirectory.validatedEntries(
-            from: one,
-            policy: restrictive,
-            minimumEntries: 2
-        ))
-        XCTAssertNil(GeoRelayDirectory.validatedEntries(
-            from: Data(repeating: 0x41, count: 101),
-            policy: restrictive,
-            minimumEntries: 1
-        ))
-        XCTAssertNil(GeoRelayDirectory.validatedEntries(
-            from: three,
-            policy: restrictive,
-            minimumEntries: 1
-        ))
-    }
-
-    func test_validatedEntries_requiresExactBaselineEntryOverlap() throws {
-        let policy = GeoRelayDirectoryValidationPolicy(
-            maximumBytes: 1_000,
-            maximumRows: 10,
-            maximumEntries: 10,
-            minimumRemoteEntries: 1,
-            minimumRetainedFraction: 0.5
-        )
-        let baseline = Set(try XCTUnwrap(GeoRelayDirectory.validatedEntries(
-            from: Data("""
-            relay url,lat,lon
-            one.example,1,1
-            two.example,2,2
-            three.example,3,3
-            """.utf8),
-            policy: policy,
-            minimumEntries: 1
-        )))
-        let disjoint = Data("""
-        relay url,lat,lon
-        four.example,1,1
-        five.example,2,2
-        six.example,3,3
-        """.utf8)
-        let rewrittenCoordinates = Data("""
-        relay url,lat,lon
-        one.example,11,11
-        two.example,12,12
-        three.example,13,13
-        """.utf8)
-        let halfRetained = Data("""
-        relay url,lat,lon
-        wss://one.example:443/,1,1
-        https://two.example/,2,2
-        replacement.example,4,4
-        """.utf8)
-
-        XCTAssertNil(GeoRelayDirectory.validatedEntries(
-            from: disjoint,
-            policy: policy,
-            minimumEntries: 1,
-            baselineEntries: baseline
-        ))
-        XCTAssertNil(GeoRelayDirectory.validatedEntries(
-            from: rewrittenCoordinates,
-            policy: policy,
-            minimumEntries: 1,
-            baselineEntries: baseline
-        ))
-        XCTAssertNotNil(GeoRelayDirectory.validatedEntries(
-            from: halfRetained,
-            policy: policy,
-            minimumEntries: 1,
-            baselineEntries: baseline
-        ))
-    }
-
-    func test_bundledReviewedCSV_passesStrictProductionValidation() throws {
-        let repositoryRoot = URL(fileURLWithPath: #filePath)
-            .deletingLastPathComponent()
-            .deletingLastPathComponent()
-            .deletingLastPathComponent()
-        let data = try Data(
-            contentsOf: repositoryRoot.appendingPathComponent("relays/online_relays_gps.csv")
-        )
-
-        let entries = try XCTUnwrap(GeoRelayDirectory.validatedEntries(
-            from: data,
-            policy: .live,
-            minimumEntries: GeoRelayDirectoryValidationPolicy.live.minimumRemoteEntries
-        ))
-        XCTAssertGreaterThan(entries.count, 250)
-    }
-
    func test_closestRelays_sortsByDistanceForLatLonAndGeohash() {
        let harness = makeHarness(
            cacheCSV: """
@@ -379,53 +243,6 @@ final class GeoRelayDirectoryTests: XCTestCase {
        XCTAssertFalse(directory.debugHasRetryTask)
    }

-    func test_prefetchIfNeeded_rejectsSharpValidLookingTruncationBeforeCaching() async {
-        let cached = """
-        relay url,lat,lon
-        old-one.example,1,1
-        old-two.example,2,2
-        old-three.example,3,3
-        """
-        let truncated = """
-        relay url,lat,lon
-        attacker.example,9,9
-        """
-        let recovered = """
-        relay url,lat,lon
-        old-one.example,1,1
-        old-two.example,2,2
-        new-three.example,6,6
-        """
-        let harness = makeHarness(
-            cacheCSV: cached,
-            fetchResults: [
-                .success(Data(truncated.utf8)),
-                .success(Data(recovered.utf8))
-            ],
-            validationPolicy: GeoRelayDirectoryValidationPolicy(
-                maximumBytes: 64 * 1024,
-                maximumRows: 1_000,
-                maximumEntries: 1_000,
-                minimumRemoteEntries: 1,
-                minimumRetainedFraction: 0.5
-            )
-        )
-        let directory = GeoRelayDirectory(dependencies: harness.dependencies)
-
-        directory.prefetchIfNeeded()
-
-        let refreshed = await waitUntil {
-            directory.entries.contains(where: { $0.host == "new-three.example" })
-        }
-        XCTAssertTrue(refreshed)
-        XCTAssertFalse(directory.entries.contains(where: { $0.host == "attacker.example" }))
-        let requestCount = await harness.fetcher.recordedRequestCount()
-        let retryDelays = await harness.retryRecorder.recordedDelays()
-        XCTAssertEqual(requestCount, 2)
-        XCTAssertEqual(retryDelays, [5])
-        XCTAssertEqual(harness.fileStore.dataByURL[harness.cacheURL], Data(recovered.utf8))
-    }
-
    func test_observers_triggerPrefetchesForTorReadyAndAppActivation() async {
        let activeNotification = Notification.Name("GeoRelayDirectoryTests.didBecomeActive")
        let harness = makeHarness(
@@ -472,14 +289,7 @@ final class GeoRelayDirectoryTests: XCTestCase {
        fetchFactoryObserver: (@MainActor @Sendable () -> Void)? = nil,
        fetchObserver: (@Sendable () async -> Void)? = nil,
        autoStart: Bool = false,
-        activeNotificationName: Notification.Name? = nil,
-        validationPolicy: GeoRelayDirectoryValidationPolicy = GeoRelayDirectoryValidationPolicy(
-            maximumBytes: 64 * 1024,
-            maximumRows: 1_000,
-            maximumEntries: 1_000,
-            minimumRemoteEntries: 1,
-            minimumRetainedFraction: 0
-        )
+        activeNotificationName: Notification.Name? = nil
    ) -> GeoRelayHarness {
        let userDefaultsSuite = "GeoRelayDirectoryTests.\(UUID().uuidString)"
        let userDefaults = UserDefaults(suiteName: userDefaultsSuite)!
@@ -537,8 +347,7 @@ final class GeoRelayDirectoryTests: XCTestCase {
                await retryRecorder.record(delay)
            },
            activeNotificationName: activeNotificationName,
-            autoStart: autoStart,
-            validationPolicy: validationPolicy
+            autoStart: autoStart
        )

        return GeoRelayHarness(
@@ -290,7 +290,65 @@ struct NostrProtocolTests {
        #expect(object["limit"] as? Int == 42)
    }

+
+    @Test func inboundNostrEventRejectsTooManyTags() throws {
+        var eventDict = Self.validInboundEventDict()
+        eventDict["tags"] = Array(
+            repeating: ["g", "u4pruyd"],
+            count: TransportConfig.nostrMaxEventTags + 1
+        )
+
+        #expect(throws: NostrError.invalidEvent) {
+            _ = try NostrEvent(from: eventDict)
+        }
+    }
+
+    @Test func inboundNostrEventRejectsTooManyTagValues() throws {
+        var eventDict = Self.validInboundEventDict()
+        eventDict["tags"] = [Array(
+            repeating: "value",
+            count: TransportConfig.nostrMaxEventTagValues + 1
+        )]
+
+        #expect(throws: NostrError.invalidEvent) {
+            _ = try NostrEvent(from: eventDict)
+        }
+    }
+
+    @Test func inboundNostrEventRejectsOversizedTagValues() throws {
+        var eventDict = Self.validInboundEventDict()
+        eventDict["tags"] = [[
+            "g",
+            String(repeating: "a", count: TransportConfig.nostrMaxEventTagValueBytes + 1)
+        ]]
+
+        #expect(throws: NostrError.invalidEvent) {
+            _ = try NostrEvent(from: eventDict)
+        }
+    }
+
+    @Test func inboundNostrEventAcceptsTagsWithinLimits() throws {
+        var eventDict = Self.validInboundEventDict()
+        eventDict["tags"] = [["g", "u4pruyd"], ["t", "teleport"]]
+
+        let event = try NostrEvent(from: eventDict)
+
+        #expect(event.tags.count == 2)
+    }
+
    // MARK: - Helpers
+    private static func validInboundEventDict() -> [String: Any] {
+        [
+            "id": String(repeating: "0", count: 64),
+            "pubkey": String(repeating: "1", count: 64),
+            "created_at": 1_234_567,
+            "kind": NostrProtocol.EventKind.ephemeralEvent.rawValue,
+            "tags": [["g", "u4pruyd"]],
+            "content": "hello",
+            "sig": String(repeating: "2", count: 128)
+        ]
+    }
+
    private static func base64URLDecode(_ s: String) -> Data? {
        var str = s.replacingOccurrences(of: "-", with: "+").replacingOccurrences(of: "_", with: "/")
        let rem = str.count % 4
@@ -152,6 +152,21 @@ struct BLENoisePacketHandlerTests {
        #expect(recorder.initiatedHandshakes.isEmpty)
    }

+    @Test
+    func peerIdentityMismatchDoesNotRecreateHandshakeState() {
+        let recorder = Recorder()
+        recorder.handshakeResult = .failure(NoiseSessionError.peerIdentityMismatch)
+        recorder.hasSession = false
+        let handler = makeHandler(recorder: recorder)
+        let packet = makeHandshakePacket(recipientID: Data(hexString: localPeerID.id))
+
+        #expect(!handler.handleHandshake(packet, from: remotePeerID))
+
+        #expect(recorder.hasSessionQueries.isEmpty)
+        #expect(recorder.initiatedHandshakes.isEmpty)
+        #expect(recorder.broadcastPackets.isEmpty)
+    }
+
    // MARK: Encrypted

    @Test
@@ -91,39 +91,150 @@ struct NoiseEncryptionServiceTests {
    func handshakeEncryptionAndFingerprintLifecycle() async throws {
        let alice = NoiseEncryptionService(keychain: MockKeychain())
        let bob = NoiseEncryptionService(keychain: MockKeychain())
-        let alicePeerID = PeerID(str: "0011223344556677")
-        let bobPeerID = PeerID(str: "8899aabbccddeeff")
+        let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
+        let bobPeerID = PeerID(publicKey: bob.getStaticPublicKeyData())
        let recorder = AuthenticationRecorder()

        #expect(alice.onPeerAuthenticated == nil)
        alice.addOnPeerAuthenticatedHandler(recorder.record(peerID:fingerprint:))
        bob.onPeerAuthenticated = recorder.record(peerID:fingerprint:)

-        try establishSessions(alice: alice, bob: bob, alicePeerID: alicePeerID, bobPeerID: bobPeerID)
+        try establishSessions(alice: alice, bob: bob)

        let authenticated = await TestHelpers.waitUntil({ recorder.count >= 2 }, timeout: 5.0)
        #expect(authenticated)
-        #expect(alice.hasEstablishedSession(with: alicePeerID))
-        #expect(bob.hasEstablishedSession(with: bobPeerID))
-        #expect(alice.hasSession(with: alicePeerID))
-        #expect(bob.hasSession(with: bobPeerID))
-        #expect(alice.getPeerPublicKeyData(alicePeerID)?.count == 32)
-        #expect(bob.getPeerPublicKeyData(bobPeerID)?.count == 32)
-        #expect(alice.getPeerFingerprint(alicePeerID) != nil)
-        #expect(bob.getPeerFingerprint(bobPeerID) != nil)
+        #expect(alice.hasEstablishedSession(with: bobPeerID))
+        #expect(bob.hasEstablishedSession(with: alicePeerID))
+        #expect(alice.hasSession(with: bobPeerID))
+        #expect(bob.hasSession(with: alicePeerID))
+        #expect(alice.getPeerPublicKeyData(bobPeerID)?.count == 32)
+        #expect(bob.getPeerPublicKeyData(alicePeerID)?.count == 32)
+        #expect(alice.getPeerFingerprint(bobPeerID) != nil)
+        #expect(bob.getPeerFingerprint(alicePeerID) != nil)

        let plaintext = Data("secret payload".utf8)
-        let ciphertext = try alice.encrypt(plaintext, for: alicePeerID)
-        let decrypted = try bob.decrypt(ciphertext, from: bobPeerID)
+        let ciphertext = try alice.encrypt(plaintext, for: bobPeerID)
+        let decrypted = try bob.decrypt(ciphertext, from: alicePeerID)
        #expect(decrypted == plaintext)

-        alice.clearSession(for: alicePeerID)
-        #expect(!alice.hasSession(with: alicePeerID))
-        #expect(alice.getPeerFingerprint(alicePeerID) == nil)
+        alice.clearSession(for: bobPeerID)
+        #expect(!alice.hasSession(with: bobPeerID))
+        #expect(alice.getPeerFingerprint(bobPeerID) == nil)

        bob.clearEphemeralStateForPanic()
-        #expect(!bob.hasSession(with: bobPeerID))
-        #expect(bob.getPeerFingerprint(bobPeerID) == nil)
+        #expect(!bob.hasSession(with: alicePeerID))
+        #expect(bob.getPeerFingerprint(alicePeerID) == nil)
+    }
+
+    @Test("Handshake rejects a claimed peer ID that does not match the authenticated static key")
+    func handshakeRejectsClaimedPeerIDStaticKeyMismatch() async throws {
+        let receiver = NoiseEncryptionService(keychain: MockKeychain())
+        let claimedAlice = NoiseEncryptionService(keychain: MockKeychain())
+        let mallory = NoiseEncryptionService(keychain: MockKeychain())
+        let receiverPeerID = PeerID(publicKey: receiver.getStaticPublicKeyData())
+        let claimedAlicePeerID = PeerID(publicKey: claimedAlice.getStaticPublicKeyData())
+        let recorder = AuthenticationRecorder()
+        receiver.addOnPeerAuthenticatedHandler(recorder.record(peerID:fingerprint:))
+
+        let message1 = try mallory.initiateHandshake(with: receiverPeerID)
+        let message2 = try #require(
+            try receiver.processHandshakeMessage(from: claimedAlicePeerID, message: message1)
+        )
+        let message3 = try #require(
+            try mallory.processHandshakeMessage(from: receiverPeerID, message: message2)
+        )
+
+        do {
+            _ = try receiver.processHandshakeMessage(from: claimedAlicePeerID, message: message3)
+            Issue.record("Expected the authenticated Mallory key to be rejected for Alice's peer ID")
+        } catch let error as NoiseSessionError {
+            #expect(error == .peerIdentityMismatch)
+        } catch {
+            Issue.record("Unexpected mismatch error: \(error)")
+        }
+
+        #expect(!receiver.hasSession(with: claimedAlicePeerID))
+        let emittedAuthentication = await TestHelpers.waitUntil(
+            { recorder.count > 0 },
+            timeout: TestConstants.shortTimeout
+        )
+        #expect(!emittedAuthentication)
+    }
+
+    @Test("Failed forged replacement preserves the established peer session")
+    func forgedReplacementPreservesEstablishedSession() async throws {
+        let alice = NoiseEncryptionService(keychain: MockKeychain())
+        let receiver = NoiseEncryptionService(keychain: MockKeychain())
+        let mallory = NoiseEncryptionService(keychain: MockKeychain())
+        let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
+        let receiverPeerID = PeerID(publicKey: receiver.getStaticPublicKeyData())
+        let recorder = AuthenticationRecorder()
+        receiver.addOnPeerAuthenticatedHandler(recorder.record(peerID:fingerprint:))
+
+        try establishSessions(alice: alice, bob: receiver)
+        let initialAuthentication = await TestHelpers.waitUntil(
+            { recorder.count == 1 },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(initialAuthentication)
+
+        let before = try alice.encrypt(Data("before".utf8), for: receiverPeerID)
+        #expect(try receiver.decrypt(before, from: alicePeerID) == Data("before".utf8))
+
+        let forgedMessage1 = try mallory.initiateHandshake(with: receiverPeerID)
+        let forgedMessage2 = try #require(
+            try receiver.processHandshakeMessage(from: alicePeerID, message: forgedMessage1)
+        )
+        // The replacement has not authenticated yet; the working Alice
+        // transport session must remain available throughout the candidate.
+        #expect(receiver.hasEstablishedSession(with: alicePeerID))
+        let forgedMessage3 = try #require(
+            try mallory.processHandshakeMessage(from: receiverPeerID, message: forgedMessage2)
+        )
+
+        do {
+            _ = try receiver.processHandshakeMessage(from: alicePeerID, message: forgedMessage3)
+            Issue.record("Expected forged replacement to fail peer binding")
+        } catch let error as NoiseSessionError {
+            #expect(error == .peerIdentityMismatch)
+        } catch {
+            Issue.record("Unexpected replacement error: \(error)")
+        }
+
+        #expect(receiver.hasEstablishedSession(with: alicePeerID))
+        let after = try alice.encrypt(Data("after".utf8), for: receiverPeerID)
+        #expect(try receiver.decrypt(after, from: alicePeerID) == Data("after".utf8))
+        let emittedReplacementAuthentication = await TestHelpers.waitUntil(
+            { recorder.count > 1 },
+            timeout: TestConstants.shortTimeout
+        )
+        #expect(!emittedReplacementAuthentication)
+    }
+
+    @Test("Valid rehandshake atomically replaces the established session")
+    func validRehandshakeReplacesEstablishedSession() throws {
+        let alice = NoiseEncryptionService(keychain: MockKeychain())
+        let receiver = NoiseEncryptionService(keychain: MockKeychain())
+        let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
+        let receiverPeerID = PeerID(publicKey: receiver.getStaticPublicKeyData())
+
+        try establishSessions(alice: alice, bob: receiver)
+        alice.clearSession(for: receiverPeerID)
+
+        let message1 = try alice.initiateHandshake(with: receiverPeerID)
+        let message2 = try #require(
+            try receiver.processHandshakeMessage(from: alicePeerID, message: message1)
+        )
+        #expect(receiver.hasEstablishedSession(with: alicePeerID))
+        let message3 = try #require(
+            try alice.processHandshakeMessage(from: receiverPeerID, message: message2)
+        )
+        _ = try receiver.processHandshakeMessage(from: alicePeerID, message: message3)
+
+        #expect(alice.hasEstablishedSession(with: receiverPeerID))
+        #expect(receiver.hasEstablishedSession(with: alicePeerID))
+        let ciphertext = try alice.encrypt(Data("new session".utf8), for: receiverPeerID)
+        #expect(try receiver.decrypt(ciphertext, from: alicePeerID) == Data("new session".utf8))
    }

    @Test("Encrypt without a session requests handshake and decrypt without session fails")
@@ -200,16 +311,16 @@ struct NoiseEncryptionServiceTests {

    private func establishSessions(
        alice: NoiseEncryptionService,
-        bob: NoiseEncryptionService,
-        alicePeerID: PeerID,
-        bobPeerID: PeerID
+        bob: NoiseEncryptionService
    ) throws {
-        let message1 = try alice.initiateHandshake(with: alicePeerID)
-        let response = try bob.processHandshakeMessage(from: bobPeerID, message: message1)
+        let alicePeerID = PeerID(publicKey: alice.getStaticPublicKeyData())
+        let bobPeerID = PeerID(publicKey: bob.getStaticPublicKeyData())
+        let message1 = try alice.initiateHandshake(with: bobPeerID)
+        let response = try bob.processHandshakeMessage(from: alicePeerID, message: message1)
        let message2 = try #require(response, "Expected handshake response")
-        let final = try alice.processHandshakeMessage(from: alicePeerID, message: message2)
+        let final = try alice.processHandshakeMessage(from: bobPeerID, message: message2)
        let message3 = try #require(final, "Expected handshake final")
-        let finalMessage = try bob.processHandshakeMessage(from: bobPeerID, message: message3)
+        let finalMessage = try bob.processHandshakeMessage(from: alicePeerID, message: message3)
        #expect(finalMessage == nil)
    }
 }
@@ -1,61 +0,0 @@
-import re
-from pathlib import Path
-import unittest
-
-
-REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
-WORKFLOW_PATH = REPOSITORY_ROOT / ".github/workflows/fetch_georelays.yml"
-
-
-class FetchGeoRelaysWorkflowTests(unittest.TestCase):
-    @classmethod
-    def setUpClass(cls) -> None:
-        cls.workflow = WORKFLOW_PATH.read_text(encoding="utf-8")
-
-    def test_write_capable_checkout_action_is_immutable(self) -> None:
-        checkout = re.search(r"uses: actions/checkout@([0-9a-f]+)", self.workflow)
-        self.assertIsNotNone(checkout)
-        self.assertRegex(checkout.group(1), r"^[0-9a-f]{40}$")
-        self.assertIn("persist-credentials: false", self.workflow)
-
-    def test_pr_failure_has_single_issue_fallback_with_review_metadata(self) -> None:
-        required_fragments = [
-            "issues: write",
-            "TRACKING_ISSUE_TITLE: GeoRelay update awaiting pull request",
-            "gh pr create",
-            "gh issue create",
-            "gh issue edit",
-            "compare/main...${UPDATE_BRANCH}?expand=1",
-            "Upstream commit: $SOURCE_COMMIT",
-            "Data rows: $DATA_ROWS",
-            "Unique normalized relays: $UNIQUE_RELAYS",
-            "SHA-256: $DATA_SHA256",
-            '[[ -n "$issue_url" ]]',
-        ]
-        for fragment in required_fragments:
-            with self.subTest(fragment=fragment):
-                self.assertIn(fragment, self.workflow)
-
-        confirmed = self.workflow.index('[[ -n "$issue_url" ]]')
-        success_summary = self.workflow.index(
-            "Published GeoRelay tracking issue fallback: $issue_url"
-        )
-        self.assertLess(confirmed, success_summary)
-
-    def test_obsolete_review_state_is_cleaned_without_pushing_main(self) -> None:
-        self.assertIn("gh pr close", self.workflow)
-        self.assertIn("gh issue close", self.workflow)
-        self.assertIn('git push origin --delete "$UPDATE_BRANCH"', self.workflow)
-        self.assertIn('git switch -C "$UPDATE_BRANCH"', self.workflow)
-        self.assertNotIn("git push origin main", self.workflow)
-        self.assertNotIn("git push --force origin main", self.workflow)
-
-    def test_workflow_runs_all_validator_tests(self) -> None:
-        self.assertIn(
-            'python3 -m unittest discover -s scripts/tests -p "test_*.py" -v',
-            self.workflow,
-        )
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -1,186 +0,0 @@
-import tempfile
-from pathlib import Path
-import sys
-import unittest
-
-sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
-import validate_georelays as validator
-
-
-def csv_bytes(rows: list[str]) -> bytes:
-    return ("Relay URL,Latitude,Longitude\n" + "\n".join(rows) + "\n").encode()
-
-
-class ValidateGeoRelaysTests(unittest.TestCase):
-    def test_validates_and_deduplicates_secure_relay_addresses(self) -> None:
-        data = csv_bytes(
-            [
-                "relay.example.com,10,20",
-                "wss://relay.example.com:443/,10,20",
-                "https://second.example.org,11,21",
-            ]
-        )
-
-        summary = validator.validate_bytes(data, minimum_unique_relays=2)
-
-        self.assertEqual(summary.data_rows, 3)
-        self.assertEqual(summary.unique_relays, 2)
-
-    def test_rejects_insecure_or_non_host_relay_urls(self) -> None:
-        bad_addresses = [
-            "http://relay.example.com",
-            "ws://relay.example.com",
-            "wss://user@relay.example.com",
-            "wss://relay.example.com/path",
-            "wss://relay.example.com?",
-            "wss://relay.example.com#",
-            "relay.example.com:0",
-            "relay.example.com:99999",
-            "localhost",
-            "127.0.0.1",
-            "relay_example.com",
-            "relay\u202e.example.com",
-        ]
-
-        for address in bad_addresses:
-            with self.subTest(address=address):
-                with self.assertRaises(validator.ValidationError):
-                    validator.validate_bytes(
-                        csv_bytes([f"{address},10,20"]),
-                        minimum_unique_relays=1,
-                    )
-
-    def test_rejects_malformed_rows_and_unsafe_coordinates(self) -> None:
-        bad_rows = [
-            "relay.example.com,10",
-            "relay.example.com,NaN,20",
-            "relay.example.com,1_0,20",
-            "relay.example.com,\u0661\u0660,20",
-            "relay.example.com,\uff11\uff10,20",
-            "relay.example.com,91,20",
-            "relay.example.com,10,-181",
-            "relay.example.com,10,20,extra",
-            '"relay.example.com",10,20',
-        ]
-
-        for row in bad_rows:
-            with self.subTest(row=row):
-                with self.assertRaises(validator.ValidationError):
-                    validator.validate_bytes(csv_bytes([row]), minimum_unique_relays=1)
-
-    def test_accepts_ascii_coordinate_forms_supported_by_swift_double(self) -> None:
-        summary = validator.validate_bytes(
-            csv_bytes(
-                [
-                    "one.example.com,+1,-.5",
-                    "two.example.com,1.e1,2E+1",
-                    "three.example.com,01,20.",
-                ]
-            ),
-            minimum_unique_relays=3,
-        )
-
-        self.assertEqual(summary.unique_relays, 3)
-
-    def test_rejects_conflicts_limits_and_large_baseline_deltas(self) -> None:
-        with self.assertRaises(validator.ValidationError):
-            validator.validate_bytes(
-                csv_bytes(["relay.example.com,10,20", "relay.example.com,11,21"]),
-                minimum_unique_relays=1,
-            )
-        with self.assertRaises(validator.ValidationError):
-            validator.validate_bytes(b"x" * 20, maximum_bytes=10, minimum_unique_relays=1)
-        with self.assertRaises(validator.ValidationError):
-            validator.validate_bytes(
-                csv_bytes(["one.example.com,1,1", "two.example.com,2,2"]),
-                minimum_unique_relays=3,
-            )
-
-        baseline = csv_bytes(
-            [f"relay-{index}.example.com,{index % 80},{index % 170}" for index in range(120)]
-        )
-        shrunken = csv_bytes(
-            [f"relay-{index}.example.com,{index % 80},{index % 170}" for index in range(59)]
-        )
-        with self.assertRaises(validator.ValidationError):
-            validator.validate_update(shrunken, baseline)
-
-        smaller_baseline = csv_bytes(
-            [f"relay-{index}.example.com,{index % 80},{index % 170}" for index in range(60)]
-        )
-        expanded = csv_bytes(
-            [f"relay-{index}.example.com,{index % 80},{index % 170}" for index in range(121)]
-        )
-        with self.assertRaises(validator.ValidationError):
-            validator.validate_update(expanded, smaller_baseline)
-
-    def test_update_requires_exact_normalized_baseline_entry_overlap(self) -> None:
-        baseline_rows = [
-            f"relay-{index}.example.com,{index % 80},{index % 170}"
-            for index in range(60)
-        ]
-        baseline = csv_bytes(baseline_rows)
-        disjoint = csv_bytes(
-            [
-                f"attacker-{index}.example.com,{index % 80},{index % 170}"
-                for index in range(60)
-            ]
-        )
-        rewritten_coordinates = csv_bytes(
-            [
-                f"relay-{index}.example.com,{(index % 80) + 0.5},{index % 170}"
-                for index in range(60)
-            ]
-        )
-
-        for candidate in (disjoint, rewritten_coordinates):
-            with self.subTest(candidate=candidate[:80]):
-                with self.assertRaisesRegex(
-                    validator.ValidationError,
-                    "exact relay-coordinate entries",
-                ):
-                    validator.validate_update(candidate, baseline)
-
-        half_retained = csv_bytes(
-            [
-                f"wss://relay-{index}.example.com:443/,{index % 80},{index % 170}"
-                for index in range(30)
-            ]
-            + [
-                f"replacement-{index}.example.com,{index % 80},{index % 170}"
-                for index in range(30)
-            ]
-        )
-        summary = validator.validate_update(half_retained, baseline)
-        self.assertEqual(summary.unique_relays, 60)
-
-    def test_cli_copies_only_validated_data_and_emits_review_metadata(self) -> None:
-        rows = [f"relay-{index}.example.com,{index % 80},{index % 170}" for index in range(60)]
-        data = csv_bytes(rows)
-        with tempfile.TemporaryDirectory() as directory:
-            root = Path(directory)
-            candidate = root / "candidate.csv"
-            baseline = root / "baseline.csv"
-            output = root / "output.csv"
-            github_output = root / "github-output.txt"
-            candidate.write_bytes(data)
-            baseline.write_bytes(data)
-
-            result = validator.main(
-                [
-                    "--input", str(candidate),
-                    "--baseline", str(baseline),
-                    "--output", str(output),
-                    "--github-output", str(github_output),
-                ]
-            )
-
-            self.assertEqual(result, 0)
-            self.assertEqual(output.read_bytes(), data)
-            metadata = github_output.read_text()
-            self.assertIn("unique_relays=60", metadata)
-            self.assertIn("sha256=", metadata)
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -1,271 +0,0 @@
-#!/usr/bin/env python3
-"""Strict validator for the reviewed georelay CSV update workflow."""
-
-from __future__ import annotations
-
-import argparse
-import csv
-import hashlib
-import io
-import math
-import re
-from dataclasses import dataclass
-from pathlib import Path
-import sys
-import unicodedata
-from urllib.parse import urlsplit
-
-
-MAX_BYTES = 512 * 1024
-MAX_ROWS = 5_000
-MAX_UNIQUE_RELAYS = 5_000
-MIN_UNIQUE_RELAYS = 50
-MIN_BASELINE_FRACTION = 0.5
-MAX_BASELINE_MULTIPLIER = 2.0
-EXPECTED_HEADER = ("relay url", "latitude", "longitude")
-ASCII_DECIMAL_PATTERN = re.compile(
-    r"[+-]?(?:[0-9]+(?:\.[0-9]*)?|\.[0-9]+)(?:[eE][+-]?[0-9]+)?\Z"
-)
-
-
-class ValidationError(ValueError):
-    pass
-
-
-@dataclass(frozen=True)
-class ValidationSummary:
-    data_rows: int
-    unique_relays: int
-    sha256: str
-
-
-@dataclass(frozen=True)
-class _ValidatedDataset:
-    summary: ValidationSummary
-    entries: frozenset[tuple[str, float, float]]
-
-
-def _has_disallowed_control(value: str) -> bool:
-    return any(
-        unicodedata.category(character) in {"Cc", "Cf"}
-        and character not in {"\r", "\n", "\t"}
-        for character in value
-    )
-
-
-def normalize_relay_address(raw_value: str) -> str:
-    value = raw_value.strip()
-    if not value or _has_disallowed_control(value):
-        raise ValidationError("relay address is empty or contains control characters")
-    # urlsplit cannot distinguish an absent query/fragment from an explicitly
-    # empty one. Reject the delimiters themselves so this validator matches
-    # URLComponents in the client and reviewed data cannot fail closed there.
-    if "?" in value or "#" in value:
-        raise ValidationError(f"relay query or fragment is not allowed: {value}")
-
-    candidate = value if "://" in value else f"wss://{value}"
-    try:
-        parsed = urlsplit(candidate)
-        port = parsed.port
-    except ValueError as error:
-        raise ValidationError(f"invalid relay URL: {value}") from error
-
-    if parsed.scheme.lower() not in {"wss", "https"}:
-        raise ValidationError(f"relay must use wss/https or a bare hostname: {value}")
-    if parsed.username is not None or parsed.password is not None:
-        raise ValidationError(f"relay credentials are not allowed: {value}")
-    if parsed.path not in {"", "/"} or parsed.query or parsed.fragment:
-        raise ValidationError(f"relay path, query, or fragment is not allowed: {value}")
-
-    host = (parsed.hostname or "").lower()
-    if not host or len(host) > 253 or not host.isascii():
-        raise ValidationError(f"relay hostname is missing or non-ASCII: {value}")
-    if host.endswith(".") or host == "localhost" or host.endswith((".localhost", ".local", ".internal")):
-        raise ValidationError(f"local or absolute relay hostname is not allowed: {value}")
-
-    labels = host.split(".")
-    if len(labels) < 2 or all(label.isdigit() for label in labels):
-        raise ValidationError(f"relay must use a public DNS hostname: {value}")
-    for label in labels:
-        if not 1 <= len(label) <= 63:
-            raise ValidationError(f"invalid DNS label length: {value}")
-        if label[0] == "-" or label[-1] == "-":
-            raise ValidationError(f"DNS labels cannot start or end with '-': {value}")
-        if any(character not in "abcdefghijklmnopqrstuvwxyz0123456789-" for character in label):
-            raise ValidationError(f"invalid DNS hostname character: {value}")
-
-    if port is not None and not 1 <= port <= 65_535:
-        raise ValidationError(f"invalid relay port: {value}")
-    if port in {None, 443}:
-        return host
-    return f"{host}:{port}"
-
-
-def _validated_dataset(
-    data: bytes,
-    *,
-    minimum_unique_relays: int = MIN_UNIQUE_RELAYS,
-    maximum_bytes: int = MAX_BYTES,
-    maximum_rows: int = MAX_ROWS,
-    maximum_unique_relays: int = MAX_UNIQUE_RELAYS,
-) -> _ValidatedDataset:
-    if not data or len(data) > maximum_bytes:
-        raise ValidationError(f"CSV must contain 1..{maximum_bytes} bytes")
-
-    try:
-        text = data.decode("utf-8")
-    except UnicodeDecodeError as error:
-        raise ValidationError("CSV is not valid UTF-8") from error
-    if text.startswith("\ufeff"):
-        raise ValidationError("UTF-8 BOM is not allowed")
-    if _has_disallowed_control(text):
-        raise ValidationError("CSV contains disallowed control characters")
-    # Runtime intentionally implements the fixed three-field schema without
-    # general CSV quoting. Reject quoted variants here so reviewed workflow
-    # output and client-side validation cannot disagree.
-    if '"' in text:
-        raise ValidationError("quoted CSV fields are not allowed")
-
-    reader = csv.reader(io.StringIO(text, newline=""), strict=True)
-    try:
-        header = next(reader)
-    except (StopIteration, csv.Error) as error:
-        raise ValidationError("CSV header is missing") from error
-    normalized_header = tuple(field.strip().lower() for field in header)
-    if normalized_header != EXPECTED_HEADER:
-        raise ValidationError(f"unexpected CSV header: {header!r}")
-
-    data_rows = 0
-    relays: dict[str, tuple[float, float]] = {}
-    try:
-        for row in reader:
-            if not row or all(not field.strip() for field in row):
-                continue
-            data_rows += 1
-            if data_rows > maximum_rows:
-                raise ValidationError(f"CSV exceeds {maximum_rows} data rows")
-            if len(row) != 3:
-                raise ValidationError(f"row {reader.line_num} must contain exactly 3 columns")
-
-            address = normalize_relay_address(row[0])
-            latitude_text = row[1].strip()
-            longitude_text = row[2].strip()
-            if not ASCII_DECIMAL_PATTERN.fullmatch(latitude_text) or not ASCII_DECIMAL_PATTERN.fullmatch(longitude_text):
-                raise ValidationError(
-                    f"row {reader.line_num} coordinates must be ASCII decimal numbers"
-                )
-            latitude = float(latitude_text)
-            longitude = float(longitude_text)
-            if not math.isfinite(latitude) or not -90 <= latitude <= 90:
-                raise ValidationError(f"row {reader.line_num} latitude is out of range")
-            if not math.isfinite(longitude) or not -180 <= longitude <= 180:
-                raise ValidationError(f"row {reader.line_num} longitude is out of range")
-
-            coordinates = (latitude, longitude)
-            previous = relays.get(address)
-            if previous is not None and previous != coordinates:
-                raise ValidationError(f"relay {address} has conflicting coordinates")
-            relays[address] = coordinates
-            if len(relays) > maximum_unique_relays:
-                raise ValidationError(f"CSV exceeds {maximum_unique_relays} unique relays")
-    except csv.Error as error:
-        raise ValidationError(f"malformed CSV near line {reader.line_num}") from error
-
-    if len(relays) < minimum_unique_relays:
-        raise ValidationError(
-            f"CSV has {len(relays)} unique relays; minimum is {minimum_unique_relays}"
-        )
-
-    return _ValidatedDataset(
-        summary=ValidationSummary(
-            data_rows=data_rows,
-            unique_relays=len(relays),
-            sha256=hashlib.sha256(data).hexdigest(),
-        ),
-        entries=frozenset(
-            (address, coordinates[0], coordinates[1])
-            for address, coordinates in relays.items()
-        ),
-    )
-
-
-def validate_bytes(
-    data: bytes,
-    *,
-    minimum_unique_relays: int = MIN_UNIQUE_RELAYS,
-    maximum_bytes: int = MAX_BYTES,
-    maximum_rows: int = MAX_ROWS,
-    maximum_unique_relays: int = MAX_UNIQUE_RELAYS,
-) -> ValidationSummary:
-    return _validated_dataset(
-        data,
-        minimum_unique_relays=minimum_unique_relays,
-        maximum_bytes=maximum_bytes,
-        maximum_rows=maximum_rows,
-        maximum_unique_relays=maximum_unique_relays,
-    ).summary
-
-
-def validate_update(candidate: bytes, baseline: bytes) -> ValidationSummary:
-    baseline_dataset = _validated_dataset(baseline, minimum_unique_relays=1)
-    candidate_dataset = _validated_dataset(candidate)
-    baseline_summary = baseline_dataset.summary
-    candidate_summary = candidate_dataset.summary
-
-    minimum_from_baseline = math.ceil(
-        baseline_summary.unique_relays * MIN_BASELINE_FRACTION
-    )
-    maximum_from_baseline = math.floor(
-        baseline_summary.unique_relays * MAX_BASELINE_MULTIPLIER
-    )
-    if candidate_summary.unique_relays < minimum_from_baseline:
-        raise ValidationError(
-            "candidate loses more than half of the baseline's unique relays "
-            f"({candidate_summary.unique_relays} < {minimum_from_baseline})"
-        )
-    if candidate_summary.unique_relays > maximum_from_baseline:
-        raise ValidationError(
-            "candidate more than doubles the baseline's unique relays "
-            f"({candidate_summary.unique_relays} > {maximum_from_baseline})"
-        )
-
-    retained_entries = len(baseline_dataset.entries & candidate_dataset.entries)
-    if retained_entries < minimum_from_baseline:
-        raise ValidationError(
-            "candidate retains fewer than half of the baseline's exact relay-coordinate entries "
-            f"({retained_entries} < {minimum_from_baseline})"
-        )
-    return candidate_summary
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--input", required=True, type=Path)
-    parser.add_argument("--baseline", required=True, type=Path)
-    parser.add_argument("--output", required=True, type=Path)
-    parser.add_argument("--github-output", type=Path)
-    args = parser.parse_args(argv)
-
-    try:
-        candidate = args.input.read_bytes()
-        baseline = args.baseline.read_bytes()
-        summary = validate_update(candidate, baseline)
-        args.output.write_bytes(candidate)
-        if args.github_output is not None:
-            with args.github_output.open("a", encoding="utf-8") as output:
-                output.write(f"data_rows={summary.data_rows}\n")
-                output.write(f"unique_relays={summary.unique_relays}\n")
-                output.write(f"sha256={summary.sha256}\n")
-    except (OSError, ValidationError) as error:
-        print(f"georelay validation failed: {error}", file=sys.stderr)
-        return 1
-
-    print(
-        f"validated {summary.unique_relays} unique relays across "
-        f"{summary.data_rows} rows (sha256 {summary.sha256})"
-    )
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())