Fix unbounded public rate limit buckets

.github/workflows/arti-provenance.yml

@@ -1,85 +0,0 @@
-name: Arti Binary Provenance
-
-# The Arti xcframework is a vendored binary; these checks turn the policy in
-# docs/ARTI-BINARY-PROVENANCE.md into an enforced gate:
-#  1. The checked-in binary must match the hash manifest in the provenance doc.
-#  2. A PR that changes the binary must also change at least one provenance
-#     input (Rust source, lockfile, build script, or the doc itself).
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - "localPackages/Arti/**"
-      - "docs/ARTI-BINARY-PROVENANCE.md"
-  pull_request:
-    paths:
-      - "localPackages/Arti/**"
-      - "docs/ARTI-BINARY-PROVENANCE.md"
-
-jobs:
-  verify-hashes:
-    name: Verify xcframework hashes against provenance doc
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-
-      - name: Compare artifact hashes with manifest
-        run: |
-          set -euo pipefail
-          doc="docs/ARTI-BINARY-PROVENANCE.md"
-
-          # Extract the manifest: lines of "<sha256>  <path>" from the doc.
-          grep -E '^[0-9a-f]{64}  localPackages/Arti/Frameworks/arti\.xcframework/' "$doc" \
-            | sort -k2 > expected.txt
-
-          if [ ! -s expected.txt ]; then
-            echo "::error::No hash manifest found in $doc"
-            exit 1
-          fi
-
-          # Hash the same file set the doc documents.
-          find localPackages/Arti/Frameworks/arti.xcframework -maxdepth 3 -type f -print0 \
-            | sort -z | xargs -0 sha256sum | sed 's/  \.\//  /' | sort -k2 > actual.txt
-
-          if ! diff -u expected.txt actual.txt; then
-            echo "::error::Checked-in arti.xcframework does not match the manifest in $doc. If the binary change is intentional, rebuild per the doc and update the manifest in the same PR."
-            exit 1
-          fi
-          echo "All $(wc -l < actual.txt) artifact hashes match the provenance manifest."
-
-  require-provenance-evidence:
-    name: Binary changes must ship with provenance inputs
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Check changed files
-        run: |
-          set -euo pipefail
-          base="origin/${{ github.base_ref }}"
-          git fetch --no-tags --depth=1 origin "${{ github.base_ref }}"
-          changed=$(git diff --name-only "$base"...HEAD)
-          echo "Changed files:"
-          echo "$changed"
-
-          if ! echo "$changed" | grep -q '^localPackages/Arti/Frameworks/arti\.xcframework/'; then
-            echo "No binary artifact changes; nothing to verify."
-            exit 0
-          fi
-
-          if echo "$changed" | grep -Eq '^(localPackages/Arti/(Cargo\.(toml|lock)|build-ios\.sh|arti-bitchat/)|docs/ARTI-BINARY-PROVENANCE\.md)'; then
-            echo "Binary change is accompanied by provenance inputs."
-            exit 0
-          fi
-
-          echo "::error::arti.xcframework changed without matching source, lockfile, build-script, or provenance-doc changes. See docs/ARTI-BINARY-PROVENANCE.md (\"Do not accept an xcframework-only update\")."
-          exit 1

.github/workflows/swift-tests.yml

@@ -10,9 +10,6 @@ jobs:
   test:
     name: Run Swift Tests (${{ matrix.name }})
     runs-on: macos-latest
-    # A hung test must fail fast, not hold a runner for GitHub's 360-minute
-    # default (observed: intermittent app-suite hangs starving the queue).
-    timeout-minutes: 15
 
     strategy:
       fail-fast: false # Don't cancel other matrix jobs when one fails
@@ -29,119 +26,17 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      # Use the Xcode-bundled Swift toolchain: it always matches the SDK on
-      # the runner image. A standalone swift.org toolchain (setup-swift) broke
-      # whenever the image's Xcode moved ahead of it ("this SDK is not
-      # supported by the compiler").
-      - name: Note toolchain version (cache key)
-        id: swift-version
-        run: echo "version=$(swift --version 2>/dev/null | head -1 | shasum | cut -c1-12)" >> "$GITHUB_OUTPUT"
+      - name: Set up Swift
+        uses: swift-actions/setup-swift@v2
 
       - name: Cache build artifacts
         uses: actions/cache@v4
         with:
           path: ${{ matrix.path }}/.build
-          key: ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/*.swift', matrix.path), format('{0}/**/Package.resolved', matrix.path)) }}
+          key: ${{ runner.os }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/*.swift', matrix.path), format('{0}/**/Package.resolved', matrix.path)) }}
           restore-keys: |
-            ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/Package.resolved', matrix.path)) }}
-            ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-
-
-      - name: Build tests
-        # Built separately so the hang watchdog below times only test
-        # execution: a cold-cache coverage build on a slow runner can
-        # legitimately take several minutes, and is already bounded by the
-        # 15-minute job timeout.
-        run: swift build --build-tests --enable-code-coverage --package-path ${{ matrix.path }}
+            ${{ runner.os }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/Package.resolved', matrix.path)) }}
+            ${{ runner.os }}-${{ matrix.name }}-
 
       - name: Run Tests
-        # Perf benchmarks are excluded here and run in their own serial step
-        # below: measuring while parallel test processes contend for cores
-        # produces noisy numbers, and the XCTest measure machinery has hung
-        # intermittently under parallel workers on loaded runners. Excluded
-        # via --skip (not just the env guard): every app run since the
-        # baselines landed timed out at the 15-minute job limit with the
-        # baseline tests dispatched into the parallel phase.
-        #
-        # The watchdog samples any still-running test processes after 5
-        # minutes (the suite passes in seconds when healthy; the build is
-        # done by this step) and kills the run, so a hang fails fast with
-        # stacks in the log instead of a silent timeout.
-        env:
-          BITCHAT_SKIP_PERF_BASELINES: "1"
-        run: |
-          swift test --skip-build --parallel --quiet --enable-code-coverage \
-            --skip PerformanceBaselineTests \
-            --package-path ${{ matrix.path }} &
-          test_pid=$!
-          (
-            sleep 300
-            if kill -0 "$test_pid" 2>/dev/null; then
-              echo "::group::Tests still running after 5 minutes — sampling before kill"
-              for pid in $(pgrep -if 'swiftpm-testing|xctest|PackageTests' || true); do
-                echo "--- sample of pid $pid ---"
-                sample "$pid" 5 2>/dev/null || true
-              done
-              echo "::endgroup::"
-              pkill -KILL -P "$test_pid" 2>/dev/null || true
-              kill -KILL "$test_pid" 2>/dev/null || true
-            fi
-          ) &
-          watchdog_pid=$!
-          wait "$test_pid" && status=0 || status=$?
-          kill "$watchdog_pid" 2>/dev/null || true
-          exit "$status"
-
-      # Benchmarks run serially on an otherwise idle runner for stable
-      # numbers; BITCHAT_PERF_LOG captures the PERF[...] lines for the gate.
-      - name: Run performance benchmarks (serial)
-        if: matrix.name == 'app'
-        timeout-minutes: 6
-        env:
-          BITCHAT_PERF_LOG: ${{ github.workspace }}/perf-output.log
-        run: swift test --quiet --filter PerformanceBaselineTests
-
-      # Order-of-magnitude performance regression gate. Floors are deliberately
-      # generous (see bitchatTests/Performance/perf-floors.json) so this
-      # catches algorithmic regressions, never runner variance.
-      - name: Performance floor gate
-        if: matrix.name == 'app'
-        run: ./scripts/check-perf-floors.sh perf-output.log
-
-      # Informational only: surfaces per-file and total line coverage in the
-      # job log so coverage trends are visible on every PR. No thresholds —
-      # this must never be the reason a build goes red.
-      - name: Coverage summary
-        run: |
-          BIN_PATH=$(swift build --show-bin-path --package-path ${{ matrix.path }})
-          PROF="$BIN_PATH/codecov/default.profdata"
-          XCTEST=$(find "$BIN_PATH" -maxdepth 1 -name '*.xctest' | head -1)
-          BINARY="$XCTEST/Contents/MacOS/$(basename "$XCTEST" .xctest)"
-          if [ -f "$PROF" ] && [ -f "$BINARY" ]; then
-            xcrun llvm-cov report "$BINARY" -instr-profile "$PROF" \
-              -ignore-filename-regex='(Tests|\.build|checkouts|Mocks|_PreviewHelpers)' || true
-          else
-            echo "No coverage data found; skipping summary."
-          fi
-
-  # SPM tests above only compile the macOS slice; this job covers the
-  # iOS-conditional code paths (UIKit, CoreBluetooth restoration, etc.).
-  ios-build:
-    name: Build iOS app (simulator)
-    runs-on: macos-latest
-    timeout-minutes: 15
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-
-      - name: Build iOS (simulator, no signing)
-        # arm64 only: the vendored arti.xcframework has no x86_64 simulator slice.
-        run: |
-          set -o pipefail
-          xcodebuild -project bitchat.xcodeproj \
-            -scheme "bitchat (iOS)" \
-            -sdk iphonesimulator \
-            -destination 'generic/platform=iOS Simulator' \
-            ARCHS=arm64 \
-            CODE_SIGNING_ALLOWED=NO \
-            build
+        run: swift test --parallel --quiet --package-path ${{ matrix.path }}

.gitignore

@@ -80,4 +80,3 @@ build.log
 
 # Local configs
 Local.xcconfig
-*.profraw

Configs/Release.xcconfig

@@ -1,4 +1,4 @@
-MARKETING_VERSION = 1.5.3
+MARKETING_VERSION = 1.5.1
 CURRENT_PROJECT_VERSION = 1
 
 IPHONEOS_DEPLOYMENT_TARGET = 16.0

PRIVACY_POLICY.md

@@ -1,6 +1,6 @@
 # bitchat Privacy Policy
 
-*Last updated: June 2026*
+*Last updated: January 2025*
 
 ## Our Commitment
 
@@ -9,7 +9,7 @@ bitchat is designed with privacy as its foundation. We believe private communica
 ## Summary
 
 - **No personal data collection** - We don't collect names, emails, or phone numbers
-- **No accounts or company servers** - Mesh chat works peer-to-peer; optional Nostr features use public or user-selected relays
+- **No servers** - Everything happens on your device and through peer-to-peer connections
 - **No tracking** - We have no analytics, telemetry, or user tracking
 - **Open source** - You can verify these claims by reading our code
 
@@ -17,11 +17,11 @@ bitchat is designed with privacy as its foundation. We believe private communica
 
 ### On Your Device Only
 
-1. **Identity Keys**
-   - Cryptographic private keys generated on first launch or when optional Nostr identities are created
+1. **Identity Key** 
+   - A cryptographic key generated on first launch
    - Stored locally in your device's secure storage
    - Allows you to maintain "favorite" relationships across app restarts
-   - Private keys never leave your device; public keys are shared when needed for messaging
+   - Never leaves your device
 
 2. **Nickname**
    - The display name you choose (or auto-generated)
@@ -38,19 +38,12 @@ bitchat is designed with privacy as its foundation. We believe private communica
    - Stored only on your device
    - Allows you to recognize these peers in future sessions
 
-5. **Optional Location Channel State**
-   - Your selected geohash channel, bookmarked geohashes, teleport flags, and bookmark display names
-   - Stored locally on your device so the location-channel UI can restore your choices
-   - Per-geohash Nostr identities are derived locally from a device seed stored in secure storage
-   - Exact latitude and longitude are not persisted by bitchat
-
 ### Temporary Session Data
 
 During each session, bitchat temporarily maintains:
 - Active peer connections (forgotten when app closes)
 - Routing information for message delivery
 - Cached messages for offline peers (12 hours max)
-- Your current location while optional location channels are enabled, used locally to compute geohash channels and friendly place names
 
 ## What Information is Shared
 
@@ -69,21 +62,13 @@ When you join a password-protected room:
 - Your nickname appears in the member list
 - Room owners can see you've joined
 
-### With Nostr Relays (Optional Features)
-
-If you enable Nostr-backed features:
-- Private fallback messages to mutual favorites are sent as encrypted NIP-17 gift wraps. Relays can see event metadata, but not message content.
-- Public location-channel messages, location notes, and presence are scoped with geohash tags. Relays and other participants can see the geohash tag, event kind, timestamp, and public key used for that geohash.
-- Exact GPS coordinates are not included in Nostr events by bitchat. The geohash precision you choose can still reveal an approximate area, from region-level to building-level.
-- Automatic presence heartbeats are limited to low-precision geohashes (region, province, and city). More precise geohash posts happen only when you use those channels or location notes.
-
 ## What We DON'T Do
 
 bitchat **never**:
 - Collects personal information
-- Sells or shares your exact GPS location
-- Stores data on servers we operate
-- Sells your data to advertisers or data brokers
+- Tracks your location
+- Stores data on servers
+- Shares data with third parties
 - Uses analytics or telemetry
 - Creates user profiles
 - Requires registration
@@ -99,27 +84,19 @@ All private messages use end-to-end encryption:
 ## Your Rights
 
 You have complete control:
-- **Delete Local State**: Triple-tap the logo to instantly wipe local keys, sessions, caches, and preferences
-- **Leave Anytime**: Close the app and local presence stops; relay-backed presence ages out
-- **No Account**: No account record exists for you to delete from us
-- **Portability**: Your local state stays on your device unless you send messages, use optional relay-backed features, or export it
+- **Delete Everything**: Triple-tap the logo to instantly wipe all data
+- **Leave Anytime**: Close the app and your presence disappears
+- **No Account**: Nothing to delete from servers because there are none
+- **Portability**: Your data never leaves your device unless you export it
 
 ## Bluetooth & Permissions
 
 bitchat requires Bluetooth permission to function:
 - Used only for peer-to-peer communication
+- No location data is accessed or stored
 - Bluetooth is not used for tracking
 - You can revoke this permission at any time in system settings
 
-## Location Permission
-
-Location permission is optional and is used only for location channels:
-- Used to compute local geohash channels and display names
-- Requested as when-in-use permission
-- Exact coordinates are not shared in messages or stored by bitchat
-- Selected and bookmarked geohashes may persist locally until you remove them, use panic wipe, or delete the app
-- You can revoke this permission at any time in system settings
-
 ## Children's Privacy
 
 bitchat does not knowingly collect information from children. The app has no age verification because it collects no personal information from anyone.
@@ -129,15 +106,12 @@ bitchat does not knowingly collect information from children. The app has no age
 - **Messages**: Deleted from memory when app closes (unless room retention is enabled)
 - **Identity Key**: Persists until you delete the app
 - **Favorites**: Persist until you remove them or delete the app
-- **Location channel choices**: Selected/bookmarked geohashes persist locally until removed, panic-wiped, or the app is deleted
-- **Nostr relay data**: Public geohash events and encrypted gift wraps may be retained by relays according to each relay's policy
 - **Everything Else**: Exists only during active sessions
 
 ## Security Measures
 
 - All communication is encrypted
-- No accounts or company servers
-- Optional Nostr relays receive only the events needed for Nostr-backed private fallback or public location channels
+- No data transmitted to servers (there are none)
 - Open source code for public audit
 - Regular security updates
 - Cryptographic signatures prevent tampering
@@ -147,7 +121,7 @@ bitchat does not knowingly collect information from children. The app has no age
 If we update this policy:
 - The "Last updated" date will change
 - The updated policy will be included in the app
-- No retroactive changes can make us collect data already held only in your app
+- No retroactive changes can affect data (since we don't collect any)
 
 ## Contact
 
@@ -158,7 +132,7 @@ bitchat is an open source project. For privacy questions:
 
 ## Philosophy
 
-Privacy isn't just a feature—it's the entire point. bitchat proves that modern communication doesn't require surrendering your privacy. No accounts, no company servers, no analytics. Just people talking freely.
+Privacy isn't just a feature—it's the entire point. bitchat proves that modern communication doesn't require surrendering your privacy. No accounts, no servers, no surveillance. Just people talking freely.
 
 ---
 

Package.swift

@@ -53,17 +53,11 @@ let package = Package(
             path: "bitchatTests",
             exclude: [
                 "Info.plist",
-                "README.md",
-                // CI perf gate data (read by scripts/check-perf-floors.sh),
-                // not a test resource.
-                "Performance/perf-floors.json"
+                "README.md"
             ],
             resources: [
                 .process("Localization"),
-                // Only the vector fixture: declaring the whole "Noise"
-                // directory would claim its .swift test files as resources
-                // and silently drop them from compilation.
-                .process("Noise/NoiseTestVectors.json")
+                .process("Noise")
             ]
         )
     ]

bitchat.xcodeproj/project.pbxproj

@@ -321,7 +321,7 @@
 			isa = PBXProject;
 			attributes = {
 				BuildIndependentTargetsInParallel = YES;
-				LastUpgradeCheck = 2650;
+				LastUpgradeCheck = 1640;
 			};
 			buildConfigurationList = 3EA424CBD51200895D361189 /* Build configuration list for PBXProject "bitchat" */;
 			developmentRegion = en;
@@ -446,6 +446,7 @@
 				CODE_SIGNING_ALLOWED = YES;
 				CODE_SIGNING_REQUIRED = YES;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
 				LD_RUNPATH_SEARCH_PATHS = (
@@ -470,6 +471,7 @@
 				CODE_SIGNING_ALLOWED = YES;
 				CODE_SIGNING_REQUIRED = YES;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
 				LD_RUNPATH_SEARCH_PATHS = (
@@ -496,6 +498,7 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -520,6 +523,7 @@
 				CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION = YES;
 				CODE_SIGN_ENTITLEMENTS = bitchatShareExtension/bitchatShareExtension.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatShareExtension/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
@@ -552,6 +556,7 @@
 				CODE_SIGN_ENTITLEMENTS = bitchat/bitchat.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				DEVELOPMENT_ASSET_PATHS = bitchat/_PreviewHelpers;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = NO;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -561,7 +566,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.5.3;
+				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				SDKROOT = iphoneos;
@@ -585,6 +590,7 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -611,6 +617,7 @@
 				CODE_SIGN_ENTITLEMENTS = bitchat/bitchat.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				DEVELOPMENT_ASSET_PATHS = bitchat/_PreviewHelpers;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -620,7 +627,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.5.3;
+				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				SDKROOT = iphoneos;
@@ -646,6 +653,7 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -655,7 +663,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
-				MARKETING_VERSION = 1.5.3;
+				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				REGISTER_APP_GROUPS = YES;
@@ -668,7 +676,6 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
@@ -702,7 +709,6 @@
 				CURRENT_PROJECT_VERSION = "$(CURRENT_PROJECT_VERSION)";
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -720,7 +726,6 @@
 				MTL_ENABLE_DEBUG_INFO = NO;
 				MTL_FAST_MATH = YES;
 				PRODUCT_NAME = "$(TARGET_NAME)";
-				STRING_CATALOG_GENERATE_SYMBOLS = NO;
 				SWIFT_COMPILATION_MODE = wholemodule;
 				SWIFT_OPTIMIZATION_LEVEL = "-O";
 				SWIFT_VERSION = "$(SWIFT_VERSION)";
@@ -740,6 +745,7 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = NO;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -749,7 +755,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
-				MARKETING_VERSION = 1.5.3;
+				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				REGISTER_APP_GROUPS = YES;
@@ -762,7 +768,6 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
@@ -796,7 +801,6 @@
 				CURRENT_PROJECT_VERSION = "$(CURRENT_PROJECT_VERSION)";
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -821,7 +825,6 @@
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
 				PRODUCT_NAME = "$(TARGET_NAME)";
-				STRING_CATALOG_GENERATE_SYMBOLS = NO;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
 				SWIFT_VERSION = "$(SWIFT_VERSION)";
@@ -838,6 +841,7 @@
 				CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION = YES;
 				CODE_SIGN_ENTITLEMENTS = bitchatShareExtension/bitchatShareExtension.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatShareExtension/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";

bitchat.xcodeproj/xcshareddata/xcschemes/bitchat (iOS).xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2650"
+   LastUpgradeVersion = "1640"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"

bitchat.xcodeproj/xcshareddata/xcschemes/bitchat (macOS).xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2650"
+   LastUpgradeVersion = "1640"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"

bitchat/App/AppArchitecture.swift

@@ -66,12 +66,12 @@ actor AppEventStream {
     }
 }
 
-/// Identity key for a direct conversation. Equality and hashing use the
-/// canonical `id` only; `routingPeerID` carries the transport-level peer ID
-/// the conversation is keyed under (see `ConversationID.directPeer`).
 struct PeerHandle: Sendable, Identifiable {
     let id: String
     let routingPeerID: PeerID
+    let displayName: String?
+    let noisePublicKeyHex: String?
+    let nostrPublicKey: String?
 }
 
 extension PeerHandle: Equatable {
@@ -100,3 +100,264 @@ enum ConversationID: Hashable, Sendable {
         }
     }
 }
+
+@MainActor
+final class IdentityResolver {
+    private var handlesByRoutingPeerID: [PeerID: PeerHandle] = [:]
+    private var handlesByNoiseKey: [String: PeerHandle] = [:]
+    private var handlesByNostrKey: [String: PeerHandle] = [:]
+
+    func register(peers: [BitchatPeer]) {
+        for peer in peers {
+            _ = register(peer: peer)
+        }
+    }
+
+    @discardableResult
+    func register(peer: BitchatPeer) -> PeerHandle {
+        let handle = buildHandle(
+            routingPeerID: peer.peerID,
+            displayName: peer.displayName,
+            noisePublicKeyHex: peer.noisePublicKey.isEmpty ? nil : peer.noisePublicKey.hexEncodedString().lowercased(),
+            nostrPublicKey: normalizedNostrKey(peer.nostrPublicKey)
+        )
+        cache(handle)
+        return handle
+    }
+
+    func canonicalHandle(for peerID: PeerID, displayName: String? = nil) -> PeerHandle {
+        if let handle = handlesByRoutingPeerID[peerID] {
+            return handle
+        }
+
+        if peerID.isNoiseKeyHex, let handle = handlesByNoiseKey[peerID.bare] {
+            return handle
+        }
+
+        if (peerID.isGeoDM || peerID.isGeoChat), let handle = handlesByNostrKey[peerID.bare] {
+            return handle
+        }
+
+        let handle = buildHandle(
+            routingPeerID: peerID,
+            displayName: displayName,
+            noisePublicKeyHex: peerID.isNoiseKeyHex ? peerID.bare : nil,
+            nostrPublicKey: (peerID.isGeoDM || peerID.isGeoChat) ? peerID.bare : nil
+        )
+        cache(handle)
+        return handle
+    }
+
+    private func buildHandle(
+        routingPeerID: PeerID,
+        displayName: String?,
+        noisePublicKeyHex: String?,
+        nostrPublicKey: String?
+    ) -> PeerHandle {
+        let canonicalID: String
+        if let noisePublicKeyHex {
+            canonicalID = "noise:\(noisePublicKeyHex)"
+        } else if let nostrPublicKey {
+            canonicalID = "nostr:\(nostrPublicKey)"
+        } else {
+            canonicalID = "mesh:\(routingPeerID.id)"
+        }
+
+        let normalizedDisplayName: String?
+        if let displayName, !displayName.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
+            normalizedDisplayName = displayName
+        } else {
+            normalizedDisplayName = nil
+        }
+
+        return PeerHandle(
+            id: canonicalID,
+            routingPeerID: routingPeerID,
+            displayName: normalizedDisplayName,
+            noisePublicKeyHex: noisePublicKeyHex,
+            nostrPublicKey: nostrPublicKey
+        )
+    }
+
+    private func normalizedNostrKey(_ nostrPublicKey: String?) -> String? {
+        guard let nostrPublicKey else { return nil }
+        let trimmed = nostrPublicKey.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        return trimmed.isEmpty ? nil : trimmed
+    }
+
+    private func cache(_ handle: PeerHandle) {
+        handlesByRoutingPeerID[handle.routingPeerID] = handle
+        if let noisePublicKeyHex = handle.noisePublicKeyHex {
+            handlesByNoiseKey[noisePublicKeyHex] = handle
+        }
+        if let nostrPublicKey = handle.nostrPublicKey {
+            handlesByNostrKey[nostrPublicKey] = handle
+        }
+    }
+}
+
+@MainActor
+final class ConversationStore: ObservableObject {
+    @Published private(set) var activeChannel: ChannelID = .mesh
+    @Published private(set) var selectedPrivatePeerID: PeerID?
+    @Published private(set) var selectedConversationID: ConversationID = .mesh
+    @Published private(set) var unreadConversations: Set<ConversationID> = []
+    @Published private(set) var messagesByConversation: [ConversationID: [BitchatMessage]] = [:]
+
+    private var directHandlesByConversation: [ConversationID: PeerHandle] = [:]
+
+    func setActiveChannel(_ channelID: ChannelID) {
+        activeChannel = channelID
+        if selectedPrivatePeerID == nil {
+            selectedConversationID = ConversationID(channelID: channelID)
+        }
+    }
+
+    func setSelectedPeerID(
+        _ peerID: PeerID?,
+        activeChannel: ChannelID,
+        identityResolver: IdentityResolver
+    ) {
+        self.activeChannel = activeChannel
+        selectedPrivatePeerID = peerID
+
+        if let peerID {
+            selectedConversationID = directConversationID(
+                for: peerID,
+                identityResolver: identityResolver
+            )
+        } else {
+            selectedConversationID = ConversationID(channelID: activeChannel)
+        }
+    }
+
+    func replaceMessages(_ messages: [BitchatMessage], for conversationID: ConversationID) {
+        messagesByConversation[conversationID] = normalized(messages)
+    }
+
+    func replaceMessages(_ messages: [BitchatMessage], for channelID: ChannelID) {
+        replaceMessages(messages, for: ConversationID(channelID: channelID))
+    }
+
+    func synchronizePublicConversation(_ messages: [BitchatMessage], activeChannel: ChannelID) {
+        setActiveChannel(activeChannel)
+        replaceMessages(messages, for: activeChannel)
+    }
+
+    func messages(for conversationID: ConversationID) -> [BitchatMessage] {
+        messagesByConversation[conversationID] ?? []
+    }
+
+    func directMessages(
+        for peerID: PeerID,
+        identityResolver: IdentityResolver
+    ) -> [BitchatMessage] {
+        messages(for: directConversationID(for: peerID, identityResolver: identityResolver))
+    }
+
+    func directMessagesByPeerID() -> [PeerID: [BitchatMessage]] {
+        var messagesByPeerID: [PeerID: [BitchatMessage]] = [:]
+
+        for (conversationID, handle) in directHandlesByConversation {
+            messagesByPeerID[handle.routingPeerID] = messages(for: conversationID)
+        }
+
+        return messagesByPeerID
+    }
+
+    func unreadDirectPeerIDs() -> Set<PeerID> {
+        unreadConversations.reduce(into: Set<PeerID>()) { result, conversationID in
+            guard case .direct(let handle) = conversationID else { return }
+            result.insert(directHandlesByConversation[conversationID]?.routingPeerID ?? handle.routingPeerID)
+        }
+    }
+
+    func synchronizeSelection(
+        activeChannel: ChannelID,
+        selectedPeerID: PeerID?,
+        identityResolver: IdentityResolver
+    ) {
+        setSelectedPeerID(
+            selectedPeerID,
+            activeChannel: activeChannel,
+            identityResolver: identityResolver
+        )
+    }
+
+    func synchronizePrivateChats(
+        _ privateChats: [PeerID: [BitchatMessage]],
+        unreadPeerIDs: Set<PeerID>,
+        identityResolver: IdentityResolver
+    ) {
+        var liveConversations = Set<ConversationID>()
+
+        for (peerID, messages) in privateChats {
+            let handle = identityResolver.canonicalHandle(for: peerID, displayName: messages.last?.sender)
+            let conversationID = ConversationID.direct(handle)
+            liveConversations.insert(conversationID)
+            directHandlesByConversation[conversationID] = handle
+            messagesByConversation[conversationID] = normalized(messages)
+        }
+
+        let staleDirectConversations = messagesByConversation.keys.filter { conversationID in
+            guard case .direct = conversationID else { return false }
+            return !liveConversations.contains(conversationID)
+        }
+
+        for conversationID in staleDirectConversations {
+            messagesByConversation.removeValue(forKey: conversationID)
+            unreadConversations.remove(conversationID)
+            directHandlesByConversation.removeValue(forKey: conversationID)
+        }
+
+        let publicUnread = unreadConversations.filter { conversationID in
+            switch conversationID {
+            case .mesh, .geohash:
+                return true
+            case .direct:
+                return false
+            }
+        }
+
+        unreadConversations = unreadPeerIDs.reduce(into: publicUnread) { result, peerID in
+            let handle = identityResolver.canonicalHandle(for: peerID)
+            result.insert(.direct(handle))
+        }
+    }
+
+    func markRead(_ conversationID: ConversationID) {
+        unreadConversations.remove(conversationID)
+    }
+
+    func markRead(
+        peerID: PeerID,
+        identityResolver: IdentityResolver
+    ) {
+        markRead(directConversationID(for: peerID, identityResolver: identityResolver))
+    }
+
+    private func normalized(_ messages: [BitchatMessage]) -> [BitchatMessage] {
+        var uniqueMessages: [String: BitchatMessage] = [:]
+
+        for message in messages {
+            uniqueMessages[message.id] = message
+        }
+
+        return uniqueMessages.values.sorted { lhs, rhs in
+            if lhs.timestamp != rhs.timestamp {
+                return lhs.timestamp < rhs.timestamp
+            }
+            return lhs.id < rhs.id
+        }
+    }
+
+    private func directConversationID(
+        for peerID: PeerID,
+        identityResolver: IdentityResolver
+    ) -> ConversationID {
+        let handle = identityResolver.canonicalHandle(for: peerID)
+        let conversationID = ConversationID.direct(handle)
+        directHandlesByConversation[conversationID] = handle
+        return conversationID
+    }
+}

bitchat/App/AppRuntime.swift

@@ -14,10 +14,7 @@ import AppKit
 final class AppRuntime: ObservableObject {
     let chatViewModel: ChatViewModel
     let events = AppEventStream()
-    /// Single source of truth for conversation message state and selection
-    /// (docs/CONVERSATION-STORE-DESIGN.md). Owned here; the feature models
-    /// and `ChatViewModel` observe and mutate it through its intent API.
-    let conversations: ConversationStore
+    let conversationStore: ConversationStore
     let peerIdentityStore: PeerIdentityStore
     let locationPresenceStore: LocationPresenceStore
     let publicChatModel: PublicChatModel
@@ -45,28 +42,30 @@ final class AppRuntime: ObservableObject {
         idBridge: NostrIdentityBridge = NostrIdentityBridge()
     ) {
         self.idBridge = idBridge
-        let conversations = ConversationStore()
+        let identityResolver = IdentityResolver()
+        let conversationStore = ConversationStore()
         let peerIdentityStore = PeerIdentityStore()
         let locationPresenceStore = LocationPresenceStore()
         let locationManager = LocationChannelManager.shared
-        self.conversations = conversations
+        self.conversationStore = conversationStore
         self.peerIdentityStore = peerIdentityStore
         self.locationPresenceStore = locationPresenceStore
         self.chatViewModel = ChatViewModel(
             keychain: keychain,
             idBridge: idBridge,
             identityManager: SecureIdentityStateManager(keychain),
-            conversations: conversations,
+            conversationStore: conversationStore,
+            identityResolver: identityResolver,
             peerIdentityStore: peerIdentityStore,
             locationPresenceStore: locationPresenceStore,
             locationManager: locationManager
         )
-        self.publicChatModel = PublicChatModel(conversations: conversations)
-        self.privateInboxModel = PrivateInboxModel(conversations: conversations)
+        self.publicChatModel = PublicChatModel(conversationStore: conversationStore)
+        self.privateInboxModel = PrivateInboxModel(conversationStore: conversationStore)
         self.locationChannelsModel = LocationChannelsModel(manager: locationManager)
         self.privateConversationModel = PrivateConversationModel(
             chatViewModel: self.chatViewModel,
-            conversations: conversations,
+            conversationStore: conversationStore,
             locationChannelsModel: self.locationChannelsModel,
             peerIdentityStore: peerIdentityStore
         )
@@ -78,11 +77,11 @@ final class AppRuntime: ObservableObject {
         self.conversationUIModel = ConversationUIModel(
             chatViewModel: self.chatViewModel,
             privateConversationModel: self.privateConversationModel,
-            conversations: conversations
+            conversationStore: conversationStore
         )
         self.peerListModel = PeerListModel(
             chatViewModel: self.chatViewModel,
-            conversations: conversations,
+            conversationStore: conversationStore,
             locationChannelsModel: self.locationChannelsModel,
             peerIdentityStore: peerIdentityStore,
             locationPresenceStore: locationPresenceStore
@@ -105,7 +104,7 @@ final class AppRuntime: ObservableObject {
 
         started = true
         NotificationDelegate.shared.runtime = self
-        VerificationService.shared.configure(with: chatViewModel.meshService)
+        VerificationService.shared.configure(with: chatViewModel.meshService.getNoiseService())
         announceInitialTorStatusIfNeeded()
 
         Task(priority: .utility) { [weak self] in
@@ -219,7 +218,7 @@ final class AppRuntime: ObservableObject {
         userInfo: [AnyHashable: Any]
     ) async -> UNNotificationPresentationOptions {
         if identifier.hasPrefix("private-"), let peerID = PeerID(str: userInfo["peerID"] as? String) {
-            if conversations.selectedPrivatePeerID == peerID {
+            if conversationStore.selectedPrivatePeerID == peerID {
                 return []
             }
             return [.banner, .sound]

bitchat/App/ConversationStore.swift

@@ -1,918 +0,0 @@
-//
-// ConversationStore.swift
-// bitchat
-//
-// Single source of truth for conversation message state (see
-// docs/CONVERSATION-STORE-DESIGN.md). One `Conversation` object per
-// `ConversationID`; all mutations flow through the store's intent API and
-// every mutation emits a `ConversationChange` after state is consistent.
-//
-// The store also owns conversation selection: the active public channel and
-// the selected private peer (the two UI selection axes) plus the derived
-// `selectedConversationID`.
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import BitFoundation
-import BitLogger
-import Combine
-import Foundation
-
-// MARK: - Conversation
-
-/// A single conversation timeline (`.mesh`, `.geohash`, or `.direct`).
-///
-/// Publishing granularity is per conversation: views observe ONE
-/// `Conversation` object, so an append to chat A never invalidates observers
-/// of chat B.
-///
-/// Mutations are `fileprivate` by design — only `ConversationStore`'s intent
-/// API may mutate a conversation, keeping the store the sole writer.
-@MainActor
-final class Conversation: ObservableObject, Identifiable {
-    let id: ConversationID
-    /// Maximum retained messages; oldest are trimmed on overflow.
-    let cap: Int
-
-    @Published private(set) var messages: [BitchatMessage] = []
-    @Published private(set) var isUnread: Bool = false
-
-    /// Incrementally-maintained message-ID → index map for O(1) dedup and
-    /// delivery-status lookup. Kept in sync on every mutation:
-    /// - tail append: single insert
-    /// - out-of-order insert: suffix reindex from the insertion point
-    /// - trim: full rebuild — `removeFirst(k)` is already O(n), so the
-    ///   rebuild does not change the asymptotics, and trim only happens once
-    ///   the cap (1337) is reached. Simple and correct beats the
-    ///   offset-tracking alternative here.
-    private var indexByMessageID: [String: Int] = [:]
-
-    fileprivate init(id: ConversationID, cap: Int) {
-        self.id = id
-        self.cap = max(1, cap)
-    }
-
-    // MARK: Reads
-
-    func containsMessage(withID messageID: String) -> Bool {
-        indexByMessageID[messageID] != nil
-    }
-
-    func message(withID messageID: String) -> BitchatMessage? {
-        guard let index = indexByMessageID[messageID] else { return nil }
-        return messages[index]
-    }
-
-    /// All message IDs currently in this conversation (unordered).
-    var messageIDs: Dictionary<String, Int>.Keys {
-        indexByMessageID.keys
-    }
-
-    // MARK: Store-internal mutations
-
-    /// Result of an ordered insert. `trimmedMessageIDs` reports messages
-    /// evicted by the cap so the store can keep its message-ID →
-    /// conversation map exact.
-    fileprivate struct InsertResult {
-        let inserted: Bool
-        let trimmedMessageIDs: [String]
-
-        static let duplicate = InsertResult(inserted: false, trimmedMessageIDs: [])
-    }
-
-    fileprivate enum UpsertOutcome {
-        case appended(trimmedMessageIDs: [String])
-        case updated
-    }
-
-    /// Inserts a message in timestamp order, deduplicating by message ID.
-    /// Fast path appends when the timestamp is >= the current tail;
-    /// otherwise a binary search finds the upper-bound insertion point so
-    /// arrival order is preserved among equal timestamps.
-    /// Reports `inserted: false` if a message with the same ID already exists.
-    fileprivate func insert(_ message: BitchatMessage) -> InsertResult {
-        guard indexByMessageID[message.id] == nil else { return .duplicate }
-
-        if let last = messages.last, message.timestamp < last.timestamp {
-            let index = insertionIndex(for: message.timestamp)
-            messages.insert(message, at: index)
-            reindex(from: index)
-        } else {
-            messages.append(message)
-            indexByMessageID[message.id] = messages.count - 1
-        }
-
-        return InsertResult(inserted: true, trimmedMessageIDs: trimIfNeeded())
-    }
-
-    /// Replace-or-append by message ID. An existing message keeps its
-    /// timeline position (in-place updates like media progress reuse the
-    /// original timestamp); a new message goes through ordered insertion.
-    fileprivate func upsert(_ message: BitchatMessage) -> UpsertOutcome {
-        if let index = indexByMessageID[message.id] {
-            messages[index] = message
-            return .updated
-        }
-        let result = insert(message)
-        return .appended(trimmedMessageIDs: result.trimmedMessageIDs)
-    }
-
-    /// Applies a delivery status keyed by message ID, honoring the
-    /// no-downgrade rule (the SOLE enforcement point — every delivery
-    /// update flows through the store): equal statuses are skipped, and
-    /// `.read` is never downgraded to `.delivered` or `.sent`.
-    /// Returns `true` when the status was applied.
-    fileprivate func applyDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool {
-        guard let index = indexByMessageID[messageID] else { return false }
-        let message = messages[index]
-        guard !Self.shouldSkipStatusUpdate(current: message.deliveryStatus, new: status) else { return false }
-
-        message.deliveryStatus = status
-        // BitchatMessage is a reference type; write back through the
-        // subscript so the @Published wrapper emits.
-        messages[index] = message
-        return true
-    }
-
-    /// Republishes a message without changing state. Used for mirrored
-    /// copies that share a BitchatMessage instance: the first conversation's
-    /// status apply mutated the shared object, so this conversation's
-    /// observers still need an @Published emission to re-render.
-    @discardableResult
-    fileprivate func republishMessage(withID messageID: String) -> Bool {
-        guard let index = indexByMessageID[messageID] else { return false }
-        messages[index] = messages[index]
-        return true
-    }
-
-    @discardableResult
-    fileprivate func setUnread(_ unread: Bool) -> Bool {
-        guard isUnread != unread else { return false }
-        isUnread = unread
-        return true
-    }
-
-    /// Removes a single message by ID. Returns the removed message, or
-    /// `nil` when no message with that ID exists.
-    fileprivate func remove(messageID: String) -> BitchatMessage? {
-        guard let index = indexByMessageID[messageID] else { return nil }
-        let removed = messages.remove(at: index)
-        indexByMessageID.removeValue(forKey: messageID)
-        reindex(from: index)
-        return removed
-    }
-
-    /// Removes every message matching `predicate`. Returns the removed
-    /// message IDs (empty when nothing matched).
-    fileprivate func removeAll(where predicate: (BitchatMessage) -> Bool) -> [String] {
-        var removedIDs: [String] = []
-        messages.removeAll { message in
-            guard predicate(message) else { return false }
-            removedIDs.append(message.id)
-            return true
-        }
-        guard !removedIDs.isEmpty else { return [] }
-        for id in removedIDs {
-            indexByMessageID.removeValue(forKey: id)
-        }
-        reindex(from: 0)
-        return removedIDs
-    }
-
-    fileprivate func clearMessages() {
-        messages.removeAll()
-        indexByMessageID.removeAll()
-    }
-
-    // MARK: Diagnostics
-
-    /// Appends human-readable invariant violations for this conversation
-    /// (empty when healthy): the ID index must be the exact inverse of the
-    /// messages array, the cap must hold, and timestamps must be
-    /// non-decreasing (equal timestamps keep arrival order, so only strict
-    /// inversions are violations). O(messages); allocates only on violation.
-    fileprivate func collectInvariantViolations(into violations: inout [String], label: String) {
-        if indexByMessageID.count != messages.count {
-            violations.append("\(label): index has \(indexByMessageID.count) entries for \(messages.count) messages")
-        }
-        if messages.count > cap {
-            violations.append("\(label): \(messages.count) messages exceeds cap \(cap)")
-        }
-        var previousTimestamp: Date?
-        for position in messages.indices {
-            let message = messages[position]
-            // Count equality + every message resolving to its own position
-            // proves the index is exactly the inverse map (no stale extras).
-            if let index = indexByMessageID[message.id] {
-                if index != position {
-                    violations.append("\(label): message \(message.id.prefix(8))… at \(position) indexed at \(index)")
-                }
-            } else {
-                violations.append("\(label): message \(message.id.prefix(8))… at \(position) missing from index")
-            }
-            if let previousTimestamp, message.timestamp < previousTimestamp {
-                violations.append("\(label): timestamp order violated at \(position)")
-            }
-            previousTimestamp = message.timestamp
-        }
-    }
-
-    // MARK: Internals
-
-    static func shouldSkipStatusUpdate(current: DeliveryStatus?, new: DeliveryStatus) -> Bool {
-        guard let current else { return false }
-        if current == new { return true }
-
-        switch (current, new) {
-        case (.read, .delivered), (.read, .sent):
-            return true
-        default:
-            return false
-        }
-    }
-
-    /// Upper-bound binary search: first index whose timestamp is strictly
-    /// greater than `timestamp`, so equal-timestamp messages keep arrival
-    /// order.
-    private func insertionIndex(for timestamp: Date) -> Int {
-        var low = 0
-        var high = messages.count
-        while low < high {
-            let mid = (low + high) / 2
-            if messages[mid].timestamp <= timestamp {
-                low = mid + 1
-            } else {
-                high = mid
-            }
-        }
-        return low
-    }
-
-    private func reindex(from start: Int) {
-        for index in start..<messages.count {
-            indexByMessageID[messages[index].id] = index
-        }
-    }
-
-    /// Trims oldest messages over the cap; returns the trimmed message IDs.
-    private func trimIfNeeded() -> [String] {
-        guard messages.count > cap else { return [] }
-        let overflow = messages.count - cap
-        let trimmedIDs = messages.prefix(overflow).map(\.id)
-        for id in trimmedIDs {
-            indexByMessageID.removeValue(forKey: id)
-        }
-        messages.removeFirst(overflow)
-        reindex(from: 0)
-        return trimmedIDs
-    }
-}
-
-// MARK: - ConversationChange
-
-/// Typed mutation events for non-UI consumers (delivery tracking,
-/// notifications, sync) that need "something changed in conversation X"
-/// without subscribing to whole message arrays. Emitted on the store's
-/// `changes` subject AFTER the corresponding state is consistent.
-enum ConversationChange {
-    case appended(ConversationID, BitchatMessage)
-    case updated(ConversationID, messageID: String)
-    case statusChanged(ConversationID, messageID: String, DeliveryStatus)
-    case messageRemoved(ConversationID, messageID: String)
-    case cleared(ConversationID)
-    case removed(ConversationID)
-    case migrated(from: ConversationID, to: ConversationID)
-    case unreadChanged(ConversationID, isUnread: Bool)
-}
-
-// MARK: - ConversationStore
-
-/// Sole writer and sole holder of conversation message state. All mutations
-/// go through the intent API below; backing collections are `private(set)`.
-/// Reads are synchronous — writers and readers share the main actor, so
-/// after an intent returns every observer sees the result.
-@MainActor
-final class ConversationStore: ObservableObject {
-    /// Conversation creation order; published so list-style consumers can
-    /// observe conversations appearing/disappearing without rebuilding from
-    /// the dictionary.
-    @Published private(set) var conversationIDs: [ConversationID] = []
-    @Published private(set) var selectedConversationID: ConversationID?
-    @Published private(set) var unreadConversations: Set<ConversationID> = []
-
-    // MARK: Selection state
-    // The two UI selection axes: which public channel is active, and which
-    // private chat (if any) is open on top of it. `selectedConversationID`
-    // is derived: the open private chat wins, otherwise the active public
-    // channel's conversation. Mutate via `setActiveChannel` /
-    // `setSelectedPrivatePeer` only.
-
-    @Published private(set) var activeChannel: ChannelID = .mesh
-    @Published private(set) var selectedPrivatePeerID: PeerID?
-
-    private(set) var conversationsByID: [ConversationID: Conversation] = [:]
-
-    /// Store-level message-ID → conversation-membership map for ID-only
-    /// lookups (delivery receipts arrive with a message ID, not a
-    /// conversation). Maintained incrementally at every mutation point —
-    /// all mutation is centralized in the intent API below, so the map is
-    /// exact, never scanned or rebuilt.
-    ///
-    /// The value is a `Set` because a private message can legitimately live
-    /// in TWO direct conversations: step 2's raw per-peer keying mirrors a
-    /// message into both the stable-key and ephemeral-peer chats
-    /// (`mirrorToEphemeralIfNeeded`). A delivery update must reach both
-    /// copies.
-    private var conversationIDsByMessageID: [String: Set<ConversationID>] = [:]
-
-    /// Monotonic count of messages inserted into any conversation (appends,
-    /// upsert-appends, migration inserts). Field-observability only: the
-    /// periodic store audit folds the delta into its heartbeat line so logs
-    /// carry throughput context. Never read on a hot path.
-    private(set) var appendCount: Int = 0
-
-    /// Sample counter for the mirrored-republish debug log in the ID-only
-    /// `setDeliveryStatus` fan-out (first + every Nth occurrence).
-    private var mirroredRepublishLogCount = 0
-
-    let changes = PassthroughSubject<ConversationChange, Never>()
-
-    // MARK: Intent API
-
-    /// Returns the conversation for `id`, creating it (with the cap policy
-    /// for its kind) on first access.
-    @discardableResult
-    func conversation(for id: ConversationID) -> Conversation {
-        if let existing = conversationsByID[id] {
-            return existing
-        }
-        let conversation = Conversation(id: id, cap: Self.cap(for: id))
-        conversationsByID[id] = conversation
-        conversationIDs.append(id)
-        return conversation
-    }
-
-    /// Appends a message in timestamp order. Returns `false` (and emits
-    /// nothing) if a message with the same ID is already present.
-    @discardableResult
-    func append(_ message: BitchatMessage, to id: ConversationID) -> Bool {
-        let conversation = conversation(for: id)
-        let result = conversation.insert(message)
-        guard result.inserted else { return false }
-        registerMessageID(message.id, in: id)
-        unregisterMessageIDs(result.trimmedMessageIDs, from: id)
-        changes.send(.appended(id, message))
-        return true
-    }
-
-    /// Replace-or-append by message ID (media progress, edits).
-    func upsertByID(_ message: BitchatMessage, in id: ConversationID) {
-        let conversation = conversation(for: id)
-        switch conversation.upsert(message) {
-        case .appended(let trimmedMessageIDs):
-            registerMessageID(message.id, in: id)
-            unregisterMessageIDs(trimmedMessageIDs, from: id)
-            changes.send(.appended(id, message))
-        case .updated:
-            changes.send(.updated(id, messageID: message.id))
-        }
-    }
-
-    /// Applies a delivery status keyed by message ID. Returns `false` when
-    /// the message is unknown or the update would downgrade the status
-    /// (read beats delivered beats sent).
-    @discardableResult
-    func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String, in id: ConversationID) -> Bool {
-        guard let conversation = conversationsByID[id],
-              conversation.applyDeliveryStatus(status, forMessageID: messageID) else {
-            return false
-        }
-        changes.send(.statusChanged(id, messageID: messageID, status))
-        return true
-    }
-
-    /// Applies a delivery status to EVERY conversation containing
-    /// `messageID` (ID-only — delivery receipts don't know conversations;
-    /// mirrored private copies live in two direct chats). Returns `false`
-    /// when the message is unknown or no copy changed (equal status or
-    /// downgrade — read beats delivered beats sent).
-    ///
-    /// `BitchatMessage` is a reference type, so mirrored copies sharing one
-    /// instance are mutated by the first conversation's apply. The skipped
-    /// conversations still hold the changed message, so they get an explicit
-    /// republish and `.statusChanged` event - otherwise a view observing the
-    /// mirrored conversation would render stale status. Distinct copies whose
-    /// update was genuinely rejected (downgrade) are left untouched, guarded
-    /// by status equality.
-    @discardableResult
-    func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool {
-        guard let ids = conversationIDsByMessageID[messageID] else { return false }
-        var applied = false
-        var skipped: [ConversationID] = []
-        for id in ids {
-            if setDeliveryStatus(status, forMessageID: messageID, in: id) {
-                applied = true
-            } else {
-                skipped.append(id)
-            }
-        }
-        guard applied else { return false }
-        for id in skipped {
-            guard let conversation = conversationsByID[id],
-                  conversation.message(withID: messageID)?.deliveryStatus == status,
-                  conversation.republishMessage(withID: messageID) else { continue }
-            // Field proof the mirrored-copy republish path actually fires;
-            // sampled (first + every Nth) so mirrored chats can't spam logs.
-            mirroredRepublishLogCount += 1
-            if mirroredRepublishLogCount == 1
-                || mirroredRepublishLogCount.isMultiple(of: TransportConfig.conversationStoreMirroredRepublishLogInterval) {
-                SecureLogger.debug(
-                    "mirrored republish #\(mirroredRepublishLogCount) for \(messageID.prefix(8))… in \(id.auditDescription)",
-                    category: .session
-                )
-            }
-            changes.send(.statusChanged(id, messageID: messageID, status))
-        }
-        return true
-    }
-
-    /// Current delivery status of `messageID` in whichever conversation
-    /// holds it (mirrored copies share status — see `setDeliveryStatus`).
-    func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus? {
-        guard let ids = conversationIDsByMessageID[messageID] else { return nil }
-        for id in ids {
-            if let status = conversationsByID[id]?.message(withID: messageID)?.deliveryStatus {
-                return status
-            }
-        }
-        return nil
-    }
-
-    /// Every conversation currently containing `messageID` (empty when the
-    /// message is unknown).
-    func conversationIDs(forMessageID messageID: String) -> Set<ConversationID> {
-        conversationIDsByMessageID[messageID] ?? []
-    }
-
-    func markRead(_ id: ConversationID) {
-        guard unreadConversations.contains(id) else { return }
-        unreadConversations.remove(id)
-        conversationsByID[id]?.setUnread(false)
-        changes.send(.unreadChanged(id, isUnread: false))
-    }
-
-    func markUnread(_ id: ConversationID) {
-        guard !unreadConversations.contains(id) else { return }
-        let conversation = conversation(for: id)
-        unreadConversations.insert(id)
-        conversation.setUnread(true)
-        changes.send(.unreadChanged(id, isUnread: true))
-    }
-
-    /// Selects a conversation (creating it if needed) or clears the
-    /// selection with `nil`.
-    func select(_ id: ConversationID?) {
-        if let id {
-            conversation(for: id)
-        }
-        guard selectedConversationID != id else { return }
-        selectedConversationID = id
-    }
-
-    /// Switches the active public channel. While no private chat is open
-    /// the selection follows the channel.
-    func setActiveChannel(_ channelID: ChannelID) {
-        if activeChannel != channelID {
-            activeChannel = channelID
-        }
-        refreshDerivedSelection()
-    }
-
-    /// Opens a private chat (`nil` closes it, returning the selection to the
-    /// active public channel's conversation).
-    func setSelectedPrivatePeer(_ peerID: PeerID?) {
-        if selectedPrivatePeerID != peerID {
-            selectedPrivatePeerID = peerID
-        }
-        refreshDerivedSelection()
-    }
-
-    private func refreshDerivedSelection() {
-        if let peerID = selectedPrivatePeerID {
-            select(.directPeer(peerID))
-        } else {
-            select(ConversationID(channelID: activeChannel))
-        }
-    }
-
-    /// Moves all messages from `source` into `destination` (the
-    /// ephemeral↔stable peer-ID handoff): dedups by message ID, preserves
-    /// timestamp order, carries unread state over, and hands off the
-    /// selection — mirroring `ChatPrivateConversationCoordinator`'s
-    /// migration semantics. The source conversation is removed. Emits a
-    /// single `.migrated(from:to:)` once the whole move is consistent.
-    func migrateConversation(from source: ConversationID, to destination: ConversationID) {
-        guard source != destination, let sourceConversation = conversationsByID[source] else { return }
-
-        let destinationConversation = conversation(for: destination)
-        for message in sourceConversation.messages {
-            let result = destinationConversation.insert(message)
-            guard result.inserted else { continue }
-            registerMessageID(message.id, in: destination)
-            unregisterMessageIDs(result.trimmedMessageIDs, from: destination)
-        }
-        for messageID in sourceConversation.messageIDs {
-            unregisterMessageID(messageID, from: source)
-        }
-
-        let wasUnread = unreadConversations.contains(source)
-        let wasSelected = selectedConversationID == source
-
-        conversationsByID.removeValue(forKey: source)
-        conversationIDs.removeAll { $0 == source }
-        unreadConversations.remove(source)
-
-        if wasUnread, !unreadConversations.contains(destination) {
-            unreadConversations.insert(destination)
-            destinationConversation.setUnread(true)
-        }
-        if wasSelected {
-            selectedConversationID = destination
-            // Keep the private-peer selection axis consistent with the
-            // handed-off selection.
-            if let peerID = selectedPrivatePeerID,
-               source == .directPeer(peerID),
-               case .direct(let destinationHandle) = destination {
-                selectedPrivatePeerID = destinationHandle.routingPeerID
-            }
-        }
-
-        changes.send(.migrated(from: source, to: destination))
-    }
-
-    /// Removes a single message by ID from a conversation. Returns the
-    /// removed message, or `nil` (emitting nothing) when the conversation or
-    /// message is unknown.
-    @discardableResult
-    func removeMessage(withID messageID: String, from id: ConversationID) -> BitchatMessage? {
-        guard let conversation = conversationsByID[id],
-              let removed = conversation.remove(messageID: messageID) else {
-            return nil
-        }
-        unregisterMessageID(messageID, from: id)
-        changes.send(.messageRemoved(id, messageID: messageID))
-        return removed
-    }
-
-    /// Removes every message matching `predicate` from a conversation,
-    /// emitting one `.messageRemoved` per removed message after the
-    /// conversation is consistent. No-op for unknown conversations.
-    func removeMessages(from id: ConversationID, where predicate: (BitchatMessage) -> Bool) {
-        guard let conversation = conversationsByID[id] else { return }
-        let removedIDs = conversation.removeAll(where: predicate)
-        unregisterMessageIDs(removedIDs, from: id)
-        for messageID in removedIDs {
-            changes.send(.messageRemoved(id, messageID: messageID))
-        }
-    }
-
-    /// Empties a conversation's timeline but keeps the conversation (and
-    /// its unread/selection state) alive.
-    func clear(_ id: ConversationID) {
-        guard let conversation = conversationsByID[id] else { return }
-        for messageID in conversation.messageIDs {
-            unregisterMessageID(messageID, from: id)
-        }
-        conversation.clearMessages()
-        changes.send(.cleared(id))
-    }
-
-    /// Removes a conversation entirely, including unread state; clears the
-    /// selection if it pointed at the removed conversation.
-    func removeConversation(_ id: ConversationID) {
-        guard let conversation = conversationsByID.removeValue(forKey: id) else { return }
-        for messageID in conversation.messageIDs {
-            unregisterMessageID(messageID, from: id)
-        }
-        conversationIDs.removeAll { $0 == id }
-        unreadConversations.remove(id)
-        if selectedConversationID == id {
-            selectedConversationID = nil
-        }
-        changes.send(.removed(id))
-    }
-
-    func clearAll() {
-        let removedIDs = conversationIDs
-        guard !removedIDs.isEmpty || selectedConversationID != nil else { return }
-
-        conversationsByID.removeAll()
-        conversationIDs.removeAll()
-        unreadConversations.removeAll()
-        conversationIDsByMessageID.removeAll()
-        if selectedConversationID != nil {
-            selectedConversationID = nil
-        }
-
-        for id in removedIDs {
-            changes.send(.removed(id))
-        }
-    }
-
-    // MARK: Diagnostics
-
-    /// Total messages across all conversations. O(#conversations) — heartbeat
-    /// logging only, never a hot path.
-    var totalMessageCount: Int {
-        conversationsByID.values.reduce(0) { $0 + $1.messages.count }
-    }
-
-    /// Number of distinct message IDs in the store-level membership map.
-    var messageIDMapCount: Int {
-        conversationIDsByMessageID.count
-    }
-
-    /// Verifies the store's correctness invariants and returns human-readable
-    /// violations (empty = healthy). Intended for a periodic field audit:
-    /// O(total messages) and allocation-free while healthy. Checks:
-    /// - the `conversationIDs` ordering array matches `conversationsByID`
-    /// - per conversation: ID index exact, cap held, timestamp order
-    ///   (see `Conversation.collectInvariantViolations`)
-    /// - the message-ID → conversation map matches reality exactly: every
-    ///   mapped membership points at a live conversation actually holding
-    ///   the message, and total memberships equal total messages (with the
-    ///   forward check, equality proves no conversation message is missing
-    ///   from the map)
-    /// - `unreadConversations` only references existing conversations
-    /// - `selectedConversationID`, when set, references an existing
-    ///   conversation (`select(_:)` creates on selection and
-    ///   `removeConversation`/`clearAll` clear it, so existence is the
-    ///   invariant for both the channel-derived and direct-peer cases)
-    func auditInvariants() -> [String] {
-        var violations: [String] = []
-
-        if conversationIDs.count != conversationsByID.count {
-            violations.append("conversationIDs lists \(conversationIDs.count) conversations but dictionary holds \(conversationsByID.count)")
-        }
-        for id in conversationIDs where conversationsByID[id] == nil {
-            violations.append("conversationIDs lists \(id.auditDescription) but no conversation exists")
-        }
-
-        var totalMessages = 0
-        for (id, conversation) in conversationsByID {
-            totalMessages += conversation.messages.count
-            conversation.collectInvariantViolations(into: &violations, label: id.auditDescription)
-        }
-
-        var totalMappedMemberships = 0
-        for (messageID, ids) in conversationIDsByMessageID {
-            totalMappedMemberships += ids.count
-            if ids.isEmpty {
-                violations.append("message map: \(messageID.prefix(8))… has an empty membership set")
-            }
-            for id in ids {
-                guard let conversation = conversationsByID[id] else {
-                    violations.append("message map: \(messageID.prefix(8))… claims unknown conversation \(id.auditDescription)")
-                    continue
-                }
-                if !conversation.containsMessage(withID: messageID) {
-                    violations.append("message map: \(messageID.prefix(8))… not present in claimed conversation \(id.auditDescription)")
-                }
-            }
-        }
-        if totalMappedMemberships != totalMessages {
-            violations.append("message map holds \(totalMappedMemberships) memberships but conversations hold \(totalMessages) messages")
-        }
-
-        for id in unreadConversations where conversationsByID[id] == nil {
-            violations.append("unreadConversations contains unknown conversation \(id.auditDescription)")
-        }
-
-        if let selected = selectedConversationID, conversationsByID[selected] == nil {
-            violations.append("selectedConversationID \(selected.auditDescription) has no conversation")
-        }
-
-        return violations
-    }
-
-    // MARK: Internals
-
-    private func registerMessageID(_ messageID: String, in id: ConversationID) {
-        conversationIDsByMessageID[messageID, default: []].insert(id)
-        // Single choke point for every successful insertion (append, upsert
-        // append, migration insert) — the audit heartbeat's throughput delta.
-        appendCount += 1
-    }
-
-    private func unregisterMessageID(_ messageID: String, from id: ConversationID) {
-        guard var ids = conversationIDsByMessageID[messageID] else { return }
-        ids.remove(id)
-        if ids.isEmpty {
-            conversationIDsByMessageID.removeValue(forKey: messageID)
-        } else {
-            conversationIDsByMessageID[messageID] = ids
-        }
-    }
-
-    private func unregisterMessageIDs(_ messageIDs: [String], from id: ConversationID) {
-        for messageID in messageIDs {
-            unregisterMessageID(messageID, from: id)
-        }
-    }
-
-    private static func cap(for id: ConversationID) -> Int {
-        switch id {
-        case .mesh:
-            return TransportConfig.meshTimelineCap
-        case .geohash:
-            return TransportConfig.geoTimelineCap
-        case .direct:
-            return TransportConfig.privateChatCap
-        }
-    }
-}
-
-// MARK: - Direct-conversation keying + derived views
-
-extension ConversationID {
-    /// Direct-conversation ID keyed by the *raw* routing peer ID.
-    ///
-    /// Direct conversations are deliberately keyed per `PeerID`, not per
-    /// resolved identity: the private-chat coordinators mirror messages into
-    /// both the ephemeral and stable peer's conversations
-    /// (`mirrorToEphemeralIfNeeded`) and consolidate/migrate between them
-    /// explicitly, so a raw lookup by whichever peer ID is selected always
-    /// finds the right timeline without an identity-resolution layer.
-    static func directPeer(_ peerID: PeerID) -> ConversationID {
-        .direct(PeerHandle(id: "peer:\(peerID.id)", routingPeerID: peerID))
-    }
-}
-
-extension ConversationStore {
-    /// All direct conversations' messages keyed by routing peer ID — the
-    /// shape `ChatViewModel.privateChats` exposes to the coordinators.
-    /// Values are the conversations' backing arrays (COW), so building this
-    /// is O(#conversations), not O(#messages).
-    func directMessagesByRoutingPeerID() -> [PeerID: [BitchatMessage]] {
-        var messagesByPeerID: [PeerID: [BitchatMessage]] = [:]
-        messagesByPeerID.reserveCapacity(conversationsByID.count)
-        for (id, conversation) in conversationsByID {
-            guard case .direct(let handle) = id else { continue }
-            messagesByPeerID[handle.routingPeerID] = conversation.messages
-        }
-        return messagesByPeerID
-    }
-
-    /// Unread direct conversations as routing peer IDs — the shape
-    /// `ChatViewModel.unreadPrivateMessages` exposes to the coordinators.
-    func unreadDirectRoutingPeerIDs() -> Set<PeerID> {
-        var peerIDs = Set<PeerID>()
-        for id in unreadConversations {
-            guard case .direct(let handle) = id else { continue }
-            peerIDs.insert(handle.routingPeerID)
-        }
-        return peerIDs
-    }
-
-    /// `true` when any direct conversation contains a message with `messageID`
-    /// (O(1) via the store-level message-ID → conversation map).
-    func directConversationsContainMessage(withID messageID: String) -> Bool {
-        conversationIDs(forMessageID: messageID).contains { id in
-            if case .direct = id { return true }
-            return false
-        }
-    }
-
-    /// Message IDs across all direct conversations (read-receipt pruning
-    /// keeps only receipts whose messages still exist).
-    func directMessageIDs() -> Set<String> {
-        var messageIDs = Set<String>()
-        for (id, conversation) in conversationsByID {
-            guard case .direct = id else { continue }
-            messageIDs.formUnion(conversation.messageIDs)
-        }
-        return messageIDs
-    }
-
-    /// Removes every direct conversation (panic clear).
-    func removeAllDirectConversations() {
-        let directIDs = conversationIDs.filter { id in
-            if case .direct = id { return true }
-            return false
-        }
-        for id in directIDs {
-            removeConversation(id)
-        }
-    }
-}
-
-// MARK: - Diagnostics support
-
-extension ConversationID {
-    /// Short, log-safe description for audit/diagnostic lines. Direct
-    /// conversations truncate the handle so full peer keys never hit logs.
-    fileprivate var auditDescription: String {
-        switch self {
-        case .mesh:
-            return "mesh"
-        case .geohash(let geohash):
-            return "geo:\(geohash)"
-        case .direct(let handle):
-            return "direct:\(handle.id.prefix(13))…"
-        }
-    }
-}
-
-#if DEBUG
-// Test-only corruption hooks for `auditInvariants()` tests. The store is the
-// sole writer by design — `Conversation`'s mutators are fileprivate and the
-// store's backing collections are private — so the inconsistent states the
-// audit exists to catch CANNOT be manufactured through the intent API. These
-// DEBUG-only hooks deliberately bypass that lockdown to inject exactly those
-// impossible states. Never call them outside tests.
-extension Conversation {
-    /// Points an existing message's index entry at the wrong position
-    /// (positions 0 and 1 swap their index entries). Requires >= 2 messages.
-    func _testCorruptIndexEntries() {
-        guard messages.count >= 2 else { return }
-        indexByMessageID[messages[0].id] = 1
-        indexByMessageID[messages[1].id] = 0
-    }
-
-    /// Drops a message's index entry entirely (count mismatch + missing).
-    func _testRemoveIndexEntry(forMessageID messageID: String) {
-        indexByMessageID.removeValue(forKey: messageID)
-    }
-
-    /// Swaps the first and last messages while keeping the index consistent,
-    /// so ONLY the timestamp-order invariant is violated (requires the two
-    /// messages to have distinct timestamps).
-    func _testCorruptOrderingPreservingIndex() {
-        guard messages.count >= 2 else { return }
-        messages.swapAt(0, messages.count - 1)
-        indexByMessageID[messages[0].id] = 0
-        indexByMessageID[messages[messages.count - 1].id] = messages.count - 1
-    }
-}
-
-extension ConversationStore {
-    /// Adds a map membership that the conversation does not actually hold.
-    func _testRegisterPhantomMessageID(_ messageID: String, in id: ConversationID) {
-        conversationIDsByMessageID[messageID, default: []].insert(id)
-    }
-
-    /// Drops a real map membership (conversation message missing from map).
-    func _testUnregisterMessageID(_ messageID: String, from id: ConversationID) {
-        conversationIDsByMessageID[messageID]?.remove(id)
-        if conversationIDsByMessageID[messageID]?.isEmpty == true {
-            conversationIDsByMessageID.removeValue(forKey: messageID)
-        }
-    }
-
-    /// Appends past the conversation cap, bypassing trim (map kept exact so
-    /// only the cap invariant is violated).
-    func _testAppendBypassingCap(_ message: BitchatMessage, to id: ConversationID) {
-        let conversation = conversation(for: id)
-        conversation._testAppendBypassingTrim(message)
-        conversationIDsByMessageID[message.id, default: []].insert(id)
-    }
-
-    /// Marks a nonexistent conversation unread without creating it.
-    func _testInsertUnreadConversationID(_ id: ConversationID) {
-        unreadConversations.insert(id)
-    }
-
-    /// Sets the selection directly, without `select(_:)`'s create-on-select.
-    func _testSetSelectedConversationID(_ id: ConversationID?) {
-        selectedConversationID = id
-    }
-}
-
-extension Conversation {
-    fileprivate func _testAppendBypassingTrim(_ message: BitchatMessage) {
-        messages.append(message)
-        indexByMessageID[message.id] = messages.count - 1
-    }
-}
-#endif
-
-// MARK: - Public timeline derived views
-
-extension ConversationStore {
-    /// Removes a message by ID from whichever public (mesh/geohash)
-    /// conversation contains it. Returns the removed message, if any.
-    @discardableResult
-    func removePublicMessage(withID messageID: String) -> BitchatMessage? {
-        for id in conversationIDs(forMessageID: messageID) {
-            switch id {
-            case .mesh, .geohash:
-                return removeMessage(withID: messageID, from: id)
-            case .direct:
-                continue
-            }
-        }
-        return nil
-    }
-}

bitchat/App/ConversationUIModel.swift

@@ -15,19 +15,19 @@ final class ConversationUIModel: ObservableObject {
 
     private let chatViewModel: ChatViewModel
     private let privateConversationModel: PrivateConversationModel
-    private let conversations: ConversationStore
+    private let conversationStore: ConversationStore
     private var activeChannel: ChannelID
     private var cancellables = Set<AnyCancellable>()
 
     init(
         chatViewModel: ChatViewModel,
         privateConversationModel: PrivateConversationModel,
-        conversations: ConversationStore
+        conversationStore: ConversationStore
     ) {
         self.chatViewModel = chatViewModel
         self.privateConversationModel = privateConversationModel
-        self.conversations = conversations
-        self.activeChannel = conversations.activeChannel
+        self.conversationStore = conversationStore
+        self.activeChannel = conversationStore.activeChannel
         self.currentNickname = chatViewModel.nickname
         self.isBatchingPublic = chatViewModel.isBatchingPublic
         self.showAutocomplete = chatViewModel.showAutocomplete
@@ -41,10 +41,6 @@ final class ConversationUIModel: ObservableObject {
         chatViewModel.currentColorScheme = colorScheme
     }
 
-    func setCurrentTheme(_ theme: AppTheme) {
-        chatViewModel.currentTheme = theme
-    }
-
     func sendMessage(_ message: String) {
         chatViewModel.sendMessage(message)
     }
@@ -80,12 +76,12 @@ final class ConversationUIModel: ObservableObject {
         chatViewModel.completeNickname(nickname, in: &text)
     }
 
-    func formatMessage(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme? = nil) -> AttributedString {
-        chatViewModel.formatMessageAsText(message, colorScheme: colorScheme, theme: theme)
+    func formatMessage(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
+        chatViewModel.formatMessageAsText(message, colorScheme: colorScheme)
     }
 
-    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme? = nil) -> AttributedString {
-        chatViewModel.formatMessageHeader(message, colorScheme: colorScheme, theme: theme)
+    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
+        chatViewModel.formatMessageHeader(message, colorScheme: colorScheme)
     }
 
     func mediaAttachment(for message: BitchatMessage) -> BitchatMessage.Media? {
@@ -155,7 +151,7 @@ final class ConversationUIModel: ObservableObject {
             .receive(on: DispatchQueue.main)
             .assign(to: &$isBatchingPublic)
 
-        conversations.$activeChannel
+        conversationStore.$activeChannel
             .receive(on: DispatchQueue.main)
             .sink { [weak self] channel in
                 self?.activeChannel = channel

bitchat/App/PeerListModel.swift

@@ -37,7 +37,7 @@ final class PeerListModel: ObservableObject {
     @Published private(set) var renderID = ""
 
     private let chatViewModel: ChatViewModel
-    private let conversations: ConversationStore
+    private let conversationStore: ConversationStore
     private let locationChannelsModel: LocationChannelsModel
     private let peerIdentityStore: PeerIdentityStore
     private let locationPresenceStore: LocationPresenceStore
@@ -45,13 +45,13 @@ final class PeerListModel: ObservableObject {
 
     init(
         chatViewModel: ChatViewModel,
-        conversations: ConversationStore,
+        conversationStore: ConversationStore,
         locationChannelsModel: LocationChannelsModel? = nil,
         peerIdentityStore: PeerIdentityStore? = nil,
         locationPresenceStore: LocationPresenceStore? = nil
     ) {
         self.chatViewModel = chatViewModel
-        self.conversations = conversations
+        self.conversationStore = conversationStore
         self.locationChannelsModel = locationChannelsModel ?? LocationChannelsModel()
         self.peerIdentityStore = peerIdentityStore ?? chatViewModel.peerIdentityStore
         self.locationPresenceStore = locationPresenceStore ?? chatViewModel.locationPresenceStore
@@ -122,7 +122,7 @@ final class PeerListModel: ObservableObject {
             }
             .store(in: &cancellables)
 
-        conversations.$unreadConversations
+        conversationStore.$unreadConversations
             .receive(on: DispatchQueue.main)
             .sink { [weak self] _ in
                 self?.refresh()

bitchat/App/PrivateConversationModels.swift

@@ -2,93 +2,68 @@ import BitFoundation
 import Combine
 import Foundation
 
-/// Feature model for private (direct) conversations.
-///
-/// Reads the single-writer `ConversationStore` directly: `messages(for:)`
-/// returns the peer's conversation backing array (no mirror dictionary), and
-/// the store's typed `changes` subject drives invalidation — a change in the
-/// SELECTED peer's conversation republishes this model, while appends to
-/// other private chats only surface through the unread set. Direct
-/// conversations are keyed by raw routing peer ID; the coordinators'
-/// ephemeral/stable mirroring guarantees the selected peer's key always
-/// holds the full timeline (see `ConversationID.directPeer`).
 @MainActor
 final class PrivateInboxModel: ObservableObject {
     @Published private(set) var selectedPeerID: PeerID?
     @Published private(set) var unreadPeerIDs: Set<PeerID> = []
+    @Published private(set) var messagesByPeerID: [PeerID: [BitchatMessage]] = [:]
 
-    private let conversations: ConversationStore
+    private let conversationStore: ConversationStore
     private var cancellables = Set<AnyCancellable>()
 
-    init(conversations: ConversationStore) {
-        self.conversations = conversations
-        self.selectedPeerID = conversations.selectedPrivatePeerID
-        self.unreadPeerIDs = conversations.unreadDirectRoutingPeerIDs()
+    init(conversationStore: ConversationStore) {
+        self.conversationStore = conversationStore
 
         bind()
+        refreshMessages()
     }
 
     func messages(for peerID: PeerID?) -> [BitchatMessage] {
         guard let peerID else { return [] }
-        return conversations.conversationsByID[.directPeer(peerID)]?.messages ?? []
+        return messagesByPeerID[peerID] ?? []
     }
 
     private func bind() {
-        conversations.$selectedPrivatePeerID
-            .dropFirst()
+        conversationStore.$selectedPrivatePeerID
+            .receive(on: DispatchQueue.main)
             .sink { [weak self] peerID in
-                guard let self, self.selectedPeerID != peerID else { return }
-                self.selectedPeerID = peerID
+                self?.selectedPeerID = peerID
+                self?.refreshMessages()
             }
             .store(in: &cancellables)
 
-        conversations.changes
-            .sink { [weak self] change in
-                self?.apply(change)
+        conversationStore.$unreadConversations
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.unreadPeerIDs = self?.conversationStore.unreadDirectPeerIDs() ?? []
+                self?.refreshMessages()
             }
             .store(in: &cancellables)
+
+        conversationStore.$messagesByConversation
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refreshMessages()
+            }
+            .store(in: &cancellables)
+
+        selectedPeerID = conversationStore.selectedPrivatePeerID
+        unreadPeerIDs = conversationStore.unreadDirectPeerIDs()
     }
 
-    private func apply(_ change: ConversationChange) {
-        switch change {
-        case .appended(let id, _),
-             .updated(let id, _),
-             .statusChanged(let id, _, _),
-             .messageRemoved(let id, _),
-             .cleared(let id):
-            republishIfSelected(id)
-
-        case .unreadChanged(let id, _):
-            guard isDirect(id) else { return }
-            refreshUnreadPeerIDs()
-
-        case .removed(let id):
-            guard isDirect(id) else { return }
-            refreshUnreadPeerIDs()
-            republishIfSelected(id)
-
-        case .migrated(let source, let destination):
-            guard isDirect(source) || isDirect(destination) else { return }
-            refreshUnreadPeerIDs()
-            republishIfSelected(source)
-            republishIfSelected(destination)
+    private func refreshMessages() {
+        var nextMessagesByPeerID = conversationStore.directMessagesByPeerID()
+        var peerIDs = Set(nextMessagesByPeerID.keys)
+        peerIDs.formUnion(conversationStore.unreadDirectPeerIDs())
+        if let selectedPeerID = conversationStore.selectedPrivatePeerID {
+            peerIDs.insert(selectedPeerID)
         }
-    }
 
-    private func republishIfSelected(_ id: ConversationID) {
-        guard let selectedPeerID, id == .directPeer(selectedPeerID) else { return }
-        objectWillChange.send()
-    }
+        for peerID in peerIDs where nextMessagesByPeerID[peerID] == nil {
+            nextMessagesByPeerID[peerID] = []
+        }
 
-    private func refreshUnreadPeerIDs() {
-        let next = conversations.unreadDirectRoutingPeerIDs()
-        guard unreadPeerIDs != next else { return }
-        unreadPeerIDs = next
-    }
-
-    private func isDirect(_ id: ConversationID) -> Bool {
-        if case .direct = id { return true }
-        return false
+        messagesByPeerID = nextMessagesByPeerID
     }
 }
 
@@ -118,22 +93,22 @@ final class PrivateConversationModel: ObservableObject {
     @Published private(set) var selectedHeaderState: PrivateConversationHeaderState?
 
     private let chatViewModel: ChatViewModel
-    private let conversations: ConversationStore
+    private let conversationStore: ConversationStore
     private let locationChannelsModel: LocationChannelsModel
     private let peerIdentityStore: PeerIdentityStore
     private var cancellables = Set<AnyCancellable>()
 
     init(
         chatViewModel: ChatViewModel,
-        conversations: ConversationStore,
+        conversationStore: ConversationStore,
         locationChannelsModel: LocationChannelsModel? = nil,
         peerIdentityStore: PeerIdentityStore? = nil
     ) {
         self.chatViewModel = chatViewModel
-        self.conversations = conversations
+        self.conversationStore = conversationStore
         self.locationChannelsModel = locationChannelsModel ?? LocationChannelsModel()
         self.peerIdentityStore = peerIdentityStore ?? chatViewModel.peerIdentityStore
-        let initialPeerID = conversations.selectedPrivatePeerID
+        let initialPeerID = conversationStore.selectedPrivatePeerID
         self.selectedPeerID = initialPeerID
         self.selectedHeaderState = initialPeerID.flatMap { peerID in
             makeHeaderState(for: peerID)
@@ -178,7 +153,7 @@ final class PrivateConversationModel: ObservableObject {
     }
 
     private func bind() {
-        conversations.$selectedPrivatePeerID
+        conversationStore.$selectedPrivatePeerID
             .receive(on: DispatchQueue.main)
             .sink { [weak self] _ in
                 self?.refreshSelectedConversation()
@@ -222,7 +197,7 @@ final class PrivateConversationModel: ObservableObject {
     }
 
     private func refreshSelectedConversation() {
-        selectedPeerID = conversations.selectedPrivatePeerID
+        selectedPeerID = conversationStore.selectedPrivatePeerID
         selectedHeaderState = selectedPeerID.flatMap { peerID in
             makeHeaderState(for: peerID)
         }

bitchat/App/PublicChatModel.swift

@@ -2,76 +2,40 @@ import BitFoundation
 import Combine
 import SwiftUI
 
-/// Feature model for the active public (mesh/geohash) timeline.
-///
-/// Observes ONE `Conversation` object in the single-writer
-/// `ConversationStore` — the active channel's — so appends to background
-/// conversations (other geohashes, private chats) never invalidate it.
-/// `messages` reads the observed conversation's backing array directly;
-/// there is no mirror copy.
 @MainActor
 final class PublicChatModel: ObservableObject {
     @Published private(set) var activeChannel: ChannelID
+    @Published private(set) var messages: [BitchatMessage] = []
 
-    /// The active public conversation's timeline.
-    var messages: [BitchatMessage] { activeConversation.messages }
-
-    private let conversations: ConversationStore
-    private var activeConversation: Conversation
-    private var activeConversationCancellable: AnyCancellable?
+    private let conversationStore: ConversationStore
     private var cancellables = Set<AnyCancellable>()
 
-    init(conversations: ConversationStore) {
-        let channel = conversations.activeChannel
-        self.conversations = conversations
-        self.activeChannel = channel
-        self.activeConversation = conversations.conversation(for: ConversationID(channelID: channel))
+    init(conversationStore: ConversationStore) {
+        self.activeChannel = conversationStore.activeChannel
+        self.conversationStore = conversationStore
 
-        observeActiveConversation()
         bind()
+        refreshMessages()
     }
 
     private func bind() {
-        conversations.$activeChannel
-            .dropFirst()
+        conversationStore.$activeChannel
+            .receive(on: DispatchQueue.main)
             .sink { [weak self] channel in
-                guard let self else { return }
-                self.activeChannel = channel
-                self.retargetActiveConversation(to: channel)
+                self?.activeChannel = channel
+                self?.refreshMessages()
             }
             .store(in: &cancellables)
 
-        // The store replaces a conversation's object when it is removed
-        // (panic clear); retarget to the fresh instance so the observation
-        // never goes stale.
-        conversations.changes
-            .sink { [weak self] change in
-                guard let self,
-                      case .removed(let id) = change,
-                      id == self.activeConversation.id else { return }
-                self.retargetActiveConversation(to: self.activeChannel)
-            }
-            .store(in: &cancellables)
-    }
-
-    private func retargetActiveConversation(to channel: ChannelID) {
-        let conversation = conversations.conversation(for: ConversationID(channelID: channel))
-        guard conversation !== activeConversation else {
-            // Same object (e.g. re-selected channel): keep the existing
-            // observation, but `messages` may still differ from what views
-            // last rendered, so republish.
-            objectWillChange.send()
-            return
-        }
-        objectWillChange.send()
-        activeConversation = conversation
-        observeActiveConversation()
-    }
-
-    private func observeActiveConversation() {
-        activeConversationCancellable = activeConversation.objectWillChange
+        conversationStore.$messagesByConversation
+            .receive(on: DispatchQueue.main)
             .sink { [weak self] _ in
-                self?.objectWillChange.send()
+                self?.refreshMessages()
             }
+            .store(in: &cancellables)
+    }
+
+    private func refreshMessages() {
+        messages = conversationStore.messages(for: ConversationID(channelID: activeChannel))
     }
 }

bitchat/BitchatApp.swift

@@ -15,7 +15,6 @@ struct BitchatApp: App {
     static let groupID = "group.\(bundleID)"
 
     @StateObject private var runtime: AppRuntime
-    @AppStorage(AppTheme.storageKey) private var appThemeRawValue = AppTheme.matrix.rawValue
     #if os(iOS)
     @Environment(\.scenePhase) var scenePhase
     @UIApplicationDelegateAdaptor(AppDelegate.self) var appDelegate
@@ -31,7 +30,6 @@ struct BitchatApp: App {
     var body: some Scene {
         WindowGroup {
             ContentView()
-                .environment(\.appTheme, AppTheme(rawValue: appThemeRawValue) ?? .matrix)
                 .environmentObject(runtime.publicChatModel)
                 .environmentObject(runtime.privateInboxModel)
                 .environmentObject(runtime.privateConversationModel)

bitchat/Identity/IdentityModels.swift

@@ -141,44 +141,22 @@ enum TrustLevel: String, Codable {
 struct IdentityCache: Codable {
     // Fingerprint -> Social mapping
     var socialIdentities: [String: SocialIdentity] = [:]
-
+    
     // Nickname -> [Fingerprints] reverse index
     // Multiple fingerprints can claim same nickname
     var nicknameIndex: [String: Set<String>] = [:]
-
+    
     // Verified fingerprints (cryptographic proof)
     var verifiedFingerprints: Set<String> = []
-
+    
     // Last interaction timestamps (privacy: optional)
-    var lastInteractions: [String: Date] = [:]
-
+    var lastInteractions: [String: Date] = [:] 
+    
     // Blocked Nostr pubkeys (lowercased hex) for geohash chats
     var blockedNostrPubkeys: Set<String> = []
-
-    // Fingerprint -> Cryptographic identity (noise + pinned signing key).
-    // Persisting the signing-key pin is security-critical: it must survive
-    // app restarts so an attacker cannot replay a known peer's
-    // noiseKey/peerID with their own signing key and be treated as first
-    // contact (TOFU downgrade).
-    var cryptographicIdentities: [String: CryptographicIdentity] = [:]
-
+    
     // Schema version for future migrations
     var version: Int = 1
-
-    init() {}
-
-    // Custom decoding so caches written by older builds (without
-    // `cryptographicIdentities`) still load instead of being discarded.
-    init(from decoder: Decoder) throws {
-        let container = try decoder.container(keyedBy: CodingKeys.self)
-        socialIdentities = try container.decodeIfPresent([String: SocialIdentity].self, forKey: .socialIdentities) ?? [:]
-        nicknameIndex = try container.decodeIfPresent([String: Set<String>].self, forKey: .nicknameIndex) ?? [:]
-        verifiedFingerprints = try container.decodeIfPresent(Set<String>.self, forKey: .verifiedFingerprints) ?? []
-        lastInteractions = try container.decodeIfPresent([String: Date].self, forKey: .lastInteractions) ?? [:]
-        blockedNostrPubkeys = try container.decodeIfPresent(Set<String>.self, forKey: .blockedNostrPubkeys) ?? []
-        cryptographicIdentities = try container.decodeIfPresent([String: CryptographicIdentity].self, forKey: .cryptographicIdentities) ?? [:]
-        version = try container.decodeIfPresent(Int.self, forKey: .version) ?? 1
-    }
 }
 
 //

bitchat/Identity/SecureIdentityStateManager.swift

@@ -145,104 +145,48 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     
     // In-memory state
     private var ephemeralSessions: [PeerID: EphemeralIdentity] = [:]
-    // Cryptographic identities (including pinned signing keys) live inside
-    // `cache` so they persist across app restarts; see IdentityCache.
+    private var cryptographicIdentities: [String: CryptographicIdentity] = [:]
     private var cache: IdentityCache = IdentityCache()
     
     // Thread safety
     private let queue = DispatchQueue(label: "bitchat.identity.state", attributes: .concurrent)
     
-    // Pending-save coalescing flag. Reads/writes are serialized on `queue`.
-    //
-    // Persistence is SYNCHRONOUS: every mutating API runs its mutate + encrypt
-    // + keychain write inside `queue.sync(flags: .barrier)`, so when the call
-    // returns the write is already complete and NOTHING is left scheduled on
-    // the queue. This is deliberate — a retained DispatchSourceTimer (the
-    // original design) kept the dispatch machinery alive and prevented the
-    // unit-test process from exiting, and fire-and-forget `queue.async(.barrier)`
-    // (a later design) left a backlog of instrumented barrier saves still
-    // draining when LLVM's `--enable-code-coverage` `atexit` handler dumped
-    // `.profraw`, deadlocking the process at teardown on the constrained CI
-    // runner. Synchronous persistence has zero outstanding dispatch at exit, so
-    // neither failure mode is possible. `pendingSave` is now effectively always
-    // false after any mutation (saveIdentityCache persists inline and clears
-    // it); it remains only as a belt-and-suspenders flag read by `forceSave`
-    // and `deinit`.
+    // Debouncing for keychain saves
+    private var saveTimer: Timer?
+    private let saveDebounceInterval: TimeInterval = 2.0  // Save at most once every 2 seconds
     private var pendingSave = false
-
+    
     // Encryption key
     private let encryptionKey: SymmetricKey
-    /// True when `encryptionKey` is a throwaway generated this session because the
-    /// persisted key could not be read (device locked / access denied). In that
-    /// state we must NOT persist (it would overwrite the real cache with data the
-    /// next launch can't decrypt) and must NOT delete the existing cache.
-    private let encryptionKeyIsEphemeral: Bool
     
     init(_ keychain: KeychainManagerProtocol) {
         self.keychain = keychain
-
-        // Retrieve (or, only on genuine first run, generate) the cache
-        // encryption key. We MUST distinguish "key doesn't exist yet" from a
-        // transient failure (device locked / access denied): the legacy
-        // getIdentityKey(forKey:) collapses both to nil, and generating+saving a
-        // new key deletes the existing one first — permanently orphaning the
-        // encrypted cache on a launch that merely couldn't read the key.
+        
+        // Generate or retrieve encryption key from keychain
         let loadedKey: SymmetricKey
-        let keyIsEphemeral: Bool
-
-        switch keychain.getIdentityKeyWithResult(forKey: encryptionKeyName) {
-        case .success(let keyData):
+        
+        // Try to load from keychain
+        if let keyData = keychain.getIdentityKey(forKey: encryptionKeyName) {
             loadedKey = SymmetricKey(data: keyData)
-            keyIsEphemeral = false
             SecureLogger.logKeyOperation(.load, keyType: "identity cache encryption key", success: true)
-
-        case .itemNotFound:
-            // Genuine first run: generate and persist a new key.
-            let newKey = SymmetricKey(size: .bits256)
-            let keyData = newKey.withUnsafeBytes { Data($0) }
-            let saved = keychain.saveIdentityKey(keyData, forKey: encryptionKeyName)
-            loadedKey = newKey
-            // If even the save failed, treat the key as ephemeral so we don't
-            // later try to persist a cache the next launch can't read.
-            keyIsEphemeral = !saved
-            SecureLogger.logKeyOperation(.generate, keyType: "identity cache encryption key", success: saved)
-
-        case .deviceLocked, .authenticationFailed, .accessDenied, .otherError:
-            // Transient/critical read failure. Do NOT overwrite the persisted
-            // key. Use a session-only ephemeral key; the real key and cache are
-            // left intact for a healthy launch.
-            SecureLogger.warning("Identity cache key unavailable; using ephemeral key for this session (not persisting)", category: .security)
+        }
+        // Generate new key if needed
+        else {
             loadedKey = SymmetricKey(size: .bits256)
-            keyIsEphemeral = true
+            let keyData = loadedKey.withUnsafeBytes { Data($0) }
+            // Save to keychain
+            let saved = keychain.saveIdentityKey(keyData, forKey: encryptionKeyName)
+            SecureLogger.logKeyOperation(.generate, keyType: "identity cache encryption key", success: saved)
         }
-
+        
         self.encryptionKey = loadedKey
-        self.encryptionKeyIsEphemeral = keyIsEphemeral
-
-        // Only read the persisted cache when we hold the real key; with an
-        // ephemeral key the decrypt would fail and discard the real cache.
-        if !keyIsEphemeral {
-            loadIdentityCache()
-        }
+        
+        // Load identity cache on init
+        loadIdentityCache()
     }
     
     deinit {
-        // Do NOT dispatch onto `queue` here. `deinit` can run on any thread
-        // (including one draining `queue`), and the object is being
-        // deallocated: a `queue.sync` risks a re-entrant same-queue wait
-        // (deadlock) and a `queue.async` schedules work that resurrects `self`
-        // and may not drain before process exit.
-        //
-        // A flush here is redundant anyway: every mutating API already
-        // persists inline within its own barrier, so the keychain is already
-        // up to date. As a queue-free best-effort belt-and-suspenders, only
-        // flush if something is still pending. This is a direct read of
-        // in-hand state — safe because a deallocating object has no other
-        // live references, so nothing can be mutating `cache` concurrently.
-        if pendingSave {
-            pendingSave = false
-            persist(snapshot: cache)
-        }
+        forceSave()
     }
     
     // MARK: - Secure Loading/Saving
@@ -267,36 +211,25 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
         }
     }
     
-    /// Persists the cache. Always invoked on `queue` under a barrier (its
-    /// callers run inside `queue.sync(flags: .barrier)`), so `cache` is read
-    /// while serialized. The encode + keychain write are done here (already on
-    /// the exclusive barrier context), synchronously, so no separate hop is
-    /// scheduled and nothing is left to keep the process alive.
     private func saveIdentityCache() {
+        // Mark that we need to save
         pendingSave = true
-        // On the barrier context already: snapshot is trivially consistent.
-        persist(snapshot: cache)
-        pendingSave = false
-    }
-
-    /// Encodes, seals, and writes a *snapshot* of the cache to the keychain.
-    ///
-    /// Takes the cache by value so callers can capture a consistent snapshot
-    /// under `queue` and then encode without holding it. Reading `cache`
-    /// concurrently with a barrier writer would be a data race on the
-    /// dictionary storage, which — because `JSONEncoder` walks that storage —
-    /// can spin forever (observed as a CI test-suite hang), so the snapshot
-    /// must be taken on `queue`, never off it.
-    private func persist(snapshot: IdentityCache) {
-        // Never persist under an ephemeral key — it would overwrite the real
-        // cache with data the next launch cannot decrypt.
-        guard !encryptionKeyIsEphemeral else {
-            SecureLogger.debug("Skipping identity cache save (ephemeral key this session)", category: .security)
-            return
+        
+        // Cancel any existing timer
+        saveTimer?.invalidate()
+        
+        // Schedule a new save after the debounce interval
+        saveTimer = Timer.scheduledTimer(withTimeInterval: saveDebounceInterval, repeats: false) { [weak self] _ in
+            self?.performSave()
         }
-
+    }
+    
+    private func performSave() {
+        guard pendingSave else { return }
+        pendingSave = false
+        
         do {
-            let data = try JSONEncoder().encode(snapshot)
+            let data = try JSONEncoder().encode(cache)
             let sealedBox = try AES.GCM.seal(data, using: encryptionKey)
             let saved = keychain.saveIdentityKey(sealedBox.combined!, forKey: cacheKey)
             if saved {
@@ -306,27 +239,11 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
             SecureLogger.error(error, context: "Failed to save identity cache", category: .security)
         }
     }
-
-    // Force a flush (for app-termination / lifecycle events — NOT from
-    // `deinit`, which persists inline; see the deinit note). Every mutating
-    // API already persists inline inside its own barrier via
-    // `saveIdentityCache`, so by the time this is called the keychain is
-    // already up to date and this is normally a no-op; it exists as a
-    // belt-and-suspenders flush of any `pendingSave` left set.
-    //
-    // Runs synchronously inside a `queue.sync(flags: .barrier)`: the barrier
-    // makes the `cache` read race-free (a plain off-queue read races in-flight
-    // barrier writers — JSONEncoder walking a concurrently-mutated dictionary
-    // can spin forever, which surfaced as a CI hang), and being synchronous it
-    // leaves nothing scheduled to keep the process alive at teardown. Safe
-    // against re-entrant deadlock because this is never invoked from `deinit`
-    // (the only path that can run *on* `queue`).
+    
+    // Force immediate save (for app termination)
     func forceSave() {
-        queue.sync(flags: .barrier) {
-            guard pendingSave else { return }
-            pendingSave = false
-            persist(snapshot: cache)
-        }
+        saveTimer?.invalidate()
+        performSave()
     }
     
     // MARK: - Social Identity Management
@@ -340,33 +257,15 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     // MARK: - Cryptographic Identities
 
     /// Insert or update a cryptographic identity and optionally persist its signing key and claimed nickname.
-    ///
-    /// TOFU signing-key pinning: once a signing key has been persisted for a
-    /// fingerprint, an update carrying a *different* signing key is refused in
-    /// full (including the claimed-nickname update) and security-logged. This
-    /// mirrors `BLEPeerRegistry.upsertVerifiedAnnounce` — without it, an
-    /// attacker replaying a victim's noiseKey/peerID with their own signing
-    /// key could overwrite the victim's persisted identity while the victim is
-    /// offline or after an app restart. The refusal is permanent: there is
-    /// currently no targeted in-app way to reset the pin (`setVerified` does
-    /// not touch it). Recovering from a legitimate signing re-key requires the
-    /// peer to establish a new noise identity (new peerID) or the local user
-    /// to wipe all identity data (`clearAllIdentityData`, e.g. panic wipe).
     /// - Parameters:
     ///   - fingerprint: SHA-256 hex of the Noise static public key
     ///   - noisePublicKey: Noise static public key data
     ///   - signingPublicKey: Optional Ed25519 signing public key for authenticating public messages
     ///   - claimedNickname: Optional latest claimed nickname to persist into social identity
     func upsertCryptographicIdentity(fingerprint: String, noisePublicKey: Data, signingPublicKey: Data?, claimedNickname: String? = nil) {
-        queue.sync(flags: .barrier) {
+        queue.async(flags: .barrier) {
             let now = Date()
-            if var existing = self.cache.cryptographicIdentities[fingerprint] {
-                if let pinnedSigningKey = existing.signingPublicKey,
-                   let announcedSigningKey = signingPublicKey,
-                   pinnedSigningKey != announcedSigningKey {
-                    SecureLogger.warning("🚨 Refusing to replace pinned signing key for \(fingerprint.prefix(8))… (possible impersonation attempt)", category: .security)
-                    return
-                }
+            if var existing = self.cryptographicIdentities[fingerprint] {
                 // Update keys if changed
                 if existing.publicKey != noisePublicKey {
                     existing = CryptographicIdentity(
@@ -376,7 +275,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
                         firstSeen: existing.firstSeen,
                         lastHandshake: now
                     )
-                    self.cache.cryptographicIdentities[fingerprint] = existing
+                    self.cryptographicIdentities[fingerprint] = existing
                 } else {
                     // Update signing key and lastHandshake
                     existing.signingPublicKey = signingPublicKey ?? existing.signingPublicKey
@@ -387,7 +286,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
                         firstSeen: existing.firstSeen,
                         lastHandshake: now
                     )
-                    self.cache.cryptographicIdentities[fingerprint] = updated
+                    self.cryptographicIdentities[fingerprint] = updated
                 }
                 // Persist updated state (already assigned in branches above)
             } else {
@@ -399,7 +298,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
                     firstSeen: now,
                     lastHandshake: now
                 )
-                self.cache.cryptographicIdentities[fingerprint] = entry
+                self.cryptographicIdentities[fingerprint] = entry
             }
 
             // Optionally persist claimed nickname into social identity
@@ -431,12 +330,12 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
         queue.sync {
             // Defensive: ensure hex and correct length
             guard peerID.isShort else { return [] }
-            return cache.cryptographicIdentities.values.filter { $0.fingerprint.hasPrefix(peerID.id) }
+            return cryptographicIdentities.values.filter { $0.fingerprint.hasPrefix(peerID.id) }
         }
     }
     
     func updateSocialIdentity(_ identity: SocialIdentity) {
-        queue.sync(flags: .barrier) {
+        queue.async(flags: .barrier) {
             let previousClaimedNickname = self.cache.socialIdentities[identity.fingerprint]?.claimedNickname
             self.cache.socialIdentities[identity.fingerprint] = identity
             
@@ -472,7 +371,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     }
     
     func setFavorite(_ fingerprint: String, isFavorite: Bool) {
-        queue.sync(flags: .barrier) {
+        queue.async(flags: .barrier) {
             if var identity = self.cache.socialIdentities[fingerprint] {
                 identity.isFavorite = isFavorite
                 self.cache.socialIdentities[fingerprint] = identity
@@ -510,7 +409,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     func setBlocked(_ fingerprint: String, isBlocked: Bool) {
         SecureLogger.info("User \(isBlocked ? "blocked" : "unblocked"): \(fingerprint)", category: .security)
         
-        queue.sync(flags: .barrier) {
+        queue.async(flags: .barrier) {
             if var identity = self.cache.socialIdentities[fingerprint] {
                 identity.isBlocked = isBlocked
                 if isBlocked {
@@ -544,7 +443,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     
     func setNostrBlocked(_ pubkeyHexLowercased: String, isBlocked: Bool) {
         let key = pubkeyHexLowercased.lowercased()
-        queue.sync(flags: .barrier) {
+        queue.async(flags: .barrier) {
             if isBlocked {
                 self.cache.blockedNostrPubkeys.insert(key)
             } else {
@@ -561,7 +460,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     // MARK: - Ephemeral Session Management
     
     func registerEphemeralSession(peerID: PeerID, handshakeState: HandshakeState = .none) {
-        queue.sync(flags: .barrier) {
+        queue.async(flags: .barrier) {
             self.ephemeralSessions[peerID] = EphemeralIdentity(
                 peerID: peerID,
                 sessionStart: Date(),
@@ -571,7 +470,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     }
     
     func updateHandshakeState(peerID: PeerID, state: HandshakeState) {
-        queue.sync(flags: .barrier) {
+        queue.async(flags: .barrier) {
             self.ephemeralSessions[peerID]?.handshakeState = state
             
             // If handshake completed, update last interaction
@@ -587,10 +486,11 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     func clearAllIdentityData() {
         SecureLogger.warning("Clearing all identity data", category: .security)
         
-        queue.sync(flags: .barrier) {
+        queue.async(flags: .barrier) {
             self.cache = IdentityCache()
             self.ephemeralSessions.removeAll()
-
+            self.cryptographicIdentities.removeAll()
+            
             // Delete from keychain
             let deleted = self.keychain.deleteIdentityKey(forKey: self.cacheKey)
             SecureLogger.logKeyOperation(.delete, keyType: "identity cache", success: deleted)
@@ -598,7 +498,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     }
     
     func removeEphemeralSession(peerID: PeerID) {
-        queue.sync(flags: .barrier) {
+        queue.async(flags: .barrier) {
             self.ephemeralSessions.removeValue(forKey: peerID)
         }
     }
@@ -608,7 +508,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
     func setVerified(fingerprint: String, verified: Bool) {
         SecureLogger.info("Fingerprint \(verified ? "verified" : "unverified"): \(fingerprint)", category: .security)
         
-        queue.sync(flags: .barrier) {
+        queue.async(flags: .barrier) {
             if verified {
                 self.cache.verifiedFingerprints.insert(fingerprint)
             } else {

bitchat/Localizable.xcstrings

@@ -540,543 +540,6 @@
         }
       }
     },
-    "app_info.appearance.liquid_glass" : {
-      "extractionState" : "manual",
-      "localizations" : {
-        "ar" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "زجاج سائل"
-          }
-        },
-        "bn" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "লিকুইড গ্লাস"
-          }
-        },
-        "de" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "en" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "es" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "fil" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "fr" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "he" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "זכוכית נוזלית"
-          }
-        },
-        "hi" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "लिक्विड ग्लास"
-          }
-        },
-        "id" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "it" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "ja" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "リキッドガラス"
-          }
-        },
-        "ko" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "리퀴드 글래스"
-          }
-        },
-        "ms" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "ne" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "लिक्विड ग्लास"
-          }
-        },
-        "nl" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "pl" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "pt" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "pt-BR" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "ru" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "жидкое стекло"
-          }
-        },
-        "sv" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "ta" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "லிக்விட் கிளாஸ்"
-          }
-        },
-        "th" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "ลิควิดกลาส"
-          }
-        },
-        "tr" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "uk" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "рідке скло"
-          }
-        },
-        "ur" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "لیکویڈ گلاس"
-          }
-        },
-        "vi" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "liquid glass"
-          }
-        },
-        "zh-Hans" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "液态玻璃"
-          }
-        },
-        "zh-Hant" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "液態玻璃"
-          }
-        }
-      }
-    },
-    "app_info.appearance.matrix" : {
-      "extractionState" : "manual",
-      "localizations" : {
-        "ar" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "ماتريكس"
-          }
-        },
-        "bn" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "ম্যাট্রিক্স"
-          }
-        },
-        "de" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "en" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "es" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "fil" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "fr" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "he" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "מטריקס"
-          }
-        },
-        "hi" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "मैट्रिक्स"
-          }
-        },
-        "id" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "it" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "ja" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "マトリックス"
-          }
-        },
-        "ko" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "매트릭스"
-          }
-        },
-        "ms" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "ne" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "म्याट्रिक्स"
-          }
-        },
-        "nl" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "pl" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "pt" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "pt-BR" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "ru" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "матрица"
-          }
-        },
-        "sv" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "ta" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "மேட்ரிக்ஸ்"
-          }
-        },
-        "th" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "เมทริกซ์"
-          }
-        },
-        "tr" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "uk" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "матриця"
-          }
-        },
-        "ur" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "میٹرکس"
-          }
-        },
-        "vi" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "matrix"
-          }
-        },
-        "zh-Hans" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "矩阵"
-          }
-        },
-        "zh-Hant" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "矩陣"
-          }
-        }
-      }
-    },
-    "app_info.appearance.title" : {
-      "extractionState" : "manual",
-      "localizations" : {
-        "ar" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "المظهر"
-          }
-        },
-        "bn" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "চেহারা"
-          }
-        },
-        "de" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "ERSCHEINUNGSBILD"
-          }
-        },
-        "en" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "APPEARANCE"
-          }
-        },
-        "es" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "APARIENCIA"
-          }
-        },
-        "fil" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "HITSURA"
-          }
-        },
-        "fr" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "APPARENCE"
-          }
-        },
-        "he" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "מראה"
-          }
-        },
-        "hi" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "दिखावट"
-          }
-        },
-        "id" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "TAMPILAN"
-          }
-        },
-        "it" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "ASPETTO"
-          }
-        },
-        "ja" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "外観"
-          }
-        },
-        "ko" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "화면 모드"
-          }
-        },
-        "ms" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "PENAMPILAN"
-          }
-        },
-        "ne" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "रूप"
-          }
-        },
-        "nl" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "WEERGAVE"
-          }
-        },
-        "pl" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "WYGLĄD"
-          }
-        },
-        "pt" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "APARÊNCIA"
-          }
-        },
-        "pt-BR" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "APARÊNCIA"
-          }
-        },
-        "ru" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "ОФОРМЛЕНИЕ"
-          }
-        },
-        "sv" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "UTSEENDE"
-          }
-        },
-        "ta" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "தோற்றம்"
-          }
-        },
-        "th" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "ลักษณะที่ปรากฏ"
-          }
-        },
-        "tr" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "GÖRÜNÜM"
-          }
-        },
-        "uk" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "ОФОРМЛЕННЯ"
-          }
-        },
-        "ur" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "ظاہری شکل"
-          }
-        },
-        "vi" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "GIAO DIỆN"
-          }
-        },
-        "zh-Hans" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "外观"
-          }
-        },
-        "zh-Hant" : {
-          "stringUnit" : {
-            "state" : "translated",
-            "value" : "外觀"
-          }
-        }
-      }
-    },
     "app_info.close" : {
       "extractionState" : "manual",
       "localizations" : {
@@ -24934,7 +24397,7 @@
         "en" : {
           "stringUnit" : {
             "state" : "translated",
-            "value" : "chat with people near you using geohash channels. the selected geohash is public and may reveal an approximate area; exact GPS is never shared. your IP address is hidden by routing all traffic over tor."
+            "value" : "chat with people near you using geohash channels. only a coarse geohash is shared, never exact GPS. your IP address is hidden by routing all traffic over tor."
           }
         },
         "es" : {

bitchat/Models/RequestSyncPacket.swift

@@ -96,7 +96,7 @@ struct RequestSyncPacket {
             }
         }
 
-        guard let pp = p, let mm = m, let dd = payload, pp >= 1, pp <= GCSFilter.maxP, mm > 0 else { return nil }
+        guard let pp = p, let mm = m, let dd = payload, pp >= 1, mm > 0 else { return nil }
         return RequestSyncPacket(p: pp, m: mm, data: dd, types: types, sinceTimestamp: sinceTimestamp, fragmentIdFilter: fragmentIdFilter)
     }
 }

bitchat/Noise/NoiseProtocol.swift

@@ -322,13 +322,6 @@ final class NoiseCipherState {
                 throw NoiseError.replayDetected
             }
             
-            // The 4-byte nonce prefix has been stripped, so the remaining bytes
-            // must still hold at least the 16-byte Poly1305 tag. The up-front
-            // `ciphertext.count >= 16` guard is not sufficient here (it counts
-            // the nonce), and `prefix(count - 16)` would trap on a short payload.
-            guard actualCiphertext.count >= 16 else {
-                throw NoiseError.invalidCiphertext
-            }
             // Split ciphertext and tag
             encryptedData = actualCiphertext.prefix(actualCiphertext.count - 16)
             tag = actualCiphertext.suffix(16)

bitchat/Nostr/GeoRelayDirectory.swift

@@ -7,11 +7,6 @@ import UIKit
 import AppKit
 #endif
 
-extension Notification.Name {
-    /// Posted after the geo relay directory successfully refreshes its entries.
-    static let geoRelayDirectoryDidRefresh = Notification.Name("bitchat.geoRelayDirectoryDidRefresh")
-}
-
 /// Directory of online Nostr relays with approximate GPS locations, used for geohash routing.
 struct GeoRelayDirectoryDependencies {
     var userDefaults: UserDefaults
@@ -170,16 +165,33 @@ final class GeoRelayDirectory {
     }
 
     /// Returns up to `count` relay URLs (wss://) closest to the given coordinate.
-    /// Ties break by host so every device with the same directory picks the
-    /// same relay set — publishers and subscribers must agree on relays.
     func closestRelays(toLat lat: Double, lon: Double, count: Int = 5) -> [String] {
         guard !entries.isEmpty, count > 0 else { return [] }
 
-        return entries
-            .map { (entry: $0, distance: haversineKm(lat, lon, $0.lat, $0.lon)) }
-            .sorted { ($0.distance, $0.entry.host) < ($1.distance, $1.entry.host) }
-            .prefix(count)
-            .map { "wss://\($0.entry.host)" }
+        if entries.count <= count {
+            return entries
+                .sorted { a, b in
+                    haversineKm(lat, lon, a.lat, a.lon) < haversineKm(lat, lon, b.lat, b.lon)
+                }
+                .map { "wss://\($0.host)" }
+        }
+
+        var best: [(entry: Entry, distance: Double)] = []
+        best.reserveCapacity(count)
+
+        for entry in entries {
+            let distance = haversineKm(lat, lon, entry.lat, entry.lon)
+            if best.count < count {
+                let idx = best.firstIndex { $0.distance > distance } ?? best.count
+                best.insert((entry, distance), at: idx)
+            } else if let worstDistance = best.last?.distance, distance < worstDistance {
+                let idx = best.firstIndex { $0.distance > distance } ?? best.count
+                best.insert((entry, distance), at: idx)
+                best.removeLast()
+            }
+        }
+
+        return best.map { "wss://\($0.entry.host)" }
     }
 
     // MARK: - Remote Fetch
@@ -277,8 +289,6 @@ final class GeoRelayDirectory {
         isFetching = false
         retryAttempt = 0
         cancelRetry()
-        // Let waiters (e.g. location notes stuck in a "no relays" state) retry.
-        dependencies.notificationCenter.post(name: .geoRelayDirectoryDidRefresh, object: nil)
     }
 
     @MainActor

bitchat/Nostr/NostrIdentityBridge.swift

@@ -82,13 +82,6 @@ final class NostrIdentityBridge {
         }
 
         deviceSeedCache = nil
-        // Also drop the in-memory derived per-geohash identities. These hold the
-        // actual secp256k1 private keys; if left cached, post-panic geohash
-        // messages would still be signed with pre-panic keys (linkable across the
-        // wipe) until the app is force-quit.
-        cacheLock.lock()
-        derivedIdentityCache.removeAll()
-        cacheLock.unlock()
     }
 
     // MARK: - Per-Geohash Identities (Location Channels)

bitchat/Nostr/NostrProtocol.swift

@@ -39,23 +39,22 @@ struct NostrProtocol {
             content: content
         )
         
-        // 2. Seal the rumor (encrypt to recipient) and sign it with the SENDER'S
-        //    real identity key. NIP-17 requires the seal be signed by the sender
-        //    so the recipient can authenticate who sent the message; signing with
-        //    a throwaway key leaves DMs forgeable/impersonatable.
-        let senderKey = try senderIdentity.schnorrSigningKey()
+        // 2. Create ephemeral key for this message
+        let ephemeralKey = try P256K.Schnorr.PrivateKey()
+        // Created ephemeral key for seal
+        
+        // 3. Seal the rumor (encrypt to recipient)
         let sealedEvent = try createSeal(
             rumor: rumor,
             recipientPubkey: recipientPubkey,
-            senderKey: senderKey
+            senderKey: ephemeralKey
         )
-
-        // 3. Gift wrap the sealed event with a throwaway ephemeral key (the wrap
-        //    layer hides the sender's identity from relays; createGiftWrap mints
-        //    its own ephemeral key internally).
+        
+        // 4. Gift wrap the sealed event (encrypt to recipient again)
         let giftWrap = try createGiftWrap(
             seal: sealedEvent,
-            recipientPubkey: recipientPubkey
+            recipientPubkey: recipientPubkey,
+            senderKey: ephemeralKey
         )
         
         // Created gift wrap
@@ -85,15 +84,7 @@ struct NostrProtocol {
             throw error
         }
         
-        // 2. Authenticate the seal. The seal MUST be signed by the sender's real
-        //    identity key (NIP-17); without this check a DM is forgeable by anyone
-        //    who knows the recipient's npub. Verify the seal's own signature.
-        guard seal.isValidSignature() else {
-            SecureLogger.error("❌ Rejecting DM: seal signature is missing or invalid", category: .session)
-            throw NostrError.invalidEvent
-        }
-
-        // 3. Open the seal
+        // 2. Open the seal
         let rumor: NostrEvent
         do {
             rumor = try openSeal(
@@ -105,63 +96,10 @@ struct NostrProtocol {
             SecureLogger.error("❌ Failed to open seal: \(error)", category: .session)
             throw error
         }
-
-        // 4. The sender claimed inside the rumor must match the key that actually
-        //    signed the seal, otherwise the sender field is unauthenticated and
-        //    spoofable.
-        guard seal.pubkey == rumor.pubkey else {
-            SecureLogger.error("❌ Rejecting DM: rumor pubkey does not match seal signer", category: .session)
-            throw NostrError.invalidEvent
-        }
-
-        // Return the seal signer's pubkey as the authenticated sender.
-        return (content: rumor.content, senderPubkey: seal.pubkey, timestamp: rumor.created_at)
+        
+        return (content: rumor.content, senderPubkey: rumor.pubkey, timestamp: rumor.created_at)
     }
 
-    #if DEBUG
-    static func createPrivateMessageWithInvalidSealSignatureForTesting(
-        content: String,
-        recipientPubkey: String,
-        senderIdentity: NostrIdentity
-    ) throws -> NostrEvent {
-        let rumor = NostrEvent(
-            pubkey: senderIdentity.publicKeyHex,
-            createdAt: Date(),
-            kind: .dm,
-            tags: [],
-            content: content
-        )
-        var seal = try createSeal(
-            rumor: rumor,
-            recipientPubkey: recipientPubkey,
-            senderKey: senderIdentity.schnorrSigningKey()
-        )
-        seal.sig = String(repeating: "0", count: 128)
-        return try createGiftWrap(seal: seal, recipientPubkey: recipientPubkey)
-    }
-
-    static func createPrivateMessageWithMismatchedSealRumorPubkeyForTesting(
-        content: String,
-        recipientPubkey: String,
-        rumorIdentity: NostrIdentity,
-        sealSignerIdentity: NostrIdentity
-    ) throws -> NostrEvent {
-        let rumor = NostrEvent(
-            pubkey: rumorIdentity.publicKeyHex,
-            createdAt: Date(),
-            kind: .dm,
-            tags: [],
-            content: content
-        )
-        let seal = try createSeal(
-            rumor: rumor,
-            recipientPubkey: recipientPubkey,
-            senderKey: sealSignerIdentity.schnorrSigningKey()
-        )
-        return try createGiftWrap(seal: seal, recipientPubkey: recipientPubkey)
-    }
-    #endif
-
     /// Create a geohash-scoped ephemeral public message (kind 20000)
     static func createEphemeralGeohashEvent(
         content: String,
@@ -257,9 +195,10 @@ struct NostrProtocol {
     
     private static func createGiftWrap(
         seal: NostrEvent,
-        recipientPubkey: String
+        recipientPubkey: String,
+        senderKey: P256K.Schnorr.PrivateKey  // This is the ephemeral key used for the seal
     ) throws -> NostrEvent {
-
+        
         let sealJSON = try seal.jsonString()
         
         // Create new ephemeral key for gift wrap

bitchat/Nostr/NostrRelayManager.swift

@@ -66,9 +66,6 @@ struct NostrRelayManagerDependencies {
     var makeSession: () -> NostrRelaySessionProtocol
     var scheduleAfter: @Sendable (TimeInterval, @escaping @Sendable () -> Void) -> Void
     var now: () -> Date
-    /// Uniform random value in [0, 1) used to jitter reconnect backoff.
-    /// Injectable so tests can pin or sweep the jitter deterministically.
-    var jitterUnit: () -> Double
 }
 
 private extension NostrRelayManagerDependencies {
@@ -96,8 +93,7 @@ private extension NostrRelayManagerDependencies {
             scheduleAfter: { delay, action in
                 DispatchQueue.main.asyncAfter(deadline: .now() + delay, execute: action)
             },
-            now: Date.init,
-            jitterUnit: { Double.random(in: 0..<1) }
+            now: Date.init
         )
     }
 }
@@ -144,34 +140,13 @@ final class NostrRelayManager: ObservableObject {
     private var hasLocationPermission: Bool = false
     private var connections: [String: NostrRelayConnectionProtocol] = [:]
     private var subscriptions: [String: Set<String>] = [:] // relay URL -> active subscription IDs
-    // Not-yet-flushed REQs per relay, bounded by a per-relay cap (oldest by
-    // insertion order evicted) and an age sweep on connect attempts. Dicts are
-    // unordered, so each entry carries an insertion sequence and queue time.
-    private struct PendingSubscription {
-        let messageString: String // encoded REQ JSON
-        let queuedAt: Date
-        let sequence: UInt64
-    }
-    private var pendingSubscriptions: [String: [String: PendingSubscription]] = [:] // relay URL -> (subscription id -> pending REQ)
-    private var pendingSubscriptionSequence: UInt64 = 0
+    private var pendingSubscriptions: [String: [String: String]] = [:] // relay URL -> (subscription id -> encoded REQ JSON)
     private var messageHandlers: [String: (NostrEvent) -> Void] = [:]
-    private struct InboundEventKey: Hashable {
-        let subscriptionID: String
-        let eventID: String
-    }
-    private let recentInboundEventKeyLimit = TransportConfig.nostrInboundEventDedupCap
-    private let recentInboundEventKeyTrimTarget = TransportConfig.nostrInboundEventDedupTrimTarget
-    private var recentInboundEventKeys = Set<InboundEventKey>()
-    private var recentInboundEventKeyOrder: [InboundEventKey] = []
-    private var duplicateInboundEventDropCount = 0
-    private var duplicateInboundEventDropCountBySubscription: [String: Int] = [:]
-    private var inboundEventLogCount = 0
     // Coalesce duplicate subscribe requests for the same id within a short window.
     private let subscribeCoalesceInterval: TimeInterval = 1.0
     private var subscribeCoalesce: [String: Date] = [:]
     private var pendingTorConnectionURLs = Set<String>()
     private var awaitingTorForConnections = false
-    private var torReadyWaitAttempts = 0
     private var cancellables = Set<AnyCancellable>()
 
     private struct SubscriptionRequestState: Equatable {
@@ -184,10 +159,9 @@ final class NostrRelayManager: ObservableObject {
     private struct EOSETracker {
         var pendingRelays: Set<String>
         var callback: () -> Void
-        let epoch: Int
+        var timer: Timer?
     }
     private var eoseTrackers: [String: EOSETracker] = [:]
-    private var eoseTrackerEpoch = 0
     private var pendingEOSECallbacks: [String: () -> Void] = [:]
     
     // Message queue for reliability
@@ -198,9 +172,6 @@ final class NostrRelayManager: ObservableObject {
     }
     private var messageQueue: [PendingSend] = []
     private let messageQueueLock = NSLock()
-    // Total pending sends dropped at the queue cap; drives the sampled
-    // overflow warning (first + every Nth drop).
-    private var pendingSendDropCount = 0
     private let encoder = JSONEncoder()
     private var shouldUseTor: Bool { dependencies.userTorEnabled() }
     
@@ -281,78 +252,19 @@ final class NostrRelayManager: ObservableObject {
             task.cancel(with: .goingAway, reason: nil)
         }
         connections.removeAll()
-        markRelaySocketsClosed(resetState: false)
-        // Sockets are gone, so per-relay subscription state is cleared — but
-        // durable intent (subscriptionRequestState, messageHandlers, parked
-        // EOSE callbacks) is kept so REQs replay when relays reconnect
-        // (e.g. background → foreground).
+        // Clear known subscriptions and any queued subs since connections are gone
         subscriptions.removeAll()
         pendingSubscriptions.removeAll()
-        // Settle in-flight initial loads instead of leaving callers hanging.
-        let trackers = eoseTrackers
-        eoseTrackers.removeAll()
-        for (_, tracker) in trackers {
-            tracker.callback()
-        }
-        pendingTorConnectionURLs.removeAll()
-        awaitingTorForConnections = false
-        torReadyWaitAttempts = 0
-        updateConnectionStatus()
-    }
-
-    /// Panic wipe reset: close sockets and drop every user/session-specific
-    /// relay intent without invoking old callbacks. Unlike `disconnect()`, this
-    /// must not preserve subscription replay state because geohash DM handlers
-    /// can capture pre-wipe Nostr private keys.
-    func resetForPanicWipe() {
-        connectionGeneration &+= 1
-        for (_, task) in connections {
-            task.cancel(with: .goingAway, reason: nil)
-        }
-        connections.removeAll()
-        markRelaySocketsClosed(resetState: true)
-        subscriptions.removeAll()
-        pendingSubscriptions.removeAll()
-        messageHandlers.removeAll()
         subscriptionRequestState.removeAll()
-        subscribeCoalesce.removeAll()
-        eoseTrackers.removeAll()
         pendingEOSECallbacks.removeAll()
+        for (_, tracker) in eoseTrackers {
+            tracker.timer?.invalidate()
+        }
+        eoseTrackers.removeAll()
         pendingTorConnectionURLs.removeAll()
         awaitingTorForConnections = false
-        torReadyWaitAttempts = 0
-        recentInboundEventKeys.removeAll()
-        recentInboundEventKeyOrder.removeAll()
-        duplicateInboundEventDropCount = 0
-        duplicateInboundEventDropCountBySubscription.removeAll()
-        inboundEventLogCount = 0
-        Self.pendingGiftWrapIDs.removeAll()
-
-        messageQueueLock.lock()
-        messageQueue.removeAll()
-        pendingSendDropCount = 0
-        messageQueueLock.unlock()
-
         updateConnectionStatus()
     }
-
-    private func markRelaySocketsClosed(resetState: Bool) {
-        let now = dependencies.now()
-        for index in relays.indices {
-            relays[index].isConnected = false
-            relays[index].nextReconnectTime = nil
-            if resetState {
-                relays[index].lastError = nil
-                relays[index].lastConnectedAt = nil
-                relays[index].lastDisconnectedAt = nil
-                relays[index].messagesSent = 0
-                relays[index].messagesReceived = 0
-                relays[index].reconnectAttempts = 0
-            } else {
-                relays[index].lastDisconnectedAt = now
-            }
-        }
-    }
     
     /// Ensure connections exist to the given relay URLs (idempotent).
     func ensureConnections(to relayUrls: [String]) {
@@ -373,14 +285,11 @@ final class NostrRelayManager: ObservableObject {
         // Global network policy gate
         guard dependencies.activationAllowed() else { return }
         if shouldUseTor && dependencies.torEnforced() && !dependencies.torIsReady() {
-            // Fail-closed: nothing touches the network until Tor is up. Queue the
-            // event locally so it survives a slow bootstrap (queued sends flush
-            // when relays connect), then kick off connection setup, which itself
-            // waits for Tor readiness.
-            let targetRelays = allowedRelayList(from: relayUrls ?? Self.defaultRelays)
-            guard !targetRelays.isEmpty else { return }
-            enqueuePendingSend(event, pendingRelays: Set(targetRelays))
-            ensureConnections(to: targetRelays)
+            // Defer sends until Tor is ready to avoid premature queueing
+            dependencies.awaitTorReady { [weak self] ready in
+                guard let self = self else { return }
+                if ready { self.sendEvent(event, to: relayUrls) }
+            }
             return
         }
         let requestedRelays = relayUrls ?? Self.defaultRelays
@@ -398,29 +307,9 @@ final class NostrRelayManager: ObservableObject {
             }
         }
         if !stillPending.isEmpty {
-            enqueuePendingSend(event, pendingRelays: stillPending)
-        }
-    }
-
-    private func enqueuePendingSend(_ event: NostrEvent, pendingRelays: Set<String>) {
-        messageQueueLock.lock()
-        messageQueue.append(PendingSend(event: event, pendingRelays: pendingRelays))
-        let overflow = messageQueue.count - TransportConfig.nostrPendingSendQueueCap
-        if overflow > 0 {
-            messageQueue.removeFirst(overflow)
-        }
-        messageQueueLock.unlock()
-        guard overflow > 0 else { return }
-        // Dropped events are ephemeral (presence/geo), so no status surfacing
-        // is needed — but the drops should be visible. Sampled so a sustained
-        // relay stall can't flood the log.
-        pendingSendDropCount += overflow
-        if pendingSendDropCount == 1 ||
-            pendingSendDropCount.isMultiple(of: TransportConfig.nostrPendingSendDropLogInterval) {
-            SecureLogger.warning(
-                "📤 Relay send queue full — dropped \(pendingSendDropCount) oldest event(s)",
-                category: .session
-            )
+            messageQueueLock.lock()
+            messageQueue.append(PendingSend(event: event, pendingRelays: stillPending))
+            messageQueueLock.unlock()
         }
     }
 
@@ -515,14 +404,16 @@ final class NostrRelayManager: ObservableObject {
                 existingSet.insert(url)
             }
             for url in urls {
-                queuePendingSubscription(id: id, messageString: messageString, for: url)
+                var map = self.pendingSubscriptions[url] ?? [:]
+                map[id] = messageString
+                self.pendingSubscriptions[url] = map
             }
             // Initialize EOSE tracking if requested
             if let onEOSE = onEOSE {
                 if urls.isEmpty {
                     onEOSE()
                 } else if shouldWaitForTorBeforeConnecting {
-                    parkEOSECallbackUntilTorReady(id: id, callback: onEOSE)
+                    pendingEOSECallbacks[id] = onEOSE
                 } else {
                     startEOSETracking(id: id, relayURLs: Set(urls), callback: onEOSE)
                 }
@@ -595,12 +486,11 @@ final class NostrRelayManager: ObservableObject {
     /// Unsubscribe from a subscription
     func unsubscribe(id: String) {
         messageHandlers.removeValue(forKey: id)
-        removeRecentInboundEvents(forSubscriptionID: id)
-        duplicateInboundEventDropCountBySubscription.removeValue(forKey: id)
         // Allow immediate re-subscription by clearing coalescer timestamp
         subscribeCoalesce.removeValue(forKey: id)
         subscriptionRequestState.removeValue(forKey: id)
         pendingEOSECallbacks.removeValue(forKey: id)
+        eoseTrackers[id]?.timer?.invalidate()
         eoseTrackers.removeValue(forKey: id)
         for url in Array(pendingSubscriptions.keys) {
             pendingSubscriptions[url]?.removeValue(forKey: id)
@@ -631,7 +521,6 @@ final class NostrRelayManager: ObservableObject {
 
     private func connectToRelays(_ relayUrls: [String], shouldLog: Bool = false) {
         guard dependencies.activationAllowed() else { return }
-        sweepStalePendingSubscriptions()
         let targets = allowedRelayList(from: relayUrls).filter {
             connections[$0] == nil && !isPermanentlyFailed($0)
         }
@@ -672,135 +561,37 @@ final class NostrRelayManager: ObservableObject {
             self.awaitingTorForConnections = false
 
             guard ready else {
-                self.torReadyWaitAttempts += 1
-                if self.torReadyWaitAttempts < TransportConfig.nostrTorReadyMaxWaitAttempts {
-                    SecureLogger.warning("Tor not ready; re-queueing \(pending.count) relay connection(s) (attempt \(self.torReadyWaitAttempts))", category: .session)
-                    self.queueConnectionsUntilTorReady(pending)
-                } else {
-                    // Still fail-closed (no network), but unblock any callers
-                    // waiting on EOSE so the UI doesn't hang indefinitely.
-                    // Queued subscriptions/sends are kept and flush if a later
-                    // trigger (e.g. app foreground) brings Tor up.
-                    SecureLogger.error("❌ Tor not ready after \(self.torReadyWaitAttempts) wait(s); aborting relay connections (fail-closed)", category: .session)
-                    self.torReadyWaitAttempts = 0
-                    self.unblockPendingEOSECallbacks(reason: "tor-unavailable")
-                }
+                SecureLogger.error("❌ Tor not ready; aborting relay connections (fail-closed)", category: .session)
                 return
             }
 
-            self.torReadyWaitAttempts = 0
             self.connectToRelays(pending, shouldLog: true)
         }
     }
 
-    /// Park an EOSE callback while Tor is not yet ready, and schedule the same
-    /// fallback timeout `startEOSETracking` uses. Without it, a parked callback
-    /// would only be unblocked by Tor-readiness retry exhaustion (several
-    /// awaitReady timeouts, i.e. minutes), leaving callers hanging far past the
-    /// normal EOSE fallback. If Tor recovers first the callback is promoted to
-    /// a real EOSE tracker (`startPendingEOSETrackingIfNeeded`), and if retry
-    /// exhaustion fires first it is drained by `unblockPendingEOSECallbacks`;
-    /// either way it leaves `pendingEOSECallbacks` and this timer is a no-op.
-    private func parkEOSECallbackUntilTorReady(id: String, callback: @escaping () -> Void) {
-        pendingEOSECallbacks[id] = callback
-        let generation = connectionGeneration
-        dependencies.scheduleAfter(TransportConfig.nostrSubscriptionEOSEFallbackSeconds) { [weak self] in
-            Task { @MainActor [weak self] in
-                guard let self else { return }
-                // Stale timers from a previous connection generation are void.
-                guard generation == self.connectionGeneration else { return }
-                // Already fired (unsubscribe, retry-exhaustion unblock) or
-                // promoted to a real EOSE tracker: nothing to do.
-                guard let callback = self.pendingEOSECallbacks.removeValue(forKey: id) else { return }
-                SecureLogger.warning("Unblocking Tor-parked EOSE callback for \(id) after fallback timeout", category: .session)
-                callback()
-            }
-        }
-    }
-
-    /// Fire and clear all EOSE callbacks that are parked waiting for Tor.
-    /// Callers treat EOSE as "initial fetch finished"; firing with no data is
-    /// safe and prevents indefinite hangs when Tor cannot bootstrap.
-    private func unblockPendingEOSECallbacks(reason: String) {
-        guard !pendingEOSECallbacks.isEmpty else { return }
-        let callbacks = pendingEOSECallbacks
-        pendingEOSECallbacks.removeAll()
-        SecureLogger.warning("Unblocking \(callbacks.count) pending EOSE callback(s) without data (\(reason))", category: .session)
-        for (_, callback) in callbacks {
-            callback()
-        }
-    }
-
     private func subscriptionStateExists(id: String, requestState: SubscriptionRequestState) -> Bool {
         guard !requestState.relayURLs.isEmpty else { return true }
         return requestState.relayURLs.allSatisfy { url in
-            pendingSubscriptions[url]?[id]?.messageString == requestState.messageString ||
+            pendingSubscriptions[url]?[id] == requestState.messageString ||
                 subscriptions[url]?.contains(id) == true
         }
     }
 
-    private func queuePendingSubscription(id: String, messageString: String, for url: String) {
-        var map = pendingSubscriptions[url] ?? [:]
-        pendingSubscriptionSequence &+= 1
-        map[id] = PendingSubscription(
-            messageString: messageString,
-            queuedAt: dependencies.now(),
-            sequence: pendingSubscriptionSequence
-        )
-        // Bound per-relay pending REQs; evict oldest by insertion order. The
-        // durable intent stays in subscriptionRequestState, so an evicted REQ
-        // is still replayed if its subscription is active when the relay
-        // (re)connects.
-        var evictedCount = 0
-        while map.count > TransportConfig.nostrPendingSubscriptionsPerRelayCap,
-              let oldest = map.min(by: { $0.value.sequence < $1.value.sequence }) {
-            map.removeValue(forKey: oldest.key)
-            evictedCount += 1
-        }
-        if evictedCount > 0 {
-            // Bounds proof: the cap eviction actually removed entries.
-            SecureLogger.warning(
-                "📋 Evicted \(evictedCount) pending sub(s) over cap for \(url)",
-                category: .session
-            )
-        }
-        pendingSubscriptions[url] = map
-    }
-
-    /// Drop pending REQs older than the TTL. Runs on connect attempts (the
-    /// natural maintenance path: connect/ensureConnections/reconnects all
-    /// funnel through connectToRelays) so stale entries for relays that never
-    /// come up cannot accumulate without bound.
-    private func sweepStalePendingSubscriptions() {
-        let now = dependencies.now()
-        for (url, map) in pendingSubscriptions {
-            let fresh = map.filter {
-                now.timeIntervalSince($0.value.queuedAt) <= TransportConfig.nostrPendingSubscriptionTTLSeconds
-            }
-            guard fresh.count != map.count else { continue }
-            // Bounds proof: the age sweep actually removed entries. Warning
-            // (not debug) — stale pending REQs mean a relay never came up.
-            SecureLogger.warning(
-                "📋 Swept \(map.count - fresh.count) stale pending sub(s) for \(url)",
-                category: .session
-            )
-            pendingSubscriptions[url] = fresh.isEmpty ? nil : fresh
-        }
-    }
-
     private func startEOSETracking(id: String, relayURLs: Set<String>, callback: @escaping () -> Void) {
-        eoseTrackerEpoch += 1
-        let epoch = eoseTrackerEpoch
-        eoseTrackers[id] = EOSETracker(pendingRelays: relayURLs, callback: callback, epoch: epoch)
+        eoseTrackers[id]?.timer?.invalidate()
+        var tracker = EOSETracker(pendingRelays: relayURLs, callback: callback, timer: nil)
         // Fallback timeout to avoid hanging if a relay never sends EOSE.
-        dependencies.scheduleAfter(TransportConfig.nostrSubscriptionEOSEFallbackSeconds) { [weak self] in
-            Task { @MainActor [weak self] in
+        tracker.timer = Timer.scheduledTimer(withTimeInterval: 2.0, repeats: false) { [weak self] _ in
+            Task { @MainActor in
                 guard let self else { return }
-                guard let tracker = self.eoseTrackers[id], tracker.epoch == epoch else { return }
-                self.eoseTrackers.removeValue(forKey: id)
-                tracker.callback()
+                if let tracker = self.eoseTrackers[id] {
+                    tracker.timer?.invalidate()
+                    self.eoseTrackers.removeValue(forKey: id)
+                    callback()
+                }
             }
         }
+        eoseTrackers[id] = tracker
     }
 
     private func startPendingEOSETrackingIfNeeded(id: String) {
@@ -817,53 +608,6 @@ final class NostrRelayManager: ObservableObject {
             startEOSETracking(id: id, relayURLs: requestState.relayURLs, callback: callback)
         }
     }
-
-    private func shouldDeliverInboundEvent(subscriptionID: String, eventID: String) -> Bool {
-        guard !eventID.isEmpty else { return true }
-        let key = InboundEventKey(subscriptionID: subscriptionID, eventID: eventID)
-        guard recentInboundEventKeys.insert(key).inserted else {
-            recordDuplicateInboundEventDrop(subscriptionID: subscriptionID)
-            return false
-        }
-        recentInboundEventKeyOrder.append(key)
-
-        if recentInboundEventKeyOrder.count > recentInboundEventKeyLimit {
-            let removeCount = recentInboundEventKeyOrder.count - recentInboundEventKeyTrimTarget
-            for staleKey in recentInboundEventKeyOrder.prefix(removeCount) {
-                recentInboundEventKeys.remove(staleKey)
-            }
-            recentInboundEventKeyOrder.removeFirst(removeCount)
-        }
-        return true
-    }
-
-    private func recordDuplicateInboundEventDrop(subscriptionID: String) {
-        duplicateInboundEventDropCount += 1
-        let subscriptionCount = (duplicateInboundEventDropCountBySubscription[subscriptionID] ?? 0) + 1
-        duplicateInboundEventDropCountBySubscription[subscriptionID] = subscriptionCount
-
-        if duplicateInboundEventDropCount == 1 ||
-            duplicateInboundEventDropCount.isMultiple(of: TransportConfig.nostrDuplicateEventLogInterval) {
-            SecureLogger.debug(
-                "Dropped duplicate Nostr event deliveries total=\(duplicateInboundEventDropCount) sub=\(subscriptionID) sub_total=\(subscriptionCount)",
-                category: .session
-            )
-        }
-    }
-
-    private func removeRecentInboundEvents(forSubscriptionID subscriptionID: String) {
-        guard !recentInboundEventKeyOrder.isEmpty else { return }
-        var retainedKeys: [InboundEventKey] = []
-        retainedKeys.reserveCapacity(recentInboundEventKeyOrder.count)
-        for key in recentInboundEventKeyOrder {
-            if key.subscriptionID == subscriptionID {
-                recentInboundEventKeys.remove(key)
-            } else {
-                retainedKeys.append(key)
-            }
-        }
-        recentInboundEventKeyOrder = retainedKeys
-    }
     
     private func connectToRelay(_ urlString: String) {
         // Global network policy gate
@@ -921,35 +665,26 @@ final class NostrRelayManager: ObservableObject {
         }
     }
 
-    /// Send queued subscriptions and replay durable ones for a relay that just
-    /// (re)connected. Relays drop subscriptions with the socket, so every
-    /// active subscription targeting this relay must be re-sent.
+    /// Send any queued subscriptions for a relay that just connected.
     private func flushPendingSubscriptions(for relayUrl: String) {
+        guard let map = pendingSubscriptions[relayUrl], !map.isEmpty else { return }
         guard let connection = connections[relayUrl] else { return }
-        var toSend = (pendingSubscriptions[relayUrl] ?? [:]).mapValues(\.messageString)
-        for (id, state) in subscriptionRequestState where state.relayURLs.contains(relayUrl) && toSend[id] == nil {
-            toSend[id] = state.messageString
-        }
-        for (id, messageString) in toSend {
+        for (id, messageString) in map {
             if self.subscriptions[relayUrl]?.contains(id) == true { continue }
             startPendingEOSETrackingIfNeeded(id: id)
-            connection.send(.string(messageString)) { [weak self, weak connection] error in
-                Task { @MainActor [weak self] in
-                    guard let self else { return }
-                    if let error = error {
-                        // Keep the pending entry; the next (re)connect retries it.
-                        SecureLogger.error("❌ Failed to send pending subscription to \(relayUrl): \(error)", category: .session)
-                    } else {
-                        // A stale completion from a socket that has since been
-                        // replaced must not mark the subscription active, or
-                        // the next connection would skip replaying it.
-                        guard let connection, self.connections[relayUrl] === connection else { return }
-                        self.subscriptions[relayUrl, default: []].insert(id)
-                        self.pendingSubscriptions[relayUrl]?.removeValue(forKey: id)
+            connection.send(.string(messageString)) { error in
+                if let error = error {
+                    SecureLogger.error("❌ Failed to send pending subscription to \(relayUrl): \(error)", category: .session)
+                } else {
+                    Task { @MainActor in
+                        var subs = self.subscriptions[relayUrl] ?? Set<String>()
+                        subs.insert(id)
+                        self.subscriptions[relayUrl] = subs
                     }
                 }
             }
         }
+        pendingSubscriptions[relayUrl] = nil
     }
     
     private func receiveMessage(from task: NostrRelayConnectionProtocol, relayUrl: String) {
@@ -987,26 +722,12 @@ final class NostrRelayManager: ObservableObject {
     private func handleParsedMessage(_ parsed: ParsedInbound, from relayUrl: String) {
         switch parsed {
         case .event(let subId, let event):
+            if event.kind != 1059 {
+                SecureLogger.debug("📥 Event kind=\(event.kind) id=\(event.id.prefix(16))… relay=\(relayUrl)", category: .session)
+            }
             if let index = self.relays.firstIndex(where: { $0.url == relayUrl }) {
                 self.relays[index].messagesReceived += 1
             }
-            guard event.isValidSignature() else {
-                SecureLogger.warning(
-                    "⚠️ Dropped invalid Nostr event id=\(event.id.prefix(16))… sub=\(subId) relay=\(relayUrl)",
-                    category: .session
-                )
-                return
-            }
-            guard shouldDeliverInboundEvent(subscriptionID: subId, eventID: event.id) else {
-                return
-            }
-            if event.kind != 1059 {
-                // Per-event logging floods dev builds in busy geohashes; sample it.
-                inboundEventLogCount += 1
-                if inboundEventLogCount == 1 || inboundEventLogCount.isMultiple(of: TransportConfig.nostrInboundEventLogInterval) {
-                    SecureLogger.debug("📥 Event #\(inboundEventLogCount) kind=\(event.kind) id=\(event.id.prefix(16))… relay=\(relayUrl)", category: .session)
-                }
-            }
             if let handler = self.messageHandlers[subId] {
                 handler(event)
             } else {
@@ -1016,6 +737,7 @@ final class NostrRelayManager: ObservableObject {
             if var tracker = eoseTrackers[subId] {
                 tracker.pendingRelays.remove(relayUrl)
                 if tracker.pendingRelays.isEmpty {
+                    tracker.timer?.invalidate()
                     eoseTrackers.removeValue(forKey: subId)
                     tracker.callback()
                 } else {
@@ -1089,30 +811,17 @@ final class NostrRelayManager: ObservableObject {
         isConnected = relays.contains { $0.isConnected }
     }
     
-    /// A relay that drops before sending EOSE must not stall initial-load
-    /// callbacks; treat it as done and let the remaining relays (or the
-    /// fallback timeout) drive completion.
-    private func settleEOSETrackers(droppingRelay relayUrl: String) {
-        for (id, var tracker) in eoseTrackers where tracker.pendingRelays.contains(relayUrl) {
-            tracker.pendingRelays.remove(relayUrl)
-            if tracker.pendingRelays.isEmpty {
-                eoseTrackers.removeValue(forKey: id)
-                tracker.callback()
-            } else {
-                eoseTrackers[id] = tracker
-            }
-        }
-    }
-
     private func handleDisconnection(relayUrl: String, error: Error) {
+        // If networking is disallowed, do not schedule reconnection
+        if !dependencies.activationAllowed() {
+            connections.removeValue(forKey: relayUrl)
+            subscriptions.removeValue(forKey: relayUrl)
+            updateRelayStatus(relayUrl, isConnected: false, error: error)
+            return
+        }
         connections.removeValue(forKey: relayUrl)
         subscriptions.removeValue(forKey: relayUrl)
         updateRelayStatus(relayUrl, isConnected: false, error: error)
-        settleEOSETrackers(droppingRelay: relayUrl)
-        // If networking is disallowed, do not schedule reconnection
-        if !dependencies.activationAllowed() {
-            return
-        }
         
         // Check if this is a DNS or handshake error; treat as permanent
         let errorDescription = error.localizedDescription.lowercased()
@@ -1143,26 +852,16 @@ final class NostrRelayManager: ObservableObject {
             return
         }
         
-        // Calculate backoff interval with ±jitterRatio random jitter so relays
-        // that dropped together don't all reconnect at the same instant.
-        let baseBackoffInterval = min(
+        // Calculate backoff interval
+        let backoffInterval = min(
             initialBackoffInterval * pow(backoffMultiplier, Double(relays[index].reconnectAttempts - 1)),
             maxBackoffInterval
         )
-        let jitterRatio = TransportConfig.nostrRelayBackoffJitterRatio
-        let jitterFactor = 1.0 + (dependencies.jitterUnit() * 2.0 - 1.0) * jitterRatio
-        let backoffInterval = baseBackoffInterval * jitterFactor
-
+        
         let nextReconnectTime = dependencies.now().addingTimeInterval(backoffInterval)
         relays[index].nextReconnectTime = nextReconnectTime
-
-        // Reconnects are bounded by maxReconnectAttempts and exponentially
-        // backed off, so this is low-frequency: plain debug, no sampling.
-        SecureLogger.debug(
-            "🔄 Reconnect \(relayUrl) in \(String(format: "%.1f", backoffInterval))s (base \(String(format: "%.1f", baseBackoffInterval))s, attempt \(relays[index].reconnectAttempts)/\(maxReconnectAttempts))",
-            category: .session
-        )
-
+        
+        
         // Schedule reconnection with exponential backoff
         let gen = connectionGeneration
         dependencies.scheduleAfter(backoffInterval) { [weak self] in
@@ -1220,31 +919,6 @@ final class NostrRelayManager: ObservableObject {
         pendingSubscriptions[relayUrl]?.count ?? 0
     }
 
-    func debugPendingSubscriptionIDs(for relayUrl: String) -> Set<String> {
-        guard let map = pendingSubscriptions[relayUrl] else { return [] }
-        return Set(map.keys)
-    }
-
-    var debugMessageHandlerCount: Int {
-        messageHandlers.count
-    }
-
-    var debugSubscriptionRequestCount: Int {
-        subscriptionRequestState.count
-    }
-
-    var debugPendingEOSECallbackCount: Int {
-        pendingEOSECallbacks.count
-    }
-
-    var debugDuplicateInboundEventDropCount: Int {
-        duplicateInboundEventDropCount
-    }
-
-    func debugDuplicateInboundEventDropCount(forSubscriptionID subscriptionID: String) -> Int {
-        duplicateInboundEventDropCountBySubscription[subscriptionID] ?? 0
-    }
-
     func debugFlushMessageQueue() {
         flushMessageQueue(for: nil)
     }
@@ -1269,13 +943,6 @@ final class NostrRelayManager: ObservableObject {
     // MARK: - Failure classification
     private func isPermanentlyFailed(_ url: String) -> Bool {
         guard let r = relays.first(where: { $0.url == url }) else { return false }
-        // Failures decay: after a cooldown the relay gets another chance, so a
-        // long network outage or transient relay trouble can't blacklist it
-        // for the rest of the process lifetime.
-        if let lastDisconnect = r.lastDisconnectedAt,
-           dependencies.now().timeIntervalSince(lastDisconnect) >= TransportConfig.nostrRelayFailureCooldownSeconds {
-            return false
-        }
         if r.reconnectAttempts >= maxReconnectAttempts { return true }
         if let ns = r.lastError as NSError?, ns.domain == NSURLErrorDomain {
             if ns.code == NSURLErrorBadServerResponse || ns.code == NSURLErrorCannotFindHost {
@@ -1307,7 +974,8 @@ private enum ParsedInbound {
             if array.count >= 3,
                let subId = array[1] as? String,
                let eventDict = array[2] as? [String: Any],
-               let event = try? NostrEvent(from: eventDict) {
+               let event = try? NostrEvent(from: eventDict),
+               event.isValidSignature() {
                 self = .event(subId: subId, event: event)
                 return
             }

bitchat/Services/BLE/BLEAnnounceHandler.swift

@@ -1,246 +0,0 @@
-import BitFoundation
-import BitLogger
-import Foundation
-
-/// Narrow environment for `BLEAnnounceHandler`.
-///
-/// All queue hops (collections barrier, BLE-queue link-state reads, main-actor
-/// UI notification, delayed re-announce) live inside the closures supplied by
-/// `BLEService`, keeping the handler queue-agnostic and synchronously testable.
-struct BLEAnnounceHandlerEnvironment {
-    /// Local peer identity at the time the announce is handled.
-    let localPeerID: () -> PeerID
-    /// TTL value used for direct (non-relayed) packets.
-    let messageTTL: UInt8
-    /// Current time source.
-    let now: () -> Date
-    /// Noise and signing public keys already recorded for the peer, if any
-    /// (single registry read so both come from one consistent snapshot).
-    let existingPeerKeys: (PeerID) -> (noisePublicKey: Data?, signingPublicKey: Data?)
-    /// Signing key from the persisted cryptographic identity for the peer, if
-    /// any. Registry pins do not survive app restarts or offline-peer
-    /// eviction; this fallback keeps the TOFU signing-key pin effective for
-    /// returning peers.
-    let persistedSigningPublicKey: (PeerID) -> Data?
-    /// Verifies the packet signature against the announced signing key.
-    let verifySignature: (_ packet: BitchatPacket, _ signingPublicKey: Data) -> Bool
-    /// Direct link state for the peer (BLE-queue read).
-    let linkState: (PeerID) -> (hasPeripheral: Bool, hasCentral: Bool)
-    /// Runs the registry mutation phase under the collections barrier.
-    let withRegistryBarrier: (() -> Void) -> Void
-    /// Upserts the verified announce into the peer registry.
-    /// Returns `nil` when the registry refuses the announce because it carries
-    /// a signing key different from the one already pinned for this peer.
-    /// Must only be called from inside `withRegistryBarrier`.
-    let upsertVerifiedAnnounce: (
-        _ peerID: PeerID,
-        _ announcement: AnnouncementPacket,
-        _ isConnected: Bool,
-        _ now: Date
-    ) -> BLEPeerAnnounceUpdate?
-    /// Debounced reconnect-log decision.
-    /// Must only be called from inside `withRegistryBarrier`.
-    let shouldEmitReconnectLog: (_ peerID: PeerID, _ now: Date) -> Bool
-    /// Records verified direct-neighbor claims in the mesh topology.
-    let updateTopology: (_ peerID: PeerID, _ neighbors: [Data]) -> Void
-    /// Persists the announced cryptographic identity for offline verification.
-    let persistIdentity: (AnnouncementPacket) -> Void
-    /// Announce-back dedup check.
-    let dedupContains: (String) -> Bool
-    /// Announce-back dedup marking.
-    let dedupMarkProcessed: (String) -> Void
-    /// Delivers the announce UI events as one ordered main-actor hop:
-    /// `.peerConnected` (if flagged) → initial gossip sync scheduling (if
-    /// flagged) → peer-ID snapshot + data publish + `.peerListUpdated`.
-    /// A single closure keeps the original in-order delivery guarantee that
-    /// separate unstructured tasks would not provide.
-    let deliverAnnounceUIEvents: (
-        _ peerID: PeerID,
-        _ notifyPeerConnected: Bool,
-        _ scheduleInitialSync: Bool
-    ) -> Void
-    /// Tracks the announce packet for gossip sync.
-    let trackPacketSeen: (BitchatPacket) -> Void
-    /// Reciprocates the announce for bidirectional discovery.
-    let sendAnnounceBack: () -> Void
-    /// Schedules a delayed re-announce (afterglow) after the given delay.
-    let scheduleAfterglow: (TimeInterval) -> Void
-}
-
-/// Orchestrates inbound announce packets: preflight validation, signature
-/// trust, registry/topology updates, identity persistence, UI notification,
-/// gossip tracking, and the reciprocal announce response.
-final class BLEAnnounceHandler {
-    private let environment: BLEAnnounceHandlerEnvironment
-
-    init(environment: BLEAnnounceHandlerEnvironment) {
-        self.environment = environment
-    }
-
-    func handle(_ packet: BitchatPacket, from peerID: PeerID) {
-        let env = environment
-        let now = env.now()
-        let preflight = BLEAnnouncePreflightPolicy.evaluate(
-            packet: packet,
-            from: peerID,
-            localPeerID: env.localPeerID(),
-            now: now
-        )
-
-        let announcement: AnnouncementPacket
-        switch preflight {
-        case .accept(let acceptance):
-            announcement = acceptance.announcement
-        case .reject(.malformed):
-            SecureLogger.error("❌ Failed to decode announce packet from \(peerID.id.prefix(8))…", category: .session)
-            return
-        case .reject(.senderMismatch(let derivedFromKey)):
-            SecureLogger.warning("⚠️ Announce sender mismatch: derived \(derivedFromKey.id.prefix(8))… vs packet \(peerID.id.prefix(8))…", category: .security)
-            return
-        case .reject(.selfAnnounce):
-            return
-        case .reject(.stale(let ageSeconds)):
-            SecureLogger.debug("⏰ Ignoring stale announce from \(peerID.id.prefix(8))… (age: \(ageSeconds)s)", category: .session)
-            return
-        }
-
-        // Suppress announce logs to reduce noise
-
-        // Precompute signature verification outside barrier to reduce contention
-        var existingPeerKeys = env.existingPeerKeys(peerID)
-        if existingPeerKeys.signingPublicKey == nil {
-            // The registry entry (and its signing-key pin) is dropped on app
-            // restart and offline-peer eviction, but the persisted
-            // cryptographic identity survives both. Fall back to it so a
-            // returning peer is not treated as first contact — otherwise an
-            // attacker could replay the peer's noiseKey/peerID with their own
-            // signing key and re-pin the identity (TOFU downgrade).
-            existingPeerKeys.signingPublicKey = env.persistedSigningPublicKey(peerID)
-        }
-        let hasSignature = packet.signature != nil
-        let signatureValid: Bool
-        if hasSignature {
-            signatureValid = env.verifySignature(packet, announcement.signingPublicKey)
-            if !signatureValid {
-                SecureLogger.warning("⚠️ Signature verification for announce failed \(peerID.id.prefix(8))", category: .security)
-            }
-        } else {
-            signatureValid = false
-        }
-        let trustDecision = BLEAnnounceTrustPolicy.evaluate(
-            hasSignature: hasSignature,
-            signatureValid: signatureValid,
-            existingNoisePublicKey: existingPeerKeys.noisePublicKey,
-            announcedNoisePublicKey: announcement.noisePublicKey,
-            existingSigningPublicKey: existingPeerKeys.signingPublicKey,
-            announcedSigningPublicKey: announcement.signingPublicKey
-        )
-        if case .reject(.keyMismatch) = trustDecision {
-            SecureLogger.warning("⚠️ Announce key mismatch for \(peerID.id.prefix(8))… — keeping unverified", category: .security)
-        }
-        if case .reject(.signingKeyMismatch) = trustDecision {
-            SecureLogger.warning("🚨 Announce signing-key mismatch for \(peerID.id.prefix(8))… — refusing to replace pinned signing key (possible impersonation attempt)", category: .security)
-        }
-        var verifiedAnnounce = trustDecision.isVerified
-
-        var isNewPeer = false
-        var isReconnectedPeer = false
-        let directLinkState = env.linkState(peerID)
-        let isDirectAnnounce = packet.ttl == env.messageTTL
-
-        env.withRegistryBarrier {
-            let hasPeripheralConnection = directLinkState.hasPeripheral
-            let hasCentralSubscription = directLinkState.hasCentral
-
-            // Require verified announce; ignore otherwise (no backward compatibility)
-            if !verifiedAnnounce {
-                SecureLogger.warning("❌ Ignoring unverified announce from \(peerID.id.prefix(8))…", category: .security)
-                // Reset flags to prevent post-barrier code from acting on unverified announces
-                isNewPeer = false
-                isReconnectedPeer = false
-                return
-            }
-
-            // The registry re-checks the signing-key pin inside the barrier.
-            // The pre-barrier trust check reads the registry outside the
-            // barrier, so this closes the race where two announces for the
-            // same peer are evaluated concurrently.
-            guard let update = env.upsertVerifiedAnnounce(
-                peerID,
-                announcement,
-                isDirectAnnounce || hasPeripheralConnection || hasCentralSubscription,
-                now
-            ) else {
-                SecureLogger.warning("🚨 Registry refused announce for \(peerID.id.prefix(8))… — signing key differs from pinned key", category: .security)
-                verifiedAnnounce = false
-                isNewPeer = false
-                isReconnectedPeer = false
-                return
-            }
-            isNewPeer = update.isNewPeer
-            isReconnectedPeer = update.wasDisconnected
-
-            // Log connection status only for direct connectivity changes; debounce to reduce spam
-            if isDirectAnnounce || hasPeripheralConnection || hasCentralSubscription {
-                let now = env.now()
-                if update.isNewPeer {
-                    SecureLogger.debug("🆕 New peer: \(announcement.nickname)", category: .session)
-                } else if update.wasDisconnected {
-                    if env.shouldEmitReconnectLog(peerID, now) {
-                        SecureLogger.debug("🔄 Peer \(announcement.nickname) reconnected", category: .session)
-                    }
-                } else if let previousNickname = update.previousNickname, previousNickname != announcement.nickname {
-                    SecureLogger.debug("🔄 Peer \(peerID.id.prefix(8))… changed nickname: \(previousNickname) -> \(announcement.nickname)", category: .session)
-                }
-            }
-        }
-
-        // Update topology with verified neighbor claims (only for authenticated announces)
-        if verifiedAnnounce, let neighbors = announcement.directNeighbors {
-            env.updateTopology(peerID, neighbors)
-        }
-
-        // Persist cryptographic identity and signing key for robust offline
-        // verification — only for verified announces. Persisting unverified
-        // announces would let an attacker who replays a victim's noisePublicKey
-        // overwrite the victim's stored signing key/nickname (identity poisoning).
-        if verifiedAnnounce {
-            env.persistIdentity(announcement)
-        }
-
-        let announceBackID = "announce-back-\(peerID)"
-        let shouldSendBack = !env.dedupContains(announceBackID)
-        if shouldSendBack {
-            env.dedupMarkProcessed(announceBackID)
-        }
-        let responsePlan = BLEAnnounceResponsePolicy.plan(
-            isDirectAnnounce: isDirectAnnounce,
-            isNewPeer: isNewPeer,
-            isReconnectedPeer: isReconnectedPeer,
-            shouldSendAnnounceBack: shouldSendBack
-        )
-
-        // Only notify of connection for new or reconnected peers when it is a
-        // direct announce; the list update always follows in the same hop.
-        env.deliverAnnounceUIEvents(
-            peerID,
-            responsePlan.shouldNotifyPeerConnected,
-            responsePlan.shouldNotifyPeerConnected && responsePlan.shouldScheduleInitialSync
-        )
-
-        // Track for sync (include our own and others' announces)
-        env.trackPacketSeen(packet)
-
-        if responsePlan.shouldSendAnnounceBack {
-            // Reciprocate announce for bidirectional discovery
-            // Force send to ensure the peer receives our announce
-            env.sendAnnounceBack()
-        }
-
-        // Afterglow: on first-seen peers, schedule a short re-announce to push presence one more hop
-        if responsePlan.shouldScheduleAfterglow {
-            let delay = Double.random(in: 0.3...0.6)
-            env.scheduleAfterglow(delay)
-        }
-    }
-}

bitchat/Services/BLE/BLEAnnounceHandlingPolicy.swift

@@ -56,7 +56,6 @@ enum BLEAnnounceTrustRejection: Equatable {
     case missingSignature
     case invalidSignature
     case keyMismatch
-    case signingKeyMismatch
 }
 
 enum BLEAnnounceTrustDecision: Equatable {
@@ -73,25 +72,12 @@ enum BLEAnnounceTrustPolicy {
         hasSignature: Bool,
         signatureValid: Bool,
         existingNoisePublicKey: Data?,
-        announcedNoisePublicKey: Data,
-        existingSigningPublicKey: Data?,
-        announcedSigningPublicKey: Data
+        announcedNoisePublicKey: Data
     ) -> BLEAnnounceTrustDecision {
         if let existingNoisePublicKey, existingNoisePublicKey != announcedNoisePublicKey {
             return .reject(.keyMismatch)
         }
 
-        // TOFU signing-key pinning. The packet signature only proves the
-        // announce is self-consistent — it is verified against the Ed25519 key
-        // carried *inside the same announce*. Since peerIDs derive from the
-        // broadcast (public) noise key, an attacker can replay a victim's
-        // peerID+noiseKey with their own signing key and a valid
-        // self-signature. Once we have bound a signing key to this peer,
-        // refuse to silently replace it.
-        if let existingSigningPublicKey, existingSigningPublicKey != announcedSigningPublicKey {
-            return .reject(.signingKeyMismatch)
-        }
-
         guard hasSignature else {
             return .reject(.missingSignature)
         }

bitchat/Services/BLE/BLEConnectionScheduler.swift

@@ -41,16 +41,13 @@ final class BLEConnectionScheduler<Peripheral> {
     private let candidateCap: Int
     private let weakLinkCooldownSeconds: TimeInterval
     private let weakLinkRSSICutoff: Int
+    private let recentTimeoutWindowSeconds: TimeInterval
+    private let recentTimeoutCountThreshold: Int
 
     private var lastGlobalConnectAttempt: Date = .distantPast
     private var candidates: [BLEConnectionCandidate<Peripheral>] = []
     private var failureCounts: [String: Int] = [:]
     private var recentConnectTimeouts: [String: Date] = [:]
-    // Tracked separately from connect timeouts: a peer we held a connection
-    // with and lost (walked out of range) usually comes back, so it only gets
-    // a brief rediscovery ignore — not the timeout backoff/cooldown treatment
-    // reserved for peers that never answered a connect attempt.
-    private var recentDisconnects: [String: Date] = [:]
     private var lastIsolatedAt: Date?
 
     private let initialDynamicRSSIThreshold: Int
@@ -66,6 +63,8 @@ final class BLEConnectionScheduler<Peripheral> {
         candidateCap: Int = TransportConfig.bleConnectionCandidatesMax,
         weakLinkCooldownSeconds: TimeInterval = TransportConfig.bleWeakLinkCooldownSeconds,
         weakLinkRSSICutoff: Int = TransportConfig.bleWeakLinkRSSICutoff,
+        recentTimeoutWindowSeconds: TimeInterval = TransportConfig.bleRecentTimeoutWindowSeconds,
+        recentTimeoutCountThreshold: Int = TransportConfig.bleRecentTimeoutCountThreshold,
         dynamicRSSIThreshold: Int = TransportConfig.bleDynamicRSSIThresholdDefault
     ) {
         self.maxCentralLinks = maxCentralLinks
@@ -73,6 +72,8 @@ final class BLEConnectionScheduler<Peripheral> {
         self.candidateCap = candidateCap
         self.weakLinkCooldownSeconds = weakLinkCooldownSeconds
         self.weakLinkRSSICutoff = weakLinkRSSICutoff
+        self.recentTimeoutWindowSeconds = recentTimeoutWindowSeconds
+        self.recentTimeoutCountThreshold = recentTimeoutCountThreshold
         self.initialDynamicRSSIThreshold = dynamicRSSIThreshold
         self.dynamicRSSIThreshold = dynamicRSSIThreshold
     }
@@ -113,12 +114,7 @@ final class BLEConnectionScheduler<Peripheral> {
         }
 
         if let lastTimeout = recentConnectTimeouts[candidate.peripheralID],
-           now.timeIntervalSince(lastTimeout) < TransportConfig.bleTimeoutDiscoveryIgnoreSeconds {
-            return .ignore
-        }
-
-        if let lastDisconnect = recentDisconnects[candidate.peripheralID],
-           now.timeIntervalSince(lastDisconnect) < TransportConfig.bleDisconnectDiscoveryIgnoreSeconds {
+           now.timeIntervalSince(lastTimeout) < 15 {
             return .ignore
         }
 
@@ -167,11 +163,6 @@ final class BLEConnectionScheduler<Peripheral> {
                 return .retryAfter(delay)
             }
 
-            if let delay = disconnectSettleDelay(for: candidate, now: now) {
-                enqueue(candidate)
-                return .retryAfter(delay)
-            }
-
             if isAlreadyConnectingOrConnected(candidate.peripheralID) {
                 continue
             }
@@ -189,7 +180,6 @@ final class BLEConnectionScheduler<Peripheral> {
     func recordConnectionSuccess(peripheralID: String) {
         failureCounts[peripheralID] = 0
         recentConnectTimeouts.removeValue(forKey: peripheralID)
-        recentDisconnects.removeValue(forKey: peripheralID)
     }
 
     func recordConnectionFailure(peripheralID: String) {
@@ -197,7 +187,7 @@ final class BLEConnectionScheduler<Peripheral> {
     }
 
     func recordDisconnectError(peripheralID: String, at now: Date) {
-        recentDisconnects[peripheralID] = now
+        recentConnectTimeouts[peripheralID] = now
     }
 
     func recordConnectionTimeout(peripheralID: String, at now: Date) {
@@ -207,7 +197,6 @@ final class BLEConnectionScheduler<Peripheral> {
 
     func pruneConnectionTimeouts(before cutoff: Date) {
         recentConnectTimeouts = recentConnectTimeouts.filter { $0.value >= cutoff }
-        recentDisconnects = recentDisconnects.filter { $0.value >= cutoff }
     }
 
     func reset() {
@@ -215,7 +204,6 @@ final class BLEConnectionScheduler<Peripheral> {
         candidates.removeAll()
         failureCounts.removeAll()
         recentConnectTimeouts.removeAll()
-        recentDisconnects.removeAll()
         lastIsolatedAt = nil
         dynamicRSSIThreshold = initialDynamicRSSIThreshold
     }
@@ -237,14 +225,18 @@ final class BLEConnectionScheduler<Peripheral> {
         }
 
         lastIsolatedAt = nil
-        // Flaky links are handled per-peripheral (weak-link cooldown, discovery
-        // ignore window, score bias) — never globally, so one flaky distant peer
-        // can't blind us to every other edge-of-range peer.
         var threshold = TransportConfig.bleDynamicRSSIThresholdDefault
         if connectedOrConnectingLinkCount >= maxCentralLinks || candidates.count >= candidateCap {
             threshold = TransportConfig.bleRSSIConnectedThreshold
         }
 
+        let recentTimeouts = recentConnectTimeouts.filter {
+            now.timeIntervalSince($0.value) < recentTimeoutWindowSeconds
+        }.count
+        if recentTimeouts >= recentTimeoutCountThreshold {
+            threshold = max(threshold, TransportConfig.bleRSSIHighTimeoutThreshold)
+        }
+
         dynamicRSSIThreshold = threshold
         return threshold
     }
@@ -266,20 +258,6 @@ final class BLEConnectionScheduler<Peripheral> {
         return min(max(2.0, remaining), 15.0)
     }
 
-    // The disconnect settle window must hold on the queue path too: a stale
-    // candidate enqueued while the peripheral was still connected would
-    // otherwise reconnect immediately via the post-disconnect queue drain,
-    // bypassing the window and recreating reconnect/cancel thrash.
-    private func disconnectSettleDelay(
-        for candidate: BLEConnectionCandidate<Peripheral>,
-        now: Date
-    ) -> TimeInterval? {
-        guard let lastDisconnect = recentDisconnects[candidate.peripheralID] else { return nil }
-        let remaining = TransportConfig.bleDisconnectDiscoveryIgnoreSeconds - now.timeIntervalSince(lastDisconnect)
-        guard remaining > 0 else { return nil }
-        return remaining + 0.05
-    }
-
     private func score(_ candidate: BLEConnectionCandidate<Peripheral>, now: Date) -> Int {
         let failures = failureCounts[candidate.peripheralID] ?? 0
         let penalty = min(20, 1 << min(4, failures))

bitchat/Services/BLE/BLEFanoutSelector.swift

@@ -13,21 +13,15 @@ enum BLEFanoutSelector {
         centralIDs: [String],
         ingressLink: BLEIngressLinkID?,
         excludedLinks: Set<BLEIngressLinkID> = [],
-        peripheralPeerBindings: [String: PeerID] = [:],
-        centralPeerBindings: [String: PeerID] = [:],
         directedPeerHint: PeerID?,
         packetType: UInt8,
         messageID: String
     ) -> BLEFanoutSelection {
-        let allowed = collapseDuplicateLinksPerPeer(
-            allowedLinks(
-                peripheralIDs: peripheralIDs,
-                centralIDs: centralIDs,
-                ingressLink: ingressLink,
-                excludedLinks: excludedLinks
-            ),
-            peripheralPeerBindings: peripheralPeerBindings,
-            centralPeerBindings: centralPeerBindings
+        let allowed = allowedLinks(
+            peripheralIDs: peripheralIDs,
+            centralIDs: centralIDs,
+            ingressLink: ingressLink,
+            excludedLinks: excludedLinks
         )
 
         guard shouldSubset(packetType: packetType, directedPeerHint: directedPeerHint) else {
@@ -71,43 +65,6 @@ enum BLEFanoutSelector {
         return (allowedPeripheralIDs, allowedCentralIDs)
     }
 
-    // Dual-role pairs hold two live links (we-as-central writing to their
-    // peripheral, and they-as-central subscribed to ours). Sending the same
-    // packet down both doubles airtime for nothing — the receiver's assembler
-    // and deduplicator just discard the copy. Keep one link per bound peer,
-    // preferring the peripheral (write) side: it has per-link flow control
-    // via canSendWriteWithoutResponse, while notifications share the
-    // peripheral manager's update queue across all centrals. Links with no
-    // bound peer yet (pre-announce) pass through untouched.
-    private static func collapseDuplicateLinksPerPeer(
-        _ links: (peripheralIDs: [String], centralIDs: [String]),
-        peripheralPeerBindings: [String: PeerID],
-        centralPeerBindings: [String: PeerID]
-    ) -> (peripheralIDs: [String], centralIDs: [String]) {
-        guard !peripheralPeerBindings.isEmpty || !centralPeerBindings.isEmpty else {
-            return links
-        }
-
-        var seenPeers = Set<PeerID>()
-        var keptPeripheralIDs: [String] = []
-        for id in links.peripheralIDs {
-            if let peer = peripheralPeerBindings[id], !seenPeers.insert(peer).inserted {
-                continue
-            }
-            keptPeripheralIDs.append(id)
-        }
-
-        var keptCentralIDs: [String] = []
-        for id in links.centralIDs {
-            if let peer = centralPeerBindings[id], !seenPeers.insert(peer).inserted {
-                continue
-            }
-            keptCentralIDs.append(id)
-        }
-
-        return (keptPeripheralIDs, keptCentralIDs)
-    }
-
     private static func shouldSubset(packetType: UInt8, directedPeerHint: PeerID?) -> Bool {
         directedPeerHint == nil
             && packetType != MessageType.fragment.rawValue

bitchat/Services/BLE/BLEFileTransferHandler.swift

@@ -1,123 +0,0 @@
-import BitFoundation
-import BitLogger
-import Foundation
-
-/// Narrow environment for `BLEFileTransferHandler`.
-///
-/// All queue hops (collections registry reads/writes, main-actor UI
-/// notification) live inside the closures supplied by `BLEService`, keeping
-/// the handler queue-agnostic and synchronously testable.
-struct BLEFileTransferHandlerEnvironment {
-    /// Local peer identity at the time the transfer is handled.
-    let localPeerID: () -> PeerID
-    /// Local nickname used for sender resolution and collision checks.
-    let localNickname: () -> String
-    /// Snapshot of known peers keyed by ID (registry read).
-    let peersSnapshot: () -> [PeerID: BLEPeerInfo]
-    /// Resolves a display name from a verified packet signature for peers missing from the registry.
-    let signedSenderDisplayName: (_ packet: BitchatPacket, _ peerID: PeerID) -> String?
-    /// Tracks the broadcast file packet for gossip sync.
-    let trackPacketSeen: (BitchatPacket) -> Void
-    /// Enforces the incoming-media storage quota before saving (BCH-01-002).
-    let enforceStorageQuota: (_ reservingBytes: Int) -> Void
-    /// Persists the validated file to the incoming-media store; returns the destination URL.
-    let saveIncomingFile: (
-        _ data: Data,
-        _ preferredName: String?,
-        _ subdirectory: String,
-        _ fallbackExtension: String?,
-        _ defaultPrefix: String
-    ) -> URL?
-    /// Updates the registry last-seen timestamp for the peer (async barrier write).
-    let updatePeerLastSeen: (PeerID) -> Void
-    /// Delivers `.messageReceived` to the UI as one main-actor hop.
-    let deliverMessage: (BitchatMessage) -> Void
-}
-
-/// Orchestrates inbound file transfers: self-echo policy, sender display-name
-/// resolution, delivery planning, payload validation, quota-checked storage,
-/// and UI delivery.
-final class BLEFileTransferHandler {
-    private let environment: BLEFileTransferHandlerEnvironment
-
-    init(environment: BLEFileTransferHandlerEnvironment) {
-        self.environment = environment
-    }
-
-    func handle(_ packet: BitchatPacket, from peerID: PeerID) {
-        let env = environment
-        if BLEFileTransferPolicy.isSelfEcho(packet: packet, from: peerID, localPeerID: env.localPeerID()) { return }
-
-        let peersSnapshot = env.peersSnapshot()
-        guard let senderNickname = BLEPeerSenderDisplayName.resolveKnownPeer(
-            peerID: peerID,
-            localPeerID: env.localPeerID(),
-            localNickname: env.localNickname(),
-            peers: peersSnapshot,
-            allowConnectedUnverified: true
-        ) ?? env.signedSenderDisplayName(packet, peerID) else {
-            SecureLogger.warning("🚫 Dropping file transfer from unverified or unknown peer \(peerID.id.prefix(8))…", category: .security)
-            return
-        }
-
-        guard let deliveryPlan = BLEFileTransferPolicy.deliveryPlan(packet: packet, localPeerID: env.localPeerID()) else {
-            return
-        }
-        if deliveryPlan.shouldTrackForSync {
-            env.trackPacketSeen(packet)
-        }
-
-        let filePacket: BitchatFilePacket
-        let mime: MimeType
-        switch BLEIncomingFileValidator.validate(payload: packet.payload) {
-        case .success(let acceptance):
-            filePacket = acceptance.filePacket
-            mime = acceptance.mime
-        case .failure(.malformedPayload):
-            SecureLogger.error("❌ Failed to decode file transfer payload", category: .session)
-            return
-        case .failure(.payloadTooLarge(let bytes)):
-            SecureLogger.warning("🚫 Dropping file transfer exceeding size cap (\(bytes) bytes)", category: .security)
-            return
-        case .failure(.unsupportedMime(let mimeType, let bytes)):
-            SecureLogger.warning("🚫 MIME REJECT: '\(mimeType ?? "<empty>")' not supported. Size=\(bytes)b from \(peerID.id.prefix(8))...", category: .security)
-            return
-        case .failure(.magicMismatch(let mime, let bytes, let prefixHex)):
-            SecureLogger.warning("🚫 MAGIC REJECT: MIME='\(mime)' size=\(bytes)b prefix=[\(prefixHex)] from \(peerID.id.prefix(8))...", category: .security)
-            return
-        }
-
-        // BCH-01-002: Enforce storage quota before saving
-        env.enforceStorageQuota(filePacket.content.count)
-
-        guard let destination = env.saveIncomingFile(
-            filePacket.content,
-            filePacket.fileName,
-            "\(mime.category.mediaDir)/incoming",
-            mime.defaultExtension,
-            mime.category.rawValue
-        ) else {
-            return
-        }
-
-        if deliveryPlan.isPrivateMessage {
-            env.updatePeerLastSeen(peerID)
-        }
-
-        let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
-        let message = BitchatMessage(
-            sender: senderNickname,
-            content: "\(mime.category.messagePrefix)\(destination.lastPathComponent)",
-            timestamp: ts,
-            isRelay: false,
-            originalSender: nil,
-            isPrivate: deliveryPlan.isPrivateMessage,
-            recipientNickname: nil,
-            senderPeerID: peerID
-        )
-
-        SecureLogger.debug("📁 Stored incoming media from \(peerID.id.prefix(8))… -> \(destination.lastPathComponent)", category: .session)
-
-        env.deliverMessage(message)
-    }
-}

bitchat/Services/BLE/BLEFragmentHandler.swift

@@ -1,94 +0,0 @@
-import BitFoundation
-import BitLogger
-import Foundation
-
-/// Narrow environment for `BLEFragmentHandler`.
-///
-/// All queue hops (the message-queue entry hop and the collections barrier
-/// around the assembly buffer) live on the `BLEService` side — the entry hop
-/// in `BLEService.handleFragment`, the barrier inside the supplied closures —
-/// keeping the handler queue-agnostic and synchronously testable.
-struct BLEFragmentHandlerEnvironment {
-    /// Local peer identity at the time the fragment is handled.
-    let localPeerID: () -> PeerID
-    /// Tracks broadcast fragments for gossip sync.
-    let trackPacketSeen: (BitchatPacket) -> Void
-    /// Appends the fragment to the assembly buffer (collections barrier write).
-    let appendFragment: (BLEFragmentHeader) -> BLEFragmentAssemblyBuffer.AppendResult
-    /// Ingress acceptance check for the reassembled inner packet.
-    let isAcceptedIngressPayload: (_ packet: BitchatPacket, _ innerSender: PeerID) -> Bool
-    /// Re-enters the receive pipeline with the reassembled packet (TTL already zeroed).
-    let processReassembledPacket: (_ packet: BitchatPacket, _ from: PeerID) -> Void
-}
-
-/// Orchestrates inbound fragments: self-fragment suppression, gossip tracking,
-/// assembly-buffer appends, and reassembled-packet validation and re-injection
-/// into the receive pipeline.
-final class BLEFragmentHandler {
-    private let environment: BLEFragmentHandlerEnvironment
-
-    init(environment: BLEFragmentHandlerEnvironment) {
-        self.environment = environment
-    }
-
-    func handle(_ packet: BitchatPacket, from peerID: PeerID) {
-        let env = environment
-        // Don't process our own fragments
-        if peerID == env.localPeerID() {
-            return
-        }
-
-        guard let header = BLEFragmentHeader(packet: packet) else { return }
-
-        if header.isBroadcastFragment {
-            env.trackPacketSeen(packet)
-        }
-
-        let assemblyResult = env.appendFragment(header)
-
-        logFragmentAssemblyResult(assemblyResult)
-
-        guard case let .complete(completedHeader, reassembled, _) = assemblyResult else { return }
-
-        // Decode the original packet bytes we reassembled, so flags/compression are preserved
-        if var originalPacket = BinaryProtocol.decode(reassembled) {
-
-            // Reassembled packet validation
-            let innerSender = PeerID(hexData: originalPacket.senderID)
-            if !env.isAcceptedIngressPayload(originalPacket, innerSender) {
-                // Cleanup below
-            } else {
-                SecureLogger.debug("✅ Reassembled packet id=\(completedHeader.idLogString) type=\(originalPacket.type) bytes=\(reassembled.count)", category: .session)
-                originalPacket.ttl = 0
-                env.processReassembledPacket(originalPacket, peerID)
-            }
-        } else {
-            SecureLogger.error("❌ Failed to decode reassembled packet (type=\(completedHeader.originalType), total=\(completedHeader.total))", category: .session)
-        }
-    }
-
-    private func logFragmentAssemblyResult(_ result: BLEFragmentAssemblyBuffer.AppendResult) {
-        func logStartedIfNeeded(header: BLEFragmentHeader, started: Bool) {
-            if started {
-                SecureLogger.debug("📦 Started fragment assembly id=\(header.idLogString) total=\(header.total)", category: .session)
-            }
-        }
-
-        switch result {
-        case let .stored(header, started):
-            logStartedIfNeeded(header: header, started: started)
-            SecureLogger.debug("📦 Fragment \(header.index + 1)/\(header.total) (len=\(header.fragmentData.count)) for id=\(header.idLogString)", category: .session)
-
-        case let .complete(header, _, started):
-            logStartedIfNeeded(header: header, started: started)
-            SecureLogger.debug("📦 Fragment \(header.index + 1)/\(header.total) (len=\(header.fragmentData.count)) for id=\(header.idLogString)", category: .session)
-
-        case let .oversized(header, projectedSize, limit, started):
-            logStartedIfNeeded(header: header, started: started)
-            SecureLogger.warning(
-                "🚫 Fragment assembly exceeds size limit (\(projectedSize) bytes > \(limit)), evicting. Type=\(header.originalType) Index=\(header.index)/\(header.total)",
-                category: .security
-            )
-        }
-    }
-}

bitchat/Services/BLE/BLELinkStateStore.swift

@@ -26,69 +26,36 @@ struct BLESubscribedCentralSnapshot {
     }
 }
 
-/// Owns all BLE link state (peripheral connections we hold as central, and
-/// central subscriptions we serve as peripheral). The store has no internal
-/// locking: every access must happen on the single owning queue (the BLE
-/// queue). Other queues must go through BLEService's `readLinkState`, which
-/// hops to that queue. Call `assumeOwnership(of:)` to have debug builds trap
-/// any access from the wrong queue.
 final class BLELinkStateStore {
     private(set) var peripherals: [String: BLEPeripheralLinkState] = [:]
     private(set) var peerToPeripheralUUID: [PeerID: String] = [:]
     private(set) var subscribedCentrals: [CBCentral] = []
     private(set) var centralToPeerID: [String: PeerID] = [:]
 
-    #if DEBUG
-    private var ownerQueue: DispatchQueue?
-    #endif
-
-    /// Pin the store to its owning queue. Debug-only enforcement; release
-    /// builds are unchanged.
-    func assumeOwnership(of queue: DispatchQueue) {
-        #if DEBUG
-        ownerQueue = queue
-        #endif
-    }
-
-    @inline(__always)
-    private func assertOwned() {
-        #if DEBUG
-        if let queue = ownerQueue {
-            dispatchPrecondition(condition: .onQueue(queue))
-        }
-        #endif
-    }
-
     var peripheralStates: [BLEPeripheralLinkState] {
-        assertOwned()
-        return Array(peripherals.values)
+        Array(peripherals.values)
     }
 
     var subscribedCentralSnapshot: BLESubscribedCentralSnapshot {
-        assertOwned()
-        return BLESubscribedCentralSnapshot(
+        BLESubscribedCentralSnapshot(
             centrals: subscribedCentrals,
             peerIDsByCentralUUID: centralToPeerID
         )
     }
 
     var subscribedCentralCount: Int {
-        assertOwned()
-        return subscribedCentrals.count
+        subscribedCentrals.count
     }
 
     var connectedOrConnectingPeripheralCount: Int {
-        assertOwned()
-        return peripherals.values.filter { $0.isConnected || $0.isConnecting }.count
+        peripherals.values.filter { $0.isConnected || $0.isConnecting }.count
     }
 
     func state(forPeripheralID peripheralID: String) -> BLEPeripheralLinkState? {
-        assertOwned()
-        return peripherals[peripheralID]
+        peripherals[peripheralID]
     }
 
     func setPeripheralState(_ state: BLEPeripheralLinkState, for peripheralID: String) {
-        assertOwned()
         peripherals[peripheralID] = state
     }
 
@@ -97,7 +64,6 @@ final class BLELinkStateStore {
         _ peripheralID: String,
         _ update: (inout BLEPeripheralLinkState) -> Void
     ) -> BLEPeripheralLinkState? {
-        assertOwned()
         guard var state = peripherals[peripheralID] else { return nil }
         update(&state)
         peripherals[peripheralID] = state
@@ -147,12 +113,10 @@ final class BLELinkStateStore {
     }
 
     func directPeripheralState(for peerID: PeerID) -> BLEPeripheralLinkState? {
-        assertOwned()
-        return peerToPeripheralUUID[peerID].flatMap { peripherals[$0] }
+        peerToPeripheralUUID[peerID].flatMap { peripherals[$0] }
     }
 
     func directLinkState(for peerID: PeerID) -> BLEDirectLinkState {
-        assertOwned()
         let peripheralUUID = peerToPeripheralUUID[peerID]
         let hasPeripheral = peripheralUUID.flatMap { peripherals[$0]?.isConnected } ?? false
         let hasCentral = centralToPeerID.values.contains(peerID)
@@ -160,7 +124,6 @@ final class BLELinkStateStore {
     }
 
     func links(to peerID: PeerID?) -> Set<BLEIngressLinkID> {
-        assertOwned()
         guard let peerID else { return [] }
 
         var links: Set<BLEIngressLinkID> = []
@@ -174,42 +137,35 @@ final class BLELinkStateStore {
     }
 
     func peerID(forPeripheralID peripheralID: String) -> PeerID? {
-        assertOwned()
-        return peripherals[peripheralID]?.peerID
+        peripherals[peripheralID]?.peerID
     }
 
     func peerID(forCentralUUID centralUUID: String) -> PeerID? {
-        assertOwned()
-        return centralToPeerID[centralUUID]
+        centralToPeerID[centralUUID]
     }
 
     func addSubscribedCentral(_ central: CBCentral) {
-        assertOwned()
         guard !subscribedCentrals.contains(central) else { return }
         subscribedCentrals.append(central)
     }
 
     func removeSubscribedCentral(_ central: CBCentral) -> PeerID? {
-        assertOwned()
         let centralUUID = central.identifier.uuidString
         subscribedCentrals.removeAll { $0.identifier == central.identifier }
         return centralToPeerID.removeValue(forKey: centralUUID)
     }
 
     func bindCentral(_ centralUUID: String, to peerID: PeerID) {
-        assertOwned()
         centralToPeerID[centralUUID] = peerID
     }
 
     func bindPeripheral(_ peripheralUUID: String, to peerID: PeerID) {
-        assertOwned()
         if updatePeripheral(peripheralUUID, { $0.peerID = peerID }) != nil {
             peerToPeripheralUUID[peerID] = peripheralUUID
         }
     }
 
     func removePeripheral(_ peripheralID: String) -> PeerID? {
-        assertOwned()
         let peerID = peripherals.removeValue(forKey: peripheralID)?.peerID
         if let peerID {
             peerToPeripheralUUID.removeValue(forKey: peerID)
@@ -218,7 +174,6 @@ final class BLELinkStateStore {
     }
 
     func clearPeripherals() -> [PeerID] {
-        assertOwned()
         let peerIDs = peripherals.compactMap { $0.value.peerID }
         peripherals.removeAll()
         peerToPeripheralUUID.removeAll()
@@ -226,7 +181,6 @@ final class BLELinkStateStore {
     }
 
     func clearCentrals() -> [PeerID] {
-        assertOwned()
         let peerIDs = Array(centralToPeerID.values)
         subscribedCentrals.removeAll()
         centralToPeerID.removeAll()
@@ -234,7 +188,6 @@ final class BLELinkStateStore {
     }
 
     func clearAll() {
-        assertOwned()
         peripherals.removeAll()
         peerToPeripheralUUID.removeAll()
         subscribedCentrals.removeAll()

bitchat/Services/BLE/BLENoisePacketHandler.swift

@@ -1,132 +0,0 @@
-import BitFoundation
-import BitLogger
-import Foundation
-
-/// Narrow environment for `BLENoisePacketHandler`.
-///
-/// All queue hops (collections barrier writes, main-actor UI notification)
-/// and every `noiseService.*` crypto call live inside the closures supplied by
-/// `BLEService`, keeping the handler queue-agnostic and synchronously testable.
-struct BLENoisePacketHandlerEnvironment {
-    /// Local peer identity at the time the packet is handled.
-    let localPeerID: () -> PeerID
-    /// Local peer ID bytes used as the sender of handshake responses.
-    let localPeerIDData: () -> Data
-    /// TTL value used for direct (non-relayed) packets.
-    let messageTTL: UInt8
-    /// Current time source.
-    let now: () -> Date
-    /// Processes an inbound handshake message, returning an optional response payload (crypto).
-    let processHandshakeMessage: (_ peerID: PeerID, _ message: Data) throws -> Data?
-    /// Whether any Noise session (established or pending) exists for the peer (crypto).
-    let hasNoiseSession: (PeerID) -> Bool
-    /// Initiates a fresh Noise handshake with the peer (crypto + send).
-    let initiateHandshake: (PeerID) -> Void
-    /// Broadcasts a packet on the mesh (caller is already on the message queue).
-    let broadcastPacket: (BitchatPacket) -> Void
-    /// Updates the registry last-seen timestamp for the peer (async barrier write).
-    let updatePeerLastSeen: (PeerID) -> Void
-    /// Decrypts an encrypted payload from the peer (crypto).
-    let decrypt: (_ payload: Data, _ peerID: PeerID) throws -> Data
-    /// Clears the peer's Noise session after an unrecoverable decrypt failure (crypto).
-    let clearSession: (PeerID) -> Void
-    /// Delivers `.noisePayloadReceived` to the UI as one main-actor hop.
-    let deliverNoisePayload: (
-        _ peerID: PeerID,
-        _ type: NoisePayloadType,
-        _ payload: Data,
-        _ timestamp: Date
-    ) -> Void
-}
-
-/// Orchestrates the Noise session domain for inbound packets: handshake
-/// processing (with response), encrypted payload decryption and dispatch,
-/// and session recovery on decrypt failure.
-final class BLENoisePacketHandler {
-    private let environment: BLENoisePacketHandlerEnvironment
-
-    init(environment: BLENoisePacketHandlerEnvironment) {
-        self.environment = environment
-    }
-
-    func handleHandshake(_ packet: BitchatPacket, from peerID: PeerID) {
-        let env = environment
-        // Use NoiseEncryptionService for handshake processing
-        if PeerID(hexData: packet.recipientID) == env.localPeerID() {
-            // Handshake is for us
-            do {
-                if let response = try env.processHandshakeMessage(peerID, packet.payload) {
-                    // Send response
-                    let responsePacket = BitchatPacket(
-                        type: MessageType.noiseHandshake.rawValue,
-                        senderID: env.localPeerIDData(),
-                        recipientID: Data(hexString: peerID.id),
-                        timestamp: UInt64(env.now().timeIntervalSince1970 * 1000),
-                        payload: response,
-                        signature: nil,
-                        ttl: env.messageTTL
-                    )
-                    // We're on messageQueue from delegate callback
-                    env.broadcastPacket(responsePacket)
-                }
-
-                // Session establishment will trigger onPeerAuthenticated callback
-                // which will send any pending messages at the right time
-            } catch {
-                SecureLogger.error("Failed to process handshake: \(error)")
-                // Try initiating a new handshake
-                if !env.hasNoiseSession(peerID) {
-                    env.initiateHandshake(peerID)
-                }
-            }
-        }
-    }
-
-    func handleEncrypted(_ packet: BitchatPacket, from peerID: PeerID) {
-        let env = environment
-        guard let recipientID = PeerID(hexData: packet.recipientID) else {
-            SecureLogger.warning("⚠️ Encrypted message has no recipient ID", category: .session)
-            return
-        }
-
-        if recipientID != env.localPeerID() {
-            SecureLogger.debug("🔐 Encrypted message not for me (for \(recipientID.id.prefix(8))…, I am \(env.localPeerID().id.prefix(8))…)", category: .session)
-            return
-        }
-
-        // Update lastSeen for the peer we received from (important for private messages)
-        env.updatePeerLastSeen(peerID)
-
-        do {
-            let decrypted = try env.decrypt(packet.payload, peerID)
-            guard decrypted.count > 0 else { return }
-
-            // First byte indicates the payload type
-            let payloadType = decrypted[0]
-            let payloadData = decrypted.dropFirst()
-
-            guard let noisePayloadType = NoisePayloadType(rawValue: payloadType) else {
-                SecureLogger.warning("⚠️ Unknown noise payload type: \(payloadType)")
-                return
-            }
-
-            SecureLogger.debug("🔐 Decrypted noise payload type \(noisePayloadType.description) from \(peerID.id.prefix(8))…", category: .session)
-
-            let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
-            env.deliverNoisePayload(peerID, noisePayloadType, Data(payloadData), ts)
-        } catch NoiseEncryptionError.sessionNotEstablished {
-            // We received an encrypted message before establishing a session with this peer.
-            // Trigger a handshake so future messages can be decrypted.
-            SecureLogger.debug("🔑 Encrypted message from \(peerID.id.prefix(8))… without session; initiating handshake")
-            if !env.hasNoiseSession(peerID) {
-                env.initiateHandshake(peerID)
-            }
-        } catch {
-            // Decryption failed - clear the corrupted session and re-initiate handshake
-            // This handles cases where session state got out of sync (nonce mismatch, etc.)
-            SecureLogger.error("❌ Failed to decrypt message from \(peerID.id.prefix(8))…: \(error) - clearing session and re-initiating handshake")
-            env.clearSession(peerID)
-            env.initiateHandshake(peerID)
-        }
-    }
-}

bitchat/Services/BLE/BLEOutboundLinkPlanner.swift

@@ -18,8 +18,6 @@ enum BLEOutboundLinkPlanner {
         centralNotifyLimits: [Int],
         ingressRecord: BLEIngressLinkRecord?,
         excludedLinks: Set<BLEIngressLinkID>,
-        peripheralPeerBindings: [String: PeerID] = [:],
-        centralPeerBindings: [String: PeerID] = [:],
         directedOnlyPeer: PeerID?
     ) -> BLEOutboundLinkPlan {
         if let minLimit = minimumLinkLimit(
@@ -41,8 +39,6 @@ enum BLEOutboundLinkPlanner {
             centralIDs: centralIDs,
             ingressLink: ingressRecord?.link,
             excludedLinks: excludedLinks,
-            peripheralPeerBindings: peripheralPeerBindings,
-            centralPeerBindings: centralPeerBindings,
             directedPeerHint: directedPeerHint,
             packetType: packet.type,
             messageID: BLEOutboundPacketPolicy.messageID(for: packet)

bitchat/Services/BLE/BLEPeerRegistry.swift

@@ -150,14 +150,6 @@ struct BLEPeerRegistry {
         peers[peerID] = peer
     }
 
-    /// Applies a verified announce to the registry.
-    ///
-    /// TOFU signing-key pinning: once a signing key has been bound to this
-    /// peer entry, an announce carrying a *different* signing key is refused
-    /// (returns `nil`) and the existing record is left untouched. PeerIDs are
-    /// derived from the (public) noise key, so without pinning an attacker
-    /// could replay a victim's noiseKey/peerID with their own signing key and
-    /// silently take over the victim's mesh identity and nickname.
     mutating func upsertVerifiedAnnounce(
         peerID: PeerID,
         nickname: String,
@@ -165,15 +157,8 @@ struct BLEPeerRegistry {
         signingPublicKey: Data?,
         isConnected: Bool,
         now: Date
-    ) -> BLEPeerAnnounceUpdate? {
+    ) -> BLEPeerAnnounceUpdate {
         let existing = peers[peerID]
-
-        if let pinnedSigningKey = existing?.signingPublicKey,
-           let announcedSigningKey = signingPublicKey,
-           pinnedSigningKey != announcedSigningKey {
-            return nil
-        }
-
         let update = BLEPeerAnnounceUpdate(
             isNewPeer: existing == nil,
             wasDisconnected: existing?.isConnected == false,
@@ -185,8 +170,7 @@ struct BLEPeerRegistry {
             nickname: nickname,
             isConnected: isConnected,
             noisePublicKey: noisePublicKey,
-            // Never drop an already-pinned signing key.
-            signingPublicKey: signingPublicKey ?? existing?.signingPublicKey,
+            signingPublicKey: signingPublicKey,
             isVerifiedNickname: true,
             lastSeen: now
         )

bitchat/Services/BLE/BLEPublicMessageHandler.swift

@@ -1,131 +0,0 @@
-import BitFoundation
-import BitLogger
-import Foundation
-
-/// Narrow environment for `BLEPublicMessageHandler`.
-///
-/// All queue hops (collections registry reads, BLE-queue link-state reads,
-/// main-actor UI notification) live inside the closures supplied by
-/// `BLEService`, keeping the handler queue-agnostic and synchronously testable.
-struct BLEPublicMessageHandlerEnvironment {
-    /// Local peer identity at the time the message is handled.
-    let localPeerID: () -> PeerID
-    /// Local nickname used for sender resolution and collision checks.
-    let localNickname: () -> String
-    /// Current time source.
-    let now: () -> Date
-    /// Snapshot of known peers keyed by ID (registry read).
-    let peersSnapshot: () -> [PeerID: BLEPeerInfo]
-    /// Verifies a packet's signature against a known signing public key.
-    let verifyPacketSignature: (_ packet: BitchatPacket, _ signingPublicKey: Data) -> Bool
-    /// Resolves a display name from a verified packet signature for peers missing from the registry.
-    let signedSenderDisplayName: (_ packet: BitchatPacket, _ peerID: PeerID) -> String?
-    /// Tracks the broadcast message packet for gossip sync.
-    let trackPacketSeen: (BitchatPacket) -> Void
-    /// Direct link state for the peer (BLE-queue read).
-    let linkState: (PeerID) -> (hasPeripheral: Bool, hasCentral: Bool)
-    /// Resolves and consumes the original message ID for our own re-broadcast.
-    let takeSelfBroadcastMessageID: (BitchatPacket) -> String?
-    /// Delivers `.publicMessageReceived` to the UI as one main-actor hop.
-    let deliverPublicMessage: (
-        _ peerID: PeerID,
-        _ nickname: String,
-        _ content: String,
-        _ timestamp: Date,
-        _ messageID: String?
-    ) -> Void
-}
-
-/// Orchestrates inbound public (broadcast) messages: freshness/self-echo
-/// policy, sender display-name resolution, gossip tracking, payload decoding,
-/// and UI delivery.
-final class BLEPublicMessageHandler {
-    private let environment: BLEPublicMessageHandlerEnvironment
-
-    init(environment: BLEPublicMessageHandlerEnvironment) {
-        self.environment = environment
-    }
-
-    func handle(_ packet: BitchatPacket, from peerID: PeerID) {
-        let env = environment
-        let now = env.now()
-        let messageDecision = BLEPublicMessagePolicy.evaluate(
-            packet: packet,
-            from: peerID,
-            localPeerID: env.localPeerID(),
-            now: now
-        )
-
-        let messagePolicy: BLEPublicMessageAcceptance
-        switch messageDecision {
-        case .accept(let acceptance):
-            messagePolicy = acceptance
-        case .reject(.selfEcho):
-            return
-        case .reject(.staleBroadcast(let ageSeconds)):
-            SecureLogger.debug("⏰ Ignoring stale broadcast message from \(peerID.id.prefix(8))… (age: \(ageSeconds)s)", category: .session)
-            return
-        }
-
-        // Snapshot peers to avoid concurrent mutation while iterating during nickname collision checks.
-        let peersSnapshot = env.peersSnapshot()
-
-        // Public messages are always signed by their sender. `senderID` is
-        // attacker-controlled, so registry membership alone is NOT proof of
-        // identity — a peer in the registry as "verified" could be impersonated
-        // by anyone spoofing their senderID. Require a valid packet signature
-        // from the claimed sender (our own echoes are exempt; they are matched
-        // by self-broadcast tracking below).
-        //
-        // Verify against the signing key already in the (synchronously-updated)
-        // peer registry first: identity-cache persistence is asynchronous, so a
-        // message arriving right after a verified announce would otherwise be
-        // dropped because `signedSenderDisplayName` only searches the persisted
-        // cache. Fall back to that persisted-identity lookup for peers not (yet)
-        // in the registry.
-        let isSelf = peerID == env.localPeerID()
-        let registrySigningKey = peersSnapshot[peerID]?.signingPublicKey
-        let verifiedViaRegistry = !isSelf
-            && (registrySigningKey.map { env.verifyPacketSignature(packet, $0) } ?? false)
-        let signedDisplayName = (isSelf || verifiedViaRegistry) ? nil : env.signedSenderDisplayName(packet, peerID)
-        guard isSelf || verifiedViaRegistry || signedDisplayName != nil else {
-            SecureLogger.warning("🚫 Dropping public message with missing/invalid signature for claimed sender \(peerID.id.prefix(8))…", category: .security)
-            return
-        }
-
-        // Authenticity is established; prefer the registry's collision-resolved
-        // display name, then the signature-derived name.
-        guard let senderNickname = BLEPeerSenderDisplayName.resolveKnownPeer(
-            peerID: peerID,
-            localPeerID: env.localPeerID(),
-            localNickname: env.localNickname(),
-            peers: peersSnapshot,
-            allowConnectedUnverified: false
-        ) ?? signedDisplayName else {
-            SecureLogger.warning("🚫 Dropping public message from unknown peer \(peerID.id.prefix(8))…", category: .security)
-            return
-        }
-
-        if messagePolicy.shouldTrackForSync {
-            env.trackPacketSeen(packet)
-        }
-
-        guard let content = String(data: packet.payload, encoding: .utf8) else {
-            SecureLogger.error("❌ Failed to decode message payload as UTF-8", category: .session)
-            return
-        }
-        // Determine if we have a direct link to the sender
-        let directLink = env.linkState(peerID)
-        let hasDirectLink = directLink.hasPeripheral || directLink.hasCentral
-
-        let pathTag = hasDirectLink ? "direct" : "mesh"
-        SecureLogger.debug("💬 [\(senderNickname)] TTL:\(packet.ttl) (\(pathTag)) chars=\(content.count) bytes=\(packet.payload.count)", category: .session)
-
-        let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
-        var resolvedSelfMessageID: String? = nil
-        if peerID == env.localPeerID() {
-            resolvedSelfMessageID = env.takeSelfBroadcastMessageID(packet)
-        }
-        env.deliverPublicMessage(peerID, senderNickname, content, ts, resolvedSelfMessageID)
-    }
-}

bitchat/Services/BLE/BLEReceivePipeline.swift

@@ -12,13 +12,7 @@ struct BLEReceivedPacketContext: Equatable {
 struct BLEReceivePipeline {
     static func context(for packet: BitchatPacket, localPeerID: PeerID) -> BLEReceivedPacketContext {
         let senderID = PeerID(hexData: packet.senderID)
-        // Include a payload digest so that distinct packets sharing the same
-        // sender/timestamp(ms)/type are not collapsed as duplicates. The
-        // post-handshake flush sends queued messages, delivery and read receipts
-        // back-to-back within a single millisecond; without the digest every
-        // packet after the first would be silently dropped.
-        let digestPrefix = packet.payload.sha256Hash().prefix(4).hexEncodedString()
-        let messageID = "\(senderID)-\(packet.timestamp)-\(packet.type)-\(digestPrefix)"
+        let messageID = "\(senderID)-\(packet.timestamp)-\(packet.type)"
         let messageType = MessageType(rawValue: packet.type)
         let allowSelfSyncReplay = packet.ttl == 0 && senderID == localPeerID
         let shouldDeduplicate = messageType != .fragment && !allowSelfSyncReplay

bitchat/Services/CommandProcessor.swift

@@ -31,6 +31,7 @@ protocol CommandContextProvider: AnyObject {
     var activeChannel: ChannelID { get }
     var selectedPrivateChatPeer: PeerID? { get }
     var blockedUsers: Set<String> { get }
+    var privateChats: [PeerID: [BitchatMessage]] { get set }
     var idBridge: NostrIdentityBridge { get }
 
     // MARK: - Peer Lookup
@@ -42,8 +43,6 @@ protocol CommandContextProvider: AnyObject {
     func startPrivateChat(with peerID: PeerID)
     func sendPrivateMessage(_ content: String, to peerID: PeerID)
     func clearCurrentPublicTimeline()
-    /// Empties the peer's chat (single-writer store intent for `/clear`).
-    func clearPrivateChat(_ peerID: PeerID)
     func sendPublicRaw(_ content: String)
 
     // MARK: - System Messages
@@ -161,7 +160,7 @@ final class CommandProcessor {
     
     private func handleClear() -> CommandResult {
         if let peerID = contextProvider?.selectedPrivateChatPeer {
-            contextProvider?.clearPrivateChat(peerID)
+            contextProvider?.privateChats[peerID]?.removeAll()
         } else {
             contextProvider?.clearCurrentPublicTimeline()
         }

bitchat/Services/FavoritesPersistenceService.swift

@@ -34,23 +34,7 @@ final class FavoritesPersistenceService: ObservableObject {
     
     static let shared = FavoritesPersistenceService()
 
-    /// Default keychain for the `shared` singleton. Under test this is an
-    /// in-memory keychain so touching `shared` never blocks on securityd
-    /// (`SecItemCopyMatching` can hang in test environments) and never reads
-    /// or writes the developer's real keychain. Production behavior is
-    /// unchanged. Tests that need their own instance keep injecting a mock
-    /// via `init(keychain:)`.
-    private nonisolated static func makeDefaultKeychain() -> KeychainManagerProtocol {
-        // PreviewKeychainManager lives in _PreviewHelpers, a development
-        // asset excluded from archive builds — release code must not
-        // reference it. Tests always run Debug, so the guard is lossless.
-        #if DEBUG
-        if TestEnvironment.isRunningTests { return PreviewKeychainManager() }
-        #endif
-        return KeychainManager()
-    }
-
-    init(keychain: KeychainManagerProtocol = FavoritesPersistenceService.makeDefaultKeychain()) {
+    init(keychain: KeychainManagerProtocol = KeychainManager()) {
         self.keychain = keychain
         loadFavorites()
         

bitchat/Services/LocationNotesManager.swift

@@ -1,5 +1,4 @@
 import BitLogger
-import Combine
 import Foundation
 
 /// Dependencies for location notes, allowing tests to stub relay/identity behavior.
@@ -15,9 +14,7 @@ struct LocationNotesDependencies {
     var sendEvent: SendEvent
     var deriveIdentity: (_ geohash: String) throws -> NostrIdentity
     var now: () -> Date
-    // Fires when the geo relay directory refreshes; used to retry after "no relays".
-    var relayDirectoryUpdates: AnyPublisher<Void, Never> = Empty(completeImmediately: false).eraseToAnyPublisher()
-
+    
     private static let idBridge = NostrIdentityBridge()
 
     static let live = LocationNotesDependencies(
@@ -42,11 +39,7 @@ struct LocationNotesDependencies {
         deriveIdentity: { geohash in
             try idBridge.deriveIdentity(forGeohash: geohash)
         },
-        now: { Date() },
-        relayDirectoryUpdates: NotificationCenter.default
-            .publisher(for: .geoRelayDirectoryDidRefresh)
-            .map { _ in () }
-            .eraseToAnyPublisher()
+        now: { Date() }
     )
 }
 
@@ -84,7 +77,6 @@ final class LocationNotesManager: ObservableObject {
     @Published private(set) var errorMessage: String?
     private var subscriptionID: String?
     private var noteIDs = Set<String>() // O(1) duplicate detection
-    private var directoryUpdateCancellable: AnyCancellable?
     private let dependencies: LocationNotesDependencies
     private let maxNotesInMemory = 500 // Defensive cap (relay limit is 200)
 
@@ -109,15 +101,6 @@ final class LocationNotesManager: ObservableObject {
             SecureLogger.warning("LocationNotesManager: invalid geohash '\(norm)' (expected 8 valid base32 chars)", category: .session)
         }
         subscribe()
-        // The relay directory may load after init (remote fetch over Tor);
-        // retry automatically instead of staying stuck on "no relays".
-        directoryUpdateCancellable = dependencies.relayDirectoryUpdates
-            .sink { [weak self] in
-                Task { @MainActor [weak self] in
-                    guard let self, self.state == .noRelays else { return }
-                    self.subscribe()
-                }
-            }
     }
 
     func setGeohash(_ newGeohash: String) {

bitchat/Services/LocationStateManager.swift

@@ -594,22 +594,6 @@ final class LocationStateManager: NSObject, CLLocationManagerDelegate, Observabl
         }
     }
 
-    /// Removes all persisted location state and resets the in-memory view.
-    /// Used by the panic wipe — selected channel, teleport set and bookmarks
-    /// (which reveal where the user has been) must not survive on device.
-    func panicWipe() {
-        storage.removeObject(forKey: selectedChannelKey)
-        storage.removeObject(forKey: teleportedStoreKey)
-        storage.removeObject(forKey: bookmarksKey)
-        storage.removeObject(forKey: bookmarkNamesKey)
-        teleportedSet.removeAll()
-        bookmarkMembership.removeAll()
-        bookmarks = []
-        bookmarkNames = [:]
-        teleported = false
-        selectedChannel = .mesh
-    }
-
     private static func normalizeGeohash(_ s: String) -> String {
         let allowed = Set("0123456789bcdefghjkmnpqrstuvwxyz")
         return s

bitchat/Services/MessageRouter.swift

@@ -6,13 +6,6 @@ import Foundation
 @MainActor
 final class MessageRouter {
     private let transports: [Transport]
-    private let now: () -> Date
-
-    /// Invoked whenever a retained private message is dropped without a
-    /// delivery ack (attempt cap, TTL expiry, or per-peer overflow eviction)
-    /// so the UI can surface the failure instead of leaving the message in a
-    /// stale "sending/sent" state forever.
-    var onMessageDropped: ((_ messageID: String, _ peerID: PeerID) -> Void)?
 
     // Outbox entry with timestamp for TTL-based eviction
     private struct QueuedMessage {
@@ -20,7 +13,6 @@ final class MessageRouter {
         let nickname: String
         let messageID: String
         let timestamp: Date
-        var sendAttempts: Int = 0
     }
 
     private var outbox: [PeerID: [QueuedMessage]] = [:]
@@ -28,13 +20,9 @@ final class MessageRouter {
     // Outbox limits to prevent unbounded memory growth
     private static let maxMessagesPerPeer = 100
     private static let messageTTLSeconds: TimeInterval = 24 * 60 * 60 // 24 hours
-    // Bound resends of messages sent on a weak reachability signal that never
-    // get a delivery ack (e.g. peer on an old client that doesn't ack).
-    private static let maxSendAttempts = 8
 
-    init(transports: [Transport], now: @escaping () -> Date = Date.init) {
+    init(transports: [Transport]) {
         self.transports = transports
-        self.now = now
 
         // Observe favorites changes to learn Nostr mapping and flush queued messages
         NotificationCenter.default.addObserver(
@@ -73,54 +61,26 @@ final class MessageRouter {
     // MARK: - Message Sending
 
     func sendPrivate(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
-        if let transport = connectedTransport(for: peerID) {
-            // A live link is a strong delivery signal; trust it outright.
-            SecureLogger.debug("Routing PM via \(type(of: transport)) (connected) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-            transport.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
-            return
-        }
-
-        let message = QueuedMessage(content: content, nickname: recipientNickname, messageID: messageID, timestamp: now(), sendAttempts: 1)
         if let transport = reachableTransport(for: peerID) {
-            // Reachability without a connection is a freshness heuristic (e.g.
-            // the mesh retention window), so the send can silently go nowhere.
-            // Send now, but retain a copy until a delivery/read ack clears it;
-            // receivers dedup resends by message ID.
-            SecureLogger.debug("Routing PM via \(type(of: transport)) (reachable) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
+            SecureLogger.debug("Routing PM via \(type(of: transport)) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
             transport.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
-            enqueue(message, for: peerID)
         } else {
-            var unsent = message
-            unsent.sendAttempts = 0
-            enqueue(unsent, for: peerID)
+            // Queue for later with timestamp for TTL tracking
+            if outbox[peerID] == nil { outbox[peerID] = [] }
+
+            let message = QueuedMessage(content: content, nickname: recipientNickname, messageID: messageID, timestamp: Date())
+            outbox[peerID]?.append(message)
+
+            // Enforce per-peer size limit with FIFO eviction
+            if let count = outbox[peerID]?.count, count > Self.maxMessagesPerPeer {
+                let evicted = outbox[peerID]?.removeFirst()
+                SecureLogger.warning("📤 Outbox overflow for \(peerID.id.prefix(8))… - evicted oldest message: \(evicted?.messageID.prefix(8) ?? "?")…", category: .session)
+            }
+
             SecureLogger.debug("Queued PM for \(peerID.id.prefix(8))… (no reachable transport) id=\(messageID.prefix(8))… queue=\(outbox[peerID]?.count ?? 0)", category: .session)
         }
     }
 
-    /// A delivery or read ack confirms receipt; stop retaining the message.
-    func markDelivered(_ messageID: String) {
-        for (peerID, queue) in outbox {
-            let filtered = queue.filter { $0.messageID != messageID }
-            guard filtered.count != queue.count else { continue }
-            outbox[peerID] = filtered.isEmpty ? nil : filtered
-        }
-    }
-
-    private func enqueue(_ message: QueuedMessage, for peerID: PeerID) {
-        var queue = outbox[peerID] ?? []
-        // Re-sending an already-queued ID replaces the entry (keeps attempt count fresh)
-        queue.removeAll { $0.messageID == message.messageID }
-        queue.append(message)
-
-        // Enforce per-peer size limit with FIFO eviction
-        if queue.count > Self.maxMessagesPerPeer {
-            let evicted = queue.removeFirst()
-            SecureLogger.warning("📤 Outbox overflow for \(peerID.id.prefix(8))… - evicted oldest message: \(evicted.messageID.prefix(8))…", category: .session)
-            onMessageDropped?(evicted.messageID, peerID)
-        }
-        outbox[peerID] = queue
-    }
-
     func sendReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
         if let transport = reachableTransport(for: peerID) {
             SecureLogger.debug("Routing READ ack via \(type(of: transport)) to \(peerID.id.prefix(8))… id=\(receipt.originalMessageID.prefix(8))…", category: .session)
@@ -151,34 +111,19 @@ final class MessageRouter {
         guard let queued = outbox[peerID], !queued.isEmpty else { return }
         SecureLogger.debug("Flushing outbox for \(peerID.id.prefix(8))… count=\(queued.count)", category: .session)
 
-        let now = now()
+        let now = Date()
         var remaining: [QueuedMessage] = []
 
         for message in queued {
             // Skip expired messages (TTL exceeded)
             if now.timeIntervalSince(message.timestamp) > Self.messageTTLSeconds {
                 SecureLogger.debug("⏰ Expired queued message for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))… (age: \(Int(now.timeIntervalSince(message.timestamp)))s)", category: .session)
-                onMessageDropped?(message.messageID, peerID)
                 continue
             }
 
-            if let transport = connectedTransport(for: peerID) {
-                // Live link: send and stop retaining.
-                SecureLogger.debug("Outbox -> \(type(of: transport)) (connected) for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))…", category: .session)
+            if let transport = reachableTransport(for: peerID) {
+                SecureLogger.debug("Outbox -> \(type(of: transport)) for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))…", category: .session)
                 transport.sendPrivateMessage(message.content, to: peerID, recipientNickname: message.nickname, messageID: message.messageID)
-            } else if let transport = reachableTransport(for: peerID) {
-                // Weak signal: send but keep retaining until an ack clears it,
-                // bounded by attempt count for peers that never ack.
-                guard message.sendAttempts < Self.maxSendAttempts else {
-                    SecureLogger.warning("📤 Dropping unacked PM for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))… after \(message.sendAttempts) attempts", category: .session)
-                    onMessageDropped?(message.messageID, peerID)
-                    continue
-                }
-                SecureLogger.debug("Outbox -> \(type(of: transport)) (reachable) for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))…", category: .session)
-                transport.sendPrivateMessage(message.content, to: peerID, recipientNickname: message.nickname, messageID: message.messageID)
-                var retained = message
-                retained.sendAttempts += 1
-                remaining.append(retained)
             } else {
                 remaining.append(message)
             }
@@ -197,21 +142,12 @@ final class MessageRouter {
 
     /// Periodically clean up expired messages from all outboxes
     func cleanupExpiredMessages() {
-        let now = now()
+        let now = Date()
         for peerID in Array(outbox.keys) {
-            var expiredMessageIDs: [String] = []
-            outbox[peerID]?.removeAll { message in
-                guard now.timeIntervalSince(message.timestamp) > Self.messageTTLSeconds else { return false }
-                expiredMessageIDs.append(message.messageID)
-                return true
-            }
+            outbox[peerID]?.removeAll { now.timeIntervalSince($0.timestamp) > Self.messageTTLSeconds }
             if outbox[peerID]?.isEmpty == true {
                 outbox.removeValue(forKey: peerID)
             }
-            for messageID in expiredMessageIDs {
-                SecureLogger.debug("⏰ Expired queued message for \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-                onMessageDropped?(messageID, peerID)
-            }
         }
     }
 }

bitchat/Services/NetworkActivationService.swift

@@ -44,11 +44,7 @@ final class NetworkActivationService: ObservableObject {
     private let permissionProvider: () -> LocationChannelManager.PermissionState
     private let mutualFavoritesProvider: () -> Set<Data>
     private let torController: NetworkActivationTorControlling
-    // Resolved lazily: NostrRelayManager.init() reads NetworkActivationService.shared
-    // (via its live dependencies), so capturing NostrRelayManager.shared here would
-    // re-enter whichever singleton's dispatch_once started first and trap at launch.
-    private lazy var relayController: NetworkActivationRelayControlling = relayControllerProvider()
-    private let relayControllerProvider: () -> NetworkActivationRelayControlling
+    private let relayController: NetworkActivationRelayControlling
     private let proxyController: NetworkActivationProxyControlling
     private let notificationCenter: NotificationCenter
 
@@ -59,7 +55,7 @@ final class NetworkActivationService: ObservableObject {
         permissionProvider = { LocationChannelManager.shared.permissionState }
         mutualFavoritesProvider = { FavoritesPersistenceService.shared.mutualFavorites }
         torController = TorManager.shared
-        relayControllerProvider = { NostrRelayManager.shared }
+        relayController = NostrRelayManager.shared
         proxyController = TorURLSession.shared
         notificationCenter = .default
     }
@@ -81,7 +77,7 @@ final class NetworkActivationService: ObservableObject {
         self.permissionProvider = permissionProvider
         self.mutualFavoritesProvider = mutualFavoritesProvider
         self.torController = torController
-        self.relayControllerProvider = { relayController }
+        self.relayController = relayController
         self.proxyController = proxyController
         self.notificationCenter = notificationCenter
     }

bitchat/Services/NostrTransport.swift

@@ -142,9 +142,17 @@ final class NostrTransport: Transport, @unchecked Sendable {
     func getFingerprint(for peerID: PeerID) -> String? { nil }
     func getNoiseSessionState(for peerID: PeerID) -> LazyHandshakeState { .none }
     func triggerHandshake(with peerID: PeerID) { /* no-op */ }
-
-    // Nostr does not use Noise sessions here; the inert Transport defaults
-    // for the noise* identity hooks apply.
+    
+    // Nostr does not use Noise sessions here; return a cached placeholder to avoid reallocation
+    private static var cachedNoiseService: NoiseEncryptionService?
+    func getNoiseService() -> NoiseEncryptionService {
+        if let noiseService = Self.cachedNoiseService {
+            return noiseService
+        }
+        let noiseService = NoiseEncryptionService(keychain: keychain)
+        Self.cachedNoiseService = noiseService
+        return noiseService
+    }
 
     // Public broadcast not supported over Nostr here
     func sendMessage(_ content: String, mentions: [String]) { /* no-op */ }

bitchat/Services/PrivateChatManager.swift

@@ -8,25 +8,14 @@
 
 import BitLogger
 import BitFoundation
-import Combine
 import Foundation
 import SwiftUI
 
-/// Manages private chat session policy (selection, read receipts,
-/// consolidation). Message storage lives in the single-writer
-/// `ConversationStore` (docs/CONVERSATION-STORE-DESIGN.md); the
-/// `privateChats` / `unreadMessages` properties below are read-only views
-/// derived from it.
-@MainActor
+/// Manages all private chat functionality
 final class PrivateChatManager: ObservableObject {
-    /// Read-only mirror of `ConversationStore.selectedPrivatePeerID` — the
-    /// store is the sole owner of conversation selection. Kept `@Published`
-    /// so existing observers (`objectWillChange` forwarding into
-    /// `ChatViewModel`) keep firing on selection changes. Mutate via
-    /// `startChat(with:)` / `endChat()`, which route through the store's
-    /// `setSelectedPrivatePeer` intent.
-    @Published private(set) var selectedPeer: PeerID? = nil
-    private var selectedPeerMirrorCancellable: AnyCancellable? = nil
+    @Published var privateChats: [PeerID: [BitchatMessage]] = [:]
+    @Published var selectedPeer: PeerID? = nil
+    @Published var unreadMessages: Set<PeerID> = []
 
     private var selectedPeerFingerprint: String? = nil
     var sentReadReceipts: Set<String> = []  // Made accessible for ChatViewModel
@@ -36,51 +25,13 @@ final class PrivateChatManager: ObservableObject {
     weak var messageRouter: MessageRouter?
     // Peer service for looking up peer info during consolidation
     weak var unifiedPeerService: UnifiedPeerService?
-    /// Single source of truth for message and selection state; injected by
-    /// the bootstrapper (`wireServiceGraph`).
-    var conversationStore: ConversationStore? {
-        didSet { bindSelectionMirror() }
-    }
 
-    init(meshService: Transport? = nil, conversationStore: ConversationStore? = nil) {
+    init(meshService: Transport? = nil) {
         self.meshService = meshService
-        self.conversationStore = conversationStore
-        bindSelectionMirror() // didSet does not fire during init
     }
 
-    /// Keeps `selectedPeer` in lock-step with the store's selection axis
-    /// (including store-internal handoffs such as conversation migration).
-    private func bindSelectionMirror() {
-        guard let store = conversationStore else {
-            selectedPeerMirrorCancellable = nil
-            return
-        }
-        selectedPeerMirrorCancellable = store.$selectedPrivatePeerID
-            .sink { [weak self] peerID in
-                guard let self, self.selectedPeer != peerID else { return }
-                self.selectedPeer = peerID
-            }
-    }
-
-    // MARK: - Derived message state (read-only compat views)
-
-    /// All private chats keyed by routing peer ID, derived from the store.
-    /// Mutations go through the store's intent API only.
-    @MainActor
-    var privateChats: [PeerID: [BitchatMessage]] {
-        conversationStore?.directMessagesByRoutingPeerID() ?? [:]
-    }
-
-    /// Unread chats, derived from the store's unread state.
-    @MainActor
-    var unreadMessages: Set<PeerID> {
-        conversationStore?.unreadDirectRoutingPeerIDs() ?? []
-    }
-
-    @MainActor
-    private func messages(for peerID: PeerID) -> [BitchatMessage] {
-        conversationStore?.conversationsByID[.directPeer(peerID)]?.messages ?? []
-    }
+    // Cap for messages stored per private chat
+    private let privateChatCap = TransportConfig.privateChatCap
 
     // MARK: - Message Consolidation
 
@@ -93,51 +44,57 @@ final class PrivateChatManager: ObservableObject {
     /// - Returns: True if any unread messages were found during consolidation
     @MainActor
     func consolidateMessages(for peerID: PeerID, peerNickname: String, persistedReadReceipts: Set<String>) -> Bool {
-        guard let meshService = meshService, let store = conversationStore else { return false }
+        guard let meshService = meshService else { return false }
         var hasUnreadMessages = false
 
         // 1. Consolidate from stable Noise key (64-char hex)
         if let peer = unifiedPeerService?.getPeer(by: peerID) {
             let noiseKeyHex = PeerID(hexData: peer.noisePublicKey)
-            let nostrMessages = messages(for: noiseKeyHex)
 
-            if noiseKeyHex != peerID, !nostrMessages.isEmpty {
+            if noiseKeyHex != peerID, let nostrMessages = privateChats[noiseKeyHex], !nostrMessages.isEmpty {
+                if privateChats[peerID] == nil {
+                    privateChats[peerID] = []
+                }
+
+                let existingMessageIds = Set(privateChats[peerID]?.map { $0.id } ?? [])
                 for message in nostrMessages {
-                    // Update senderPeerID for correct read receipts
-                    let updatedMessage = BitchatMessage(
-                        id: message.id,
-                        sender: message.sender,
-                        content: message.content,
-                        timestamp: message.timestamp,
-                        isRelay: message.isRelay,
-                        originalSender: message.originalSender,
-                        isPrivate: message.isPrivate,
-                        recipientNickname: message.recipientNickname,
-                        senderPeerID: message.senderPeerID == meshService.myPeerID ? meshService.myPeerID : peerID,
-                        mentions: message.mentions,
-                        deliveryStatus: message.deliveryStatus
-                    )
-                    // Store append dedups by message ID (skips ones the
-                    // target chat already has).
-                    guard store.append(updatedMessage, to: .directPeer(peerID)) else { continue }
+                    if !existingMessageIds.contains(message.id) {
+                        // Update senderPeerID for correct read receipts
+                        let updatedMessage = BitchatMessage(
+                            id: message.id,
+                            sender: message.sender,
+                            content: message.content,
+                            timestamp: message.timestamp,
+                            isRelay: message.isRelay,
+                            originalSender: message.originalSender,
+                            isPrivate: message.isPrivate,
+                            recipientNickname: message.recipientNickname,
+                            senderPeerID: message.senderPeerID == meshService.myPeerID ? meshService.myPeerID : peerID,
+                            mentions: message.mentions,
+                            deliveryStatus: message.deliveryStatus
+                        )
+                        privateChats[peerID]?.append(updatedMessage)
 
-                    // Check for recent unread messages (< 60s, not sent by us, not already read)
-                    // Use persistedReadReceipts to correctly identify already-read messages after app restart
-                    if message.senderPeerID != meshService.myPeerID {
-                        let messageAge = Date().timeIntervalSince(message.timestamp)
-                        if messageAge < 60 && !persistedReadReceipts.contains(message.id) {
-                            hasUnreadMessages = true
+                        // Check for recent unread messages (< 60s, not sent by us, not already read)
+                        // Use persistedReadReceipts to correctly identify already-read messages after app restart
+                        if message.senderPeerID != meshService.myPeerID {
+                            let messageAge = Date().timeIntervalSince(message.timestamp)
+                            if messageAge < 60 && !persistedReadReceipts.contains(message.id) {
+                                hasUnreadMessages = true
+                            }
                         }
                     }
                 }
 
+                privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
+
                 if hasUnreadMessages {
-                    store.markUnread(.directPeer(peerID))
-                } else {
-                    store.markRead(.directPeer(noiseKeyHex))
+                    unreadMessages.insert(peerID)
+                } else if unreadMessages.contains(noiseKeyHex) {
+                    unreadMessages.remove(noiseKeyHex)
                 }
 
-                store.removeConversation(.directPeer(noiseKeyHex))
+                privateChats.removeValue(forKey: noiseKeyHex)
             }
         }
 
@@ -155,43 +112,52 @@ final class PrivateChatManager: ObservableObject {
         }
 
         if !tempPeerIDsToConsolidate.isEmpty {
+            if privateChats[peerID] == nil {
+                privateChats[peerID] = []
+            }
+
+            let existingMessageIds = Set(privateChats[peerID]?.map { $0.id } ?? [])
             var consolidatedCount = 0
             var hadUnreadTemp = false
-            let unreadPeerIDs = unreadMessages
 
             for tempPeerID in tempPeerIDsToConsolidate {
-                if unreadPeerIDs.contains(tempPeerID) {
+                if unreadMessages.contains(tempPeerID) {
                     hadUnreadTemp = true
                 }
 
-                for message in messages(for: tempPeerID) {
-                    let updatedMessage = BitchatMessage(
-                        id: message.id,
-                        sender: message.sender,
-                        content: message.content,
-                        timestamp: message.timestamp,
-                        isRelay: message.isRelay,
-                        originalSender: message.originalSender,
-                        isPrivate: message.isPrivate,
-                        recipientNickname: message.recipientNickname,
-                        senderPeerID: peerID,
-                        mentions: message.mentions,
-                        deliveryStatus: message.deliveryStatus
-                    )
-                    if store.append(updatedMessage, to: .directPeer(peerID)) {
-                        consolidatedCount += 1
+                if let tempMessages = privateChats[tempPeerID] {
+                    for message in tempMessages {
+                        if !existingMessageIds.contains(message.id) {
+                            let updatedMessage = BitchatMessage(
+                                id: message.id,
+                                sender: message.sender,
+                                content: message.content,
+                                timestamp: message.timestamp,
+                                isRelay: message.isRelay,
+                                originalSender: message.originalSender,
+                                isPrivate: message.isPrivate,
+                                recipientNickname: message.recipientNickname,
+                                senderPeerID: peerID,
+                                mentions: message.mentions,
+                                deliveryStatus: message.deliveryStatus
+                            )
+                            privateChats[peerID]?.append(updatedMessage)
+                            consolidatedCount += 1
+                        }
                     }
+                    privateChats.removeValue(forKey: tempPeerID)
+                    unreadMessages.remove(tempPeerID)
                 }
-                store.removeConversation(.directPeer(tempPeerID))
             }
 
             if hadUnreadTemp {
-                store.markUnread(.directPeer(peerID))
+                unreadMessages.insert(peerID)
                 hasUnreadMessages = true
                 SecureLogger.debug("📬 Transferred unread status from temp peer IDs to \(peerID)", category: .session)
             }
 
             if consolidatedCount > 0 {
+                privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
                 SecureLogger.info("📥 Consolidated \(consolidatedCount) Nostr messages from temporary peer IDs to \(peerNickname)", category: .session)
             }
         }
@@ -202,7 +168,9 @@ final class PrivateChatManager: ObservableObject {
     /// Syncs the read receipt tracking between manager and view model for sent messages
     @MainActor
     func syncReadReceiptsForSentMessages(peerID: PeerID, nickname: String, externalReceipts: inout Set<String>) {
-        for message in messages(for: peerID) {
+        guard let messages = privateChats[peerID] else { return }
+
+        for message in messages {
             if message.sender == nickname {
                 if let status = message.deliveryStatus {
                     switch status {
@@ -216,68 +184,86 @@ final class PrivateChatManager: ObservableObject {
             }
         }
     }
-
-    /// Start a private chat with a peer. Selection is mutated through the
-    /// store's intent (the store owns it); the manager keeps its side
-    /// effects (fingerprint tracking, read receipts, unread clearing).
-    @MainActor
+    
+    /// Start a private chat with a peer
     func startChat(with peerID: PeerID) {
-        // Also creates the conversation if needed and updates the derived
-        // `selectedConversationID`; `selectedPeer` mirrors the change.
-        conversationStore?.setSelectedPrivatePeer(peerID)
-
+        selectedPeer = peerID
+        
         // Store fingerprint for persistence across reconnections
         if let fingerprint = meshService?.getFingerprint(for: peerID) {
             selectedPeerFingerprint = fingerprint
         }
-
+        
         // Mark messages as read
         markAsRead(from: peerID)
+        
+        // Initialize chat if needed
+        if privateChats[peerID] == nil {
+            privateChats[peerID] = []
+        }
     }
-
-    /// End the current private chat (selection returns to the active public
-    /// channel's conversation).
+    
+    /// End the current private chat
     func endChat() {
-        conversationStore?.setSelectedPrivatePeer(nil)
+        selectedPeer = nil
         selectedPeerFingerprint = nil
     }
 
-    /// No-op since the `ConversationStore` cutover: the store maintains
-    /// chronological order and dedups by message ID on every insert, so the
-    /// per-append re-sort/dedup sweep this performed is no longer needed.
-    /// Kept only for API compatibility until step 5 removes the callers.
-    func sanitizeChat(for peerID: PeerID) {}
+    /// Remove duplicate messages by ID and keep chronological order
+    func sanitizeChat(for peerID: PeerID) {
+        guard let arr = privateChats[peerID] else { return }
+        if arr.count <= 1 {
+            return
+        }
 
+        var indexByID: [String: Int] = [:]
+        indexByID.reserveCapacity(arr.count)
+        var deduped: [BitchatMessage] = []
+        deduped.reserveCapacity(arr.count)
+
+        for msg in arr.sorted(by: { $0.timestamp < $1.timestamp }) {
+            if let existing = indexByID[msg.id] {
+                deduped[existing] = msg
+            } else {
+                indexByID[msg.id] = deduped.count
+                deduped.append(msg)
+            }
+        }
+
+        privateChats[peerID] = deduped
+    }
+    
     /// Mark messages from a peer as read
-    @MainActor
     func markAsRead(from peerID: PeerID) {
-        conversationStore?.markRead(.directPeer(peerID))
-
+        unreadMessages.remove(peerID)
+        
         // Send read receipts for unread messages that haven't been sent yet
-        for message in messages(for: peerID) {
-            if message.senderPeerID == peerID && !message.isRelay && !sentReadReceipts.contains(message.id) {
-                sendReadReceipt(for: message)
+        if let messages = privateChats[peerID] {
+            for message in messages {
+                if message.senderPeerID == peerID && !message.isRelay && !sentReadReceipts.contains(message.id) {
+                    sendReadReceipt(for: message)
+                }
             }
         }
     }
-
+    
     // MARK: - Private Methods
-
+    
     private func sendReadReceipt(for message: BitchatMessage) {
         guard !sentReadReceipts.contains(message.id),
               let senderPeerID = message.senderPeerID else {
             return
         }
-
+        
         sentReadReceipts.insert(message.id)
-
+        
         // Create read receipt using the simplified method
         let receipt = ReadReceipt(
             originalMessageID: message.id,
             readerID: meshService?.myPeerID ?? PeerID(str: ""),
             readerNickname: meshService?.myNickname ?? ""
         )
-
+        
         // Route via MessageRouter to avoid handshakeRequired spam when session isn't established
         if let router = messageRouter {
             SecureLogger.debug("PrivateChatManager: sending READ ack for \(message.id.prefix(8))… to \(senderPeerID.id.prefix(8))… via router", category: .session)

bitchat/Services/RelayController.swift

@@ -39,12 +39,7 @@ struct RelayController {
         }
 
         if isFragment {
-            // Dense graphs clamp harder to contain full-fanout fragment floods;
-            // sparse graphs get full depth so media reaches as far as text.
-            let fragmentCap = degree >= highDegreeThreshold
-                ? TransportConfig.bleFragmentRelayTtlCapDense
-                : TransportConfig.bleFragmentRelayTtlCap
-            let ttlLimit = min(ttlCap, fragmentCap)
+            let ttlLimit = min(ttlCap, TransportConfig.bleFragmentRelayTtlCap)
             guard ttlLimit > 1 else {
                 return RelayDecision(shouldRelay: false, newTTL: ttlLimit, delayMs: 0)
             }
@@ -55,16 +50,11 @@ struct RelayController {
 
         // TTL clamping for broadcast
         // - Dense graphs: keep lower but still allow multi-hop bridging
-        // - Thin chains (degree <= 2): every hop counts and flood cost is
-        //   minimal, so relay at full incoming depth
         // - Announces get a bit more headroom
         let ttlLimit: UInt8 = {
             if degree >= highDegreeThreshold {
                 return max(UInt8(2), min(ttlCap, UInt8(5)))
             }
-            if degree <= 2 {
-                return ttlCap
-            }
             let preferred = UInt8(isAnnounce ? 7 : 6)
             return max(UInt8(2), min(ttlCap, preferred))
         }()

bitchat/Services/TestEnvironment.swift

@@ -1,25 +0,0 @@
-//
-// TestEnvironment.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import Foundation
-
-/// Process-level test-environment detection for singletons that must swap a
-/// real OS-backed dependency (keychain, persistent defaults, notifications)
-/// for an in-memory one under test. Mirrors the detection already used by
-/// `NotificationService` and `LocationStateManager`.
-enum TestEnvironment {
-    /// True when running under XCTest / Swift Testing or in CI.
-    static let isRunningTests: Bool = {
-        let env = ProcessInfo.processInfo.environment
-        return NSClassFromString("XCTestCase") != nil ||
-               env["XCTestConfigurationFilePath"] != nil ||
-               env["XCTestBundlePath"] != nil ||
-               env["GITHUB_ACTIONS"] != nil ||
-               env["CI"] != nil
-    }()
-}

bitchat/Services/Transport.swift

@@ -61,27 +61,7 @@ protocol Transport: AnyObject {
     func getFingerprint(for peerID: PeerID) -> String?
     func getNoiseSessionState(for peerID: PeerID) -> LazyHandshakeState
     func triggerHandshake(with peerID: PeerID)
-
-    // Noise identity/session access. Narrow, purpose-named wrappers so the
-    // underlying NoiseEncryptionService (and its peer-binding/session
-    // orchestration) is never exposed outside the transport.
-    /// The remote static public key of the Noise session with `peerID`, if established.
-    func noiseSessionPublicKeyData(for peerID: PeerID) -> Data?
-    /// Fingerprint of our own Noise static identity key.
-    func noiseIdentityFingerprint() -> String
-    /// Our Noise static public key (Curve25519 key agreement).
-    func noiseStaticPublicKeyData() -> Data
-    /// Our Noise signing public key (Ed25519).
-    func noiseSigningPublicKeyData() -> Data
-    /// Signs `data` with our Noise signing key.
-    func noiseSignData(_ data: Data) -> Data?
-    /// Verifies an Ed25519 `signature` over `data` against `publicKey`.
-    func noiseVerifySignature(_ signature: Data, for data: Data, publicKey: Data) -> Bool
-    /// Registers session-lifecycle callbacks (peer authenticated / handshake required).
-    func installNoiseSessionCallbacks(
-        onPeerAuthenticated: @escaping (PeerID, String) -> Void,
-        onHandshakeRequired: @escaping (PeerID) -> Void
-    )
+    func getNoiseService() -> NoiseEncryptionService
 
     // Messaging
     func sendMessage(_ content: String, mentions: [String])
@@ -105,19 +85,6 @@ protocol Transport: AnyObject {
 }
 
 extension Transport {
-    // Noise identity hooks default to inert for transports that do not carry
-    // Noise sessions (e.g. NostrTransport).
-    func noiseSessionPublicKeyData(for peerID: PeerID) -> Data? { nil }
-    func noiseIdentityFingerprint() -> String { "" }
-    func noiseStaticPublicKeyData() -> Data { Data() }
-    func noiseSigningPublicKeyData() -> Data { Data() }
-    func noiseSignData(_ data: Data) -> Data? { nil }
-    func noiseVerifySignature(_ signature: Data, for data: Data, publicKey: Data) -> Bool { false }
-    func installNoiseSessionCallbacks(
-        onPeerAuthenticated: @escaping (PeerID, String) -> Void,
-        onHandshakeRequired: @escaping (PeerID) -> Void
-    ) {}
-
     func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {}
     func sendVerifyResponse(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {}
     func sendFileBroadcast(_ packet: BitchatFilePacket, transferId: String) {}

bitchat/Services/TransportConfig.swift

@@ -11,17 +11,13 @@ enum TransportConfig {
     static let bleMaxConcurrentTransfers: Int = 2           // Limit simultaneous large media sends
     static let bleFragmentRelayMinDelayMs: Int = 8          // Faster forwarding for media fragments
     static let bleFragmentRelayMaxDelayMs: Int = 25         // Upper jitter bound for fragment relays
-    // Fragment relay TTL in sparse graphs; matches messageTTLDefault so media
-    // reaches as far as text. Dense graphs clamp harder in RelayController.
-    static let bleFragmentRelayTtlCap: UInt8 = 7
-    static let bleFragmentRelayTtlCapDense: UInt8 = 5       // Contain fragment floods in dense graphs
+    static let bleFragmentRelayTtlCap: UInt8 = 5            // Clamp fragment TTL to contain floods
 
     // UI / Storage Caps
     static let privateChatCap: Int = 1337
     static let meshTimelineCap: Int = 1337
     static let geoTimelineCap: Int = 1337
     static let contentLRUCap: Int = 2000
-    static let geoSamplingEventLRUCap: Int = 2000
 
     // Timers
     static let networkResetGraceSeconds: TimeInterval = 600 // 10 minutes
@@ -44,27 +40,14 @@ enum TransportConfig {
     static let blePendingNotificationsCapCount: Int = 128
     static let bleNotificationRetryDelayMs: Int = 25
     static let bleNotificationRetryMaxAttempts: Int = 80
-    // Sample interval for notification backpressure logs (fire per fragment
-    // during media transfers).
-    static let bleBackpressureLogInterval: Int = 25
 
     // Nostr
     static let nostrReadAckInterval: TimeInterval = 0.35 // ~3 per second
-    static let nostrInboundEventDedupCap: Int = 4096
-    static let nostrInboundEventDedupTrimTarget: Int = 3072
-    static let nostrDuplicateEventLogInterval: Int = 50
-    // Sample interval for per-event debug logs on the inbound hot path.
-    static let nostrInboundEventLogInterval: Int = 100
-
-    // Conversation store diagnostics (field observability)
-    // Sample interval for the periodic store-audit "OK" heartbeat line
-    // (first + every Nth audit); violations always log at error level.
-    static let conversationStoreAuditLogInterval: Int = 10
-    // Sample interval for the mirrored-republish debug line in the ID-only
-    // delivery fan-out (first + every Nth republish).
-    static let conversationStoreMirroredRepublishLogInterval: Int = 25
 
     // UI thresholds
+    static let uiLateInsertThreshold: TimeInterval = 15.0
+    // Geohash public chats are more sensitive to ordering; use a tighter threshold
+    static let uiLateInsertThresholdGeo: TimeInterval = 0.0
     static let uiProcessedNostrEventsCap: Int = 2000
     static let uiChannelInactivityThresholdSeconds: TimeInterval = 9 * 60
     
@@ -73,6 +56,9 @@ enum TransportConfig {
     static let uiSenderRateBucketRefillPerSec: Double = 1.0
     static let uiContentRateBucketCapacity: Double = 3
     static let uiContentRateBucketRefillPerSec: Double = 0.5
+    static let uiSenderRateBucketMaxEntries: Int = 2000
+    static let uiContentRateBucketMaxEntries: Int = 2000
+    static let uiRateBucketIdleTTL: TimeInterval = 10 * 60
 
     // UI sleeps/delays
     static let uiStartupInitialDelaySeconds: TimeInterval = 1.0
@@ -93,21 +79,19 @@ enum TransportConfig {
     // BLE maintenance & thresholds
     static let bleMaintenanceInterval: TimeInterval = 5.0
     static let bleMaintenanceLeewaySeconds: Int = 1
-    static let bleIsolationRelaxThresholdSeconds: TimeInterval = 30
-    // Isolated nodes accept the weakest usable links — a fringe connection
-    // beats no connection. Relaxed floor sits at CoreBluetooth's practical
-    // reporting limit so prolonged isolation gates on nothing but decode.
-    static let bleRSSIIsolatedBase: Int = -95
-    static let bleRSSIIsolatedRelaxed: Int = -100
+    static let bleIsolationRelaxThresholdSeconds: TimeInterval = 60
+    static let bleRecentTimeoutWindowSeconds: TimeInterval = 60
+    static let bleRecentTimeoutCountThreshold: Int = 3
+    static let bleRSSIIsolatedBase: Int = -90
+    static let bleRSSIIsolatedRelaxed: Int = -92
     static let bleRSSIConnectedThreshold: Int = -85
+    static let bleRSSIHighTimeoutThreshold: Int = -80
     // How long without seeing traffic before we sanity-check the direct link
     // Lowered to make connected→reachable icon changes react faster when walking out of range
     static let blePeerInactivityTimeoutSeconds: TimeInterval = 8.0
-    // How long to retain a peer as "reachable" (not directly connected) since lastSeen.
-    // Must comfortably exceed the worst-case dense announce interval (38s) plus a
-    // missed cycle, so duty-cycled nodes don't forget peers between announces.
-    static let bleReachabilityRetentionVerifiedSeconds: TimeInterval = 60.0    // verified/favorites
-    static let bleReachabilityRetentionUnverifiedSeconds: TimeInterval = 45.0  // unknown/unverified
+    // How long to retain a peer as "reachable" (not directly connected) since lastSeen
+    static let bleReachabilityRetentionVerifiedSeconds: TimeInterval = 21.0    // 21s for verified/favorites
+    static let bleReachabilityRetentionUnverifiedSeconds: TimeInterval = 21.0  // 21s for unknown/unverified
     static let bleFragmentLifetimeSeconds: TimeInterval = 30.0
     static let bleIngressRecordLifetimeSeconds: TimeInterval = 3.0
     static let bleConnectTimeoutBackoffWindowSeconds: TimeInterval = 120.0
@@ -164,27 +148,7 @@ enum TransportConfig {
     static let nostrRelayMaxBackoffSeconds: TimeInterval = 300.0
     static let nostrRelayBackoffMultiplier: Double = 2.0
     static let nostrRelayMaxReconnectAttempts: Int = 10
-    // Reconnect delays get ±20% random jitter so relays that dropped together
-    // (e.g. a network blip) don't thundering-herd the same reconnect instant.
-    static let nostrRelayBackoffJitterRatio: Double = 0.2
     static let nostrRelayDefaultFetchLimit: Int = 100
-    // How many consecutive Tor-readiness waits (each bounded by TorManager's
-    // bootstrap deadline) to attempt before unblocking pending EOSE callers.
-    static let nostrTorReadyMaxWaitAttempts: Int = 3
-    static let nostrPendingSendQueueCap: Int = 200
-    // Sample interval for the send-queue overflow warning (first + every Nth
-    // dropped event). Drops are ephemeral presence/geo traffic — log-only.
-    static let nostrPendingSendDropLogInterval: Int = 10
-    // Pending (not-yet-flushed) REQs are bounded per relay: oldest-by-insertion
-    // eviction at the cap, plus an age sweep on connect attempts. Durable
-    // subscription intent survives in subscriptionRequestState either way.
-    static let nostrPendingSubscriptionsPerRelayCap: Int = 64
-    static let nostrPendingSubscriptionTTLSeconds: TimeInterval = 600.0
-    // Fallback deadline for treating a subscription's initial fetch as complete
-    // when a relay never sends EOSE (generous to cover Tor circuit setup).
-    static let nostrSubscriptionEOSEFallbackSeconds: TimeInterval = 10.0
-    // After this long, a relay marked permanently failed gets another chance.
-    static let nostrRelayFailureCooldownSeconds: TimeInterval = 600.0
 
     // Geo relay directory
     static let geoRelayFetchIntervalSeconds: TimeInterval = 60 * 60 * 24
@@ -208,10 +172,8 @@ enum TransportConfig {
     static let bleSubscriptionRateLimitWindowSeconds: TimeInterval = 60.0   // Window for tracking subscription attempts
     static let bleSubscriptionRateLimitMaxAttempts: Int = 5                 // Max attempts before extended cooldown
 
-    // Store-and-forward for directed packets at relays. Spooled packets retry
-    // on each maintenance flush until the window lapses; a longer window lets
-    // brief link gaps (walking between rooms, reconnect churn) heal themselves.
-    static let bleDirectedSpoolWindowSeconds: TimeInterval = 60.0
+    // Store-and-forward for directed packets at relays
+    static let bleDirectedSpoolWindowSeconds: TimeInterval = 15.0
 
     // Log/UI debounce windows
     // Shorter debounce so UI reacts faster while still suppressing duplicate callbacks
@@ -221,12 +183,6 @@ enum TransportConfig {
     // Weak-link cooldown after connection timeouts
     static let bleWeakLinkCooldownSeconds: TimeInterval = 30.0
     static let bleWeakLinkRSSICutoff: Int = -90
-    // Rediscovery ignore windows after a failed link, by failure kind:
-    // a connect attempt that timed out means the peer likely isn't reachable,
-    // so back off; a dropped established connection (walked out of range)
-    // usually returns, so only pause long enough for CoreBluetooth to settle.
-    static let bleTimeoutDiscoveryIgnoreSeconds: TimeInterval = 15.0
-    static let bleDisconnectDiscoveryIgnoreSeconds: TimeInterval = 3.0
 
     // Content hashing / formatting
     static let contentKeyPrefixLength: Int = 256

bitchat/Services/VerificationService.swift

@@ -4,11 +4,9 @@ import Foundation
 final class VerificationService {
     static let shared = VerificationService()
 
-    // Injected running transport (do NOT create new BLEService). Noise
-    // identity operations go through the transport's narrow noise* wrappers
-    // so the raw NoiseEncryptionService is never exposed.
-    private var transport: Transport?
-    func configure(with transport: Transport) { self.transport = transport }
+    // Injected Noise service from the running transport (do NOT create new BLEService)
+    private var noise: NoiseEncryptionService?
+    func configure(with noise: NoiseEncryptionService) { self.noise = noise }
 
     /// Encapsulates the data encoded into a verification QR
     struct VerificationQR: Codable {
@@ -79,16 +77,16 @@ final class VerificationService {
         if let c = Cache.last, c.nick == nickname, c.npub == npub, Date().timeIntervalSince(c.builtAt) < 60 {
             return c.value
         }
-        guard let transport = transport else { return nil }
-        let noiseKey = transport.noiseStaticPublicKeyData().hexEncodedString()
-        let signKey = transport.noiseSigningPublicKeyData().hexEncodedString()
+        guard let noise = noise else { return nil }
+        let noiseKey = noise.getStaticPublicKeyData().hexEncodedString()
+        let signKey = noise.getSigningPublicKeyData().hexEncodedString()
         let ts = Int64(Date().timeIntervalSince1970)
         var nonce = Data(count: 16)
         _ = nonce.withUnsafeMutableBytes { SecRandomCopyBytes(kSecRandomDefault, 16, $0.baseAddress!) }
         let nonceB64 = nonce.base64EncodedString().replacingOccurrences(of: "+", with: "-").replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "=", with: "")
         let payload = VerificationQR(v: 1, noiseKeyHex: noiseKey, signKeyHex: signKey, npub: npub, nickname: nickname, ts: ts, nonceB64: nonceB64, sigHex: "")
         let msg = payload.canonicalBytes()
-        guard let sig = transport.noiseSignData(msg) else { return nil }
+        guard let sig = noise.signData(msg) else { return nil }
         let signed = VerificationQR(v: payload.v,
                                     noiseKeyHex: payload.noiseKeyHex,
                                     signKeyHex: payload.signKeyHex,
@@ -110,8 +108,8 @@ final class VerificationService {
         if now - Double(qr.ts) > maxAge { return nil }
         // Verify signature using embedded ed25519 signKey
         guard let sig = Data(hexString: qr.sigHex), let signKey = Data(hexString: qr.signKeyHex) else { return nil }
-        guard let transport = transport else { return nil }
-        let ok = transport.noiseVerifySignature(sig, for: qr.canonicalBytes(), publicKey: signKey)
+        guard let noise = noise else { return nil }
+        let ok = noise.verifySignature(sig, for: qr.canonicalBytes(), publicKey: signKey)
         return ok ? qr : nil
     }
 
@@ -135,7 +133,7 @@ final class VerificationService {
         let nk = noiseKeyHex.data(using: .utf8) ?? Data()
         msg.append(UInt8(min(nk.count, 255))); msg.append(nk.prefix(255))
         msg.append(nonceA)
-        guard let transport = transport, let sig = transport.noiseSignData(msg) else { return nil }
+        guard let noise = noise, let sig = noise.signData(msg) else { return nil }
         var tlv = Data()
         tlv.append(0x01); tlv.append(UInt8(min(nk.count, 255))); tlv.append(nk.prefix(255))
         tlv.append(0x02); tlv.append(UInt8(min(nonceA.count, 255))); tlv.append(nonceA.prefix(255))
@@ -180,7 +178,7 @@ final class VerificationService {
         let nk = noiseKeyHex.data(using: .utf8) ?? Data()
         msg.append(UInt8(min(nk.count, 255))); msg.append(nk.prefix(255))
         msg.append(nonceA)
-        guard let transport = transport, let pub = Data(hexString: signerPublicKeyHex) else { return false }
-        return transport.noiseVerifySignature(signature, for: msg, publicKey: pub)
+        guard let noise = noise, let pub = Data(hexString: signerPublicKeyHex) else { return false }
+        return noise.verifySignature(signature, for: msg, publicKey: pub)
     }
 }

bitchat/Sync/GCSFilter.swift

@@ -12,11 +12,6 @@ import CryptoKit
 enum GCSFilter {
     struct Params { let p: Int; let m: UInt32; let data: Data }
 
-    // Highest Golomb-Rice parameter we accept from the wire. P maps to an FPR
-    // of ~1/2^P; beyond 32 the remainder width exceeds any practical filter
-    // and shifts in decode would silently overflow to garbage values.
-    static let maxP = 32
-
     // Derive P from FPR (~ 1 / 2^P)
     static func deriveP(targetFpr: Double) -> Int {
         let f = max(0.000001, min(0.25, targetFpr))
@@ -71,9 +66,6 @@ enum GCSFilter {
     }
 
     static func decodeToSortedSet(p: Int, m: UInt32, data: Data) -> [UInt64] {
-        // Reject out-of-range parameters rather than decoding garbage: callers
-        // treat the result as "peer has nothing" and fall back to sending data.
-        guard p >= 1, p <= maxP, m > 1 else { return [] }
         var values: [UInt64] = []
         let reader = BitReader(data)
         var acc: UInt64 = 0

bitchat/Utils/Theme.swift

@@ -1,339 +0,0 @@
-//
-// Theme.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import SwiftUI
-
-/// A user-selectable app-wide visual theme. Persisted by raw value.
-enum AppTheme: String, CaseIterable, Identifiable {
-    case matrix
-    case liquidGlass
-
-    var id: String { rawValue }
-
-    /// UserDefaults key backing the theme selection.
-    static let storageKey = "appTheme"
-
-    var displayNameKey: LocalizedStringKey {
-        switch self {
-        case .matrix: return "app_info.appearance.matrix"
-        case .liquidGlass: return "app_info.appearance.liquid_glass"
-        }
-    }
-
-    /// Font design used for themed text. Matrix keeps the terminal monospace;
-    /// liquid glass uses the system default.
-    var bodyFontDesign: Font.Design {
-        switch self {
-        case .matrix: return .monospaced
-        case .liquidGlass: return .default
-        }
-    }
-
-    /// Whether chrome surfaces (header/composer bars, input field) render as
-    /// translucent glass/material instead of the flat matrix background.
-    var usesGlassChrome: Bool {
-        self == .liquidGlass
-    }
-
-    /// Discriminator mixed into per-message formatting caches so cached
-    /// AttributedStrings from one theme are never served under another.
-    /// Empty for matrix to keep its historical cache keys.
-    var formatCacheVariant: String {
-        switch self {
-        case .matrix: return ""
-        case .liquidGlass: return "lg:"
-        }
-    }
-
-    /// Resolves the semantic color palette for this theme under the given color scheme.
-    func palette(for colorScheme: ColorScheme) -> ThemePalette {
-        switch self {
-        case .matrix:
-            return .matrix(colorScheme)
-        case .liquidGlass:
-            return .liquidGlass(colorScheme)
-        }
-    }
-}
-
-/// Semantic colors for the active theme, resolved against the current color scheme.
-/// Views should consume these via `@ThemedPalette` rather than computing colors inline.
-struct ThemePalette {
-    /// Primary window/sheet background.
-    let background: Color
-    /// Primary text color.
-    let primary: Color
-    /// De-emphasized text (timestamps, hints, captions).
-    let secondary: Color
-    /// Interactive tint (buttons, toggles, selection).
-    let accent: Color
-    /// Location/geohash channel accent (badges, counts, subtitles).
-    let locationAccent: Color
-    /// Informational accent (links, read receipts, teleport markers).
-    let accentBlue: Color
-    /// Destructive/error accent.
-    let alertRed: Color
-    /// Hairline separators.
-    let divider: Color
-
-    static func matrix(_ colorScheme: ColorScheme) -> ThemePalette {
-        let isDark = colorScheme == .dark
-        let green = isDark ? Color.green : Color(red: 0, green: 0.5, blue: 0)
-        return ThemePalette(
-            background: isDark ? Color.black : Color.white,
-            primary: green,
-            secondary: green.opacity(0.8),
-            accent: green,
-            locationAccent: green,
-            accentBlue: Color(red: 0.0, green: 0.478, blue: 1.0),
-            alertRed: Color(red: 0.75, green: 0.1, blue: 0.1),
-            divider: isDark ? Color.white.opacity(0.12) : Color.black.opacity(0.08)
-        )
-    }
-
-    static func liquidGlass(_ colorScheme: ColorScheme) -> ThemePalette {
-        ThemePalette(
-            background: systemBackground,
-            primary: .primary,
-            secondary: .secondary,
-            accent: .blue,
-            locationAccent: .green,
-            accentBlue: .blue,
-            alertRed: .red,
-            divider: separator
-        )
-    }
-
-    private static var systemBackground: Color {
-        #if os(iOS)
-        Color(UIColor.systemBackground)
-        #else
-        Color(NSColor.windowBackgroundColor)
-        #endif
-    }
-
-    private static var separator: Color {
-        #if os(iOS)
-        Color(UIColor.separator)
-        #else
-        Color(NSColor.separatorColor)
-        #endif
-    }
-}
-
-private struct AppThemeKey: EnvironmentKey {
-    static let defaultValue: AppTheme = .matrix
-}
-
-extension EnvironmentValues {
-    var appTheme: AppTheme {
-        get { self[AppThemeKey.self] }
-        set { self[AppThemeKey.self] = newValue }
-    }
-}
-
-/// Resolves the active theme's palette against the view's color scheme.
-///
-///     @ThemedPalette private var palette
-///     var body: some View { Text("hi").foregroundColor(palette.primary) }
-@propertyWrapper
-struct ThemedPalette: DynamicProperty {
-    @Environment(\.appTheme) private var theme
-    @Environment(\.colorScheme) private var colorScheme
-
-    var wrappedValue: ThemePalette { theme.palette(for: colorScheme) }
-}
-
-// MARK: - Themed view helpers
-
-/// Themed replacement for `.font(.bitchatSystem(size:weight:design: .monospaced))`:
-/// monospaced under matrix, system default under liquid glass.
-private struct ThemedFontModifier: ViewModifier {
-    @Environment(\.appTheme) private var theme
-    let size: CGFloat
-    let weight: Font.Weight
-
-    func body(content: Content) -> some View {
-        content.font(.bitchatSystem(size: size, weight: weight, design: theme.bodyFontDesign))
-    }
-}
-
-/// Root backdrop. Matrix gets its flat background; glass gets a subtle static
-/// gradient with a soft tinted glow — glass panels need visual texture behind
-/// them to refract, and collapse to flat gray over a solid color.
-struct ThemedRootBackground: View {
-    @Environment(\.appTheme) private var theme
-    @Environment(\.colorScheme) private var colorScheme
-    @ThemedPalette private var palette
-
-    var body: some View {
-        if theme.usesGlassChrome {
-            let isDark = colorScheme == .dark
-            ZStack {
-                LinearGradient(
-                    colors: isDark
-                        ? [Color(red: 0.09, green: 0.10, blue: 0.15), Color(red: 0.04, green: 0.04, blue: 0.07)]
-                        : [Color(red: 0.93, green: 0.95, blue: 1.0), Color(red: 0.98, green: 0.97, blue: 0.99)],
-                    startPoint: .top,
-                    endPoint: .bottom
-                )
-                RadialGradient(
-                    colors: [Color.blue.opacity(isDark ? 0.22 : 0.12), .clear],
-                    center: .topLeading,
-                    startRadius: 0,
-                    endRadius: 600
-                )
-                RadialGradient(
-                    colors: [Color.purple.opacity(isDark ? 0.14 : 0.08), .clear],
-                    center: .bottomTrailing,
-                    startRadius: 0,
-                    endRadius: 500
-                )
-            }
-            .ignoresSafeArea()
-        } else {
-            palette.background
-        }
-    }
-}
-
-/// Wraps glass-shape content in real Liquid Glass on OS 26+, with a material
-/// fallback below that keeps the frosted look.
-private struct GlassPanel<S: Shape>: ViewModifier {
-    let shape: S
-
-    @ViewBuilder
-    func body(content: Content) -> some View {
-        #if compiler(>=6.2)
-        if #available(iOS 26.0, macOS 26.0, *) {
-            content.glassEffect(.regular, in: shape)
-        } else {
-            materialFallback(content)
-        }
-        #else
-        materialFallback(content)
-        #endif
-    }
-
-    private func materialFallback(_ content: Content) -> some View {
-        content
-            .background(shape.fill(.ultraThinMaterial))
-            .overlay(shape.stroke(Color.white.opacity(0.15), lineWidth: 0.5))
-    }
-}
-
-/// Chrome surface for the header and composer. Matrix keeps the original flat
-/// edge-to-edge wash; glass floats the content as an inset Liquid Glass panel
-/// (content is expected to scroll underneath via safe-area insets).
-private struct ThemedChromePanelModifier: ViewModifier {
-    @Environment(\.appTheme) private var theme
-    @ThemedPalette private var palette
-    let edge: VerticalEdge
-
-    @ViewBuilder
-    func body(content: Content) -> some View {
-        if theme.usesGlassChrome {
-            content
-                .modifier(GlassPanel(shape: RoundedRectangle(cornerRadius: 18, style: .continuous)))
-                .padding(.horizontal, 8)
-                .padding(edge == .top ? .top : .bottom, 4)
-        } else {
-            content.background(palette.background.opacity(0.95))
-        }
-    }
-}
-
-/// Background for the composer input field. Matrix keeps its translucent fill;
-/// glass leaves it clear — the field sits inside the composer's glass panel,
-/// and glass cannot sample other glass.
-private struct ThemedInputBackgroundModifier: ViewModifier {
-    @Environment(\.appTheme) private var theme
-    @Environment(\.colorScheme) private var colorScheme
-
-    private var shape: RoundedRectangle {
-        RoundedRectangle(cornerRadius: 14, style: .continuous)
-    }
-
-    @ViewBuilder
-    func body(content: Content) -> some View {
-        if theme.usesGlassChrome {
-            content
-        } else {
-            content.background(
-                shape.fill(colorScheme == .dark ? Color.black.opacity(0.35) : Color.white.opacity(0.7))
-            )
-        }
-    }
-}
-
-extension View {
-    func bitchatFont(size: CGFloat, weight: Font.Weight = .regular) -> some View {
-        modifier(ThemedFontModifier(size: size, weight: weight))
-    }
-
-    func themedChromePanel(edge: VerticalEdge) -> some View {
-        modifier(ThemedChromePanelModifier(edge: edge))
-    }
-
-    func themedInputBackground() -> some View {
-        modifier(ThemedInputBackgroundModifier())
-    }
-
-    /// Floating surface for popover-style boxes (autocomplete, command
-    /// suggestions): glass panel under liquid glass, the original flat
-    /// background + hairline stroke under matrix.
-    func themedOverlayPanel() -> some View {
-        modifier(ThemedOverlayPanelModifier())
-    }
-
-    /// Root background for sheets — same backdrop as the main window so every
-    /// surface speaks one visual language.
-    func themedSheetBackground() -> some View {
-        background(ThemedRootBackground())
-    }
-
-    /// Flat background wash for bars/headers inside sheets. Matrix keeps its
-    /// opaque wash; glass goes transparent so the backdrop gradient shows.
-    func themedSurface(opacity: Double = 1.0) -> some View {
-        modifier(ThemedSurfaceModifier(opacity: opacity))
-    }
-}
-
-private struct ThemedSurfaceModifier: ViewModifier {
-    @Environment(\.appTheme) private var theme
-    @ThemedPalette private var palette
-    let opacity: Double
-
-    @ViewBuilder
-    func body(content: Content) -> some View {
-        if theme.usesGlassChrome {
-            content
-        } else {
-            content.background(palette.background.opacity(opacity))
-        }
-    }
-}
-
-private struct ThemedOverlayPanelModifier: ViewModifier {
-    @Environment(\.appTheme) private var theme
-    @ThemedPalette private var palette
-
-    @ViewBuilder
-    func body(content: Content) -> some View {
-        if theme.usesGlassChrome {
-            content.modifier(GlassPanel(shape: RoundedRectangle(cornerRadius: 12, style: .continuous)))
-        } else {
-            content
-                .background(palette.background)
-                .overlay(
-                    RoundedRectangle(cornerRadius: 4)
-                        .stroke(palette.secondary.opacity(0.3), lineWidth: 1)
-                )
-        }
-    }
-}

bitchat/ViewModels/ChatComposerCoordinator.swift

@@ -1,105 +1,44 @@
 import BitFoundation
 import Foundation
 
-/// The narrow surface `ChatComposerCoordinator` needs from its owner.
-///
-/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
-/// minimal context it actually uses instead of holding an `unowned` back-ref
-/// to the whole `ChatViewModel`. This keeps the coordinator independently
-/// testable (see `ChatComposerCoordinatorContextTests`) and makes its true
-/// dependencies explicit.
-@MainActor
-protocol ChatComposerContext: AnyObject {
-    // MARK: Autocomplete UI state
-    var autocompleteSuggestions: [String] { get set }
-    var autocompleteRange: NSRange? { get set }
-    var showAutocomplete: Bool { get set }
-    var selectedAutocompleteIndex: Int { get set }
-    /// Computes mention suggestions for the text up to the cursor.
-    func autocompleteQuery(
-        for text: String,
-        peers: [String],
-        cursorPosition: Int
-    ) -> (suggestions: [String], range: NSRange?)
-    /// Replaces the matched range in `text` with the chosen suggestion.
-    func applyAutocompleteSuggestion(_ suggestion: String, to text: String, range: NSRange) -> String
-
-    // MARK: Identity & channel state
-    var nickname: String { get }
-    var myPeerID: PeerID { get }
-    var activeChannel: ChannelID { get }
-    /// The transport's own nickname (excluded from autocomplete candidates).
-    var meshNickname: String { get }
-    func meshPeerNicknames() -> [PeerID: String]
-
-    // MARK: Geohash identity (shared with the other contexts)
-    var geoNicknames: [String: String] { get }
-    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
-}
-
-extension ChatViewModel: ChatComposerContext {
-    // `autocompleteSuggestions`, `autocompleteRange`, `showAutocomplete`,
-    // `selectedAutocompleteIndex`, `nickname`, `myPeerID`, `activeChannel`,
-    // `geoNicknames`, `meshPeerNicknames()`, and
-    // `deriveNostrIdentity(forGeohash:)` are shared requirements with the
-    // other contexts or satisfied by existing `ChatViewModel` members. The
-    // members below flatten nested service accesses into intent-named calls.
-
-    func autocompleteQuery(
-        for text: String,
-        peers: [String],
-        cursorPosition: Int
-    ) -> (suggestions: [String], range: NSRange?) {
-        autocompleteService.getSuggestions(for: text, peers: peers, cursorPosition: cursorPosition)
-    }
-
-    func applyAutocompleteSuggestion(_ suggestion: String, to text: String, range: NSRange) -> String {
-        autocompleteService.applySuggestion(suggestion, to: text, range: range)
-    }
-
-    var meshNickname: String {
-        meshService.myNickname
-    }
-}
-
 @MainActor
 final class ChatComposerCoordinator {
-    private unowned let context: any ChatComposerContext
+    private unowned let viewModel: ChatViewModel
 
-    init(context: any ChatComposerContext) {
-        self.context = context
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
     }
 
     func updateAutocomplete(for text: String, cursorPosition: Int) {
         let peerCandidates = autocompleteCandidates()
-        let (suggestions, range) = context.autocompleteQuery(
+        let (suggestions, range) = viewModel.autocompleteService.getSuggestions(
             for: text,
             peers: peerCandidates,
             cursorPosition: cursorPosition
         )
 
         if !suggestions.isEmpty {
-            context.autocompleteSuggestions = suggestions
-            context.autocompleteRange = range
-            context.showAutocomplete = true
-            context.selectedAutocompleteIndex = 0
+            viewModel.autocompleteSuggestions = suggestions
+            viewModel.autocompleteRange = range
+            viewModel.showAutocomplete = true
+            viewModel.selectedAutocompleteIndex = 0
         } else {
-            context.autocompleteSuggestions = []
-            context.autocompleteRange = nil
-            context.showAutocomplete = false
-            context.selectedAutocompleteIndex = 0
+            viewModel.autocompleteSuggestions = []
+            viewModel.autocompleteRange = nil
+            viewModel.showAutocomplete = false
+            viewModel.selectedAutocompleteIndex = 0
         }
     }
 
     func completeNickname(_ nickname: String, in text: inout String) -> Int {
-        guard let range = context.autocompleteRange else { return text.count }
+        guard let range = viewModel.autocompleteRange else { return text.count }
 
-        text = context.applyAutocompleteSuggestion(nickname, to: text, range: range)
+        text = viewModel.autocompleteService.applySuggestion(nickname, to: text, range: range)
 
-        context.showAutocomplete = false
-        context.autocompleteSuggestions = []
-        context.autocompleteRange = nil
-        context.selectedAutocompleteIndex = 0
+        viewModel.showAutocomplete = false
+        viewModel.autocompleteSuggestions = []
+        viewModel.autocompleteRange = nil
+        viewModel.selectedAutocompleteIndex = 0
 
         return range.location + nickname.count + (nickname.hasPrefix("@") ? 1 : 2)
     }
@@ -113,10 +52,10 @@ final class ChatComposerCoordinator {
             range: NSRange(location: 0, length: nsContent.length)
         )
 
-        let peerNicknames = context.meshPeerNicknames()
+        let peerNicknames = viewModel.meshService.getPeerNicknames()
         var validTokens = Set(peerNicknames.values)
-        validTokens.insert(context.nickname)
-        validTokens.insert(context.nickname + "#" + String(context.myPeerID.id.prefix(4)))
+        validTokens.insert(viewModel.nickname)
+        validTokens.insert(viewModel.nickname + "#" + String(viewModel.meshService.myPeerID.id.prefix(4)))
 
         var mentions: [String] = []
         for match in matches {
@@ -133,18 +72,18 @@ final class ChatComposerCoordinator {
 
 private extension ChatComposerCoordinator {
     func autocompleteCandidates() -> [String] {
-        switch context.activeChannel {
+        switch viewModel.activeChannel {
         case .mesh:
-            let values = context.meshPeerNicknames().values
-            return Array(values.filter { $0 != context.meshNickname })
+            let values = viewModel.meshService.getPeerNicknames().values
+            return Array(values.filter { $0 != viewModel.meshService.myNickname })
 
         case .location(let channel):
             var tokens = Set<String>()
-            for (pubkey, nick) in context.geoNicknames {
+            for (pubkey, nick) in viewModel.geoNicknames {
                 tokens.insert("\(nick)#\(pubkey.suffix(4))")
             }
-            if let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
-                let myToken = context.nickname + "#" + String(identity.publicKeyHex.suffix(4))
+            if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+                let myToken = viewModel.nickname + "#" + String(identity.publicKeyHex.suffix(4))
                 tokens.remove(myToken)
             }
             return Array(tokens)

bitchat/ViewModels/ChatDeliveryCoordinator.swift

@@ -2,80 +2,29 @@ import BitFoundation
 import BitLogger
 import Foundation
 
-/// The narrow surface `ChatDeliveryCoordinator` needs from its owner.
-///
-/// Coordinators should depend on the minimal context they actually use rather
-/// than holding an `unowned` back-reference to the whole `ChatViewModel`. This
-/// keeps the coordinator independently testable (see
-/// `ChatDeliveryCoordinatorContextTests`) and makes its true dependencies
-/// explicit. This protocol is the exemplar for migrating the other
-/// coordinators off their `unowned let viewModel: ChatViewModel` back-refs.
-@MainActor
-protocol ChatDeliveryContext: AnyObject {
-    var isStartupPhase: Bool { get }
-    /// Applies a delivery status to every copy of the message across
-    /// conversations (`ConversationStore` intent, ID-only: the store's
-    /// message-ID → conversation map resolves which conversations hold the
-    /// message, including mirrored ephemeral/stable private copies). The
-    /// no-downgrade rule is enforced in the store. Returns `false` when the
-    /// message is unknown or no copy changed.
-    @discardableResult
-    func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool
-    /// Current delivery status of the message in whichever conversation holds it.
-    func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus?
-    /// Message IDs across all direct conversations (read-receipt pruning).
-    func privateMessageIDs() -> Set<String>
-    /// Drops every recorded read receipt whose message ID is not in `validMessageIDs`.
-    /// Returns the number of receipts removed. (Single mutation path for the
-    /// owner's `sentReadReceipts`; this coordinator never reads the raw set.)
-    func pruneSentReadReceipts(keeping validMessageIDs: Set<String>) -> Int
-    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
-    func notifyUIChanged()
-    /// Confirms receipt so the message router stops retaining the message for resend.
-    func markMessageDelivered(_ messageID: String)
-}
-
-extension ChatViewModel: ChatDeliveryContext {
-    @discardableResult
-    func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool {
-        conversations.setDeliveryStatus(status, forMessageID: messageID)
-    }
-
-    func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus? {
-        conversations.deliveryStatus(forMessageID: messageID)
-    }
-
-    func privateMessageIDs() -> Set<String> {
-        conversations.directMessageIDs()
-    }
-
-    func notifyUIChanged() {
-        objectWillChange.send()
-    }
-
-    func markMessageDelivered(_ messageID: String) {
-        messageRouter.markDelivered(messageID)
-    }
-}
-
-/// Thin mapper from delivery events (read receipts, transport delivery
-/// callbacks) onto `ConversationStore` delivery intents, plus read-receipt
-/// retention cleanup. The store's message-ID → conversation map replaces the
-/// positional `messageLocationIndex` this coordinator used to maintain.
 final class ChatDeliveryCoordinator {
-    private unowned let context: any ChatDeliveryContext
+    private unowned let viewModel: ChatViewModel
 
-    init(context: any ChatDeliveryContext) {
-        self.context = context
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
     }
 
     @MainActor
     func cleanupOldReadReceipts() {
-        guard !context.isStartupPhase else { return }
-        let validMessageIDs = context.privateMessageIDs()
-        guard !validMessageIDs.isEmpty else { return }
+        guard !viewModel.isStartupPhase, !viewModel.privateChats.isEmpty else {
+            return
+        }
 
-        let removedCount = context.pruneSentReadReceipts(keeping: validMessageIDs)
+        let validMessageIDs = Set(
+            viewModel.privateChats.values.flatMap { messages in
+                messages.map(\.id)
+            }
+        )
+
+        let oldCount = viewModel.sentReadReceipts.count
+        viewModel.sentReadReceipts = viewModel.sentReadReceipts.intersection(validMessageIDs)
+
+        let removedCount = oldCount - viewModel.sentReadReceipts.count
         if removedCount > 0 {
             SecureLogger.debug("🧹 Cleaned up \(removedCount) old read receipts", category: .session)
         }
@@ -96,24 +45,63 @@ final class ChatDeliveryCoordinator {
 
     @MainActor
     func deliveryStatus(for messageID: String) -> DeliveryStatus? {
-        context.deliveryStatus(forMessageID: messageID)
+        if let message = viewModel.messages.first(where: { $0.id == messageID }) {
+            return message.deliveryStatus
+        }
+
+        for messages in viewModel.privateChats.values {
+            if let message = messages.first(where: { $0.id == messageID }) {
+                return message.deliveryStatus
+            }
+        }
+
+        return nil
     }
 
     @MainActor
     @discardableResult
     func updateMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool {
-        switch status {
-        case .delivered, .read:
-            // Confirmed receipt — stop retaining the message for resend.
-            context.markMessageDelivered(messageID)
-        default:
-            break
+        var didUpdateStatus = false
+
+        if let index = viewModel.messages.firstIndex(where: { $0.id == messageID }) {
+            let currentStatus = viewModel.messages[index].deliveryStatus
+            if !shouldSkipUpdate(currentStatus: currentStatus, newStatus: status) {
+                viewModel.messages[index].deliveryStatus = status
+                didUpdateStatus = true
+            }
         }
 
-        guard context.setDeliveryStatus(status, forMessageID: messageID) else {
+        var privateChats = viewModel.privateChats
+        for (peerID, chatMessages) in privateChats {
+            guard let index = chatMessages.firstIndex(where: { $0.id == messageID }) else { continue }
+
+            let currentStatus = chatMessages[index].deliveryStatus
+            guard !shouldSkipUpdate(currentStatus: currentStatus, newStatus: status) else { continue }
+
+            let updatedMessages = chatMessages
+            updatedMessages[index].deliveryStatus = status
+            privateChats[peerID] = updatedMessages
+            didUpdateStatus = true
+        }
+
+        if didUpdateStatus {
+            viewModel.privateChats = privateChats
+            viewModel.objectWillChange.send()
+        }
+
+        return didUpdateStatus
+    }
+}
+
+private extension ChatDeliveryCoordinator {
+    func shouldSkipUpdate(currentStatus: DeliveryStatus?, newStatus: DeliveryStatus) -> Bool {
+        guard let currentStatus else { return false }
+
+        switch (currentStatus, newStatus) {
+        case (.read, .delivered), (.read, .sent):
+            return true
+        default:
             return false
         }
-        context.notifyUIChanged()
-        return true
     }
 }

bitchat/ViewModels/ChatLifecycleCoordinator.swift

@@ -2,149 +2,36 @@ import BitFoundation
 import BitLogger
 import Foundation
 
-/// The narrow surface `ChatLifecycleCoordinator` needs from its owner.
-///
-/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
-/// minimal context it actually uses instead of holding an `unowned` back-ref
-/// to the whole `ChatViewModel`. This keeps the coordinator independently
-/// testable (see `ChatLifecycleCoordinatorContextTests`) and makes its true
-/// dependencies explicit.
 @MainActor
-protocol ChatLifecycleContext: AnyObject {
-    // MARK: Chat & receipt state
-    var messages: [BitchatMessage] { get }
-    /// A single private chat's timeline (store-direct lookup on
-    /// `ChatViewModel`; no `privateChats` dictionary build).
-    func privateMessages(for peerID: PeerID) -> [BitchatMessage]
-    var unreadPrivateMessages: Set<PeerID> { get }
-    var selectedPrivateChatPeer: PeerID? { get }
-    /// Appends a private message via the single-writer store intent.
-    @discardableResult
-    func appendPrivateMessage(_ message: BitchatMessage, to peerID: PeerID) -> Bool
-    /// Clears the peer's unread flag (store unread state only).
-    func markPrivateChatRead(_ peerID: PeerID)
-    var sentReadReceipts: Set<String> { get }
-    var nickname: String { get }
-    var myPeerID: PeerID { get }
-    var activeChannel: ChannelID { get }
-    var nostrKeyMapping: [PeerID: String] { get }
-    /// Records that a read receipt is being sent for `messageID`.
-    /// Returns `false` when one was already recorded — the caller must skip sending.
-    @discardableResult
-    func markReadReceiptSent(_ messageID: String) -> Bool
-    /// The owner-level read pass (chat manager + receipts); used for the
-    /// delayed re-run after the app becomes active.
-    func markPrivateMessagesAsRead(from peerID: PeerID)
-    /// Marks the chat read in the private chat manager (sends pending mesh READ acks).
-    func markChatAsRead(from peerID: PeerID)
-    /// Schedules main-actor work after a UI-timing delay. Injected so tests
-    /// can run the work synchronously instead of polling wall-clock queues.
-    func scheduleOnMainAfter(_ delay: TimeInterval, _ work: @escaping @MainActor () -> Void)
-    func addSystemMessage(_ content: String)
+final class ChatLifecycleCoordinator {
+    private unowned let viewModel: ChatViewModel
 
-    // MARK: Peers & sessions
-    func peerNickname(for peerID: PeerID) -> String?
-    /// The peer's current entry in the unified peer service, if known.
-    func unifiedPeer(for peerID: PeerID) -> BitchatPeer?
-    func noiseSessionState(for peerID: PeerID) -> LazyHandshakeState
-    func stopMeshServices()
-    /// Re-reads the transport's current Bluetooth state and updates the alert UI.
-    func refreshBluetoothState()
-
-    // MARK: Routing & receipts
-    func routePrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String)
-    func routeReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID)
-    func sendMeshMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date)
-    func sendGeohashReadReceipt(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
-
-    // MARK: Nostr & geohash
-    var isTeleported: Bool { get }
-    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
-    func recordGeoParticipant(pubkeyHex: String)
-
-    // MARK: Favorites (shared with `ChatPrivateConversationContext`)
-    /// The persisted favorite relationship for the peer's Noise static key, if any.
-    func favoriteRelationship(forNoiseKey noiseKey: Data) -> FavoritesPersistenceService.FavoriteRelationship?
-
-    // MARK: Identity persistence
-    /// Forces the identity manager to persist its state now.
-    func forceSaveIdentity()
-    /// Confirms the Noise identity key is still present in the keychain.
-    @discardableResult
-    func verifyIdentityKeyExists() -> Bool
-}
-
-extension ChatViewModel: ChatLifecycleContext {
-    // `messages`, `privateMessages(for:)`, `unreadPrivateMessages`,
-    // `selectedPrivateChatPeer`, `sentReadReceipts`, `nickname`, `myPeerID`,
-    // `activeChannel`, `nostrKeyMapping`, `markReadReceiptSent(_:)`,
-    // `markPrivateMessagesAsRead(from:)`, `appendPrivateMessage(_:to:)`,
-    // `markPrivateChatRead(_:)`, `addSystemMessage(_:)`,
-    // `peerNickname(for:)`, `unifiedPeer(for:)`, `noiseSessionState(for:)`,
-    // the routing/ack members, `isTeleported`,
-    // `deriveNostrIdentity(forGeohash:)`, `recordGeoParticipant(pubkeyHex:)`,
-    // and `favoriteRelationship(forNoiseKey:)`
-    // are shared requirements with the other contexts or satisfied by
-    // existing `ChatViewModel` members. The members below flatten nested
-    // service accesses into intent-named calls.
-
-    func markChatAsRead(from peerID: PeerID) {
-        privateChatManager.markAsRead(from: peerID)
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
     }
 
-    func scheduleOnMainAfter(_ delay: TimeInterval, _ work: @escaping @MainActor () -> Void) {
-        DispatchQueue.main.asyncAfter(deadline: .now() + delay) {
+    func handleDidBecomeActive() {
+        if let bleService = viewModel.meshService as? BLEService {
+            let currentState = bleService.getCurrentBluetoothState()
+            viewModel.updateBluetoothState(currentState)
+        }
+
+        guard let peerID = viewModel.selectedPrivateChatPeer else { return }
+
+        markPrivateMessagesAsRead(from: peerID)
+
+        let viewModel = self.viewModel
+        DispatchQueue.main.asyncAfter(deadline: .now() + TransportConfig.uiAnimationMediumSeconds) { [weak viewModel] in
             Task { @MainActor in
-                work()
+                viewModel?.markPrivateMessagesAsRead(from: peerID)
             }
         }
     }
 
-    func stopMeshServices() {
-        meshService.stopServices()
-    }
-
-    func refreshBluetoothState() {
-        if let bleService = meshService as? BLEService {
-            updateBluetoothState(bleService.getCurrentBluetoothState())
-        }
-    }
-
-    func forceSaveIdentity() {
-        identityManager.forceSave()
-    }
-
-    @discardableResult
-    func verifyIdentityKeyExists() -> Bool {
-        keychain.verifyIdentityKeyExists()
-    }
-}
-
-@MainActor
-final class ChatLifecycleCoordinator {
-    private unowned let context: any ChatLifecycleContext
-
-    init(context: any ChatLifecycleContext) {
-        self.context = context
-    }
-
-    func handleDidBecomeActive() {
-        context.refreshBluetoothState()
-
-        guard let peerID = context.selectedPrivateChatPeer else { return }
-
-        markPrivateMessagesAsRead(from: peerID)
-
-        let context = self.context
-        context.scheduleOnMainAfter(TransportConfig.uiAnimationMediumSeconds) { [weak context] in
-            context?.markPrivateMessagesAsRead(from: peerID)
-        }
-    }
-
     func handleScreenshotCaptured() {
-        let screenshotMessage = "* \(context.nickname) took a screenshot *"
+        let screenshotMessage = "* \(viewModel.nickname) took a screenshot *"
 
-        if let peerID = context.selectedPrivateChatPeer {
+        if let peerID = viewModel.selectedPrivateChatPeer {
             sendPrivateScreenshotNotificationIfPossible(
                 screenshotMessage,
                 to: peerID
@@ -153,9 +40,9 @@ final class ChatLifecycleCoordinator {
             return
         }
 
-        switch context.activeChannel {
+        switch viewModel.activeChannel {
         case .mesh:
-            context.sendMeshMessage(
+            viewModel.meshService.sendMessage(
                 screenshotMessage,
                 mentions: [],
                 messageID: UUID().uuidString,
@@ -169,40 +56,43 @@ final class ChatLifecycleCoordinator {
             )
         }
 
-        context.addSystemMessage("you took a screenshot")
+        viewModel.addSystemMessage("you took a screenshot")
     }
 
     func saveIdentityState() {
-        context.forceSaveIdentity()
-        context.verifyIdentityKeyExists()
+        viewModel.identityManager.forceSave()
+        _ = viewModel.keychain.verifyIdentityKeyExists()
     }
 
     func applicationWillTerminate() {
-        context.stopMeshServices()
+        viewModel.meshService.stopServices()
         saveIdentityState()
     }
 
     func markPrivateMessagesAsRead(from peerID: PeerID) {
-        context.markChatAsRead(from: peerID)
+        viewModel.privateChatManager.markAsRead(from: peerID)
+        viewModel.synchronizePrivateConversationStore()
 
         if peerID.isGeoDM,
-           let recipientHex = context.nostrKeyMapping[peerID],
-           case .location(let channel) = context.activeChannel,
-           let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
-            let messages = context.privateMessages(for: peerID)
+           let recipientHex = viewModel.nostrKeyMapping[peerID],
+           case .location(let channel) = viewModel.activeChannel,
+           let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+            let messages = viewModel.privateChats[peerID] ?? []
             for message in messages where message.senderPeerID == peerID && !message.isRelay {
-                guard !context.sentReadReceipts.contains(message.id) else { continue }
+                guard !viewModel.sentReadReceipts.contains(message.id) else { continue }
 
                 SecureLogger.debug(
                     "GeoDM: sending READ for mid=\(message.id.prefix(8))… to=\(recipientHex.prefix(8))…",
                     category: .session
                 )
-                context.sendGeohashReadReceipt(
+                let nostrTransport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+                nostrTransport.senderPeerID = viewModel.meshService.myPeerID
+                nostrTransport.sendReadReceiptGeohash(
                     message.id,
                     toRecipientHex: recipientHex,
                     from: identity
                 )
-                context.markReadReceiptSent(message.id)
+                viewModel.sentReadReceipts.insert(message.id)
             }
             return
         }
@@ -211,16 +101,16 @@ final class ChatLifecycleCoordinator {
         var peerNostrPubkey: String?
 
         if let noiseKey = Data(hexString: peerID.id),
-           let favoriteStatus = context.favoriteRelationship(forNoiseKey: noiseKey) {
+           let favoriteStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey) {
             noiseKeyHex = peerID
             peerNostrPubkey = favoriteStatus.peerNostrPublicKey
-        } else if let peer = context.unifiedPeer(for: peerID) {
+        } else if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
             noiseKeyHex = PeerID(hexData: peer.noisePublicKey)
-            let favoriteStatus = context.favoriteRelationship(forNoiseKey: peer.noisePublicKey)
+            let favoriteStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: peer.noisePublicKey)
             peerNostrPubkey = favoriteStatus?.peerNostrPublicKey
 
-            if let noiseKeyHex, context.unreadPrivateMessages.contains(noiseKeyHex) {
-                context.markPrivateChatRead(noiseKeyHex)
+            if let noiseKeyHex, viewModel.unreadPrivateMessages.contains(noiseKeyHex) {
+                viewModel.unreadPrivateMessages.remove(noiseKeyHex)
             }
         }
 
@@ -231,36 +121,38 @@ final class ChatLifecycleCoordinator {
                 continue
             }
 
-            guard !context.sentReadReceipts.contains(message.id) else { continue }
+            guard !viewModel.sentReadReceipts.contains(message.id) else { continue }
 
             let receipt = ReadReceipt(
                 originalMessageID: message.id,
-                readerID: context.myPeerID,
-                readerNickname: context.nickname
+                readerID: viewModel.meshService.myPeerID,
+                readerNickname: viewModel.nickname
             )
             let recipientPeerID = peerID.isHex
                 ? peerID
-                : (context.unifiedPeer(for: peerID)?.peerID ?? peerID)
+                : (viewModel.unifiedPeerService.getPeer(by: peerID)?.peerID ?? peerID)
 
-            context.routeReadReceipt(receipt, to: recipientPeerID)
-            context.markReadReceiptSent(message.id)
+            viewModel.messageRouter.sendReadReceipt(receipt, to: recipientPeerID)
+            viewModel.sentReadReceipts.insert(message.id)
         }
     }
 
     func getMessages(for peerID: PeerID?) -> [BitchatMessage] {
-        guard let peerID else { return context.messages }
+        guard let peerID else { return viewModel.messages }
         return getPrivateChatMessages(for: peerID)
     }
 
     func getPrivateChatMessages(for peerID: PeerID) -> [BitchatMessage] {
         var combined: [BitchatMessage] = []
 
-        combined.append(contentsOf: context.privateMessages(for: peerID))
+        if let ephemeralMessages = viewModel.privateChats[peerID] {
+            combined.append(contentsOf: ephemeralMessages)
+        }
 
-        if let peer = context.unifiedPeer(for: peerID) {
+        if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
             let noiseKeyHex = PeerID(hexData: peer.noisePublicKey)
-            if noiseKeyHex != peerID {
-                combined.append(contentsOf: context.privateMessages(for: noiseKeyHex))
+            if noiseKeyHex != peerID, let stableMessages = viewModel.privateChats[noiseKeyHex] {
+                combined.append(contentsOf: stableMessages)
             }
         }
 
@@ -283,12 +175,12 @@ final class ChatLifecycleCoordinator {
 
 private extension ChatLifecycleCoordinator {
     func sendPrivateScreenshotNotificationIfPossible(_ message: String, to peerID: PeerID) {
-        guard let peerNickname = context.peerNickname(for: peerID) else { return }
+        guard let peerNickname = viewModel.meshService.peerNickname(peerID: peerID) else { return }
 
-        let sessionState = context.noiseSessionState(for: peerID)
+        let sessionState = viewModel.meshService.getNoiseSessionState(for: peerID)
         switch sessionState {
         case .established:
-            context.routePrivateMessage(
+            viewModel.messageRouter.sendPrivate(
                 message,
                 to: peerID,
                 recipientNickname: peerNickname,
@@ -311,25 +203,30 @@ private extension ChatLifecycleCoordinator {
             isRelay: false,
             originalSender: nil,
             isPrivate: true,
-            recipientNickname: context.peerNickname(for: peerID),
-            senderPeerID: context.myPeerID
+            recipientNickname: viewModel.meshService.peerNickname(peerID: peerID),
+            senderPeerID: viewModel.meshService.myPeerID
         )
 
-        context.appendPrivateMessage(notice, to: peerID)
+        var chats = viewModel.privateChats
+        if chats[peerID] == nil {
+            chats[peerID] = []
+        }
+        chats[peerID]?.append(notice)
+        viewModel.privateChats = chats
     }
 
     func sendPublicGeohashScreenshotMessage(_ message: String, channel: GeohashChannel) {
-        Task { @MainActor [weak context = self.context] in
-            guard let context else { return }
+        Task { @MainActor [weak viewModel] in
+            guard let viewModel else { return }
 
             do {
-                let identity = try context.deriveNostrIdentity(forGeohash: channel.geohash)
+                let identity = try viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash)
                 let event = try NostrProtocol.createEphemeralGeohashEvent(
                     content: message,
                     geohash: channel.geohash,
                     senderIdentity: identity,
-                    nickname: context.nickname,
-                    teleported: context.isTeleported
+                    nickname: viewModel.nickname,
+                    teleported: viewModel.locationManager.teleported
                 )
 
                 let targetRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: channel.geohash, count: 5)
@@ -339,10 +236,10 @@ private extension ChatLifecycleCoordinator {
                     NostrRelayManager.shared.sendEvent(event, to: targetRelays)
                 }
 
-                context.recordGeoParticipant(pubkeyHex: identity.publicKeyHex)
+                viewModel.participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
             } catch {
                 SecureLogger.error("❌ Failed to send geohash screenshot message: \(error)", category: .session)
-                context.addSystemMessage(
+                viewModel.addSystemMessage(
                     String(localized: "system.location.send_failed", comment: "System message when a location channel send fails")
                 )
             }

bitchat/ViewModels/ChatMediaTransferCoordinator.swift

@@ -6,92 +6,26 @@ import Foundation
 import UIKit
 #endif
 
-/// The narrow surface `ChatMediaTransferCoordinator` needs from its owner.
-///
-/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
-/// minimal context it actually uses instead of holding an `unowned` back-ref
-/// to the whole `ChatViewModel`. This keeps the coordinator independently
-/// testable (see `ChatMediaTransferCoordinatorContextTests`) and makes its
-/// true dependencies explicit.
-@MainActor
-protocol ChatMediaTransferContext: AnyObject {
-    // MARK: Composition state
-    var canSendMediaInCurrentContext: Bool { get }
-    var selectedPrivateChatPeer: PeerID? { get }
-    var nickname: String { get }
-    var myPeerID: PeerID { get }
-    var activeChannel: ChannelID { get }
-    func nicknameForPeer(_ peerID: PeerID) -> String
-    func currentPublicSender() -> (name: String, peerID: PeerID)
-
-    // MARK: Message state
-    /// Appends a private message via the single-writer store intent.
-    @discardableResult
-    func appendPrivateMessage(_ message: BitchatMessage, to peerID: PeerID) -> Bool
-    /// Appends a public message via the single-writer store intent
-    /// (immediate: outgoing media placeholders must render without batching).
-    @discardableResult
-    func appendPublicMessage(_ message: BitchatMessage, to conversationID: ConversationID) -> Bool
-    func removeMessage(withID messageID: String, cleanupFile: Bool)
-    func addSystemMessage(_ content: String)
-    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
-    func notifyUIChanged()
-
-    // MARK: Delivery status & dedup
-    func updateMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus)
-    func normalizedContentKey(_ content: String) -> String
-    func recordContentKey(_ key: String, timestamp: Date)
-
-    // MARK: Mesh file transfer
-    func sendFilePrivate(_ packet: BitchatFilePacket, to peerID: PeerID, transferId: String)
-    func sendFileBroadcast(_ packet: BitchatFilePacket, transferId: String)
-    func cancelTransfer(_ transferId: String)
-}
-
-extension ChatViewModel: ChatMediaTransferContext {
-    // `canSendMediaInCurrentContext`, `selectedPrivateChatPeer`, `nickname`,
-    // `myPeerID`, `activeChannel`, `nicknameForPeer(_:)`,
-    // `currentPublicSender()`,
-    // `appendPublicMessage(_:to:)`, `removeMessage(withID:cleanupFile:)`,
-    // `addSystemMessage(_:)`, `notifyUIChanged()`,
-    // `updateMessageDeliveryStatus(_:status:)`, `normalizedContentKey(_:)`,
-    // and `recordContentKey(_:timestamp:)` are shared requirements with the
-    // other contexts or satisfied by existing `ChatViewModel` members. The
-    // members below flatten mesh service accesses.
-
-    func sendFilePrivate(_ packet: BitchatFilePacket, to peerID: PeerID, transferId: String) {
-        meshService.sendFilePrivate(packet, to: peerID, transferId: transferId)
-    }
-
-    func sendFileBroadcast(_ packet: BitchatFilePacket, transferId: String) {
-        meshService.sendFileBroadcast(packet, transferId: transferId)
-    }
-
-    func cancelTransfer(_ transferId: String) {
-        meshService.cancelTransfer(transferId)
-    }
-}
-
 @MainActor
 final class ChatMediaTransferCoordinator {
-    private unowned let context: any ChatMediaTransferContext
+    private unowned let viewModel: ChatViewModel
 
     private(set) var transferIdToMessageIDs: [String: [String]] = [:]
     private(set) var messageIDToTransferId: [String: String] = [:]
 
-    init(context: any ChatMediaTransferContext) {
-        self.context = context
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
     }
 
     func sendVoiceNote(at url: URL) {
-        guard context.canSendMediaInCurrentContext else {
+        guard viewModel.canSendMediaInCurrentContext else {
             SecureLogger.info("Voice note blocked outside mesh/private context", category: .session)
             try? FileManager.default.removeItem(at: url)
-            context.addSystemMessage("Voice notes are only available in mesh chats.")
+            viewModel.addSystemMessage("Voice notes are only available in mesh chats.")
             return
         }
 
-        let targetPeer = context.selectedPrivateChatPeer
+        let targetPeer = viewModel.selectedPrivateChatPeer
         let message = enqueueMediaMessage(
             content: "\(MimeType.Category.audio.messagePrefix)\(url.lastPathComponent)",
             targetPeer: targetPeer
@@ -100,29 +34,27 @@ final class ChatMediaTransferCoordinator {
         let transferId = makeTransferID(messageID: messageID)
 
         Task.detached(priority: .userInitiated) { [weak self] in
+            guard let self else { return }
             do {
                 let packet = try ChatMediaPreparation.prepareVoiceNotePacket(at: url)
 
-                await MainActor.run { [weak self] in
-                    guard let self else { return }
+                await MainActor.run {
                     self.registerTransfer(transferId: transferId, messageID: messageID)
                     if let peerID = targetPeer {
-                        self.context.sendFilePrivate(packet, to: peerID, transferId: transferId)
+                        self.viewModel.meshService.sendFilePrivate(packet, to: peerID, transferId: transferId)
                     } else {
-                        self.context.sendFileBroadcast(packet, transferId: transferId)
+                        self.viewModel.meshService.sendFileBroadcast(packet, transferId: transferId)
                     }
                 }
             } catch ChatMediaPreparationError.voiceNoteTooLarge(let size) {
                 SecureLogger.warning("Voice note exceeds size limit (\(size) bytes)", category: .session)
                 try? FileManager.default.removeItem(at: url)
-                await MainActor.run { [weak self] in
-                    guard let self else { return }
+                await MainActor.run {
                     self.handleMediaSendFailure(messageID: messageID, reason: "Voice note too large")
                 }
             } catch {
                 SecureLogger.error("Voice note send failed: \(error)", category: .session)
-                await MainActor.run { [weak self] in
-                    guard let self else { return }
+                await MainActor.run {
                     self.handleMediaSendFailure(messageID: messageID, reason: "Failed to send voice note")
                 }
             }
@@ -133,10 +65,10 @@ final class ChatMediaTransferCoordinator {
     func processThenSendImage(_ image: UIImage?) {
         guard let image else { return }
         Task.detached { [weak self] in
+            guard let self else { return }
             do {
                 let processedURL = try ImageUtils.processImage(image)
-                await MainActor.run { [weak self] in
-                    guard let self else { return }
+                await MainActor.run {
                     self.sendImage(from: processedURL)
                 }
             } catch {
@@ -148,10 +80,10 @@ final class ChatMediaTransferCoordinator {
     func processThenSendImage(from url: URL?) {
         guard let url else { return }
         Task.detached { [weak self] in
+            guard let self else { return }
             do {
                 let processedURL = try ImageUtils.processImage(at: url)
-                await MainActor.run { [weak self] in
-                    guard let self else { return }
+                await MainActor.run {
                     self.sendImage(from: processedURL)
                 }
             } catch {
@@ -162,29 +94,29 @@ final class ChatMediaTransferCoordinator {
     #endif
 
     func sendImage(from sourceURL: URL, cleanup: (() -> Void)? = nil) {
-        guard context.canSendMediaInCurrentContext else {
+        guard viewModel.canSendMediaInCurrentContext else {
             SecureLogger.info("Image send blocked outside mesh/private context", category: .session)
             cleanup?()
-            context.addSystemMessage("Images are only available in mesh chats.")
+            viewModel.addSystemMessage("Images are only available in mesh chats.")
             return
         }
 
-        let targetPeer = context.selectedPrivateChatPeer
+        let targetPeer = viewModel.selectedPrivateChatPeer
 
         do {
             try ImageUtils.validateImageSource(at: sourceURL)
         } catch {
             SecureLogger.error("Image send preparation failed: \(error)", category: .session)
-            context.addSystemMessage("Failed to prepare image for sending.")
+            viewModel.addSystemMessage("Failed to prepare image for sending.")
             return
         }
 
         Task.detached(priority: .userInitiated) { [weak self] in
+            guard let self else { return }
             do {
                 let prepared = try ChatMediaPreparation.prepareImagePacket(from: sourceURL)
 
-                await MainActor.run { [weak self] in
-                    guard let self else { return }
+                await MainActor.run {
                     let message = self.enqueueMediaMessage(
                         content: "\(MimeType.Category.image.messagePrefix)\(prepared.outputURL.lastPathComponent)",
                         targetPeer: targetPeer
@@ -193,22 +125,20 @@ final class ChatMediaTransferCoordinator {
                     let transferId = self.makeTransferID(messageID: messageID)
                     self.registerTransfer(transferId: transferId, messageID: messageID)
                     if let peerID = targetPeer {
-                        self.context.sendFilePrivate(prepared.packet, to: peerID, transferId: transferId)
+                        self.viewModel.meshService.sendFilePrivate(prepared.packet, to: peerID, transferId: transferId)
                     } else {
-                        self.context.sendFileBroadcast(prepared.packet, transferId: transferId)
+                        self.viewModel.meshService.sendFileBroadcast(prepared.packet, transferId: transferId)
                     }
                 }
             } catch ChatMediaPreparationError.imageTooLarge(let size) {
                 SecureLogger.warning("Processed image exceeds size limit (\(size) bytes)", category: .session)
-                await MainActor.run { [weak self] in
-                    guard let self else { return }
-                    self.context.addSystemMessage("Image is too large to send.")
+                await MainActor.run {
+                    self.viewModel.addSystemMessage("Image is too large to send.")
                 }
             } catch {
                 SecureLogger.error("Image send preparation failed: \(error)", category: .session)
-                await MainActor.run { [weak self] in
-                    guard let self else { return }
-                    self.context.addSystemMessage("Failed to prepare image for sending.")
+                await MainActor.run {
+                    self.viewModel.addSystemMessage("Failed to prepare image for sending.")
                 }
             }
         }
@@ -220,19 +150,22 @@ final class ChatMediaTransferCoordinator {
 
         if let peerID = targetPeer {
             message = BitchatMessage(
-                sender: context.nickname,
+                sender: viewModel.nickname,
                 content: content,
                 timestamp: timestamp,
                 isRelay: false,
                 originalSender: nil,
                 isPrivate: true,
-                recipientNickname: context.nicknameForPeer(peerID),
-                senderPeerID: context.myPeerID,
+                recipientNickname: viewModel.nicknameForPeer(peerID),
+                senderPeerID: viewModel.meshService.myPeerID,
                 deliveryStatus: .sending
             )
-            context.appendPrivateMessage(message, to: peerID)
+            var chats = viewModel.privateChats
+            chats[peerID, default: []].append(message)
+            viewModel.privateChats = chats
+            viewModel.trimMessagesIfNeeded()
         } else {
-            let (displayName, senderPeerID) = context.currentPublicSender()
+            let (displayName, senderPeerID) = viewModel.currentPublicSender()
             message = BitchatMessage(
                 sender: displayName,
                 content: content,
@@ -244,12 +177,14 @@ final class ChatMediaTransferCoordinator {
                 senderPeerID: senderPeerID,
                 deliveryStatus: .sending
             )
-            context.appendPublicMessage(message, to: ConversationID(channelID: context.activeChannel))
+            viewModel.timelineStore.append(message, to: viewModel.activeChannel)
+            viewModel.refreshVisibleMessages(from: viewModel.activeChannel)
+            viewModel.trimMessagesIfNeeded()
         }
 
-        let key = context.normalizedContentKey(message.content)
-        context.recordContentKey(key, timestamp: timestamp)
-        context.notifyUIChanged()
+        let key = viewModel.deduplicationService.normalizedContentKey(message.content)
+        viewModel.deduplicationService.recordContentKey(key, timestamp: timestamp)
+        viewModel.objectWillChange.send()
         return message
     }
 
@@ -278,7 +213,7 @@ final class ChatMediaTransferCoordinator {
     }
 
     func handleMediaSendFailure(messageID: String, reason: String) {
-        context.updateMessageDeliveryStatus(messageID, status: .failed(reason: reason))
+        viewModel.updateMessageDeliveryStatus(messageID, status: .failed(reason: reason))
         clearTransferMapping(for: messageID)
     }
 
@@ -286,18 +221,18 @@ final class ChatMediaTransferCoordinator {
         switch event {
         case .started(let id, let total):
             guard let messageID = transferIdToMessageIDs[id]?.first else { return }
-            context.updateMessageDeliveryStatus(messageID, status: .partiallyDelivered(reached: 0, total: total))
+            viewModel.updateMessageDeliveryStatus(messageID, status: .partiallyDelivered(reached: 0, total: total))
         case .updated(let id, let sent, let total):
             guard let messageID = transferIdToMessageIDs[id]?.first else { return }
-            context.updateMessageDeliveryStatus(messageID, status: .partiallyDelivered(reached: sent, total: total))
+            viewModel.updateMessageDeliveryStatus(messageID, status: .partiallyDelivered(reached: sent, total: total))
         case .completed(let id, _):
             guard let messageID = transferIdToMessageIDs[id]?.first else { return }
-            context.updateMessageDeliveryStatus(messageID, status: .sent)
+            viewModel.updateMessageDeliveryStatus(messageID, status: .sent)
             clearTransferMapping(for: messageID)
         case .cancelled(let id, _, _):
             guard let messageID = transferIdToMessageIDs[id]?.first else { return }
             clearTransferMapping(for: messageID)
-            context.removeMessage(withID: messageID, cleanupFile: true)
+            viewModel.removeMessage(withID: messageID, cleanupFile: true)
         }
     }
 
@@ -331,15 +266,15 @@ final class ChatMediaTransferCoordinator {
         if let transferId = messageIDToTransferId[messageID],
            let active = transferIdToMessageIDs[transferId]?.first,
            active == messageID {
-            context.cancelTransfer(transferId)
+            viewModel.meshService.cancelTransfer(transferId)
         }
         clearTransferMapping(for: messageID)
-        context.removeMessage(withID: messageID, cleanupFile: true)
+        viewModel.removeMessage(withID: messageID, cleanupFile: true)
     }
 
     func deleteMediaMessage(messageID: String) {
         clearTransferMapping(for: messageID)
-        context.removeMessage(withID: messageID, cleanupFile: true)
+        viewModel.removeMessage(withID: messageID, cleanupFile: true)
     }
 }
 

bitchat/ViewModels/ChatMessageFormatter.swift

@@ -14,8 +14,7 @@ final class ChatMessageFormatter {
         self.viewModel = viewModel
     }
 
-    func formatMessageAsText(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme = .matrix) -> AttributedString {
-        let design = theme.bodyFontDesign
+    func formatMessageAsText(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
         let isSelf: Bool = {
             if let spid = message.senderPeerID {
                 if case .location(let channel) = viewModel.activeChannel, spid.isGeoChat {
@@ -41,7 +40,7 @@ final class ChatMessageFormatter {
         }()
 
         let isDark = colorScheme == .dark
-        if let cachedText = message.getCachedFormattedText(isDark: isDark, isSelf: isSelf, variant: theme.formatCacheVariant) {
+        if let cachedText = message.getCachedFormattedText(isDark: isDark, isSelf: isSelf) {
             return cachedText
         }
 
@@ -53,7 +52,7 @@ final class ChatMessageFormatter {
             var senderStyle = AttributeContainer()
             senderStyle.foregroundColor = baseColor
             let fontWeight: Font.Weight = isSelf ? .bold : .medium
-            senderStyle.font = .bitchatSystem(size: 14, weight: fontWeight, design: design)
+            senderStyle.font = .bitchatSystem(size: 14, weight: fontWeight, design: .monospaced)
             if let spid = message.senderPeerID,
                let url = URL(string: "bitchat://user/\(spid.toPercentEncoded())") {
                 senderStyle.link = url
@@ -80,8 +79,8 @@ final class ChatMessageFormatter {
                 var plainStyle = AttributeContainer()
                 plainStyle.foregroundColor = baseColor
                 plainStyle.font = isSelf
-                    ? .bitchatSystem(size: 14, weight: .bold, design: design)
-                    : .bitchatSystem(size: 14, design: design)
+                    ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+                    : .bitchatSystem(size: 14, design: .monospaced)
                 result.append(AttributedString(content).mergingAttributes(plainStyle))
             } else {
                 let hashtagRegex = Patterns.hashtag
@@ -198,8 +197,8 @@ final class ChatMessageFormatter {
                             var beforeStyle = AttributeContainer()
                             beforeStyle.foregroundColor = baseColor
                             beforeStyle.font = isSelf
-                                ? .bitchatSystem(size: 14, weight: .bold, design: design)
-                                : .bitchatSystem(size: 14, design: design)
+                                ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+                                : .bitchatSystem(size: 14, design: .monospaced)
                             if isMentioned {
                                 beforeStyle.font = beforeStyle.font?.bold()
                             }
@@ -231,7 +230,7 @@ final class ChatMessageFormatter {
                         mentionStyle.font = .bitchatSystem(
                             size: 14,
                             weight: isSelf ? .bold : .semibold,
-                            design: design
+                            design: .monospaced
                         )
                         let mentionColor: Color = isMentionToMe ? .orange : baseColor
                         mentionStyle.foregroundColor = mentionColor
@@ -268,8 +267,8 @@ final class ChatMessageFormatter {
 
                         var tagStyle = AttributeContainer()
                         tagStyle.font = isSelf
-                            ? .bitchatSystem(size: 14, weight: .bold, design: design)
-                            : .bitchatSystem(size: 14, design: design)
+                            ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+                            : .bitchatSystem(size: 14, design: .monospaced)
                         tagStyle.foregroundColor = baseColor
                         if isGeohash && !attachedToMentionToken && standalone,
                            let url = URL(string: "bitchat://geohash/\(token)") {
@@ -281,15 +280,15 @@ final class ChatMessageFormatter {
                         var spacer = AttributeContainer()
                         spacer.foregroundColor = baseColor
                         spacer.font = isSelf
-                            ? .bitchatSystem(size: 14, weight: .bold, design: design)
-                            : .bitchatSystem(size: 14, design: design)
+                            ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+                            : .bitchatSystem(size: 14, design: .monospaced)
                         result.append(AttributedString(" ").mergingAttributes(spacer))
                     } else {
                         var matchStyle = AttributeContainer()
                         matchStyle.font = .bitchatSystem(
                             size: 14,
                             weight: isSelf ? .bold : .semibold,
-                            design: design
+                            design: .monospaced
                         )
                         if type == "url" {
                             matchStyle.foregroundColor = isSelf ? .orange : .blue
@@ -311,8 +310,8 @@ final class ChatMessageFormatter {
                     var remainingStyle = AttributeContainer()
                     remainingStyle.foregroundColor = baseColor
                     remainingStyle.font = isSelf
-                        ? .bitchatSystem(size: 14, weight: .bold, design: design)
-                        : .bitchatSystem(size: 14, design: design)
+                        ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+                        : .bitchatSystem(size: 14, design: .monospaced)
                     if isMentioned {
                         remainingStyle.font = remainingStyle.font?.bold()
                     }
@@ -323,28 +322,27 @@ final class ChatMessageFormatter {
             let timestamp = AttributedString(" [\(message.formattedTimestamp)]")
             var timestampStyle = AttributeContainer()
             timestampStyle.foregroundColor = Color.gray.opacity(0.7)
-            timestampStyle.font = .bitchatSystem(size: 10, design: design)
+            timestampStyle.font = .bitchatSystem(size: 10, design: .monospaced)
             result.append(timestamp.mergingAttributes(timestampStyle))
         } else {
             var contentStyle = AttributeContainer()
             contentStyle.foregroundColor = Color.gray
             let content = AttributedString("* \(message.content) *")
-            contentStyle.font = .bitchatSystem(size: 12, design: design).italic()
+            contentStyle.font = .bitchatSystem(size: 12, design: .monospaced).italic()
             result.append(content.mergingAttributes(contentStyle))
 
             let timestamp = AttributedString(" [\(message.formattedTimestamp)]")
             var timestampStyle = AttributeContainer()
             timestampStyle.foregroundColor = Color.gray.opacity(0.5)
-            timestampStyle.font = .bitchatSystem(size: 10, design: design)
+            timestampStyle.font = .bitchatSystem(size: 10, design: .monospaced)
             result.append(timestamp.mergingAttributes(timestampStyle))
         }
 
-        message.setCachedFormattedText(result, isDark: isDark, isSelf: isSelf, variant: theme.formatCacheVariant)
+        message.setCachedFormattedText(result, isDark: isDark, isSelf: isSelf)
         return result
     }
 
-    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme = .matrix) -> AttributedString {
-        let design = theme.bodyFontDesign
+    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
         let isSelf: Bool = {
             if let spid = message.senderPeerID {
                 if case .location(let channel) = viewModel.activeChannel, spid.id.hasPrefix("nostr:"),
@@ -364,7 +362,7 @@ final class ChatMessageFormatter {
         if message.sender == "system" {
             var style = AttributeContainer()
             style.foregroundColor = baseColor
-            style.font = .bitchatSystem(size: 14, weight: .medium, design: design)
+            style.font = .bitchatSystem(size: 14, weight: .medium, design: .monospaced)
             return AttributedString(message.sender).mergingAttributes(style)
         }
 
@@ -372,7 +370,7 @@ final class ChatMessageFormatter {
         let (baseName, suffix) = message.sender.splitSuffix()
         var senderStyle = AttributeContainer()
         senderStyle.foregroundColor = baseColor
-        senderStyle.font = .bitchatSystem(size: 14, weight: isSelf ? .bold : .medium, design: design)
+        senderStyle.font = .bitchatSystem(size: 14, weight: isSelf ? .bold : .medium, design: .monospaced)
         if let spid = message.senderPeerID,
            let url = URL(string: "bitchat://user/\(spid.id.addingPercentEncoding(withAllowedCharacters: .urlPathAllowed) ?? spid.id)") {
             senderStyle.link = url

bitchat/ViewModels/ChatNostrCoordinator.swift

@@ -1,66 +1,707 @@
 import BitFoundation
 import BitLogger
 import Foundation
+import SwiftUI
+import Tor
 
-/// The surface `ChatNostrCoordinator` needs from its owner.
-///
-/// Inherits the component contexts (`GeohashSubscriptionContext`,
-/// `NostrInboundPipelineContext`, `GeoPresenceContext`) so a single object —
-/// `ChatViewModel` in production, one mock in tests — can back the whole
-/// Nostr stack. The members declared here are only the residual
-/// favorites/ack glue the slimmed coordinator still owns.
-@MainActor
-protocol ChatNostrContext: GeohashSubscriptionContext, NostrInboundPipelineContext, GeoPresenceContext {
-    var selectedPrivateChatPeer: PeerID? { get }
-    var nostrKeyMapping: [PeerID: String] { get }
-    func startPrivateChat(with peerID: PeerID)
-    func visibleGeohashPeople() -> [GeoPerson]
-
-    // MARK: Routing & acknowledgements (shared with `ChatPrivateConversationContext`)
-    func routeFavoriteNotification(to peerID: PeerID, isFavorite: Bool)
-    func sendGeohashDeliveryAck(for messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
-    func sendGeohashReadReceipt(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
-
-    // MARK: Favorites & notifications (shared with the other contexts)
-    /// The persisted favorite relationship for the peer's Noise static key, if any.
-    func favoriteRelationship(forNoiseKey noiseKey: Data) -> FavoritesPersistenceService.FavoriteRelationship?
-    /// Adds (or updates) a favorite in the favorites store.
-    func addFavorite(noiseKey: Data, nostrPublicKey: String?, nickname: String)
-    /// Posts a generic local user notification.
-    func postLocalNotification(title: String, body: String, identifier: String)
-}
-
-extension ChatViewModel: ChatNostrContext {
-    // All requirements — including the component-context witnesses declared
-    // in `GeohashSubscriptionManager.swift`, `NostrInboundPipeline.swift`,
-    // `GeoPresenceTracker.swift`, and the favorites/notification witnesses in
-    // `ChatPrivateConversationCoordinator.swift`,
-    // `ChatPeerIdentityCoordinator.swift`, and
-    // `ChatVerificationCoordinator.swift` — already exist on `ChatViewModel`.
-}
-
-/// Thin facade over the Nostr stack: owns and wires the three components and
-/// keeps the residual favorites/ack glue that fits none of them.
-///
-/// - `subscriptions`: relay lifecycle and subscription IDs
-///   (`GeohashSubscriptionManager`)
-/// - `inbound`: the hot event -> message/payload pipeline
-///   (`NostrInboundPipeline`)
-/// - `presence`: teleport marking, sampling dedup, notification cooldown
-///   (`GeoPresenceTracker`)
 final class ChatNostrCoordinator {
-    private weak var context: (any ChatNostrContext)?
-    let presence: GeoPresenceTracker
-    let inbound: NostrInboundPipeline
-    let subscriptions: GeohashSubscriptionManager
+    private unowned let viewModel: ChatViewModel
 
-    init(context: any ChatNostrContext) {
-        self.context = context
-        let presence = GeoPresenceTracker(context: context)
-        let inbound = NostrInboundPipeline(context: context, presence: presence)
-        self.presence = presence
-        self.inbound = inbound
-        self.subscriptions = GeohashSubscriptionManager(context: context, inbound: inbound, presence: presence)
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
+    }
+
+    @MainActor
+    func resubscribeCurrentGeohash() {
+        guard case .location(let channel) = viewModel.activeChannel else { return }
+        guard let subID = viewModel.geoSubscriptionID else {
+            switchLocationChannel(to: viewModel.activeChannel)
+            return
+        }
+
+        viewModel.participantTracker.startRefreshTimer()
+        NostrRelayManager.shared.unsubscribe(id: subID)
+        let filter = NostrFilter.geohashEphemeral(
+            channel.geohash,
+            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds),
+            limit: TransportConfig.nostrGeohashInitialLimit
+        )
+        let subRelays = GeoRelayDirectory.shared.closestRelays(
+            toGeohash: channel.geohash,
+            count: TransportConfig.nostrGeoRelayCount
+        )
+        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
+            Task { @MainActor [weak self] in
+                self?.subscribeNostrEvent(event)
+            }
+        }
+
+        if let dmSub = viewModel.geoDmSubscriptionID {
+            NostrRelayManager.shared.unsubscribe(id: dmSub)
+            viewModel.geoDmSubscriptionID = nil
+        }
+
+        if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+            let dmSub = "geo-dm-\(channel.geohash)"
+            viewModel.geoDmSubscriptionID = dmSub
+            let dmFilter = NostrFilter.giftWrapsFor(
+                pubkey: identity.publicKeyHex,
+                since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
+            )
+            NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
+                Task { @MainActor [weak self] in
+                    self?.subscribeGiftWrap(giftWrap, id: identity)
+                }
+            }
+        }
+    }
+
+    @MainActor
+    func subscribeNostrEvent(_ event: NostrEvent) {
+        guard event.isValidSignature() else { return }
+        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
+            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue),
+              !viewModel.deduplicationService.hasProcessedNostrEvent(event.id)
+        else {
+            return
+        }
+
+        viewModel.deduplicationService.recordNostrEvent(event.id)
+
+        if let gh = viewModel.currentGeohash,
+           let myGeoIdentity = try? viewModel.idBridge.deriveIdentity(forGeohash: gh),
+           myGeoIdentity.publicKeyHex.lowercased() == event.pubkey.lowercased() {
+            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+            if Date().timeIntervalSince(eventTime) < 15 {
+                return
+            }
+        }
+
+        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
+            let nick = nickTag[1].trimmed
+            viewModel.locationPresenceStore.setNickname(nick, for: event.pubkey)
+        }
+
+        viewModel.nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
+        viewModel.nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
+        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey)
+
+        if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
+            return
+        }
+
+        let hasTeleportTag = event.tags.contains { tag in
+            tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
+        }
+
+        if hasTeleportTag {
+            let key = event.pubkey.lowercased()
+            let isSelf: Bool = {
+                if let gh = viewModel.currentGeohash,
+                   let myIdentity = try? viewModel.idBridge.deriveIdentity(forGeohash: gh) {
+                    return myIdentity.publicKeyHex.lowercased() == key
+                }
+                return false
+            }()
+            if !isSelf {
+                Task { @MainActor [weak viewModel] in
+                    viewModel?.locationPresenceStore.markTeleported(key)
+                }
+            }
+        }
+
+        let senderName = viewModel.displayNameForNostrPubkey(event.pubkey)
+        let content = event.content.trimmed
+        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+        let timestamp = min(rawTs, Date())
+        let mentions = viewModel.parseMentions(from: content)
+        let message = BitchatMessage(
+            id: event.id,
+            sender: senderName,
+            content: content,
+            timestamp: timestamp,
+            isRelay: false,
+            senderPeerID: PeerID(nostr: event.pubkey),
+            mentions: mentions.isEmpty ? nil : mentions
+        )
+
+        Task { @MainActor [weak viewModel] in
+            guard let viewModel else { return }
+            let isBlocked = viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased())
+            viewModel.handlePublicMessage(message)
+            if !isBlocked {
+                viewModel.checkForMentions(message)
+                viewModel.sendHapticFeedback(for: message)
+            }
+        }
+    }
+
+    @MainActor
+    func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
+        guard giftWrap.isValidSignature() else { return }
+        guard !viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) else { return }
+        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
+
+        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
+            giftWrap: giftWrap,
+            recipientIdentity: id
+        ),
+        let packet = Self.decodeEmbeddedBitChatPacket(from: content),
+        packet.type == MessageType.noiseEncrypted.rawValue,
+        let noisePayload = NoisePayload.decode(packet.payload)
+        else {
+            return
+        }
+
+        let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
+        let convKey = PeerID(nostr_: senderPubkey)
+        viewModel.nostrKeyMapping[convKey] = senderPubkey
+
+        switch noisePayload.type {
+        case .privateMessage:
+            viewModel.handlePrivateMessage(
+                noisePayload,
+                senderPubkey: senderPubkey,
+                convKey: convKey,
+                id: id,
+                messageTimestamp: messageTimestamp
+            )
+        case .delivered:
+            viewModel.handleDelivered(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
+        case .readReceipt:
+            viewModel.handleReadReceipt(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
+        case .verifyChallenge, .verifyResponse:
+            break
+        }
+    }
+
+    @MainActor
+    func switchLocationChannel(to channel: ChannelID) {
+        viewModel.publicMessagePipeline.reset()
+        viewModel.activeChannel = channel
+        viewModel.publicMessagePipeline.updateActiveChannel(channel)
+
+        viewModel.deduplicationService.clearNostrCaches()
+        switch channel {
+        case .mesh:
+            viewModel.refreshVisibleMessages(from: .mesh)
+            let emptyMesh = viewModel.messages.filter { $0.content.trimmed.isEmpty }.count
+            if emptyMesh > 0 {
+                SecureLogger.debug("RenderGuard: mesh timeline contains \(emptyMesh) empty messages", category: .session)
+            }
+            viewModel.participantTracker.stopRefreshTimer()
+            viewModel.participantTracker.setActiveGeohash(nil)
+            viewModel.locationPresenceStore.clearTeleportedGeo()
+
+        case .location:
+            viewModel.refreshVisibleMessages(from: channel)
+        }
+
+        if case .location = channel {
+            for content in viewModel.timelineStore.drainPendingGeohashSystemMessages() {
+                viewModel.addPublicSystemMessage(content)
+            }
+        }
+
+        if let sub = viewModel.geoSubscriptionID {
+            NostrRelayManager.shared.unsubscribe(id: sub)
+            viewModel.geoSubscriptionID = nil
+        }
+        if let dmSub = viewModel.geoDmSubscriptionID {
+            NostrRelayManager.shared.unsubscribe(id: dmSub)
+            viewModel.geoDmSubscriptionID = nil
+        }
+        viewModel.currentGeohash = nil
+        viewModel.participantTracker.setActiveGeohash(nil)
+        viewModel.locationPresenceStore.clearGeoNicknames()
+
+        guard case .location(let channel) = channel else { return }
+        viewModel.currentGeohash = channel.geohash
+        viewModel.participantTracker.setActiveGeohash(channel.geohash)
+
+        if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+            viewModel.participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
+            let hasRegional = !viewModel.locationManager.availableChannels.isEmpty
+            let inRegional = viewModel.locationManager.availableChannels.contains { $0.geohash == channel.geohash }
+            let key = identity.publicKeyHex.lowercased()
+            if viewModel.locationManager.teleported && hasRegional && !inRegional {
+                viewModel.locationPresenceStore.markTeleported(key)
+                SecureLogger.info(
+                    "GeoTeleport: channel switch mark self teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
+                    category: .session
+                )
+            } else {
+                viewModel.locationPresenceStore.clearTeleported(key)
+            }
+        }
+
+        let subID = "geo-\(channel.geohash)"
+        viewModel.geoSubscriptionID = subID
+        viewModel.participantTracker.startRefreshTimer()
+        let ts = Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds)
+        let filter = NostrFilter.geohashEphemeral(channel.geohash, since: ts, limit: TransportConfig.nostrGeohashInitialLimit)
+        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: channel.geohash, count: 5)
+        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
+            Task { @MainActor [weak self] in
+                self?.handleNostrEvent(event)
+            }
+        }
+
+        subscribeToGeoChat(channel)
+    }
+
+    @MainActor
+    func handleNostrEvent(_ event: NostrEvent) {
+        guard event.isValidSignature() else { return }
+        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
+            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue)
+        else {
+            return
+        }
+
+        if viewModel.deduplicationService.hasProcessedNostrEvent(event.id) { return }
+        viewModel.deduplicationService.recordNostrEvent(event.id)
+
+        let tagSummary = event.tags.map { "[" + $0.joined(separator: ",") + "]" }.joined(separator: ",")
+        SecureLogger.debug("GeoTeleport: recv pub=\(event.pubkey.prefix(8))… tags=\(tagSummary)", category: .session)
+
+        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
+            return
+        }
+
+        let hasTeleportTag = event.tags.contains { tag in
+            tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
+        }
+
+        let isSelf: Bool = {
+            if let gh = viewModel.currentGeohash,
+               let my = try? viewModel.idBridge.deriveIdentity(forGeohash: gh) {
+                return my.publicKeyHex.lowercased() == event.pubkey.lowercased()
+            }
+            return false
+        }()
+
+        if hasTeleportTag, !isSelf {
+            let key = event.pubkey.lowercased()
+            Task { @MainActor [weak viewModel] in
+                guard let viewModel else { return }
+                viewModel.locationPresenceStore.markTeleported(key)
+                SecureLogger.info(
+                    "GeoTeleport: mark peer teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
+                    category: .session
+                )
+            }
+        }
+
+        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey)
+
+        if isSelf {
+            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+            if Date().timeIntervalSince(eventTime) < 15 {
+                return
+            }
+        }
+
+        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
+            viewModel.locationPresenceStore.setNickname(nickTag[1].trimmed, for: event.pubkey)
+        }
+
+        viewModel.nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
+        viewModel.nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
+
+        if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
+            return
+        }
+
+        let senderName = viewModel.displayNameForNostrPubkey(event.pubkey)
+        let content = event.content
+
+        if let teleTag = event.tags.first(where: { $0.first == "t" }),
+           teleTag.count >= 2,
+           teleTag[1] == "teleport",
+           content.trimmed.isEmpty {
+            return
+        }
+
+        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+        let mentions = viewModel.parseMentions(from: content)
+        let message = BitchatMessage(
+            id: event.id,
+            sender: senderName,
+            content: content,
+            timestamp: min(rawTs, Date()),
+            isRelay: false,
+            senderPeerID: PeerID(nostr: event.pubkey),
+            mentions: mentions.isEmpty ? nil : mentions
+        )
+
+        Task { @MainActor [weak viewModel] in
+            guard let viewModel else { return }
+            viewModel.handlePublicMessage(message)
+            viewModel.checkForMentions(message)
+            viewModel.sendHapticFeedback(for: message)
+        }
+    }
+
+    @MainActor
+    func subscribeToGeoChat(_ channel: GeohashChannel) {
+        guard let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) else { return }
+
+        let dmSub = "geo-dm-\(channel.geohash)"
+        viewModel.geoDmSubscriptionID = dmSub
+        if TorManager.shared.isReady {
+            SecureLogger.debug("GeoDM: subscribing DMs pub=\(identity.publicKeyHex.prefix(8))… sub=\(dmSub)", category: .session)
+        }
+        let dmFilter = NostrFilter.giftWrapsFor(
+            pubkey: identity.publicKeyHex,
+            since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
+        )
+        NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
+            Task { @MainActor [weak self] in
+                self?.handleGiftWrap(giftWrap, id: identity)
+            }
+        }
+    }
+
+    @MainActor
+    func handleGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
+        guard giftWrap.isValidSignature() else { return }
+        if viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) {
+            return
+        }
+        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
+
+        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
+            giftWrap: giftWrap,
+            recipientIdentity: id
+        ) else {
+            SecureLogger.warning("GeoDM: failed decrypt giftWrap id=\(giftWrap.id.prefix(8))…", category: .session)
+            return
+        }
+
+        SecureLogger.debug(
+            "GeoDM: decrypted gift-wrap id=\(giftWrap.id.prefix(16))... from=\(senderPubkey.prefix(8))...",
+            category: .session
+        )
+
+        guard let packet = Self.decodeEmbeddedBitChatPacket(from: content),
+              packet.type == MessageType.noiseEncrypted.rawValue,
+              let payload = NoisePayload.decode(packet.payload)
+        else {
+            return
+        }
+
+        let convKey = PeerID(nostr_: senderPubkey)
+        viewModel.nostrKeyMapping[convKey] = senderPubkey
+
+        switch payload.type {
+        case .privateMessage:
+            let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
+            viewModel.handlePrivateMessage(
+                payload,
+                senderPubkey: senderPubkey,
+                convKey: convKey,
+                id: id,
+                messageTimestamp: messageTimestamp
+            )
+        case .delivered:
+            viewModel.handleDelivered(payload, senderPubkey: senderPubkey, convKey: convKey)
+        case .readReceipt:
+            viewModel.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: convKey)
+        case .verifyChallenge, .verifyResponse:
+            break
+        }
+    }
+
+    @MainActor
+    func sendGeohash(context: ChatViewModel.GeoOutgoingContext) {
+        let channel = context.channel
+        let event = context.event
+        let identity = context.identity
+
+        let targetRelays = GeoRelayDirectory.shared.closestRelays(
+            toGeohash: channel.geohash,
+            count: TransportConfig.nostrGeoRelayCount
+        )
+
+        if targetRelays.isEmpty {
+            SecureLogger.warning("Geo: no geohash relays available for \(channel.geohash); not sending", category: .session)
+        } else {
+            NostrRelayManager.shared.sendEvent(event, to: targetRelays)
+        }
+
+        viewModel.participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
+        viewModel.nostrKeyMapping[PeerID(nostr: identity.publicKeyHex)] = identity.publicKeyHex
+        SecureLogger.debug(
+            "GeoTeleport: sent geo message pub=\(identity.publicKeyHex.prefix(8))… teleported=\(context.teleported)",
+            category: .session
+        )
+
+        let hasRegional = !viewModel.locationManager.availableChannels.isEmpty
+        let inRegional = viewModel.locationManager.availableChannels.contains { $0.geohash == channel.geohash }
+        if context.teleported && hasRegional && !inRegional {
+            let key = identity.publicKeyHex.lowercased()
+            viewModel.locationPresenceStore.markTeleported(key)
+            SecureLogger.info(
+                "GeoTeleport: mark self teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
+                category: .session
+            )
+        }
+
+        viewModel.deduplicationService.recordNostrEvent(event.id)
+    }
+
+    @MainActor
+    func beginGeohashSampling(for geohashes: [String]) {
+        if !TorManager.shared.isForeground() {
+            endGeohashSampling()
+            return
+        }
+
+        let desired = Set(geohashes)
+        let current = Set(viewModel.geoSamplingSubs.values)
+        let toAdd = desired.subtracting(current)
+        let toRemove = current.subtracting(desired)
+
+        for (subID, gh) in viewModel.geoSamplingSubs where toRemove.contains(gh) {
+            NostrRelayManager.shared.unsubscribe(id: subID)
+            viewModel.geoSamplingSubs.removeValue(forKey: subID)
+        }
+
+        for gh in toAdd {
+            subscribe(gh)
+        }
+    }
+
+    @MainActor
+    func subscribe(_ gh: String) {
+        let subID = "geo-sample-\(gh)"
+        viewModel.geoSamplingSubs[subID] = gh
+        let filter = NostrFilter.geohashEphemeral(
+            gh,
+            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashSampleLookbackSeconds),
+            limit: TransportConfig.nostrGeohashSampleLimit
+        )
+        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: gh, count: 5)
+        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
+            Task { @MainActor [weak self] in
+                self?.subscribeNostrEvent(event, gh: gh)
+            }
+        }
+    }
+
+    @MainActor
+    func subscribeNostrEvent(_ event: NostrEvent, gh: String) {
+        guard event.isValidSignature() else { return }
+        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
+            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue)
+        else {
+            return
+        }
+
+        let existingCount = viewModel.participantTracker.participantCount(for: gh)
+        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey, geohash: gh)
+
+        guard let content = event.content.trimmedOrNilIfEmpty else { return }
+        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased()) { return }
+        if let my = try? viewModel.idBridge.deriveIdentity(forGeohash: gh),
+           my.publicKeyHex.lowercased() == event.pubkey.lowercased() {
+            return
+        }
+        guard existingCount == 0 else { return }
+
+        let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+        if Date().timeIntervalSince(eventTime) > 30 { return }
+
+        #if os(iOS)
+        guard UIApplication.shared.applicationState == .active else { return }
+        if case .location(let channel) = viewModel.activeChannel, channel.geohash == gh { return }
+        #elseif os(macOS)
+        guard NSApplication.shared.isActive else { return }
+        if case .location(let channel) = viewModel.activeChannel, channel.geohash == gh { return }
+        #endif
+
+        cooldownPerGeohash(gh, content: content, event: event)
+    }
+
+    @MainActor
+    func cooldownPerGeohash(_ gh: String, content: String, event: NostrEvent) {
+        let now = Date()
+        let last = viewModel.lastGeoNotificationAt[gh] ?? .distantPast
+        if now.timeIntervalSince(last) < TransportConfig.uiGeoNotifyCooldownSeconds { return }
+
+        let preview: String = {
+            let maxLen = TransportConfig.uiGeoNotifySnippetMaxLen
+            if content.count <= maxLen { return content }
+            let idx = content.index(content.startIndex, offsetBy: maxLen)
+            return String(content[..<idx]) + "…"
+        }()
+
+        Task { @MainActor [weak viewModel] in
+            guard let viewModel else { return }
+            viewModel.lastGeoNotificationAt[gh] = now
+            let senderSuffix = String(event.pubkey.suffix(4))
+            let nick = viewModel.geoNicknames[event.pubkey.lowercased()]
+            let senderName = (nick?.isEmpty == false ? nick! : "anon") + "#" + senderSuffix
+
+            let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+            let ts = min(rawTs, Date())
+            let mentions = viewModel.parseMentions(from: content)
+            let message = BitchatMessage(
+                id: event.id,
+                sender: senderName,
+                content: content,
+                timestamp: ts,
+                isRelay: false,
+                senderPeerID: PeerID(nostr: event.pubkey),
+                mentions: mentions.isEmpty ? nil : mentions
+            )
+            if viewModel.timelineStore.appendIfAbsent(message, toGeohash: gh) {
+                viewModel.synchronizePublicConversationStore(forGeohash: gh)
+                NotificationService.shared.sendGeohashActivityNotification(geohash: gh, bodyPreview: preview)
+            }
+        }
+    }
+
+    @MainActor
+    func endGeohashSampling() {
+        for subID in viewModel.geoSamplingSubs.keys {
+            NostrRelayManager.shared.unsubscribe(id: subID)
+        }
+        viewModel.geoSamplingSubs.removeAll()
+    }
+
+    @MainActor
+    func setupNostrMessageHandling() {
+        guard let currentIdentity = try? viewModel.idBridge.getCurrentNostrIdentity() else {
+            SecureLogger.warning("⚠️ No Nostr identity available for message handling", category: .session)
+            return
+        }
+
+        SecureLogger.debug(
+            "🔑 Setting up Nostr subscription for pubkey: \(currentIdentity.publicKeyHex.prefix(16))...",
+            category: .session
+        )
+
+        let filter = NostrFilter.giftWrapsFor(
+            pubkey: currentIdentity.publicKeyHex,
+            since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
+        )
+
+        viewModel.nostrRelayManager?.subscribe(filter: filter, id: "chat-messages") { [weak self] event in
+            Task { @MainActor [weak self] in
+                self?.handleNostrMessage(event)
+            }
+        }
+    }
+
+    @MainActor
+    func handleNostrMessage(_ giftWrap: NostrEvent) {
+        if viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) { return }
+        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
+
+        Task.detached(priority: .userInitiated) { [weak self] in
+            await self?.processNostrMessage(giftWrap)
+        }
+    }
+
+    func processNostrMessage(_ giftWrap: NostrEvent) async {
+        guard giftWrap.isValidSignature() else { return }
+        let currentIdentity: NostrIdentity? = await MainActor.run {
+            try? viewModel.idBridge.getCurrentNostrIdentity()
+        }
+        guard let currentIdentity else { return }
+
+        do {
+            let (content, senderPubkey, rumorTimestamp) = try NostrProtocol.decryptPrivateMessage(
+                giftWrap: giftWrap,
+                recipientIdentity: currentIdentity
+            )
+
+            if content.hasPrefix("verify:") {
+                return
+            }
+
+            if content.hasPrefix("bitchat1:") {
+                let packet: BitchatPacket? = await MainActor.run {
+                    Self.decodeEmbeddedBitChatPacket(from: content)
+                }
+                guard let packet else {
+                    SecureLogger.error("Failed to decode embedded BitChat packet from Nostr DM", category: .session)
+                    return
+                }
+
+                let actualSenderNoiseKey: Data? = await MainActor.run {
+                    self.findNoiseKey(for: senderPubkey)
+                }
+                let targetPeerID = PeerID(str: actualSenderNoiseKey?.hexEncodedString()) ?? PeerID(nostr_: senderPubkey)
+
+                if packet.type == MessageType.noiseEncrypted.rawValue,
+                   let payload = NoisePayload.decode(packet.payload) {
+                    let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTimestamp))
+                    await MainActor.run {
+                        viewModel.nostrKeyMapping[targetPeerID] = senderPubkey
+
+                        switch payload.type {
+                        case .privateMessage:
+                            viewModel.handlePrivateMessage(
+                                payload,
+                                senderPubkey: senderPubkey,
+                                convKey: targetPeerID,
+                                id: currentIdentity,
+                                messageTimestamp: messageTimestamp
+                            )
+                        case .delivered:
+                            viewModel.handleDelivered(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
+                        case .readReceipt:
+                            viewModel.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
+                        case .verifyChallenge, .verifyResponse:
+                            break
+                        }
+                    }
+                }
+            } else {
+                SecureLogger.debug("Ignoring non-embedded Nostr DM content", category: .session)
+            }
+        } catch {
+            SecureLogger.error("Failed to decrypt Nostr message: \(error)", category: .session)
+        }
+    }
+
+    @MainActor
+    func findNoiseKey(for nostrPubkey: String) -> Data? {
+        let favorites = FavoritesPersistenceService.shared.favorites.values
+        var npubToMatch = nostrPubkey
+
+        if !nostrPubkey.hasPrefix("npub") {
+            if let pubkeyData = Data(hexString: nostrPubkey),
+               let encoded = try? Bech32.encode(hrp: "npub", data: pubkeyData) {
+                npubToMatch = encoded
+            } else {
+                SecureLogger.warning(
+                    "⚠️ Invalid hex public key format or encoding failed: \(nostrPubkey.prefix(16))...",
+                    category: .session
+                )
+            }
+        }
+
+        for relationship in favorites {
+            if let storedNostrKey = relationship.peerNostrPublicKey {
+                if storedNostrKey == npubToMatch {
+                    return relationship.peerNoisePublicKey
+                }
+                if !storedNostrKey.hasPrefix("npub") && storedNostrKey == nostrPubkey {
+                    SecureLogger.debug("✅ Found Noise key for Nostr sender (hex match)", category: .session)
+                    return relationship.peerNoisePublicKey
+                }
+            }
+        }
+
+        SecureLogger.debug(
+            "⚠️ No matching Noise key found for Nostr pubkey: \(nostrPubkey.prefix(16))... (tried npub: \(npubToMatch.prefix(16))...)",
+            category: .session
+        )
+        return nil
     }
 
     @MainActor
@@ -70,26 +711,33 @@ final class ChatNostrCoordinator {
         senderPubkey: String,
         key: Data?
     ) {
-        guard let context else { return }
         if let _ = key {
-            if let identity = context.currentNostrIdentity() {
-                context.sendGeohashDeliveryAck(for: message.id, toRecipientHex: senderPubkey, from: identity)
+            if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
+                let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+                transport.senderPeerID = viewModel.meshService.myPeerID
+                transport.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: identity)
             }
-        } else if let identity = context.currentNostrIdentity() {
-            context.sendGeohashDeliveryAck(for: message.id, toRecipientHex: senderPubkey, from: identity)
+        } else if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
+            let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+            transport.senderPeerID = viewModel.meshService.myPeerID
+            transport.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: identity)
             SecureLogger.debug(
                 "Sent DELIVERED ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…",
                 category: .session
             )
         }
 
-        if !wasReadBefore && context.selectedPrivateChatPeer == message.senderPeerID {
+        if !wasReadBefore && viewModel.selectedPrivateChatPeer == message.senderPeerID {
             if let _ = key {
-                if let identity = context.currentNostrIdentity() {
-                    context.sendGeohashReadReceipt(message.id, toRecipientHex: senderPubkey, from: identity)
+                if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
+                    let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+                    transport.senderPeerID = viewModel.meshService.myPeerID
+                    transport.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: identity)
                 }
-            } else if let identity = context.currentNostrIdentity() {
-                context.sendGeohashReadReceipt(message.id, toRecipientHex: senderPubkey, from: identity)
+            } else if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
+                let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+                transport.senderPeerID = viewModel.meshService.myPeerID
+                transport.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: identity)
                 SecureLogger.debug(
                     "Viewing chat; sent READ ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…",
                     category: .session
@@ -100,17 +748,16 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func handleFavoriteNotification(content: String, from nostrPubkey: String) {
-        guard let context else { return }
-        guard let senderNoiseKey = inbound.findNoiseKey(for: nostrPubkey) else { return }
+        guard let senderNoiseKey = findNoiseKey(for: nostrPubkey) else { return }
 
         let isFavorite = content.contains("FAVORITE:TRUE")
         let senderNickname = content.components(separatedBy: "|").last ?? "Unknown"
 
         if isFavorite {
-            context.addFavorite(
-                noiseKey: senderNoiseKey,
-                nostrPublicKey: nostrPubkey,
-                nickname: senderNickname
+            FavoritesPersistenceService.shared.addFavorite(
+                peerNoisePublicKey: senderNoiseKey,
+                peerNostrPublicKey: nostrPubkey,
+                peerNickname: senderNickname
             )
         }
 
@@ -135,14 +782,14 @@ final class ChatNostrCoordinator {
                 "💾 Storing Nostr key association for \(senderNickname): \(extractedNostrPubkey!.prefix(16))...",
                 category: .session
             )
-            context.addFavorite(
-                noiseKey: senderNoiseKey,
-                nostrPublicKey: extractedNostrPubkey,
-                nickname: senderNickname
+            FavoritesPersistenceService.shared.addFavorite(
+                peerNoisePublicKey: senderNoiseKey,
+                peerNostrPublicKey: extractedNostrPubkey,
+                peerNickname: senderNickname
             )
         }
 
-        context.postLocalNotification(
+        NotificationService.shared.sendLocalNotification(
             title: isFavorite ? "New Favorite" : "Favorite Removed",
             body: "\(senderNickname) \(isFavorite ? "favorited" : "unfavorited") you",
             identifier: "fav-\(UUID().uuidString)"
@@ -151,24 +798,22 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func sendFavoriteNotificationViaNostr(noisePublicKey: Data, isFavorite: Bool) {
-        guard let context else { return }
-        guard let relationship = context.favoriteRelationship(forNoiseKey: noisePublicKey),
+        guard let relationship = FavoritesPersistenceService.shared.getFavoriteStatus(for: noisePublicKey),
               relationship.peerNostrPublicKey != nil else {
             SecureLogger.warning("⚠️ Cannot send favorite notification - no Nostr key for peer", category: .session)
             return
         }
 
         let peerID = PeerID(hexData: noisePublicKey)
-        context.routeFavoriteNotification(to: peerID, isFavorite: isFavorite)
+        viewModel.messageRouter.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
     }
 
     @MainActor
     func nostrPubkeyForDisplayName(_ name: String) -> String? {
-        guard let context else { return nil }
-        for person in context.visibleGeohashPeople() where person.displayName == name {
+        for person in viewModel.visibleGeohashPeople() where person.displayName == name {
             return person.id
         }
-        for (pub, nick) in context.geoNicknames where nick == name {
+        for (pub, nick) in viewModel.geoNicknames where nick == name {
             return pub
         }
         return nil
@@ -176,24 +821,38 @@ final class ChatNostrCoordinator {
 
     @MainActor
     func startGeohashDM(withPubkeyHex hex: String) {
-        guard let context else { return }
         let convKey = PeerID(nostr_: hex)
-        context.registerNostrKeyMapping(hex, for: convKey)
-        context.startPrivateChat(with: convKey)
+        viewModel.nostrKeyMapping[convKey] = hex
+        viewModel.startPrivateChat(with: convKey)
     }
 
     @MainActor
     func fullNostrHex(forSenderPeerID senderID: PeerID) -> String? {
-        guard let context else { return nil }
-        return context.nostrKeyMapping[senderID]
+        viewModel.nostrKeyMapping[senderID]
     }
 
     @MainActor
     func geohashDisplayName(for convKey: PeerID) -> String {
-        guard let context else { return convKey.bare }
-        guard let full = context.nostrKeyMapping[convKey] else {
+        guard let full = viewModel.nostrKeyMapping[convKey] else {
             return convKey.bare
         }
-        return context.displayNameForNostrPubkey(full)
+        return viewModel.displayNameForNostrPubkey(full)
+    }
+}
+
+private extension ChatNostrCoordinator {
+    @MainActor
+    static func decodeEmbeddedBitChatPacket(from content: String) -> BitchatPacket? {
+        guard content.hasPrefix("bitchat1:") else { return nil }
+        let encoded = String(content.dropFirst("bitchat1:".count))
+        let maxBytes = FileTransferLimits.maxFramedFileBytes
+        let maxEncoded = ((maxBytes + 2) / 3) * 4
+        guard encoded.count <= maxEncoded else { return nil }
+        guard let packetData = Base64URLCoding.decode(encoded),
+              packetData.count <= maxBytes
+        else {
+            return nil
+        }
+        return BitchatPacket.from(packetData)
     }
 }

bitchat/ViewModels/ChatOutgoingCoordinator.swift

@@ -2,96 +2,34 @@ import BitFoundation
 import BitLogger
 import Foundation
 
-/// The narrow surface `ChatOutgoingCoordinator` needs from its owner.
-///
-/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
-/// minimal context it actually uses instead of holding an `unowned` back-ref
-/// to the whole `ChatViewModel`. This keeps the coordinator independently
-/// testable (see `ChatOutgoingCoordinatorContextTests`) and makes its true
-/// dependencies explicit.
-@MainActor
-protocol ChatOutgoingContext: AnyObject {
-    // MARK: Identity & channel state
-    var nickname: String { get }
-    var myPeerID: PeerID { get }
-    var activeChannel: ChannelID { get }
-    var selectedPrivateChatPeer: PeerID? { get }
-    var isTeleported: Bool { get }
-
-    // MARK: Commands & private messages
-    func handleCommand(_ command: String)
-    func updatePrivateChatPeerIfNeeded()
-    func sendPrivateMessage(_ content: String, to peerID: PeerID)
-
-    // MARK: Public timeline (local echo)
-    func parseMentions(from content: String) -> [String]
-    /// Appends a public message via the single-writer store intent
-    /// (immediate: the local echo must render without batching).
-    @discardableResult
-    func appendPublicMessage(_ message: BitchatMessage, to conversationID: ConversationID) -> Bool
-    func addSystemMessage(_ content: String)
-
-    // MARK: Content dedup
-    func normalizedContentKey(_ content: String) -> String
-    func recordContentKey(_ key: String, timestamp: Date)
-
-    // MARK: Outbound routing
-    /// Stamps "now" as the channel's last public activity (background nudges).
-    /// (Single mutation path for the owner's `lastPublicActivityAt`; this
-    /// coordinator never reads it.)
-    func recordPublicActivity(forChannelKey key: String)
-    func sendMeshMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date)
-    func sendGeohash(context: ChatViewModel.GeoOutgoingContext)
-
-    // MARK: Geohash identity (shared with the other contexts)
-    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
-}
-
-extension ChatViewModel: ChatOutgoingContext {
-    // `nickname`, `myPeerID`, `activeChannel`, `selectedPrivateChatPeer`,
-    // `isTeleported`, `handleCommand(_:)`, `updatePrivateChatPeerIfNeeded()`,
-    // `sendPrivateMessage(_:to:)`, `parseMentions(from:)`,
-    // `appendPublicMessage(_:to:)`, `addSystemMessage(_:)`,
-    // `normalizedContentKey(_:)`, `recordContentKey(_:timestamp:)`,
-    // `sendMeshMessage(_:mentions:messageID:timestamp:)`,
-    // `sendGeohash(context:)`, and `deriveNostrIdentity(forGeohash:)` are
-    // shared requirements with the other contexts or satisfied by existing
-    // `ChatViewModel` members. The single-writer intent op below lives next to
-    // its backing state's owner.
-
-    func recordPublicActivity(forChannelKey key: String) {
-        lastPublicActivityAt[key] = Date()
-    }
-}
-
 @MainActor
 final class ChatOutgoingCoordinator {
-    private unowned let context: any ChatOutgoingContext
+    private unowned let viewModel: ChatViewModel
 
-    init(context: any ChatOutgoingContext) {
-        self.context = context
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
     }
 
     func sendMessage(_ content: String) {
         guard let trimmed = content.trimmedOrNilIfEmpty else { return }
 
         if content.hasPrefix("/") {
-            Task { @MainActor [weak context = self.context] in
-                context?.handleCommand(content)
+            Task { @MainActor [weak viewModel] in
+                viewModel?.handleCommand(content)
             }
             return
         }
 
-        if context.selectedPrivateChatPeer != nil {
-            context.updatePrivateChatPeerIfNeeded()
+        if viewModel.selectedPrivateChatPeer != nil {
+            viewModel.updatePrivateChatPeerIfNeeded()
 
-            if let selectedPeer = context.selectedPrivateChatPeer {
-                context.sendPrivateMessage(content, to: selectedPeer)
+            if let selectedPeer = viewModel.selectedPrivateChatPeer {
+                viewModel.sendPrivateMessage(content, to: selectedPeer)
             }
             return
         }
 
-        let mentions = context.parseMentions(from: content)
+        let mentions = viewModel.parseMentions(from: content)
         let preparedMessage = preparePublicMessage(content: content, trimmed: trimmed, mentions: mentions)
         guard let preparedMessage else { return }
 
@@ -113,28 +51,28 @@ private extension ChatOutgoingCoordinator {
         mentions: [String]
     ) -> (message: BitchatMessage, geoContext: ChatViewModel.GeoOutgoingContext?)? {
         var geoContext: ChatViewModel.GeoOutgoingContext?
-        var displaySender = context.nickname
-        var localSenderPeerID = context.myPeerID
+        var displaySender = viewModel.nickname
+        var localSenderPeerID = viewModel.meshService.myPeerID
         var messageID: String?
         var messageTimestamp = Date()
 
-        switch context.activeChannel {
+        switch viewModel.activeChannel {
         case .mesh:
             break
 
         case .location(let channel):
             do {
-                let identity = try context.deriveNostrIdentity(forGeohash: channel.geohash)
+                let identity = try viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash)
                 let suffix = String(identity.publicKeyHex.suffix(4))
-                displaySender = context.nickname + "#" + suffix
+                displaySender = viewModel.nickname + "#" + suffix
                 localSenderPeerID = PeerID(nostr: identity.publicKeyHex)
 
-                let teleported = context.isTeleported
+                let teleported = viewModel.locationManager.teleported
                 let event = try NostrProtocol.createEphemeralGeohashEvent(
                     content: trimmed,
                     geohash: channel.geohash,
                     senderIdentity: identity,
-                    nickname: context.nickname,
+                    nickname: viewModel.nickname,
                     teleported: teleported
                 )
 
@@ -148,7 +86,7 @@ private extension ChatOutgoingCoordinator {
                 )
             } catch {
                 SecureLogger.error("❌ Failed to prepare geohash message: \(error)", category: .session)
-                context.addSystemMessage(
+                viewModel.addSystemMessage(
                     String(localized: "system.location.send_failed", comment: "System message when a location channel send fails")
                 )
                 return nil
@@ -169,10 +107,12 @@ private extension ChatOutgoingCoordinator {
     }
 
     func appendLocalEcho(_ message: BitchatMessage) {
-        context.appendPublicMessage(message, to: ConversationID(channelID: context.activeChannel))
+        viewModel.timelineStore.append(message, to: viewModel.activeChannel)
+        viewModel.refreshVisibleMessages(from: viewModel.activeChannel)
 
-        let contentKey = context.normalizedContentKey(message.content)
-        context.recordContentKey(contentKey, timestamp: message.timestamp)
+        let contentKey = viewModel.deduplicationService.normalizedContentKey(message.content)
+        viewModel.deduplicationService.recordContentKey(contentKey, timestamp: message.timestamp)
+        viewModel.trimMessagesIfNeeded()
     }
 
     func routePublicMessage(
@@ -182,10 +122,10 @@ private extension ChatOutgoingCoordinator {
         messageID: String,
         timestamp: Date
     ) {
-        switch context.activeChannel {
+        switch viewModel.activeChannel {
         case .mesh:
-            context.recordPublicActivity(forChannelKey: "mesh")
-            context.sendMeshMessage(
+            viewModel.lastPublicActivityAt["mesh"] = Date()
+            viewModel.meshService.sendMessage(
                 originalContent,
                 mentions: mentions,
                 messageID: messageID,
@@ -193,18 +133,18 @@ private extension ChatOutgoingCoordinator {
             )
 
         case .location(let channel):
-            context.recordPublicActivity(forChannelKey: "geo:\(channel.geohash)")
+            viewModel.lastPublicActivityAt["geo:\(channel.geohash)"] = Date()
 
             guard let geoContext, geoContext.channel.geohash == channel.geohash else {
                 SecureLogger.error("Geo: missing send context for \(channel.geohash)", category: .session)
-                context.addSystemMessage(
+                viewModel.addSystemMessage(
                     String(localized: "system.location.send_failed", comment: "System message when a location channel send fails")
                 )
                 return
             }
 
-            Task { @MainActor [weak context = self.context] in
-                context?.sendGeohash(context: geoContext)
+            Task { @MainActor [weak viewModel] in
+                viewModel?.sendGeohash(context: geoContext)
             }
         }
     }

bitchat/ViewModels/ChatPeerIdentityCoordinator.swift

@@ -3,247 +3,24 @@ import BitLogger
 import CoreBluetooth
 import Foundation
 
-/// The narrow surface `ChatPeerIdentityCoordinator` needs from its owner.
-///
-/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
-/// minimal context it actually uses instead of holding an `unowned` back-ref
-/// to the whole `ChatViewModel`. This keeps the coordinator independently
-/// testable (see `ChatPeerIdentityCoordinatorContextTests`) and makes its true
-/// dependencies explicit. Several members are flattened service accesses —
-/// this coordinator implements the `ChatViewModel`-level peer-identity API, so
-/// its context members deliberately sit one level below those wrappers
-/// (`unifiedIsBlocked(_:)` vs `isPeerBlocked(_:)`, `unifiedFingerprint(for:)`
-/// vs `getFingerprint(for:)`, …) to avoid call cycles.
-@MainActor
-protocol ChatPeerIdentityContext: AnyObject {
-    // MARK: Conversation state
-    var privateChats: [PeerID: [BitchatMessage]] { get }
-    /// A single private chat's timeline. Witnessed by the store-direct
-    /// lookup on `ChatViewModel` (no `privateChats` dictionary build).
-    func privateMessages(for peerID: PeerID) -> [BitchatMessage]
-    var unreadPrivateMessages: Set<PeerID> { get }
-    /// Clears the peer's unread flag (single-writer store intent).
-    func markPrivateChatRead(_ peerID: PeerID)
-    /// Moves all messages from `oldPeerID`'s chat into `newPeerID`'s chat
-    /// (dedup by ID, order preserved, unread carried, old chat removed).
-    func migratePrivateChat(from oldPeerID: PeerID, to newPeerID: PeerID)
-    var selectedPrivateChatPeer: PeerID? { get set }
-    var selectedPrivateChatFingerprint: String? { get set }
-    var nickname: String { get }
-    var myPeerID: PeerID { get }
-    var activeChannel: ChannelID { get }
-    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
-    func notifyUIChanged()
-    func addSystemMessage(_ content: String)
-
-    // MARK: Private chat session lifecycle
-    /// Merges messages stored under alternate peer-ID representations into `peerID`'s chat.
-    /// Returns `true` when unread messages were discovered during consolidation.
-    @discardableResult
-    func consolidatePrivateMessages(for peerID: PeerID, peerNickname: String) -> Bool
-    /// Marks read receipts as sent for own messages already delivered/read in
-    /// `peerID`'s chat. (Single mutation path into the owner's
-    /// `sentReadReceipts`; this coordinator never touches the raw set.)
-    func syncReadReceiptsForSentMessages(for peerID: PeerID)
-    /// Re-targets the private chat session: selection mutates through the
-    /// `ConversationStore` intent (the store owns selection).
-    func beginPrivateChatSession(with peerID: PeerID)
-    func markPrivateMessagesAsRead(from peerID: PeerID)
-
-    // MARK: Unified peer service
-    var connectedPeers: Set<PeerID> { get }
-    /// The peer's current entry in the unified peer service, if known.
-    func unifiedPeer(for peerID: PeerID) -> BitchatPeer?
-    func unifiedIsBlocked(_ peerID: PeerID) -> Bool
-    func unifiedToggleFavorite(_ peerID: PeerID)
-    func unifiedFingerprint(for peerID: PeerID) -> String?
-    func unifiedPeerID(forNickname nickname: String) -> PeerID?
-    /// Resolves the ephemeral (short) peer ID for a known Noise public key, if connected.
-    func ephemeralPeerID(forNoiseKey noiseKey: Data) -> PeerID?
-
-    // MARK: Mesh & Noise sessions
-    func peerNickname(for peerID: PeerID) -> String?
-    func meshPeerNicknames() -> [PeerID: String]
-    func noiseSessionState(for peerID: PeerID) -> LazyHandshakeState
-    func triggerHandshake(with peerID: PeerID)
-    func hasEstablishedNoiseSession(with peerID: PeerID) -> Bool
-    func hasNoiseSession(with peerID: PeerID) -> Bool
-    /// Our own Noise identity fingerprint.
-    func noiseIdentityFingerprint() -> String
-
-    // MARK: Identity store (fingerprints & encryption status)
-    func setStoredFingerprint(_ fingerprint: String, for peerID: PeerID)
-    /// Moves the stored fingerprint mapping from `oldPeerID` to `newPeerID`,
-    /// falling back to `fallback` when none was stored. Returns the migrated fingerprint.
-    func migrateFingerprintMapping(from oldPeerID: PeerID, to newPeerID: PeerID, fallback: String?) -> String?
-    func isVerifiedFingerprint(_ fingerprint: String) -> Bool
-    func setEncryptionStatus(_ status: EncryptionStatus?, for peerID: PeerID)
-    func cachedEncryptionStatus(for peerID: PeerID) -> EncryptionStatus?
-    func setCachedEncryptionStatus(_ status: EncryptionStatus, for peerID: PeerID)
-    func invalidateStoredEncryptionCache(for peerID: PeerID?)
-    func socialIdentity(forFingerprint fingerprint: String) -> SocialIdentity?
-
-    // MARK: Favorites
-    /// The persisted favorite relationship for the peer's Noise static key, if any.
-    func favoriteRelationship(forNoiseKey noiseKey: Data) -> FavoritesPersistenceService.FavoriteRelationship?
-    /// The persisted favorite relationship for a short (ephemeral) peer ID, if any.
-    func favoriteRelationship(forPeerID peerID: PeerID) -> FavoritesPersistenceService.FavoriteRelationship?
-    /// Adds (or updates) a favorite in the favorites store.
-    func addFavorite(noiseKey: Data, nostrPublicKey: String?, nickname: String)
-    /// Removes a favorite from the favorites store.
-    func removeFavorite(noiseKey: Data)
-
-    // MARK: Geohash & Nostr
-    var geoNicknames: [String: String] { get }
-    func visibleGeohashPeople() -> [GeoPerson]
-    /// Records the Nostr pubkey behind a (possibly virtual) peer ID.
-    func registerNostrKeyMapping(_ pubkey: String, for peerID: PeerID)
-    func bridgedNostrPublicKey(for noiseKey: Data) -> String?
-    func sendFavoriteNotificationViaNostr(noisePublicKey: Data, isFavorite: Bool)
-}
-
-extension ChatViewModel: ChatPeerIdentityContext {
-    // `privateChats`, `unreadPrivateMessages`, `selectedPrivateChatPeer`,
-    // `selectedPrivateChatFingerprint`, `nickname`, `myPeerID`,
-    // `activeChannel`, `connectedPeers`, `geoNicknames`, `notifyUIChanged()`,
-    // `addSystemMessage(_:)`, `peerNickname(for:)`, `meshPeerNicknames()`,
-    // `ephemeralPeerID(forNoiseKey:)`, `unifiedPeer(for:)`,
-    // `registerNostrKeyMapping(_:for:)`, `visibleGeohashPeople()`,
-    // `markPrivateMessagesAsRead(from:)`, `sendFavoriteNotificationViaNostr`,
-    // and the conversation-store sync methods are shared requirements with
-    // the other contexts or satisfied by existing `ChatViewModel` members.
-    // The single-writer intent op `syncReadReceiptsForSentMessages(for:)`
-    // lives next to its backing state in `ChatViewModel`. The members below
-    // flatten nested service accesses into intent-named calls.
-
-    @discardableResult
-    func consolidatePrivateMessages(for peerID: PeerID, peerNickname: String) -> Bool {
-        privateChatManager.consolidateMessages(
-            for: peerID,
-            peerNickname: peerNickname,
-            persistedReadReceipts: sentReadReceipts
-        )
-    }
-
-    func beginPrivateChatSession(with peerID: PeerID) {
-        privateChatManager.startChat(with: peerID)
-    }
-
-    func unifiedIsBlocked(_ peerID: PeerID) -> Bool {
-        unifiedPeerService.isBlocked(peerID)
-    }
-
-    func unifiedToggleFavorite(_ peerID: PeerID) {
-        unifiedPeerService.toggleFavorite(peerID)
-    }
-
-    func unifiedFingerprint(for peerID: PeerID) -> String? {
-        unifiedPeerService.getFingerprint(for: peerID)
-    }
-
-    func unifiedPeerID(forNickname nickname: String) -> PeerID? {
-        unifiedPeerService.getPeerID(for: nickname)
-    }
-
-    func noiseSessionState(for peerID: PeerID) -> LazyHandshakeState {
-        meshService.getNoiseSessionState(for: peerID)
-    }
-
-    func triggerHandshake(with peerID: PeerID) {
-        meshService.triggerHandshake(with: peerID)
-    }
-
-    func hasEstablishedNoiseSession(with peerID: PeerID) -> Bool {
-        if case .established = meshService.getNoiseSessionState(for: peerID) { return true }
-        return false
-    }
-
-    func hasNoiseSession(with peerID: PeerID) -> Bool {
-        switch meshService.getNoiseSessionState(for: peerID) {
-        case .established, .handshaking: return true
-        case .none, .handshakeQueued, .failed: return false
-        }
-    }
-
-    func noiseIdentityFingerprint() -> String {
-        meshService.noiseIdentityFingerprint()
-    }
-
-    func setStoredFingerprint(_ fingerprint: String, for peerID: PeerID) {
-        peerIdentityStore.setFingerprint(fingerprint, for: peerID)
-    }
-
-    func migrateFingerprintMapping(from oldPeerID: PeerID, to newPeerID: PeerID, fallback: String?) -> String? {
-        peerIdentityStore.migrateFingerprintMapping(from: oldPeerID, to: newPeerID, fallback: fallback)
-    }
-
-    func isVerifiedFingerprint(_ fingerprint: String) -> Bool {
-        peerIdentityStore.isVerified(fingerprint)
-    }
-
-    func setEncryptionStatus(_ status: EncryptionStatus?, for peerID: PeerID) {
-        peerIdentityStore.setEncryptionStatus(status, for: peerID)
-    }
-
-    func cachedEncryptionStatus(for peerID: PeerID) -> EncryptionStatus? {
-        peerIdentityStore.cachedEncryptionStatus(for: peerID)
-    }
-
-    func setCachedEncryptionStatus(_ status: EncryptionStatus, for peerID: PeerID) {
-        peerIdentityStore.setCachedEncryptionStatus(status, for: peerID)
-    }
-
-    func invalidateStoredEncryptionCache(for peerID: PeerID?) {
-        peerIdentityStore.invalidateEncryptionCache(for: peerID)
-    }
-
-    func socialIdentity(forFingerprint fingerprint: String) -> SocialIdentity? {
-        identityManager.getSocialIdentity(for: fingerprint)
-    }
-
-    func bridgedNostrPublicKey(for noiseKey: Data) -> String? {
-        idBridge.getNostrPublicKey(for: noiseKey)
-    }
-
-    // `favoriteRelationship(forNoiseKey:)` is shared with
-    // `ChatPrivateConversationContext`; its witness lives in
-    // `ChatPrivateConversationCoordinator.swift`.
-
-    func favoriteRelationship(forPeerID peerID: PeerID) -> FavoritesPersistenceService.FavoriteRelationship? {
-        FavoritesPersistenceService.shared.getFavoriteStatus(forPeerID: peerID)
-    }
-
-    func addFavorite(noiseKey: Data, nostrPublicKey: String?, nickname: String) {
-        FavoritesPersistenceService.shared.addFavorite(
-            peerNoisePublicKey: noiseKey,
-            peerNostrPublicKey: nostrPublicKey,
-            peerNickname: nickname
-        )
-    }
-
-    func removeFavorite(noiseKey: Data) {
-        FavoritesPersistenceService.shared.removeFavorite(peerNoisePublicKey: noiseKey)
-    }
-}
-
 final class ChatPeerIdentityCoordinator {
-    private unowned let context: any ChatPeerIdentityContext
+    private unowned let viewModel: ChatViewModel
 
-    init(context: any ChatPeerIdentityContext) {
-        self.context = context
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
     }
 
     @MainActor
     func openMostRelevantPrivateChat() {
-        let unreadSorted = context.unreadPrivateMessages
-            .map { ($0, context.privateMessages(for: $0).last?.timestamp ?? Date.distantPast) }
+        let unreadSorted = viewModel.unreadPrivateMessages
+            .map { ($0, viewModel.privateChats[$0]?.last?.timestamp ?? Date.distantPast) }
             .sorted { $0.1 > $1.1 }
         if let target = unreadSorted.first?.0 {
             startPrivateChat(with: target)
             return
         }
 
-        let recent = context.privateChats
+        let recent = viewModel.privateChats
             .map { (id: $0.key, ts: $0.value.last?.timestamp ?? Date.distantPast) }
             .sorted { $0.ts > $1.ts }
         if let target = recent.first?.id {
@@ -253,7 +30,7 @@ final class ChatPeerIdentityCoordinator {
 
     @MainActor
     func isPeerBlocked(_ peerID: PeerID) -> Bool {
-        context.unifiedIsBlocked(peerID)
+        viewModel.unifiedPeerService.isBlocked(peerID)
     }
 
     @MainActor
@@ -261,24 +38,24 @@ final class ChatPeerIdentityCoordinator {
         var noiseKeyPeerID: PeerID?
         var nostrPeerID: PeerID?
 
-        if let peer = context.unifiedPeer(for: peerID) {
+        if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
             noiseKeyPeerID = PeerID(hexData: peer.noisePublicKey)
             if let nostrHex = peer.nostrPublicKey {
                 nostrPeerID = PeerID(nostr_: nostrHex)
             }
         }
 
-        let unreadContext = ChatUnreadPeerContext(
+        let context = ChatUnreadPeerContext(
             peerID: peerID,
             noiseKeyPeerID: noiseKeyPeerID,
             nostrPeerID: nostrPeerID,
-            nickname: context.peerNickname(for: peerID)
+            nickname: viewModel.meshService.peerNickname(peerID: peerID)
         )
 
         return ChatUnreadStateResolver.hasUnreadMessages(
-            for: unreadContext,
-            unreadPrivateMessages: context.unreadPrivateMessages,
-            privateChats: context.privateChats
+            for: context,
+            unreadPrivateMessages: viewModel.unreadPrivateMessages,
+            privateChats: viewModel.privateChats
         )
     }
 
@@ -289,44 +66,46 @@ final class ChatPeerIdentityCoordinator {
             return
         }
 
-        context.unifiedToggleFavorite(peerID)
-        context.notifyUIChanged()
+        viewModel.unifiedPeerService.toggleFavorite(peerID)
+        viewModel.objectWillChange.send()
     }
 
     @MainActor
     func isFavorite(peerID: PeerID) -> Bool {
         if let noisePublicKey = peerID.noiseKey {
-            return context.favoriteRelationship(forNoiseKey: noisePublicKey)?.isFavorite ?? false
+            return FavoritesPersistenceService.shared.getFavoriteStatus(for: noisePublicKey)?.isFavorite ?? false
         }
 
-        return context.unifiedPeer(for: peerID)?.isFavorite ?? false
+        return viewModel.unifiedPeerService.getPeer(by: peerID)?.isFavorite ?? false
     }
 
     @MainActor
     func updatePrivateChatPeerIfNeeded() {
-        guard let chatFingerprint = context.selectedPrivateChatFingerprint,
+        guard let chatFingerprint = viewModel.selectedPrivateChatFingerprint,
               let currentPeerID = currentPeerID(forFingerprint: chatFingerprint) else {
             return
         }
 
-        if let oldPeerID = context.selectedPrivateChatPeer, oldPeerID != currentPeerID {
+        if let oldPeerID = viewModel.selectedPrivateChatPeer, oldPeerID != currentPeerID {
             migrateChatState(from: oldPeerID, to: currentPeerID)
-            context.selectedPrivateChatPeer = currentPeerID
-        } else if context.selectedPrivateChatPeer == nil {
-            context.selectedPrivateChatPeer = currentPeerID
+            viewModel.selectedPrivateChatPeer = currentPeerID
+        } else if viewModel.selectedPrivateChatPeer == nil {
+            viewModel.selectedPrivateChatPeer = currentPeerID
         }
 
-        context.markPrivateChatRead(currentPeerID)
+        var unread = viewModel.unreadPrivateMessages
+        unread.remove(currentPeerID)
+        viewModel.unreadPrivateMessages = unread
     }
 
     @MainActor
     func startPrivateChat(with peerID: PeerID) {
-        guard peerID != context.myPeerID else { return }
+        guard peerID != viewModel.meshService.myPeerID else { return }
 
-        let peerNickname = context.peerNickname(for: peerID) ?? "unknown"
+        let peerNickname = viewModel.meshService.peerNickname(peerID: peerID) ?? "unknown"
 
-        if context.unifiedIsBlocked(peerID) {
-            context.addSystemMessage(
+        if viewModel.unifiedPeerService.isBlocked(peerID) {
+            viewModel.addSystemMessage(
                 String(
                     format: String(
                         localized: "system.chat.blocked",
@@ -339,9 +118,9 @@ final class ChatPeerIdentityCoordinator {
             return
         }
 
-        if let peer = context.unifiedPeer(for: peerID),
+        if let peer = viewModel.unifiedPeerService.getPeer(by: peerID),
            peer.isFavorite && !peer.theyFavoritedUs && !peer.isConnected {
-            context.addSystemMessage(
+            viewModel.addSystemMessage(
                 String(
                     format: String(
                         localized: "system.chat.requires_favorite",
@@ -354,12 +133,16 @@ final class ChatPeerIdentityCoordinator {
             return
         }
 
-        _ = context.consolidatePrivateMessages(for: peerID, peerNickname: peerNickname)
+        _ = viewModel.privateChatManager.consolidateMessages(
+            for: peerID,
+            peerNickname: peerNickname,
+            persistedReadReceipts: viewModel.sentReadReceipts
+        )
 
         if !peerID.isGeoDM && !peerID.isGeoChat {
-            switch context.noiseSessionState(for: peerID) {
+            switch viewModel.meshService.getNoiseSessionState(for: peerID) {
             case .none, .failed:
-                context.triggerHandshake(with: peerID)
+                viewModel.meshService.triggerHandshake(with: peerID)
             case .handshakeQueued, .handshaking, .established:
                 break
             }
@@ -367,22 +150,28 @@ final class ChatPeerIdentityCoordinator {
             SecureLogger.debug("GeoDM: skipping mesh handshake for virtual peerID=\(peerID)", category: .session)
         }
 
-        context.syncReadReceiptsForSentMessages(for: peerID)
+        viewModel.privateChatManager.syncReadReceiptsForSentMessages(
+            peerID: peerID,
+            nickname: viewModel.nickname,
+            externalReceipts: &viewModel.sentReadReceipts
+        )
 
         if let fingerprint = getFingerprint(for: peerID) {
-            context.setStoredFingerprint(fingerprint, for: peerID)
-            context.selectedPrivateChatFingerprint = fingerprint
+            viewModel.peerIdentityStore.setFingerprint(fingerprint, for: peerID)
+            viewModel.peerIdentityStore.setSelectedPrivateChatFingerprint(fingerprint)
         } else {
-            context.selectedPrivateChatFingerprint = nil
+            viewModel.peerIdentityStore.setSelectedPrivateChatFingerprint(nil)
         }
-        context.beginPrivateChatSession(with: peerID)
-        context.markPrivateMessagesAsRead(from: peerID)
+        viewModel.privateChatManager.startChat(with: peerID)
+        viewModel.synchronizePrivateConversationStore()
+        viewModel.synchronizeConversationSelectionStore()
+        viewModel.markPrivateMessagesAsRead(from: peerID)
     }
 
     @MainActor
     func endPrivateChat() {
-        context.selectedPrivateChatPeer = nil
-        context.selectedPrivateChatFingerprint = nil
+        viewModel.selectedPrivateChatPeer = nil
+        viewModel.peerIdentityStore.setSelectedPrivateChatFingerprint(nil)
     }
 
     @MainActor
@@ -393,8 +182,8 @@ final class ChatPeerIdentityCoordinator {
     func handleFavoriteStatusChanged(_ notification: Notification) {
         guard let peerPublicKey = notification.userInfo?["peerPublicKey"] as? Data else { return }
 
-        Task { @MainActor [weak context = self.context] in
-            guard let context else { return }
+        Task { @MainActor [weak viewModel] in
+            guard let viewModel else { return }
 
             if let isKeyUpdate = notification.userInfo?["isKeyUpdate"] as? Bool,
                isKeyUpdate,
@@ -411,26 +200,28 @@ final class ChatPeerIdentityCoordinator {
                 let peerID = PeerID(hexData: peerPublicKey)
                 let action = isFavorite ? "favorited" : "unfavorited"
                 let peerNickname = favoriteNotificationNickname(for: peerID, peerPublicKey: peerPublicKey)
-                context.addSystemMessage("\(peerNickname) \(action) you")
+                viewModel.addSystemMessage("\(peerNickname) \(action) you")
             }
         }
     }
 
     @MainActor
     func updateEncryptionStatusForPeers() {
-        for peerID in context.connectedPeers {
+        for peerID in viewModel.connectedPeers {
             updateEncryptionStatus(for: peerID)
         }
     }
 
     @MainActor
     func updateEncryptionStatus(for peerID: PeerID) {
-        if context.hasEstablishedNoiseSession(with: peerID) {
-            context.setEncryptionStatus(verifiedEncryptionStatus(for: peerID), for: peerID)
-        } else if context.hasNoiseSession(with: peerID) {
-            context.setEncryptionStatus(.noiseHandshaking, for: peerID)
+        let noiseService = viewModel.meshService.getNoiseService()
+
+        if noiseService.hasEstablishedSession(with: peerID) {
+            viewModel.peerIdentityStore.setEncryptionStatus(verifiedEncryptionStatus(for: peerID), for: peerID)
+        } else if noiseService.hasSession(with: peerID) {
+            viewModel.peerIdentityStore.setEncryptionStatus(.noiseHandshaking, for: peerID)
         } else {
-            context.setEncryptionStatus(nil, for: peerID)
+            viewModel.peerIdentityStore.setEncryptionStatus(nil, for: peerID)
         }
 
         invalidateEncryptionCache(for: peerID)
@@ -438,12 +229,12 @@ final class ChatPeerIdentityCoordinator {
 
     @MainActor
     func getEncryptionStatus(for peerID: PeerID) -> EncryptionStatus {
-        if let cachedStatus = context.cachedEncryptionStatus(for: peerID) {
+        if let cachedStatus = viewModel.peerIdentityStore.cachedEncryptionStatus(for: peerID) {
             return cachedStatus
         }
 
         let hasEverEstablishedSession = getFingerprint(for: peerID) != nil
-        let sessionState = context.noiseSessionState(for: peerID)
+        let sessionState = viewModel.meshService.getNoiseSessionState(for: peerID)
 
         let status: EncryptionStatus
         switch sessionState {
@@ -457,18 +248,18 @@ final class ChatPeerIdentityCoordinator {
             status = hasEverEstablishedSession ? verifiedEncryptionStatus(for: peerID) : .none
         }
 
-        context.setCachedEncryptionStatus(status, for: peerID)
+        viewModel.peerIdentityStore.setCachedEncryptionStatus(status, for: peerID)
         return status
     }
 
     @MainActor
     func invalidateEncryptionCache(for peerID: PeerID? = nil) {
-        context.invalidateStoredEncryptionCache(for: peerID)
+        viewModel.peerIdentityStore.invalidateEncryptionCache(for: peerID)
     }
 
     @MainActor
     func getFingerprint(for peerID: PeerID) -> String? {
-        context.unifiedFingerprint(for: peerID)
+        viewModel.unifiedPeerService.getFingerprint(for: peerID)
     }
 
     @MainActor
@@ -479,12 +270,12 @@ final class ChatPeerIdentityCoordinator {
             return peerID.id
         }
 
-        if let nickname = context.meshPeerNicknames()[peerID] {
+        if let nickname = viewModel.meshService.getPeerNicknames()[peerID] {
             return nickname
         }
 
         if let fingerprint = getFingerprint(for: peerID),
-           let identity = context.socialIdentity(forFingerprint: fingerprint) {
+           let identity = viewModel.identityManager.getSocialIdentity(for: fingerprint) {
             if let petname = identity.localPetname {
                 return petname
             }
@@ -498,18 +289,19 @@ final class ChatPeerIdentityCoordinator {
 
     @MainActor
     func getMyFingerprint() -> String {
-        context.noiseIdentityFingerprint()
+        viewModel.meshService.getNoiseService().getIdentityFingerprint()
     }
 
     @MainActor
     func getPeerIDForNickname(_ nickname: String) -> PeerID? {
-        switch context.activeChannel {
+        switch viewModel.activeChannel {
         case .location:
             if nickname.contains("#"),
-               let person = context.visibleGeohashPeople()
+               let person = viewModel.publicConversationCoordinator
+                .visibleGeohashPeople()
                 .first(where: { $0.displayName == nickname }) {
                 let conversationKey = PeerID(nostr_: person.id)
-                context.registerNostrKeyMapping(person.id, for: conversationKey)
+                viewModel.nostrKeyMapping[conversationKey] = person.id
                 return conversationKey
             }
 
@@ -518,9 +310,9 @@ final class ChatPeerIdentityCoordinator {
                 .first
                 .map(String.init)?
                 .lowercased() ?? nickname.lowercased()
-            if let pubkey = context.geoNicknames.first(where: { $0.value.lowercased() == base })?.key {
+            if let pubkey = viewModel.geoNicknames.first(where: { $0.value.lowercased() == base })?.key {
                 let conversationKey = PeerID(nostr_: pubkey)
-                context.registerNostrKeyMapping(pubkey, for: conversationKey)
+                viewModel.nostrKeyMapping[conversationKey] = pubkey
                 return conversationKey
             }
 
@@ -528,20 +320,20 @@ final class ChatPeerIdentityCoordinator {
             break
         }
 
-        return context.unifiedPeerID(forNickname: nickname)
+        return viewModel.unifiedPeerService.getPeerID(for: nickname)
     }
 
     @MainActor
     func nicknameForPeer(_ peerID: PeerID) -> String {
-        if let name = context.peerNickname(for: peerID) {
+        if let name = viewModel.meshService.peerNickname(peerID: peerID) {
             return name
         }
-        if let favorite = context.favoriteRelationship(forPeerID: peerID),
+        if let favorite = FavoritesPersistenceService.shared.getFavoriteStatus(forPeerID: peerID),
            !favorite.peerNickname.isEmpty {
             return favorite.peerNickname
         }
         if let noiseKey = Data(hexString: peerID.id),
-           let favorite = context.favoriteRelationship(forNoiseKey: noiseKey),
+           let favorite = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey),
            !favorite.peerNickname.isEmpty {
             return favorite.peerNickname
         }
@@ -552,7 +344,7 @@ final class ChatPeerIdentityCoordinator {
 private extension ChatPeerIdentityCoordinator {
     @MainActor
     func currentPeerID(forFingerprint fingerprint: String) -> PeerID? {
-        for peerID in context.connectedPeers where getFingerprint(for: peerID) == fingerprint {
+        for peerID in viewModel.connectedPeers where getFingerprint(for: peerID) == fingerprint {
             return peerID
         }
         return nil
@@ -560,46 +352,63 @@ private extension ChatPeerIdentityCoordinator {
 
     @MainActor
     func migrateChatState(from oldPeerID: PeerID, to newPeerID: PeerID) {
-        // The store migration dedups by message ID, preserves timestamp
-        // order, carries the unread flag, and removes the old chat.
-        context.migratePrivateChat(from: oldPeerID, to: newPeerID)
+        if let oldMessages = viewModel.privateChats[oldPeerID] {
+            var chats = viewModel.privateChats
+            chats[newPeerID, default: []].append(contentsOf: oldMessages)
+            chats[newPeerID]?.sort { $0.timestamp < $1.timestamp }
+
+            var seenMessageIDs = Set<String>()
+            chats[newPeerID] = chats[newPeerID]?.filter { message in
+                if seenMessageIDs.contains(message.id) {
+                    return false
+                }
+                seenMessageIDs.insert(message.id)
+                return true
+            }
+
+            chats.removeValue(forKey: oldPeerID)
+            viewModel.privateChats = chats
+        }
+
+        var unread = viewModel.unreadPrivateMessages
+        if unread.contains(oldPeerID) {
+            unread.remove(oldPeerID)
+            unread.insert(newPeerID)
+            viewModel.unreadPrivateMessages = unread
+        }
     }
 
     @MainActor
     func migrateNoiseKeyUpdate(oldPeerID: PeerID, newPeerID: PeerID) {
-        // Capture before the migration: the store hands its selection off to
-        // `newPeerID` during `migrateChatState`, and the manager's selection
-        // mirrors the store, so the old peer ID is no longer selected after.
-        let wasSelected = context.selectedPrivateChatPeer == oldPeerID
-        if wasSelected {
+        if viewModel.selectedPrivateChatPeer == oldPeerID {
             SecureLogger.info("📱 Updating private chat peer ID due to key change: \(oldPeerID) -> \(newPeerID)", category: .session)
-        } else if !context.privateMessages(for: oldPeerID).isEmpty {
+        } else if viewModel.privateChats[oldPeerID] != nil {
             SecureLogger.debug("📱 Migrating private chat messages from \(oldPeerID) to \(newPeerID)", category: .session)
         }
 
         migrateChatState(from: oldPeerID, to: newPeerID)
 
-        if wasSelected {
-            context.selectedPrivateChatPeer = newPeerID
+        if viewModel.selectedPrivateChatPeer == oldPeerID {
+            viewModel.selectedPrivateChatPeer = newPeerID
         }
 
-        if let fingerprint = context.migrateFingerprintMapping(
+        if let fingerprint = viewModel.peerIdentityStore.migrateFingerprintMapping(
             from: oldPeerID,
             to: newPeerID,
             fallback: getFingerprint(for: newPeerID)
         ) {
-            if context.selectedPrivateChatPeer == newPeerID {
-                context.selectedPrivateChatFingerprint = fingerprint
+            if viewModel.selectedPrivateChatPeer == newPeerID {
+                viewModel.peerIdentityStore.setSelectedPrivateChatFingerprint(fingerprint)
             }
         }
     }
 
     @MainActor
     func favoriteNotificationNickname(for peerID: PeerID, peerPublicKey: Data) -> String {
-        if let nickname = context.peerNickname(for: peerID) {
+        if let nickname = viewModel.meshService.peerNickname(peerID: peerID) {
             return nickname
         }
-        if let favorite = context.favoriteRelationship(forNoiseKey: peerPublicKey) {
+        if let favorite = FavoritesPersistenceService.shared.getFavoriteStatus(for: peerPublicKey) {
             return favorite.peerNickname
         }
         return "Unknown"
@@ -608,7 +417,7 @@ private extension ChatPeerIdentityCoordinator {
     @MainActor
     func verifiedEncryptionStatus(for peerID: PeerID) -> EncryptionStatus {
         if let fingerprint = getFingerprint(for: peerID),
-           context.isVerifiedFingerprint(fingerprint) {
+           viewModel.peerIdentityStore.isVerified(fingerprint) {
             return .noiseVerified
         }
         return .noiseSecured
@@ -616,47 +425,39 @@ private extension ChatPeerIdentityCoordinator {
 
     @MainActor
     func toggleFavoriteForNoiseKey(_ noisePublicKey: Data, peerID: PeerID) {
-        if let ephemeralID = context.ephemeralPeerID(forNoiseKey: noisePublicKey) {
-            context.unifiedToggleFavorite(ephemeralID)
-            context.notifyUIChanged()
+        if let ephemeralID = viewModel.unifiedPeerService.peers.first(where: { $0.noisePublicKey == noisePublicKey })?.peerID {
+            viewModel.unifiedPeerService.toggleFavorite(ephemeralID)
+            viewModel.objectWillChange.send()
             return
         }
 
-        let currentStatus = context.favoriteRelationship(forNoiseKey: noisePublicKey)
-        let fallbackNickname = context.privateMessages(for: peerID).first { $0.senderPeerID == peerID }?.sender
+        let currentStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: noisePublicKey)
+        let fallbackNickname = viewModel.privateChats[peerID]?.first { $0.senderPeerID == peerID }?.sender
         let plan = ChatFavoriteTogglePolicy.plan(
             currentStatus: currentStatus.map(ChatFavoriteStatusSnapshot.init),
             fallbackNickname: fallbackNickname,
-            bridgedNostrKey: context.bridgedNostrPublicKey(for: noisePublicKey)
+            bridgedNostrKey: viewModel.idBridge.getNostrPublicKey(for: noisePublicKey)
         )
 
         switch plan.persistenceAction {
         case .add(let nickname, let nostrKey):
-            context.addFavorite(
-                noiseKey: noisePublicKey,
-                nostrPublicKey: nostrKey,
-                nickname: nickname
+            FavoritesPersistenceService.shared.addFavorite(
+                peerNoisePublicKey: noisePublicKey,
+                peerNostrPublicKey: nostrKey,
+                peerNickname: nickname
             )
 
         case .remove:
-            context.removeFavorite(noiseKey: noisePublicKey)
+            FavoritesPersistenceService.shared.removeFavorite(peerNoisePublicKey: noisePublicKey)
         }
 
-        context.notifyUIChanged()
+        viewModel.objectWillChange.send()
 
         if case .send(let isFavorite) = plan.notification {
-            context.sendFavoriteNotificationViaNostr(
+            viewModel.sendFavoriteNotificationViaNostr(
                 noisePublicKey: noisePublicKey,
                 isFavorite: isFavorite
             )
         }
     }
 }
-
-/// Default for conforming test contexts that model chats as a dictionary;
-/// `ChatViewModel` overrides with a store-direct lookup.
-extension ChatPeerIdentityContext {
-    func privateMessages(for peerID: PeerID) -> [BitchatMessage] {
-        privateChats[peerID] ?? []
-    }
-}

bitchat/ViewModels/ChatPeerListCoordinator.swift

@@ -2,86 +2,16 @@ import BitFoundation
 import BitLogger
 import Foundation
 
-/// The narrow surface `ChatPeerListCoordinator` needs from its owner.
-///
-/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
-/// minimal context it actually uses instead of holding an `unowned` back-ref
-/// to the whole `ChatViewModel`. This keeps the coordinator independently
-/// testable (see `ChatPeerListCoordinatorContextTests`) and makes its true
-/// dependencies explicit.
-@MainActor
-protocol ChatPeerListContext: AnyObject {
-    // MARK: Connection & chat state
-    var isConnected: Bool { get set }
-    /// A single private chat's timeline (store-direct lookup on
-    /// `ChatViewModel`; no `privateChats` dictionary build).
-    func privateMessages(for peerID: PeerID) -> [BitchatMessage]
-    var unreadPrivateMessages: Set<PeerID> { get }
-    /// Clears the peer's unread flag (single-writer store intent).
-    func markPrivateChatRead(_ peerID: PeerID)
-    var hasTrackedPrivateChatSelection: Bool { get }
-    func updatePrivateChatPeerIfNeeded()
-    func cleanupOldReadReceipts()
-
-    // MARK: Peers & sessions
-    var unifiedPeers: [BitchatPeer] { get }
-    func isPeerConnected(_ peerID: PeerID) -> Bool
-    func isPeerReachable(_ peerID: PeerID) -> Bool
-    /// Number of mesh peers currently connected or reachable, from the
-    /// transport's live peer snapshots.
-    func activeMeshPeerCount() -> Int
-    func registerEphemeralSession(peerID: PeerID)
-    func updateEncryptionStatusForPeers()
-
-    // MARK: Notifications
-    /// Posts the "bitchatters nearby" local notification.
-    func notifyNetworkAvailable(peerCount: Int)
-}
-
-extension ChatViewModel: ChatPeerListContext {
-    // `isConnected`, `privateMessages(for:)`, `unreadPrivateMessages`,
-    // `hasTrackedPrivateChatSelection`, `updatePrivateChatPeerIfNeeded()`,
-    // `cleanupOldReadReceipts()`, `unifiedPeers`, `isPeerConnected(_:)`,
-    // `isPeerReachable(_:)`, `registerEphemeralSession(peerID:)`, and
-    // `updateEncryptionStatusForPeers()` are shared requirements with the
-    // other contexts or satisfied by existing `ChatViewModel` members. The
-    // member below flattens the nested transport access into an intent-named
-    // call.
-
-    func activeMeshPeerCount() -> Int {
-        meshService
-            .currentPeerSnapshots()
-            .filter { snapshot in
-                snapshot.isConnected || meshService.isPeerReachable(snapshot.peerID)
-            }
-            .count
-    }
-
-    func notifyNetworkAvailable(peerCount: Int) {
-        NotificationService.shared.sendNetworkAvailableNotification(peerCount: peerCount)
-    }
-}
-
 final class ChatPeerListCoordinator: @unchecked Sendable {
-    private unowned let context: any ChatPeerListContext
+    private unowned let viewModel: ChatViewModel
     private var recentlySeenPeers: Set<PeerID> = []
-    // The "bitchatters nearby" notification only fires on the transition from
-    // an empty mesh to a populated one — joining peers while already meshed
-    // are visible in the app and must not notify. Set back to true only after
-    // a confirmed-empty reset, so brief link flaps stay silent.
-    private var meshWasEmpty = true
     private var lastNetworkNotificationTime = Date.distantPast
     private var networkResetTimer: Timer?
     private var networkEmptyTimer: Timer?
     private let networkResetGraceSeconds = TransportConfig.networkResetGraceSeconds
-    private let notificationCooldownSeconds: TimeInterval
 
-    init(
-        context: any ChatPeerListContext,
-        notificationCooldownSeconds: TimeInterval = TransportConfig.networkNotificationCooldownSeconds
-    ) {
-        self.context = context
-        self.notificationCooldownSeconds = notificationCooldownSeconds
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
     }
 
     deinit {
@@ -99,23 +29,23 @@ final class ChatPeerListCoordinator: @unchecked Sendable {
 private extension ChatPeerListCoordinator {
     @MainActor
     func handlePeerListUpdate(_ peers: [PeerID]) {
-        context.isConnected = !peers.isEmpty
+        viewModel.isConnected = !peers.isEmpty
         cleanupStaleUnreadPeerIDs()
 
         let meshPeers = peers.filter { peerID in
-            context.isPeerConnected(peerID) || context.isPeerReachable(peerID)
+            viewModel.meshService.isPeerConnected(peerID) || viewModel.meshService.isPeerReachable(peerID)
         }
 
         handleNetworkAvailability(meshPeers)
 
         for peerID in peers {
-            context.registerEphemeralSession(peerID: peerID)
+            viewModel.identityManager.registerEphemeralSession(peerID: peerID, handshakeState: .none)
         }
 
-        context.updateEncryptionStatusForPeers()
+        viewModel.updateEncryptionStatusForPeers()
 
-        if context.hasTrackedPrivateChatSelection {
-            context.updatePrivateChatPeerIfNeeded()
+        if viewModel.hasTrackedPrivateChatSelection {
+            viewModel.updatePrivateChatPeerIfNeeded()
         }
     }
 
@@ -131,20 +61,13 @@ private extension ChatPeerListCoordinator {
         invalidateNetworkEmptyTimer()
 
         let newPeers = meshPeerSet.subtracting(recentlySeenPeers)
-        // Record every sighted peer even when no notification fires. A peer
-        // first seen during the cooldown (or while already meshed) must not
-        // still count as "new" at some later peer-list event — that re-fired
-        // the notification while devices sat idle and connected.
-        recentlySeenPeers.formUnion(meshPeerSet)
+        guard !newPeers.isEmpty else { return }
 
-        let cameFromEmpty = meshWasEmpty
-        meshWasEmpty = false
-
-        guard cameFromEmpty, !newPeers.isEmpty else { return }
-
-        if Date().timeIntervalSince(lastNetworkNotificationTime) >= notificationCooldownSeconds {
+        let cooldown = TransportConfig.networkNotificationCooldownSeconds
+        if Date().timeIntervalSince(lastNetworkNotificationTime) >= cooldown {
+            recentlySeenPeers.formUnion(newPeers)
             lastNetworkNotificationTime = Date()
-            context.notifyNetworkAvailable(peerCount: meshPeers.count)
+            NotificationService.shared.sendNetworkAvailableNotification(peerCount: meshPeers.count)
             SecureLogger.info(
                 "👥 Sent bitchatters nearby notification for \(meshPeers.count) mesh peers (new: \(newPeers.count))",
                 category: .session
@@ -156,34 +79,34 @@ private extension ChatPeerListCoordinator {
 
     @MainActor
     func cleanupStaleUnreadPeerIDs() {
-        let currentPeerIDs = Set(context.unifiedPeers.map(\.peerID))
-        let staleIDs = context.unreadPrivateMessages.subtracting(currentPeerIDs)
+        let currentPeerIDs = Set(viewModel.unifiedPeerService.peers.map(\.peerID))
+        let staleIDs = viewModel.unreadPrivateMessages.subtracting(currentPeerIDs)
 
         guard !staleIDs.isEmpty else {
-            context.cleanupOldReadReceipts()
+            viewModel.cleanupOldReadReceipts()
             return
         }
 
         var idsToRemove: [PeerID] = []
 
         for staleID in staleIDs {
-            if staleID.isGeoDM, !context.privateMessages(for: staleID).isEmpty {
+            if staleID.isGeoDM, let messages = viewModel.privateChats[staleID], !messages.isEmpty {
                 continue
             }
 
-            if staleID.isNoiseKeyHex, !context.privateMessages(for: staleID).isEmpty {
+            if staleID.isNoiseKeyHex, let messages = viewModel.privateChats[staleID], !messages.isEmpty {
                 continue
             }
 
             idsToRemove.append(staleID)
-            context.markPrivateChatRead(staleID)
+            viewModel.unreadPrivateMessages.remove(staleID)
         }
 
         if !idsToRemove.isEmpty {
             SecureLogger.debug("🧹 Cleaned up \(idsToRemove.count) stale unread peer IDs", category: .session)
         }
 
-        context.cleanupOldReadReceipts()
+        viewModel.cleanupOldReadReceipts()
     }
 
     @MainActor
@@ -198,15 +121,18 @@ private extension ChatPeerListCoordinator {
 
     @MainActor
     func handleNetworkResetTimerFired() {
-        let activeMeshPeerCount = context.activeMeshPeerCount()
+        let activeMeshPeers = viewModel.meshService
+            .currentPeerSnapshots()
+            .filter { snapshot in
+                snapshot.isConnected || viewModel.meshService.isPeerReachable(snapshot.peerID)
+            }
 
-        if activeMeshPeerCount == 0 {
+        if activeMeshPeers.isEmpty {
             recentlySeenPeers.removeAll()
-            meshWasEmpty = true
             SecureLogger.debug("⏱️ Network notification window reset after quiet period", category: .session)
         } else {
             SecureLogger.debug(
-                "⏱️ Skipped network notification reset; still seeing \(activeMeshPeerCount) mesh peers",
+                "⏱️ Skipped network notification reset; still seeing \(activeMeshPeers.count) mesh peers",
                 category: .session
             )
         }
@@ -239,15 +165,18 @@ private extension ChatPeerListCoordinator {
 
     @MainActor
     func handleNetworkEmptyTimerFired() {
-        let activeMeshPeerCount = context.activeMeshPeerCount()
+        let activeMeshPeers = viewModel.meshService
+            .currentPeerSnapshots()
+            .filter { snapshot in
+                snapshot.isConnected || viewModel.meshService.isPeerReachable(snapshot.peerID)
+            }
 
-        if activeMeshPeerCount == 0 {
+        if activeMeshPeers.isEmpty {
             recentlySeenPeers.removeAll()
-            meshWasEmpty = true
             SecureLogger.debug("⏳ Mesh empty — notification state reset after confirmation", category: .session)
         } else {
             SecureLogger.debug(
-                "⏳ Mesh empty timer cancelled; \(activeMeshPeerCount) mesh peers detected again",
+                "⏳ Mesh empty timer cancelled; \(activeMeshPeers.count) mesh peers detected again",
                 category: .session
             )
         }

bitchat/ViewModels/ChatPrivateConversationCoordinator.swift

@@ -2,235 +2,20 @@ import BitFoundation
 import BitLogger
 import Foundation
 
-/// The narrow surface `ChatPrivateConversationCoordinator` needs from its owner.
-///
-/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
-/// minimal context it actually uses instead of holding an `unowned` back-ref
-/// to the whole `ChatViewModel`. This keeps the coordinator independently
-/// testable (see `ChatPrivateConversationCoordinatorContextTests`) and makes
-/// its true dependencies explicit. The surface is intentionally large — it
-/// documents the coordinator's real coupling to private-chat state, peer
-/// identity, and the routing/ack transports.
-@MainActor
-protocol ChatPrivateConversationContext: AnyObject {
-    // MARK: Conversation state
-    var privateChats: [PeerID: [BitchatMessage]] { get }
-    /// A single private chat's timeline. Witnessed by the store-direct
-    /// lookup on `ChatViewModel` (no `privateChats` dictionary build).
-    func privateMessages(for peerID: PeerID) -> [BitchatMessage]
-    var sentReadReceipts: Set<String> { get }
-    var unreadPrivateMessages: Set<PeerID> { get }
-    var selectedPrivateChatPeer: PeerID? { get }
-    var nickname: String { get }
-    var activeChannel: ChannelID { get }
-    var nostrKeyMapping: [PeerID: String] { get }
-
-    // MARK: Conversation store intents
-    // The sole mutation paths for private message state (single-writer
-    // `ConversationStore` ops; see docs/CONVERSATION-STORE-DESIGN.md).
-    /// Appends a private message in timestamp order; returns `false` on
-    /// duplicate message ID.
-    @discardableResult
-    func appendPrivateMessage(_ message: BitchatMessage, to peerID: PeerID) -> Bool
-    /// Replace-or-append a private message by ID, keeping its position.
-    func upsertPrivateMessage(_ message: BitchatMessage, in peerID: PeerID)
-    /// Applies a delivery status by message ID; returns `false` when the
-    /// message is unknown or the update would downgrade the status.
-    @discardableResult
-    func setPrivateDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String, peerID: PeerID) -> Bool
-    func markPrivateChatUnread(_ peerID: PeerID)
-    func markPrivateChatRead(_ peerID: PeerID)
-    /// Removes the peer's chat entirely, including unread state.
-    func removePrivateChat(_ peerID: PeerID)
-    /// Moves all messages from `oldPeerID`'s chat into `newPeerID`'s chat
-    /// (dedup by ID, order preserved, unread carried, old chat removed).
-    func migratePrivateChat(from oldPeerID: PeerID, to newPeerID: PeerID)
-    /// `true` when any private chat contains a message with `messageID`.
-    func privateChatsContainMessage(withID messageID: String) -> Bool
-    /// `true` when `peerID`'s chat contains a message with `messageID`.
-    func privateChat(_ peerID: PeerID, containsMessageWithID messageID: String) -> Bool
-
-    /// Records that a read receipt is being sent for `messageID`.
-    /// Returns `false` when one was already recorded — the caller must skip sending.
-    @discardableResult
-    func markReadReceiptSent(_ messageID: String) -> Bool
-    /// Records that a GeoDM delivery ACK is being sent for `messageID`.
-    /// Returns `false` when one was already recorded — the caller must skip sending.
-    @discardableResult
-    func markGeoDeliveryAckSent(_ messageID: String) -> Bool
-    /// Moves the open private chat to `newPeerID` when the current selection is
-    /// one of the peer IDs being migrated away.
-    func handOffSelectedPrivateChat(from oldPeerIDs: [PeerID], to newPeerID: PeerID)
-    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
-    func notifyUIChanged()
-
-    // MARK: Peers & identity
-    var myPeerID: PeerID { get }
-    func peerNickname(for peerID: PeerID) -> String?
-    func isPeerConnected(_ peerID: PeerID) -> Bool
-    func isPeerReachable(_ peerID: PeerID) -> Bool
-    func isPeerBlocked(_ peerID: PeerID) -> Bool
-    func noisePublicKey(for peerID: PeerID) -> Data?
-    /// Resolves the ephemeral (short) peer ID for a known Noise public key, if connected.
-    func ephemeralPeerID(forNoiseKey noiseKey: Data) -> PeerID?
-    func getPeerIDForNickname(_ nickname: String) -> PeerID?
-    func getFingerprint(for peerID: PeerID) -> String?
-    func storedFingerprint(for peerID: PeerID) -> String?
-    func clearStoredFingerprint(for peerID: PeerID)
-
-    // MARK: Nostr identity
-    func isNostrBlocked(pubkeyHexLowercased: String) -> Bool
-    func displayNameForNostrPubkey(_ pubkeyHex: String) -> String
-    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
-    func currentNostrIdentity() -> NostrIdentity?
-
-    // MARK: Routing & acknowledgements
-    func routePrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String)
-    func routeReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID)
-    func routeFavoriteNotification(to peerID: PeerID, isFavorite: Bool)
-    func sendMeshReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID)
-    func sendGeohashPrivateMessage(_ content: String, toRecipientHex recipientHex: String, from identity: NostrIdentity, messageID: String)
-    func sendGeohashDeliveryAck(for messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
-    func sendGeohashReadReceipt(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity)
-    func sendDeliveryAckViaNostrEmbedded(_ message: BitchatMessage, wasReadBefore: Bool, senderPubkey: String, key: Data?)
-
-    // MARK: System messages
-    func addSystemMessage(_ content: String)
-    func addMeshOnlySystemMessage(_ content: String)
-
-    // MARK: Favorites & notifications
-    /// The persisted favorite relationship for the peer's Noise static key, if any.
-    func favoriteRelationship(forNoiseKey noiseKey: Data) -> FavoritesPersistenceService.FavoriteRelationship?
-    /// Persists that the peer favorited/unfavorited us (favorites store write).
-    func updatePeerFavoritedUs(noiseKey: Data, favorited: Bool, nickname: String, nostrPublicKey: String?)
-    /// Posts the incoming-private-message local notification.
-    func notifyPrivateMessage(from senderName: String, message: String, peerID: PeerID)
-}
-
-extension ChatViewModel: ChatPrivateConversationContext {
-    // `privateChats` and `notifyUIChanged()` are shared requirements with
-    // `ChatDeliveryContext`; the single-writer intent ops (`markReadReceiptSent`,
-    // `markGeoDeliveryAckSent`, `handOffSelectedPrivateChat`) live next to their
-    // backing state in `ChatViewModel`. The remaining state members are
-    // satisfied by existing `ChatViewModel` properties and methods.
-
-    var myPeerID: PeerID { meshService.myPeerID }
-
-    func peerNickname(for peerID: PeerID) -> String? {
-        meshService.peerNickname(peerID: peerID)
-    }
-
-    func isPeerConnected(_ peerID: PeerID) -> Bool {
-        meshService.isPeerConnected(peerID)
-    }
-
-    func isPeerReachable(_ peerID: PeerID) -> Bool {
-        meshService.isPeerReachable(peerID)
-    }
-
-    func noisePublicKey(for peerID: PeerID) -> Data? {
-        unifiedPeerService.getPeer(by: peerID)?.noisePublicKey
-    }
-
-    func ephemeralPeerID(forNoiseKey noiseKey: Data) -> PeerID? {
-        unifiedPeerService.peers.first(where: { $0.noisePublicKey == noiseKey })?.peerID
-    }
-
-    func storedFingerprint(for peerID: PeerID) -> String? {
-        peerIDToPublicKeyFingerprint[peerID]
-    }
-
-    func clearStoredFingerprint(for peerID: PeerID) {
-        peerIdentityStore.setFingerprint(nil, for: peerID)
-    }
-
-    func isNostrBlocked(pubkeyHexLowercased: String) -> Bool {
-        identityManager.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
-    }
-
-    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity {
-        try idBridge.deriveIdentity(forGeohash: geohash)
-    }
-
-    func currentNostrIdentity() -> NostrIdentity? {
-        try? idBridge.getCurrentNostrIdentity()
-    }
-
-    func routePrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
-        messageRouter.sendPrivate(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
-    }
-
-    func routeReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
-        messageRouter.sendReadReceipt(receipt, to: peerID)
-    }
-
-    func routeFavoriteNotification(to peerID: PeerID, isFavorite: Bool) {
-        messageRouter.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
-    }
-
-    func sendMeshReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
-        meshService.sendReadReceipt(receipt, to: peerID)
-    }
-
-    func sendGeohashPrivateMessage(_ content: String, toRecipientHex recipientHex: String, from identity: NostrIdentity, messageID: String) {
-        makeGeohashNostrTransport().sendPrivateMessageGeohash(
-            content: content,
-            toRecipientHex: recipientHex,
-            from: identity,
-            messageID: messageID
-        )
-    }
-
-    func sendGeohashDeliveryAck(for messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity) {
-        makeGeohashNostrTransport().sendDeliveryAckGeohash(for: messageID, toRecipientHex: recipientHex, from: identity)
-    }
-
-    func sendGeohashReadReceipt(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity) {
-        makeGeohashNostrTransport().sendReadReceiptGeohash(messageID, toRecipientHex: recipientHex, from: identity)
-    }
-
-    func addSystemMessage(_ content: String) {
-        addSystemMessage(content, timestamp: Date())
-    }
-
-    func favoriteRelationship(forNoiseKey noiseKey: Data) -> FavoritesPersistenceService.FavoriteRelationship? {
-        FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey)
-    }
-
-    func updatePeerFavoritedUs(noiseKey: Data, favorited: Bool, nickname: String, nostrPublicKey: String?) {
-        FavoritesPersistenceService.shared.updatePeerFavoritedUs(
-            peerNoisePublicKey: noiseKey,
-            favorited: favorited,
-            peerNickname: nickname,
-            peerNostrPublicKey: nostrPublicKey
-        )
-    }
-
-    func notifyPrivateMessage(from senderName: String, message: String, peerID: PeerID) {
-        NotificationService.shared.sendPrivateMessageNotification(from: senderName, message: message, peerID: peerID)
-    }
-
-    private func makeGeohashNostrTransport() -> NostrTransport {
-        let transport = NostrTransport(keychain: keychain, idBridge: idBridge)
-        transport.senderPeerID = meshService.myPeerID
-        return transport
-    }
-}
-
 @MainActor
 final class ChatPrivateConversationCoordinator {
-    private unowned let context: any ChatPrivateConversationContext
+    private unowned let viewModel: ChatViewModel
 
-    init(context: any ChatPrivateConversationContext) {
-        self.context = context
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
     }
 
     func sendPrivateMessage(_ content: String, to peerID: PeerID) {
         guard !content.isEmpty else { return }
 
-        if context.isPeerBlocked(peerID) {
-            let nickname = context.peerNickname(for: peerID) ?? "user"
-            context.addSystemMessage(
+        if viewModel.unifiedPeerService.isBlocked(peerID) {
+            let nickname = viewModel.meshService.peerNickname(peerID: peerID) ?? "user"
+            viewModel.addSystemMessage(
                 String(
                     format: String(localized: "system.dm.blocked_recipient", comment: "System message when attempting to message a blocked user"),
                     locale: .current,
@@ -246,13 +31,13 @@ final class ChatPrivateConversationCoordinator {
         }
 
         guard let noiseKey = Data(hexString: peerID.id) else { return }
-        let isConnected = context.isPeerConnected(peerID)
-        let isReachable = context.isPeerReachable(peerID)
-        let favoriteStatus = context.favoriteRelationship(forNoiseKey: noiseKey)
+        let isConnected = viewModel.meshService.isPeerConnected(peerID)
+        let isReachable = viewModel.meshService.isPeerReachable(peerID)
+        let favoriteStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey)
         let isMutualFavorite = favoriteStatus?.isMutual ?? false
         let hasNostrKey = favoriteStatus?.peerNostrPublicKey != nil
 
-        var recipientNickname = context.peerNickname(for: peerID)
+        var recipientNickname = viewModel.meshService.peerNickname(peerID: peerID)
         if recipientNickname == nil && favoriteStatus != nil {
             recipientNickname = favoriteStatus?.peerNickname
         }
@@ -261,39 +46,42 @@ final class ChatPrivateConversationCoordinator {
         let messageID = UUID().uuidString
         let message = BitchatMessage(
             id: messageID,
-            sender: context.nickname,
+            sender: viewModel.nickname,
             content: content,
             timestamp: Date(),
             isRelay: false,
             originalSender: nil,
             isPrivate: true,
             recipientNickname: recipientNickname,
-            senderPeerID: context.myPeerID,
+            senderPeerID: viewModel.meshService.myPeerID,
             mentions: nil,
             deliveryStatus: .sending
         )
 
-        context.appendPrivateMessage(message, to: peerID)
-        context.notifyUIChanged()
+        if viewModel.privateChats[peerID] == nil {
+            viewModel.privateChats[peerID] = []
+        }
+        viewModel.privateChats[peerID]?.append(message)
+        viewModel.objectWillChange.send()
 
         if isConnected || isReachable || (isMutualFavorite && hasNostrKey) {
-            context.routePrivateMessage(
+            viewModel.messageRouter.sendPrivate(
                 content,
                 to: peerID,
                 recipientNickname: recipientNickname ?? "user",
                 messageID: messageID
             )
-            context.setPrivateDeliveryStatus(.sent, forMessageID: messageID, peerID: peerID)
+            if let idx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                viewModel.privateChats[peerID]?[idx].deliveryStatus = .sent
+            }
         } else {
-            context.setPrivateDeliveryStatus(
-                .failed(
+            if let index = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                viewModel.privateChats[peerID]?[index].deliveryStatus = .failed(
                     reason: String(localized: "content.delivery.reason.unreachable", comment: "Failure reason when a peer is unreachable")
-                ),
-                forMessageID: messageID,
-                peerID: peerID
-            )
+                )
+            }
             let name = recipientNickname ?? "user"
-            context.addSystemMessage(
+            viewModel.addSystemMessage(
                 String(
                     format: String(localized: "system.dm.unreachable", comment: "System message when a recipient is unreachable"),
                     locale: .current,
@@ -304,8 +92,8 @@ final class ChatPrivateConversationCoordinator {
     }
 
     func sendGeohashDM(_ content: String, to peerID: PeerID) {
-        guard case .location(let channel) = context.activeChannel else {
-            context.addSystemMessage(
+        guard case .location(let channel) = viewModel.activeChannel else {
+            viewModel.addSystemMessage(
                 String(localized: "system.location.not_in_channel", comment: "System message when attempting to send without being in a location channel")
             )
             return
@@ -314,54 +102,52 @@ final class ChatPrivateConversationCoordinator {
         let messageID = UUID().uuidString
         let message = BitchatMessage(
             id: messageID,
-            sender: context.nickname,
+            sender: viewModel.nickname,
             content: content,
             timestamp: Date(),
             isRelay: false,
             isPrivate: true,
-            recipientNickname: context.nickname,
-            senderPeerID: context.myPeerID,
+            recipientNickname: viewModel.nickname,
+            senderPeerID: viewModel.meshService.myPeerID,
             deliveryStatus: .sending
         )
 
-        context.appendPrivateMessage(message, to: peerID)
-        context.notifyUIChanged()
+        if viewModel.privateChats[peerID] == nil {
+            viewModel.privateChats[peerID] = []
+        }
 
-        guard let recipientHex = context.nostrKeyMapping[peerID] else {
-            context.setPrivateDeliveryStatus(
-                .failed(
+        viewModel.privateChats[peerID]?.append(message)
+        viewModel.objectWillChange.send()
+
+        guard let recipientHex = viewModel.nostrKeyMapping[peerID] else {
+            if let msgIdx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                viewModel.privateChats[peerID]?[msgIdx].deliveryStatus = .failed(
                     reason: String(localized: "content.delivery.reason.unknown_recipient", comment: "Failure reason when the recipient is unknown")
-                ),
-                forMessageID: messageID,
-                peerID: peerID
-            )
+                )
+            }
             return
         }
 
-        if context.isNostrBlocked(pubkeyHexLowercased: recipientHex) {
-            context.setPrivateDeliveryStatus(
-                .failed(
+        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: recipientHex) {
+            if let msgIdx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                viewModel.privateChats[peerID]?[msgIdx].deliveryStatus = .failed(
                     reason: String(localized: "content.delivery.reason.blocked", comment: "Failure reason when the user is blocked")
-                ),
-                forMessageID: messageID,
-                peerID: peerID
-            )
-            context.addSystemMessage(
+                )
+            }
+            viewModel.addSystemMessage(
                 String(localized: "system.dm.blocked_generic", comment: "System message when sending fails because user is blocked")
             )
             return
         }
 
         do {
-            let identity = try context.deriveNostrIdentity(forGeohash: channel.geohash)
+            let identity = try viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash)
             if recipientHex.lowercased() == identity.publicKeyHex.lowercased() {
-                context.setPrivateDeliveryStatus(
-                    .failed(
+                if let idx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                    viewModel.privateChats[peerID]?[idx].deliveryStatus = .failed(
                         reason: String(localized: "content.delivery.reason.self", comment: "Failure reason when attempting to message yourself")
-                    ),
-                    forMessageID: messageID,
-                    peerID: peerID
-                )
+                    )
+                }
                 return
             }
 
@@ -369,21 +155,23 @@ final class ChatPrivateConversationCoordinator {
                 "GeoDM: local send mid=\(messageID.prefix(8))… to=\(recipientHex.prefix(8))… conv=\(peerID)",
                 category: .session
             )
-            context.sendGeohashPrivateMessage(
-                content,
+            let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+            transport.senderPeerID = viewModel.meshService.myPeerID
+            transport.sendPrivateMessageGeohash(
+                content: content,
                 toRecipientHex: recipientHex,
                 from: identity,
                 messageID: messageID
             )
-            context.setPrivateDeliveryStatus(.sent, forMessageID: messageID, peerID: peerID)
+            if let msgIdx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                viewModel.privateChats[peerID]?[msgIdx].deliveryStatus = .sent
+            }
         } catch {
-            context.setPrivateDeliveryStatus(
-                .failed(
+            if let idx = viewModel.privateChats[peerID]?.firstIndex(where: { $0.id == messageID }) {
+                viewModel.privateChats[peerID]?[idx].deliveryStatus = .failed(
                     reason: String(localized: "content.delivery.reason.send_error", comment: "Failure reason for a generic send error")
-                ),
-                forMessageID: messageID,
-                peerID: peerID
-            )
+                )
+            }
         }
     }
 
@@ -401,13 +189,16 @@ final class ChatPrivateConversationCoordinator {
 
         sendDeliveryAckIfNeeded(to: messageId, senderPubKey: senderPubkey, from: id)
 
-        if context.isNostrBlocked(pubkeyHexLowercased: senderPubkey) {
+        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: senderPubkey) {
             return
         }
 
-        if context.privateChatsContainMessage(withID: messageId) { return }
+        if viewModel.privateChats[convKey]?.contains(where: { $0.id == messageId }) == true { return }
+        for (_, arr) in viewModel.privateChats where arr.contains(where: { $0.id == messageId }) {
+            return
+        }
 
-        let senderName = context.displayNameForNostrPubkey(senderPubkey)
+        let senderName = viewModel.displayNameForNostrPubkey(senderPubkey)
         let message = BitchatMessage(
             id: messageId,
             sender: senderName,
@@ -415,19 +206,22 @@ final class ChatPrivateConversationCoordinator {
             timestamp: messageTimestamp,
             isRelay: false,
             isPrivate: true,
-            recipientNickname: context.nickname,
+            recipientNickname: viewModel.nickname,
             senderPeerID: convKey,
-            deliveryStatus: .delivered(to: context.nickname, at: Date())
+            deliveryStatus: .delivered(to: viewModel.nickname, at: Date())
         )
 
-        context.appendPrivateMessage(message, to: convKey)
+        if viewModel.privateChats[convKey] == nil {
+            viewModel.privateChats[convKey] = []
+        }
+        viewModel.privateChats[convKey]?.append(message)
 
-        let isViewing = context.selectedPrivateChatPeer == convKey
-        let wasReadBefore = context.sentReadReceipts.contains(messageId)
+        let isViewing = viewModel.selectedPrivateChatPeer == convKey
+        let wasReadBefore = viewModel.sentReadReceipts.contains(messageId)
         let isRecentMessage = Date().timeIntervalSince(messageTimestamp) < 30
         let shouldMarkUnread = !wasReadBefore && !isViewing && isRecentMessage
         if shouldMarkUnread {
-            context.markPrivateChatUnread(convKey)
+            viewModel.unreadPrivateMessages.insert(convKey)
         }
 
         if isViewing {
@@ -435,22 +229,25 @@ final class ChatPrivateConversationCoordinator {
         }
 
         if !isViewing && shouldMarkUnread {
-            context.notifyPrivateMessage(from: senderName, message: pm.content, peerID: convKey)
+            NotificationService.shared.sendPrivateMessageNotification(
+                from: senderName,
+                message: pm.content,
+                peerID: convKey
+            )
         }
 
-        context.notifyUIChanged()
+        viewModel.objectWillChange.send()
     }
 
     func handleDelivered(_ payload: NoisePayload, senderPubkey: String, convKey: PeerID) {
         guard let messageID = String(data: payload.data, encoding: .utf8) else { return }
 
-        if context.privateChat(convKey, containsMessageWithID: messageID) {
-            context.setPrivateDeliveryStatus(
-                .delivered(to: context.displayNameForNostrPubkey(senderPubkey), at: Date()),
-                forMessageID: messageID,
-                peerID: convKey
+        if let idx = viewModel.privateChats[convKey]?.firstIndex(where: { $0.id == messageID }) {
+            viewModel.privateChats[convKey]?[idx].deliveryStatus = .delivered(
+                to: viewModel.displayNameForNostrPubkey(senderPubkey),
+                at: Date()
             )
-            context.notifyUIChanged()
+            viewModel.objectWillChange.send()
             SecureLogger.info(
                 "GeoDM: recv DELIVERED for mid=\(messageID.prefix(8))… from=\(senderPubkey.prefix(8))…",
                 category: .session
@@ -463,13 +260,12 @@ final class ChatPrivateConversationCoordinator {
     func handleReadReceipt(_ payload: NoisePayload, senderPubkey: String, convKey: PeerID) {
         guard let messageID = String(data: payload.data, encoding: .utf8) else { return }
 
-        if context.privateChat(convKey, containsMessageWithID: messageID) {
-            context.setPrivateDeliveryStatus(
-                .read(by: context.displayNameForNostrPubkey(senderPubkey), at: Date()),
-                forMessageID: messageID,
-                peerID: convKey
+        if let idx = viewModel.privateChats[convKey]?.firstIndex(where: { $0.id == messageID }) {
+            viewModel.privateChats[convKey]?[idx].deliveryStatus = .read(
+                by: viewModel.displayNameForNostrPubkey(senderPubkey),
+                at: Date()
             )
-            context.notifyUIChanged()
+            viewModel.objectWillChange.send()
             SecureLogger.info("GeoDM: recv READ for mid=\(messageID.prefix(8))… from=\(senderPubkey.prefix(8))…", category: .session)
         } else {
             SecureLogger.warning("GeoDM: read ack for unknown mid=\(messageID.prefix(8))… conv=\(convKey)", category: .session)
@@ -477,13 +273,19 @@ final class ChatPrivateConversationCoordinator {
     }
 
     func sendDeliveryAckIfNeeded(to messageId: String, senderPubKey: String, from id: NostrIdentity) {
-        guard context.markGeoDeliveryAckSent(messageId) else { return }
-        context.sendGeohashDeliveryAck(for: messageId, toRecipientHex: senderPubKey, from: id)
+        guard !viewModel.sentGeoDeliveryAcks.contains(messageId) else { return }
+        let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+        transport.senderPeerID = viewModel.meshService.myPeerID
+        transport.sendDeliveryAckGeohash(for: messageId, toRecipientHex: senderPubKey, from: id)
+        viewModel.sentGeoDeliveryAcks.insert(messageId)
     }
 
     func sendReadReceiptIfNeeded(to messageId: String, senderPubKey: String, from id: NostrIdentity) {
-        guard context.markReadReceiptSent(messageId) else { return }
-        context.sendGeohashReadReceipt(messageId, toRecipientHex: senderPubKey, from: id)
+        guard !viewModel.sentReadReceipts.contains(messageId) else { return }
+        let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+        transport.senderPeerID = viewModel.meshService.myPeerID
+        transport.sendReadReceiptGeohash(messageId, toRecipientHex: senderPubKey, from: id)
+        viewModel.sentReadReceipts.insert(messageId)
     }
 
     func handlePrivateMessage(
@@ -513,15 +315,15 @@ final class ChatPrivateConversationCoordinator {
             return
         }
 
-        let wasReadBefore = context.sentReadReceipts.contains(messageId)
+        let wasReadBefore = viewModel.sentReadReceipts.contains(messageId)
 
         var isViewingThisChat = false
-        if context.selectedPrivateChatPeer == targetPeerID {
+        if viewModel.selectedPrivateChatPeer == targetPeerID {
             isViewingThisChat = true
-        } else if let selectedPeer = context.selectedPrivateChatPeer,
-                  let selectedPeerNoiseKey = context.noisePublicKey(for: selectedPeer),
+        } else if let selectedPeer = viewModel.selectedPrivateChatPeer,
+                  let selectedPeerData = viewModel.unifiedPeerService.getPeer(by: selectedPeer),
                   let key = actualSenderNoiseKey,
-                  selectedPeerNoiseKey == key {
+                  selectedPeerData.noisePublicKey == key {
             isViewingThisChat = true
         }
 
@@ -535,15 +337,15 @@ final class ChatPrivateConversationCoordinator {
             timestamp: messageTimestamp,
             isRelay: false,
             isPrivate: true,
-            recipientNickname: context.nickname,
+            recipientNickname: viewModel.nickname,
             senderPeerID: targetPeerID,
-            deliveryStatus: .delivered(to: context.nickname, at: Date())
+            deliveryStatus: .delivered(to: viewModel.nickname, at: Date())
         )
 
         addMessageToPrivateChatsIfNeeded(message, targetPeerID: targetPeerID)
         mirrorToEphemeralIfNeeded(message, targetPeerID: targetPeerID, key: actualSenderNoiseKey)
 
-        context.sendDeliveryAckViaNostrEmbedded(
+        viewModel.sendDeliveryAckViaNostrEmbedded(
             message,
             wasReadBefore: wasReadBefore,
             senderPubkey: senderPubkey,
@@ -570,12 +372,12 @@ final class ChatPrivateConversationCoordinator {
             )
         }
 
-        context.notifyUIChanged()
+        viewModel.objectWillChange.send()
     }
 
     func handlePrivateMessage(_ message: BitchatMessage) {
         SecureLogger.debug("📥 handlePrivateMessage called for message from \(message.sender)", category: .session)
-        let senderPeerID = message.senderPeerID ?? context.getPeerIDForNickname(message.sender)
+        let senderPeerID = message.senderPeerID ?? viewModel.getPeerIDForNickname(message.sender)
 
         guard let peerID = senderPeerID else {
             SecureLogger.warning("⚠️ Could not get peer ID for sender \(message.sender)", category: .session)
@@ -589,14 +391,22 @@ final class ChatPrivateConversationCoordinator {
 
         migratePrivateChatsIfNeeded(for: peerID, senderNickname: message.sender)
 
-        if peerID.id.count == 16, let peerNoiseKey = context.noisePublicKey(for: peerID) {
-            let stableKeyHex = PeerID(hexData: peerNoiseKey)
-            let nostrMessages = context.privateMessages(for: stableKeyHex)
+        if peerID.id.count == 16, let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
+            let stableKeyHex = PeerID(hexData: peer.noisePublicKey)
             if stableKeyHex != peerID,
+               let nostrMessages = viewModel.privateChats[stableKeyHex],
                !nostrMessages.isEmpty {
-                // Store migration dedups by ID, keeps timestamp order, and
-                // removes the stable-key chat.
-                context.migratePrivateChat(from: stableKeyHex, to: peerID)
+                if viewModel.privateChats[peerID] == nil {
+                    viewModel.privateChats[peerID] = []
+                }
+
+                let existingMessageIds = Set(viewModel.privateChats[peerID]?.map { $0.id } ?? [])
+                for nostrMessage in nostrMessages where !existingMessageIds.contains(nostrMessage.id) {
+                    viewModel.privateChats[peerID]?.append(nostrMessage)
+                }
+
+                viewModel.privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
+                viewModel.privateChats.removeValue(forKey: stableKeyHex)
 
                 SecureLogger.info(
                     "📥 Consolidated \(nostrMessages.count) Nostr messages from stable key to ephemeral peer \(peerID)",
@@ -610,47 +420,69 @@ final class ChatPrivateConversationCoordinator {
         }
 
         addMessageToPrivateChatsIfNeeded(message, targetPeerID: peerID)
-        let noiseKey = peerID.noiseKey ?? context.noisePublicKey(for: peerID)
+        let noiseKey = peerID.noiseKey ?? viewModel.unifiedPeerService.getPeer(by: peerID)?.noisePublicKey
         mirrorToEphemeralIfNeeded(message, targetPeerID: peerID, key: noiseKey)
 
-        let isViewing = context.selectedPrivateChatPeer == peerID
+        let isViewing = viewModel.selectedPrivateChatPeer == peerID
         if isViewing {
             let receipt = ReadReceipt(
                 originalMessageID: message.id,
-                readerID: context.myPeerID,
-                readerNickname: context.nickname
+                readerID: viewModel.meshService.myPeerID,
+                readerNickname: viewModel.nickname
             )
-            context.sendMeshReadReceipt(receipt, to: peerID)
-            context.markReadReceiptSent(message.id)
+            viewModel.meshService.sendReadReceipt(receipt, to: peerID)
+            viewModel.sentReadReceipts.insert(message.id)
         } else {
-            context.markPrivateChatUnread(peerID)
-            context.notifyPrivateMessage(from: message.sender, message: message.content, peerID: peerID)
+            viewModel.unreadPrivateMessages.insert(peerID)
+            NotificationService.shared.sendPrivateMessageNotification(
+                from: message.sender,
+                message: message.content,
+                peerID: peerID
+            )
         }
 
-        context.notifyUIChanged()
+        viewModel.objectWillChange.send()
     }
 
-    /// O(1)-per-conversation dedup via the store's message-ID indexes
-    /// (replaces the full scan over every private chat).
     func isDuplicateMessage(_ messageId: String, targetPeerID: PeerID) -> Bool {
-        context.privateChatsContainMessage(withID: messageId)
+        if viewModel.privateChats[targetPeerID]?.contains(where: { $0.id == messageId }) == true {
+            return true
+        }
+        for (_, messages) in viewModel.privateChats where messages.contains(where: { $0.id == messageId }) {
+            return true
+        }
+        return false
     }
 
     func addMessageToPrivateChatsIfNeeded(_ message: BitchatMessage, targetPeerID: PeerID) {
-        // Store upsert replaces in place by message ID or inserts in
-        // timestamp order; the old per-append sanitize re-sort is obsolete.
-        context.upsertPrivateMessage(message, in: targetPeerID)
+        if viewModel.privateChats[targetPeerID] == nil {
+            viewModel.privateChats[targetPeerID] = []
+        }
+        if let idx = viewModel.privateChats[targetPeerID]?.firstIndex(where: { $0.id == message.id }) {
+            viewModel.privateChats[targetPeerID]?[idx] = message
+        } else {
+            viewModel.privateChats[targetPeerID]?.append(message)
+        }
+        viewModel.privateChatManager.sanitizeChat(for: targetPeerID)
     }
 
     func mirrorToEphemeralIfNeeded(_ message: BitchatMessage, targetPeerID: PeerID, key: Data?) {
         guard let key,
-              let ephemeralPeerID = context.ephemeralPeerID(forNoiseKey: key),
+              let ephemeralPeerID = viewModel.unifiedPeerService.peers.first(where: { $0.noisePublicKey == key })?.peerID,
               ephemeralPeerID != targetPeerID
         else {
             return
         }
 
-        context.upsertPrivateMessage(message, in: ephemeralPeerID)
+        if viewModel.privateChats[ephemeralPeerID] == nil {
+            viewModel.privateChats[ephemeralPeerID] = []
+        }
+        if let idx = viewModel.privateChats[ephemeralPeerID]?.firstIndex(where: { $0.id == message.id }) {
+            viewModel.privateChats[ephemeralPeerID]?[idx] = message
+        } else {
+            viewModel.privateChats[ephemeralPeerID]?.append(message)
+        }
+        viewModel.privateChatManager.sanitizeChat(for: ephemeralPeerID)
     }
 
     func handleViewingThisChat(
@@ -659,25 +491,27 @@ final class ChatPrivateConversationCoordinator {
         key: Data?,
         senderPubkey: String
     ) {
-        context.markPrivateChatRead(targetPeerID)
+        viewModel.unreadPrivateMessages.remove(targetPeerID)
         if let key,
-           let ephemeralPeerID = context.ephemeralPeerID(forNoiseKey: key) {
-            context.markPrivateChatRead(ephemeralPeerID)
+           let ephemeralPeerID = viewModel.unifiedPeerService.peers.first(where: { $0.noisePublicKey == key })?.peerID {
+            viewModel.unreadPrivateMessages.remove(ephemeralPeerID)
         }
-        guard !context.sentReadReceipts.contains(message.id) else { return }
+        guard !viewModel.sentReadReceipts.contains(message.id) else { return }
 
         if let key {
             let receipt = ReadReceipt(
                 originalMessageID: message.id,
-                readerID: context.myPeerID,
-                readerNickname: context.nickname
+                readerID: viewModel.meshService.myPeerID,
+                readerNickname: viewModel.nickname
             )
             SecureLogger.debug("Viewing chat; sending READ ack for \(message.id.prefix(8))… via router", category: .session)
-            context.routeReadReceipt(receipt, to: PeerID(hexData: key))
-            context.markReadReceiptSent(message.id)
-        } else if let identity = context.currentNostrIdentity() {
-            context.sendGeohashReadReceipt(message.id, toRecipientHex: senderPubkey, from: identity)
-            context.markReadReceiptSent(message.id)
+            viewModel.messageRouter.sendReadReceipt(receipt, to: PeerID(hexData: key))
+            viewModel.sentReadReceipts.insert(message.id)
+        } else if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
+            let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+            transport.senderPeerID = viewModel.meshService.myPeerID
+            transport.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: identity)
+            viewModel.sentReadReceipts.insert(message.id)
             SecureLogger.debug(
                 "Viewing chat; sent READ ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…",
                 category: .session
@@ -695,14 +529,18 @@ final class ChatPrivateConversationCoordinator {
     ) {
         guard shouldMarkAsUnread else { return }
 
-        context.markPrivateChatUnread(targetPeerID)
+        viewModel.unreadPrivateMessages.insert(targetPeerID)
         if let key,
-           let ephemeralPeerID = context.ephemeralPeerID(forNoiseKey: key),
+           let ephemeralPeerID = viewModel.unifiedPeerService.peers.first(where: { $0.noisePublicKey == key })?.peerID,
            ephemeralPeerID != targetPeerID {
-            context.markPrivateChatUnread(ephemeralPeerID)
+            viewModel.unreadPrivateMessages.insert(ephemeralPeerID)
         }
         if isRecentMessage {
-            context.notifyPrivateMessage(from: senderNickname, message: messageContent, peerID: targetPeerID)
+            NotificationService.shared.sendPrivateMessageNotification(
+                from: senderNickname,
+                message: messageContent,
+                peerID: targetPeerID
+            )
         }
     }
 
@@ -716,18 +554,18 @@ final class ChatPrivateConversationCoordinator {
             SecureLogger.info("📝 Received Nostr npub in favorite notification: \(nostrPubkey ?? "none")", category: .session)
         }
 
-        let noiseKey = peerID.noiseKey ?? context.noisePublicKey(for: peerID)
+        let noiseKey = peerID.noiseKey ?? viewModel.unifiedPeerService.getPeer(by: peerID)?.noisePublicKey
         guard let finalNoiseKey = noiseKey else {
             SecureLogger.warning("⚠️ Cannot get Noise key for peer \(peerID)", category: .session)
             return
         }
 
-        let prior = context.favoriteRelationship(forNoiseKey: finalNoiseKey)?.theyFavoritedUs ?? false
-        context.updatePeerFavoritedUs(
-            noiseKey: finalNoiseKey,
+        let prior = FavoritesPersistenceService.shared.getFavoriteStatus(for: finalNoiseKey)?.theyFavoritedUs ?? false
+        FavoritesPersistenceService.shared.updatePeerFavoritedUs(
+            peerNoisePublicKey: finalNoiseKey,
             favorited: isFavorite,
-            nickname: senderNickname,
-            nostrPublicKey: nostrPubkey
+            peerNickname: senderNickname,
+            peerNostrPublicKey: nostrPubkey
         )
 
         if isFavorite && nostrPubkey != nil {
@@ -739,7 +577,7 @@ final class ChatPrivateConversationCoordinator {
 
         if prior != isFavorite {
             let action = isFavorite ? "favorited" : "unfavorited"
-            context.addMeshOnlySystemMessage("\(senderNickname) \(action) you")
+            viewModel.addMeshOnlySystemMessage("\(senderNickname) \(action) you")
         }
     }
 
@@ -768,31 +606,25 @@ final class ChatPrivateConversationCoordinator {
     }
 
     func migratePrivateChatsIfNeeded(for peerID: PeerID, senderNickname: String) {
-        let currentFingerprint = context.getFingerprint(for: peerID)
+        let currentFingerprint = viewModel.getFingerprint(for: peerID)
 
-        if context.privateMessages(for: peerID).isEmpty {
-            // Chats migrated wholesale go through the store's
-            // `migrateConversation` intent; partially-migrated chats keep
-            // their non-recent tail, so the recent messages are copied in
-            // via ordered append (dedup by ID) instead.
-            var partiallyMigratedMessages: [BitchatMessage] = []
+        if viewModel.privateChats[peerID] == nil || viewModel.privateChats[peerID]?.isEmpty == true {
+            var migratedMessages: [BitchatMessage] = []
             var oldPeerIDsToRemove: [PeerID] = []
-            var didMigrate = false
             let cutoffTime = Date().addingTimeInterval(-TransportConfig.uiMigrationCutoffSeconds)
 
-            for (oldPeerID, messages) in context.privateChats where oldPeerID != peerID {
-                let oldFingerprint = context.storedFingerprint(for: oldPeerID)
+            for (oldPeerID, messages) in viewModel.privateChats where oldPeerID != peerID {
+                let oldFingerprint = viewModel.peerIDToPublicKeyFingerprint[oldPeerID]
                 let recentMessages = messages.filter { $0.timestamp > cutoffTime }
                 guard !recentMessages.isEmpty else { continue }
 
                 if let currentFp = currentFingerprint,
                    let oldFp = oldFingerprint,
                    currentFp == oldFp {
-                    didMigrate = true
+                    migratedMessages.append(contentsOf: recentMessages)
                     if recentMessages.count == messages.count {
                         oldPeerIDsToRemove.append(oldPeerID)
                     } else {
-                        partiallyMigratedMessages.append(contentsOf: recentMessages)
                         SecureLogger.info(
                             "📦 Partially migrating \(recentMessages.count) of \(messages.count) messages from \(oldPeerID)",
                             category: .session
@@ -805,16 +637,14 @@ final class ChatPrivateConversationCoordinator {
                     )
                 } else if currentFingerprint == nil || oldFingerprint == nil {
                     let isRelevantChat = recentMessages.contains { msg in
-                        (msg.sender == senderNickname && msg.sender != context.nickname)
-                            || (msg.sender == context.nickname && msg.recipientNickname == senderNickname)
+                        (msg.sender == senderNickname && msg.sender != viewModel.nickname)
+                            || (msg.sender == viewModel.nickname && msg.recipientNickname == senderNickname)
                     }
 
                     if isRelevantChat {
-                        didMigrate = true
+                        migratedMessages.append(contentsOf: recentMessages)
                         if recentMessages.count == messages.count {
                             oldPeerIDsToRemove.append(oldPeerID)
-                        } else {
-                            partiallyMigratedMessages.append(contentsOf: recentMessages)
                         }
 
                         SecureLogger.warning(
@@ -826,24 +656,27 @@ final class ChatPrivateConversationCoordinator {
             }
 
             if !oldPeerIDsToRemove.isEmpty {
+                let needsSelectedUpdate = oldPeerIDsToRemove.contains { viewModel.selectedPrivateChatPeer == $0 }
+
                 for oldID in oldPeerIDsToRemove {
-                    // The old behavior dropped the unread flag of removed
-                    // chats instead of transferring it; clear it before the
-                    // migration so the store doesn't carry it over.
-                    context.markPrivateChatRead(oldID)
-                    context.migratePrivateChat(from: oldID, to: peerID)
-                    context.clearStoredFingerprint(for: oldID)
+                    viewModel.privateChats.removeValue(forKey: oldID)
+                    viewModel.unreadPrivateMessages.remove(oldID)
+                    viewModel.peerIdentityStore.setFingerprint(nil, for: oldID)
                 }
 
-                context.handOffSelectedPrivateChat(from: oldPeerIDsToRemove, to: peerID)
+                if needsSelectedUpdate {
+                    viewModel.selectedPrivateChatPeer = peerID
+                }
             }
 
-            for message in partiallyMigratedMessages {
-                context.appendPrivateMessage(message, to: peerID)
-            }
-
-            if didMigrate {
-                context.notifyUIChanged()
+            if !migratedMessages.isEmpty {
+                if viewModel.privateChats[peerID] == nil {
+                    viewModel.privateChats[peerID] = []
+                }
+                viewModel.privateChats[peerID]?.append(contentsOf: migratedMessages)
+                viewModel.privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
+                viewModel.privateChatManager.sanitizeChat(for: peerID)
+                viewModel.objectWillChange.send()
             }
         }
     }
@@ -853,37 +686,29 @@ final class ChatPrivateConversationCoordinator {
 
         if let hexKey = Data(hexString: peerID.id) {
             noiseKey = hexKey
-        } else if let peerNoiseKey = context.noisePublicKey(for: peerID) {
-            noiseKey = peerNoiseKey
+        } else if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
+            noiseKey = peer.noisePublicKey
         }
 
-        if context.isPeerConnected(peerID) {
-            context.routeFavoriteNotification(to: peerID, isFavorite: isFavorite)
+        if viewModel.meshService.isPeerConnected(peerID) {
+            viewModel.messageRouter.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
             SecureLogger.debug("📤 Sent favorite notification via BLE to \(peerID)", category: .session)
         } else if let key = noiseKey {
-            context.routeFavoriteNotification(to: PeerID(hexData: key), isFavorite: isFavorite)
+            viewModel.messageRouter.sendFavoriteNotification(to: PeerID(hexData: key), isFavorite: isFavorite)
         } else {
             SecureLogger.warning("⚠️ Cannot send favorite notification - peer not connected and no Nostr pubkey", category: .session)
         }
     }
 
     func isMessageBlocked(_ message: BitchatMessage) -> Bool {
-        if let peerID = message.senderPeerID ?? context.getPeerIDForNickname(message.sender) {
-            if context.isPeerBlocked(peerID) { return true }
+        if let peerID = message.senderPeerID ?? viewModel.getPeerIDForNickname(message.sender) {
+            if viewModel.isPeerBlocked(peerID) { return true }
             if peerID.isGeoChat || peerID.isGeoDM,
-               let full = context.nostrKeyMapping[peerID]?.lowercased(),
-               context.isNostrBlocked(pubkeyHexLowercased: full) {
+               let full = viewModel.nostrKeyMapping[peerID]?.lowercased(),
+               viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: full) {
                 return true
             }
         }
         return false
     }
 }
-
-/// Default for conforming test contexts that model chats as a dictionary;
-/// `ChatViewModel` overrides with a store-direct lookup.
-extension ChatPrivateConversationContext {
-    func privateMessages(for peerID: PeerID) -> [BitchatMessage] {
-        privateChats[peerID] ?? []
-    }
-}

bitchat/ViewModels/ChatPublicConversationCoordinator.swift

@@ -7,175 +7,16 @@ import SwiftUI
 import UIKit
 #endif
 
-/// The narrow surface `ChatPublicConversationCoordinator` needs from its owner.
-///
-/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
-/// minimal context it actually uses instead of holding an `unowned` back-ref
-/// to the whole `ChatViewModel`. This keeps the coordinator independently
-/// testable (see `ChatPublicConversationCoordinatorContextTests`) and makes
-/// its true dependencies explicit. The surface is intentionally large — it
-/// documents the coordinator's real coupling to the public timeline, the
-/// conversation stores, geohash participants, and the inbound public message
-/// pipeline.
-@MainActor
-protocol ChatPublicConversationContext: AnyObject {
-    // MARK: Channel state
-    var activeChannel: ChannelID { get }
-    var currentGeohash: String? { get }
-    var nickname: String { get }
-    var myPeerID: PeerID { get }
-    /// Publishes the public-timeline batching state (UI animation suppression).
-    /// (Single mutation path for the owner's `isBatchingPublic`; this
-    /// coordinator never reads it.)
-    func setPublicBatching(_ isBatching: Bool)
-    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
-    func notifyUIChanged()
-
-    // MARK: Public conversation store (single-writer intents)
-    /// Appends a public message in timestamp order. Returns `false` when a
-    /// message with the same ID is already in that conversation.
-    @discardableResult
-    func appendPublicMessage(_ message: BitchatMessage, to conversationID: ConversationID) -> Bool
-    /// Appends a geohash message if absent. Returns `true` when stored.
-    @discardableResult
-    func appendGeohashMessageIfAbsent(_ message: BitchatMessage, toGeohash geohash: String) -> Bool
-    func publicConversationContainsMessage(withID messageID: String, in conversationID: ConversationID) -> Bool
-    /// Removes a message by ID from whichever public conversation contains it.
-    @discardableResult
-    func removePublicMessage(withID messageID: String) -> BitchatMessage?
-    /// Removes every matching message from a geohash conversation (block purge).
-    func removePublicMessages(fromGeohash geohash: String, where predicate: (BitchatMessage) -> Bool)
-    /// Empties a public conversation's timeline (`/clear`).
-    func clearPublicConversation(_ conversationID: ConversationID)
-    /// Queues a system message for the next geohash channel visit.
-    func queueGeohashSystemMessage(_ content: String)
-
-    // MARK: Private chats (block cleanup & message removal)
-    /// Removes the peer's chat entirely, including unread state
-    /// (single-writer store intent; no-op for unknown peers).
-    func removePrivateChat(_ peerID: PeerID)
-    /// Removes a message by ID from every private chat containing it,
-    /// dropping chats that become empty. Returns the removed message.
-    @discardableResult
-    func removePrivateMessage(withID messageID: String) -> BitchatMessage?
-    func cleanupLocalFile(forMessage message: BitchatMessage)
-
-    // MARK: Geohash participants & presence
-    var geoNicknames: [String: String] { get }
-    var isTeleported: Bool { get }
-    var nostrKeyMapping: [PeerID: String] { get }
-    /// Drops every key mapping that resolves to the given (lowercased) Nostr pubkey.
-    func removeNostrKeyMappings(matchingPubkeyHexLowercased hex: String)
-    func visibleGeoPeople() -> [GeoPerson]
-    func geoParticipantCount(for geohash: String) -> Int
-    func removeGeoParticipant(pubkeyHex: String)
-
-    // MARK: Nostr identity & blocking (shared with the other contexts)
-    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
-    func isNostrBlocked(pubkeyHexLowercased: String) -> Bool
-    func setNostrBlocked(_ pubkeyHexLowercased: String, isBlocked: Bool)
-
-    // MARK: Mesh transport
-    func meshPeerNicknames() -> [PeerID: String]
-    func sendMeshMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date)
-
-    // MARK: Inbound public message processing
-    func processActionMessage(_ message: BitchatMessage) -> BitchatMessage
-    func isMessageBlocked(_ message: BitchatMessage) -> Bool
-    func allowPublicMessage(senderKey: String, contentKey: String) -> Bool
-    /// Buffers a visible-channel message for the batched (~80 ms) pipeline
-    /// flush, which commits it to `conversationID` in the store.
-    func enqueuePublicMessage(_ message: BitchatMessage, to conversationID: ConversationID)
-    func cachedStablePeerID(for shortPeerID: PeerID) -> PeerID?
-
-    // MARK: Content dedup & formatting
-    func normalizedContentKey(_ content: String) -> String
-    func contentTimestamp(forKey key: String) -> Date?
-    func recordContentKey(_ key: String, timestamp: Date)
-    /// Pre-renders the message so the formatting cache is warm before display.
-    func prewarmMessageFormatting(_ message: BitchatMessage)
-
-    // MARK: Notifications
-    /// Posts the you-were-mentioned local notification.
-    func notifyMention(from sender: String, message: String)
-}
-
-extension ChatViewModel: ChatPublicConversationContext {
-    // `unreadPrivateMessages`, `nostrKeyMapping`,
-    // `nickname`, `activeChannel`, `currentGeohash`, `geoNicknames`,
-    // `myPeerID`, `isTeleported`, `notifyUIChanged()`,
-    // `geoParticipantCount(for:)`, `isNostrBlocked(pubkeyHexLowercased:)`,
-    // `deriveNostrIdentity(forGeohash:)`, the public conversation store
-    // intents (`appendPublicMessage(_:to:)`,
-    // `appendGeohashMessageIfAbsent(_:toGeohash:)`,
-    // `publicConversationContainsMessage(withID:in:)`,
-    // `removePublicMessage(withID:)`,
-    // `removePublicMessages(fromGeohash:where:)`,
-    // `clearPublicConversation(_:)`, and `queueGeohashSystemMessage(_:)`)
-    // are shared requirements with `ChatDeliveryContext` /
-    // `ChatPrivateConversationContext` / `ChatNostrContext` or satisfied by
-    // existing `ChatViewModel` members. The members below flatten nested
-    // service accesses into intent-named calls.
-
-    func visibleGeoPeople() -> [GeoPerson] {
-        participantTracker.getVisiblePeople()
-    }
-
-    func removeGeoParticipant(pubkeyHex: String) {
-        participantTracker.removeParticipant(pubkeyHex: pubkeyHex)
-    }
-
-    func setNostrBlocked(_ pubkeyHexLowercased: String, isBlocked: Bool) {
-        identityManager.setNostrBlocked(pubkeyHexLowercased, isBlocked: isBlocked)
-    }
-
-    func meshPeerNicknames() -> [PeerID: String] {
-        meshService.getPeerNicknames()
-    }
-
-    func sendMeshMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date) {
-        meshService.sendMessage(content, mentions: mentions, messageID: messageID, timestamp: timestamp)
-    }
-
-    func allowPublicMessage(senderKey: String, contentKey: String) -> Bool {
-        publicRateLimiter.allow(senderKey: senderKey, contentKey: contentKey)
-    }
-
-    func enqueuePublicMessage(_ message: BitchatMessage, to conversationID: ConversationID) {
-        publicMessagePipeline.enqueue(message, to: conversationID)
-    }
-
-    func normalizedContentKey(_ content: String) -> String {
-        deduplicationService.normalizedContentKey(content)
-    }
-
-    func contentTimestamp(forKey key: String) -> Date? {
-        deduplicationService.contentTimestamp(forKey: key)
-    }
-
-    func recordContentKey(_ key: String, timestamp: Date) {
-        deduplicationService.recordContentKey(key, timestamp: timestamp)
-    }
-
-    func prewarmMessageFormatting(_ message: BitchatMessage) {
-        _ = formatMessageAsText(message, colorScheme: currentColorScheme)
-    }
-
-    func notifyMention(from sender: String, message: String) {
-        NotificationService.shared.sendMentionNotification(from: sender, message: message)
-    }
-}
-
 @MainActor
 final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
-    private unowned let context: any ChatPublicConversationContext
+    private unowned let viewModel: ChatViewModel
 
-    init(context: any ChatPublicConversationContext) {
-        self.context = context
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
     }
 
     func visibleGeohashPeople() -> [GeoPerson] {
-        context.visibleGeoPeople()
+        viewModel.participantTracker.getVisiblePeople()
     }
 
     func getVisibleGeoParticipants() -> [CommandGeoParticipant] {
@@ -183,7 +24,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func geohashParticipantCount(for geohash: String) -> Int {
-        context.geoParticipantCount(for: geohash)
+        viewModel.participantTracker.participantCount(for: geohash)
     }
 
     func displayNameForPubkey(_ pubkeyHex: String) -> String {
@@ -191,36 +32,50 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func isBlocked(_ pubkeyHexLowercased: String) -> Bool {
-        context.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
+        viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
     }
 
     func isGeohashUserBlocked(pubkeyHexLowercased: String) -> Bool {
-        context.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
+        viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: pubkeyHexLowercased)
     }
 
     func blockGeohashUser(pubkeyHexLowercased: String, displayName: String) {
         let hex = pubkeyHexLowercased.lowercased()
-        context.setNostrBlocked(hex, isBlocked: true)
-        context.removeGeoParticipant(pubkeyHex: hex)
+        viewModel.identityManager.setNostrBlocked(hex, isBlocked: true)
+        viewModel.participantTracker.removeParticipant(pubkeyHex: hex)
 
-        if let gh = context.currentGeohash {
-            let predicate: (BitchatMessage) -> Bool = { [unowned context] message in
+        if let gh = viewModel.currentGeohash {
+            let predicate: (BitchatMessage) -> Bool = { [unowned viewModel] message in
                 guard let senderPeerID = message.senderPeerID,
                       senderPeerID.isGeoDM || senderPeerID.isGeoChat else {
                     return false
                 }
-                if let full = context.nostrKeyMapping[senderPeerID]?.lowercased() {
+                if let full = viewModel.nostrKeyMapping[senderPeerID]?.lowercased() {
                     return full == hex
                 }
                 return false
             }
-            context.removePublicMessages(fromGeohash: gh, where: predicate)
+            viewModel.timelineStore.removeMessages(in: gh, where: predicate)
+            synchronizePublicConversationStore(forGeohash: gh)
+            if case .location = viewModel.activeChannel {
+                viewModel.messages.removeAll(where: predicate)
+            }
         }
 
-        // The store intent no-ops when no such chat exists.
-        context.removePrivateChat(PeerID(nostr_: hex))
+        let conversationPeerID = PeerID(nostr_: hex)
+        if viewModel.privateChats[conversationPeerID] != nil {
+            var privateChats = viewModel.privateChats
+            privateChats.removeValue(forKey: conversationPeerID)
+            viewModel.privateChats = privateChats
 
-        context.removeNostrKeyMappings(matchingPubkeyHexLowercased: hex)
+            var unread = viewModel.unreadPrivateMessages
+            unread.remove(conversationPeerID)
+            viewModel.unreadPrivateMessages = unread
+        }
+
+        for (key, value) in viewModel.nostrKeyMapping where value.lowercased() == hex {
+            viewModel.nostrKeyMapping.removeValue(forKey: key)
+        }
 
         addSystemMessage(
             String(
@@ -235,7 +90,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func unblockGeohashUser(pubkeyHexLowercased: String, displayName: String) {
-        context.setNostrBlocked(pubkeyHexLowercased, isBlocked: false)
+        viewModel.identityManager.setNostrBlocked(pubkeyHexLowercased, isBlocked: false)
         addSystemMessage(
             String(
                 format: String(
@@ -250,45 +105,104 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
 
     func displayNameForNostrPubkey(_ pubkeyHex: String) -> String {
         let suffix = String(pubkeyHex.suffix(4))
-        if let geohash = context.currentGeohash,
-           let myGeoIdentity = try? context.deriveNostrIdentity(forGeohash: geohash),
+        if let geohash = viewModel.currentGeohash,
+           let myGeoIdentity = try? viewModel.idBridge.deriveIdentity(forGeohash: geohash),
            myGeoIdentity.publicKeyHex.lowercased() == pubkeyHex.lowercased() {
-            return context.nickname + "#" + suffix
+            return viewModel.nickname + "#" + suffix
         }
-        if let nick = context.geoNicknames[pubkeyHex.lowercased()], !nick.isEmpty {
+        if let nick = viewModel.geoNicknames[pubkeyHex.lowercased()], !nick.isEmpty {
             return nick + "#" + suffix
         }
         return "anon#\(suffix)"
     }
 
     func currentPublicSender() -> (name: String, peerID: PeerID) {
-        var displaySender = context.nickname
-        var senderPeerID = context.myPeerID
-        if case .location(let channel) = context.activeChannel,
-           let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
+        var displaySender = viewModel.nickname
+        var senderPeerID = viewModel.meshService.myPeerID
+        if case .location(let channel) = viewModel.activeChannel,
+           let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
             let suffix = String(identity.publicKeyHex.suffix(4))
-            displaySender = context.nickname + "#" + suffix
+            displaySender = viewModel.nickname + "#" + suffix
             senderPeerID = PeerID(nostr: identity.publicKeyHex)
         }
         return (displaySender, senderPeerID)
     }
 
     func removeMessage(withID messageID: String, cleanupFile: Bool = false) {
-        var removedMessage = context.removePublicMessage(withID: messageID)
+        var removedMessage: BitchatMessage?
 
-        if let removedPrivateMessage = context.removePrivateMessage(withID: messageID) {
-            removedMessage = removedMessage ?? removedPrivateMessage
+        if let index = viewModel.messages.firstIndex(where: { $0.id == messageID }) {
+            removedMessage = viewModel.messages.remove(at: index)
         }
 
+        if let storeRemoved = viewModel.timelineStore.removeMessage(withID: messageID) {
+            removedMessage = removedMessage ?? storeRemoved
+            synchronizeAllPublicConversationStores()
+        }
+
+        var chats = viewModel.privateChats
+        for (peerID, items) in chats {
+            let filtered = items.filter { $0.id != messageID }
+            if filtered.count != items.count {
+                if filtered.isEmpty {
+                    chats.removeValue(forKey: peerID)
+                } else {
+                    chats[peerID] = filtered
+                }
+                if removedMessage == nil {
+                    removedMessage = items.first(where: { $0.id == messageID })
+                }
+            }
+        }
+        viewModel.privateChats = chats
+
         if cleanupFile, let removedMessage {
-            context.cleanupLocalFile(forMessage: removedMessage)
+            viewModel.cleanupLocalFile(forMessage: removedMessage)
         }
 
-        context.notifyUIChanged()
+        viewModel.objectWillChange.send()
+    }
+
+    func initializeConversationStore() {
+        viewModel.conversationStore.setActiveChannel(viewModel.activeChannel)
+        synchronizePublicConversationStore(for: viewModel.activeChannel)
+        viewModel.synchronizePrivateConversationStore()
+        viewModel.synchronizeConversationSelectionStore()
+    }
+
+    func synchronizePublicConversationStore(for channel: ChannelID) {
+        let publicMessages = viewModel.timelineStore.messages(for: channel)
+        viewModel.conversationStore.replaceMessages(publicMessages, for: channel)
+        if channel == viewModel.activeChannel {
+            viewModel.conversationStore.setActiveChannel(viewModel.activeChannel)
+        }
+    }
+
+    func synchronizePublicConversationStore(forGeohash geohash: String) {
+        let channel = ChannelID.location(GeohashChannel(level: .city, geohash: geohash))
+        let publicMessages = viewModel.timelineStore.messages(for: channel)
+        viewModel.conversationStore.replaceMessages(publicMessages, for: .geohash(geohash.lowercased()))
+    }
+
+    func synchronizeAllPublicConversationStores() {
+        synchronizePublicConversationStore(for: .mesh)
+        for geohash in viewModel.timelineStore.geohashKeys() {
+            synchronizePublicConversationStore(forGeohash: geohash)
+        }
+    }
+
+    func refreshVisibleMessages(from channel: ChannelID? = nil) {
+        let target = channel ?? viewModel.activeChannel
+        viewModel.messages = viewModel.timelineStore.messages(for: target)
+        viewModel.conversationStore.replaceMessages(viewModel.messages, for: target)
+        if target == viewModel.activeChannel {
+            viewModel.conversationStore.setActiveChannel(viewModel.activeChannel)
+        }
     }
 
     func clearCurrentPublicTimeline() {
-        context.clearPublicConversation(ConversationID(channelID: context.activeChannel))
+        viewModel.messages.removeAll()
+        viewModel.timelineStore.clear(channel: viewModel.activeChannel)
 
         Task.detached(priority: .utility) {
             do {
@@ -328,7 +242,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             timestamp: timestamp,
             isRelay: false
         )
-        context.appendPublicMessage(systemMessage, to: ConversationID(channelID: context.activeChannel))
+        viewModel.messages.append(systemMessage)
     }
 
     func addMeshOnlySystemMessage(_ content: String) {
@@ -338,7 +252,11 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             timestamp: Date(),
             isRelay: false
         )
-        context.appendPublicMessage(systemMessage, to: .mesh)
+        viewModel.timelineStore.append(systemMessage, to: .mesh)
+        synchronizePublicConversationStore(for: .mesh)
+        refreshVisibleMessages()
+        viewModel.trimMessagesIfNeeded()
+        viewModel.objectWillChange.send()
     }
 
     func addPublicSystemMessage(_ content: String) {
@@ -348,31 +266,34 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             timestamp: Date(),
             isRelay: false
         )
-        context.appendPublicMessage(systemMessage, to: ConversationID(channelID: context.activeChannel))
-        let contentKey = context.normalizedContentKey(systemMessage.content)
-        context.recordContentKey(contentKey, timestamp: systemMessage.timestamp)
+        viewModel.timelineStore.append(systemMessage, to: viewModel.activeChannel)
+        refreshVisibleMessages(from: viewModel.activeChannel)
+        let contentKey = viewModel.deduplicationService.normalizedContentKey(systemMessage.content)
+        viewModel.deduplicationService.recordContentKey(contentKey, timestamp: systemMessage.timestamp)
+        viewModel.trimMessagesIfNeeded()
+        viewModel.objectWillChange.send()
     }
 
     func addGeohashOnlySystemMessage(_ content: String) {
-        if case .location = context.activeChannel {
+        if case .location = viewModel.activeChannel {
             addPublicSystemMessage(content)
         } else {
-            context.queueGeohashSystemMessage(content)
+            viewModel.timelineStore.queueGeohashSystemMessage(content)
         }
     }
 
     func sendPublicRaw(_ content: String) {
-        if case .location(let channel) = context.activeChannel {
-            Task { @MainActor [weak context] in
-                guard let context else { return }
+        if case .location(let channel) = viewModel.activeChannel {
+            Task { @MainActor [weak viewModel] in
+                guard let viewModel else { return }
                 do {
-                    let identity = try context.deriveNostrIdentity(forGeohash: channel.geohash)
+                    let identity = try viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash)
                     let event = try NostrProtocol.createEphemeralGeohashEvent(
                         content: content,
                         geohash: channel.geohash,
                         senderIdentity: identity,
-                        nickname: context.nickname,
-                        teleported: context.isTeleported
+                        nickname: viewModel.nickname,
+                        teleported: viewModel.locationManager.teleported
                     )
                     let targetRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: channel.geohash, count: 5)
                     if targetRelays.isEmpty {
@@ -387,7 +308,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
             return
         }
 
-        context.sendMeshMessage(
+        viewModel.meshService.sendMessage(
             content,
             mentions: [],
             messageID: UUID().uuidString,
@@ -396,73 +317,61 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
     }
 
     func handlePublicMessage(_ message: BitchatMessage) {
-        let finalMessage = context.processActionMessage(message)
-        if context.isMessageBlocked(finalMessage) { return }
+        let finalMessage = viewModel.processActionMessage(message)
+        if viewModel.isMessageBlocked(finalMessage) { return }
 
         let isGeo = finalMessage.senderPeerID?.isGeoChat == true
-        let isSystem = finalMessage.sender == "system"
-        let shouldRateLimit = !isSystem || finalMessage.senderPeerID != nil
+        let shouldRateLimit = finalMessage.sender != "system" || finalMessage.senderPeerID != nil
         if shouldRateLimit {
             let senderKey = normalizedSenderKey(for: finalMessage)
-            let contentKey = context.normalizedContentKey(finalMessage.content)
-            if !context.allowPublicMessage(senderKey: senderKey, contentKey: contentKey) {
+            let contentKey = viewModel.deduplicationService.normalizedContentKey(finalMessage.content)
+            if !viewModel.publicRateLimiter.allow(senderKey: senderKey, contentKey: contentKey) {
                 return
             }
         }
 
-        if !isSystem && finalMessage.content.count > 16000 { return }
-        // Empty content never rendered before (the old visible-array enqueue
-        // filtered it); with the store as the sole timeline it is dropped
-        // outright instead of lingering invisibly in a backing buffer.
-        guard !finalMessage.content.trimmed.isEmpty else { return }
+        if finalMessage.sender != "system" && finalMessage.content.count > 16000 { return }
 
-        // Resolve the destination conversation. System messages surface on
-        // the active channel (matching their old visible-only routing); geo
-        // messages require a current geohash, mesh messages always land in
-        // the mesh conversation.
-        let destination: ConversationID?
-        if isSystem {
-            destination = ConversationID(channelID: context.activeChannel)
-        } else if isGeo {
-            destination = context.currentGeohash.map { .geohash($0.lowercased()) }
-        } else {
-            destination = .mesh
+        if !isGeo && finalMessage.sender != "system" {
+            viewModel.timelineStore.append(finalMessage, to: .mesh)
+            synchronizePublicConversationStore(for: .mesh)
         }
-        guard let destination else { return }
 
+        if isGeo && finalMessage.sender != "system",
+           let geohash = viewModel.currentGeohash,
+           viewModel.timelineStore.appendIfAbsent(finalMessage, toGeohash: geohash) {
+            synchronizePublicConversationStore(forGeohash: geohash)
+        }
+
+        let isSystem = finalMessage.sender == "system"
         let channelMatches: Bool = {
-            switch context.activeChannel {
+            switch viewModel.activeChannel {
             case .mesh: return !isGeo || isSystem
             case .location: return isGeo || isSystem
             }
         }()
 
-        if channelMatches {
-            // Visible-channel arrivals are batched: the pipeline's ~80 ms
-            // flush commits them to the store (which dedups by ID), keeping
-            // the deliberate UI flush cadence.
-            guard !context.publicConversationContainsMessage(withID: finalMessage.id, in: destination) else { return }
-            context.enqueuePublicMessage(finalMessage, to: destination)
-        } else {
-            // Background-channel arrivals have no rendering observers to
-            // batch for; they land in the store immediately.
-            context.appendPublicMessage(finalMessage, to: destination)
+        guard channelMatches else { return }
+
+        if !finalMessage.content.trimmed.isEmpty,
+           !viewModel.messages.contains(where: { $0.id == finalMessage.id }) {
+            viewModel.publicMessagePipeline.enqueue(finalMessage)
         }
     }
 
     func checkForMentions(_ message: BitchatMessage) {
-        var myTokens: Set<String> = [context.nickname]
-        let meshPeers = context.meshPeerNicknames()
-        let collisions = meshPeers.values.filter { $0.hasPrefix(context.nickname + "#") }
+        var myTokens: Set<String> = [viewModel.nickname]
+        let meshPeers = viewModel.meshService.getPeerNicknames()
+        let collisions = meshPeers.values.filter { $0.hasPrefix(viewModel.nickname + "#") }
         if !collisions.isEmpty {
-            let suffix = "#" + String(context.myPeerID.id.prefix(4))
-            myTokens = [context.nickname + suffix]
+            let suffix = "#" + String(viewModel.meshService.myPeerID.id.prefix(4))
+            myTokens = [viewModel.nickname + suffix]
         }
         let isMentioned = message.mentions?.contains(where: myTokens.contains) ?? false
 
-        if isMentioned && message.sender != context.nickname {
+        if isMentioned && message.sender != viewModel.nickname {
             SecureLogger.info("🔔 Mention from \(message.sender)", category: .session)
-            context.notifyMention(from: message.sender, message: message.content)
+            NotificationService.shared.sendMentionNotification(from: message.sender, message: message.content)
         }
     }
 
@@ -470,11 +379,11 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
         #if os(iOS)
         guard UIApplication.shared.applicationState == .active else { return }
 
-        var tokens: [String] = [context.nickname]
-        switch context.activeChannel {
+        var tokens: [String] = [viewModel.nickname]
+        switch viewModel.activeChannel {
         case .location(let channel):
-            if let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
-                tokens.append(context.nickname + "#" + String(identity.publicKeyHex.suffix(4)))
+            if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+                tokens.append(viewModel.nickname + "#" + String(identity.publicKeyHex.suffix(4)))
             }
         case .mesh:
             break
@@ -485,7 +394,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
         let isHugForMe = message.content.contains("🫂") && hugsMe
         let isSlapForMe = message.content.contains("🐟") && slapsMe
 
-        if isHugForMe && message.sender != context.nickname {
+        if isHugForMe && message.sender != viewModel.nickname {
             let impactFeedback = UIImpactFeedbackGenerator(style: .medium)
             impactFeedback.prepare()
 
@@ -496,7 +405,7 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
                     impactFeedback.impactOccurred()
                 }
             }
-        } else if isSlapForMe && message.sender != context.nickname {
+        } else if isSlapForMe && message.sender != viewModel.nickname {
             let impactFeedback = UIImpactFeedbackGenerator(style: .heavy)
             impactFeedback.prepare()
             impactFeedback.impactOccurred()
@@ -504,28 +413,36 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
         #endif
     }
 
+    func pipelineCurrentMessages(_ pipeline: PublicMessagePipeline) -> [BitchatMessage] {
+        viewModel.messages
+    }
+
+    func pipeline(_ pipeline: PublicMessagePipeline, setMessages messages: [BitchatMessage]) {
+        viewModel.messages = messages
+    }
+
     func pipeline(_ pipeline: PublicMessagePipeline, normalizeContent content: String) -> String {
-        context.normalizedContentKey(content)
+        viewModel.deduplicationService.normalizedContentKey(content)
     }
 
     func pipeline(_ pipeline: PublicMessagePipeline, contentTimestampForKey key: String) -> Date? {
-        context.contentTimestamp(forKey: key)
+        viewModel.deduplicationService.contentTimestamp(forKey: key)
     }
 
     func pipeline(_ pipeline: PublicMessagePipeline, recordContentKey key: String, timestamp: Date) {
-        context.recordContentKey(key, timestamp: timestamp)
+        viewModel.deduplicationService.recordContentKey(key, timestamp: timestamp)
     }
 
-    func pipeline(_ pipeline: PublicMessagePipeline, commit message: BitchatMessage, to conversationID: ConversationID) -> Bool {
-        context.appendPublicMessage(message, to: conversationID)
+    func pipelineTrimMessages(_ pipeline: PublicMessagePipeline) {
+        viewModel.trimMessagesIfNeeded()
     }
 
     func pipelinePrewarmMessage(_ pipeline: PublicMessagePipeline, message: BitchatMessage) {
-        context.prewarmMessageFormatting(message)
+        _ = viewModel.formatMessageAsText(message, colorScheme: viewModel.currentColorScheme)
     }
 
     func pipelineSetBatchingState(_ pipeline: PublicMessagePipeline, isBatching: Bool) {
-        context.setPublicBatching(isBatching)
+        viewModel.isBatchingPublic = isBatching
     }
 }
 
@@ -533,10 +450,10 @@ private extension ChatPublicConversationCoordinator {
     func normalizedSenderKey(for message: BitchatMessage) -> String {
         if let senderPeerID = message.senderPeerID {
             if senderPeerID.isGeoChat || senderPeerID.isGeoDM {
-                let full = (context.nostrKeyMapping[senderPeerID] ?? senderPeerID.bare).lowercased()
+                let full = (viewModel.nostrKeyMapping[senderPeerID] ?? senderPeerID.bare).lowercased()
                 return "nostr:" + full
             } else if senderPeerID.id.count == 16,
-                      let full = context.cachedStablePeerID(for: senderPeerID)?.id.lowercased() {
+                      let full = viewModel.cachedStablePeerID(for: senderPeerID)?.id.lowercased() {
                 return "noise:" + full
             } else {
                 return "mesh:" + senderPeerID.id.lowercased()

bitchat/ViewModels/ChatTransportEventCoordinator.swift

@@ -2,149 +2,26 @@ import BitFoundation
 import BitLogger
 import Foundation
 
-/// The narrow surface `ChatTransportEventCoordinator` needs from its owner.
-///
-/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
-/// minimal context it actually uses instead of holding an `unowned` back-ref
-/// to the whole `ChatViewModel`. This keeps the coordinator independently
-/// testable (see `ChatTransportEventCoordinatorContextTests`) and makes its
-/// true dependencies explicit.
-@MainActor
-protocol ChatTransportEventContext: AnyObject {
-    // MARK: Connection & chat state
-    var isConnected: Bool { get set }
-    var nickname: String { get }
-    var myPeerID: PeerID { get }
-    /// A single private chat's timeline (store-direct lookup on
-    /// `ChatViewModel`; no `privateChats` dictionary build).
-    func privateMessages(for peerID: PeerID) -> [BitchatMessage]
-    var unreadPrivateMessages: Set<PeerID> { get }
-    var selectedPrivateChatPeer: PeerID? { get set }
-    /// Appends a private message via the single-writer store intent;
-    /// returns `false` on duplicate message ID.
-    @discardableResult
-    func appendPrivateMessage(_ message: BitchatMessage, to peerID: PeerID) -> Bool
-    /// Removes the peer's chat entirely, including unread state.
-    func removePrivateChat(_ peerID: PeerID)
-    func markPrivateChatUnread(_ peerID: PeerID)
-    func markPrivateChatRead(_ peerID: PeerID)
-    /// Forgets that read receipts were sent for `ids` so READ acks can be
-    /// re-sent after the peer reconnects. (Single mutation path for the
-    /// owner's `sentReadReceipts`; this coordinator never reads the raw set.)
-    func unmarkReadReceiptsSent(_ ids: [String])
-    /// Signals that message state changed so observers refresh (e.g. `objectWillChange.send()`).
-    func notifyUIChanged()
-
-    // MARK: Inbound message handling
-    func isMessageBlocked(_ message: BitchatMessage) -> Bool
-    func handlePrivateMessage(_ message: BitchatMessage)
-    func handlePublicMessage(_ message: BitchatMessage)
-    func checkForMentions(_ message: BitchatMessage)
-    func sendHapticFeedback(for message: BitchatMessage)
-    func parseMentions(from content: String) -> [String]
-
-    // MARK: Peer identity & sessions
-    func isPeerBlocked(_ peerID: PeerID) -> Bool
-    /// The peer's current entry in the unified peer service, if known.
-    func unifiedPeer(for peerID: PeerID) -> BitchatPeer?
-    func resolveNickname(for peerID: PeerID) -> String
-    func registerEphemeralSession(peerID: PeerID)
-    func removeEphemeralSession(peerID: PeerID)
-    /// Resolves the peer's Noise static key from the active Noise session, if any.
-    func noiseSessionPublicKeyData(for peerID: PeerID) -> Data?
-    func cacheStablePeerID(_ stablePeerID: PeerID, for shortPeerID: PeerID)
-    func cachedStablePeerID(for shortPeerID: PeerID) -> PeerID?
-
-    // MARK: Routing & acknowledgements
-    func flushRouterOutbox(for peerID: PeerID)
-    func sendMeshDeliveryAck(for messageID: String, to peerID: PeerID)
-
-    // MARK: Delivery status
-    /// Applies the status to every known location of the message.
-    /// Returns `false` when no message with that ID was updated.
-    @discardableResult
-    func applyMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool
-    func deliveryStatus(for messageID: String) -> DeliveryStatus?
-
-    // MARK: Verification payloads
-    func handleVerifyChallengePayload(from peerID: PeerID, payload: Data)
-    func handleVerifyResponsePayload(from peerID: PeerID, payload: Data)
-}
-
-extension ChatViewModel: ChatTransportEventContext {
-    // `isConnected`, `nickname`, `myPeerID`, `privateMessages(for:)`,
-    // `unreadPrivateMessages`, `selectedPrivateChatPeer`, `notifyUIChanged()`,
-    // the inbound message handlers, `isPeerBlocked(_:)`,
-    // `parseMentions(from:)`, `resolveNickname(for:)`,
-    // `cacheStablePeerID(_:for:)`, and `cachedStablePeerID(for:)` are shared
-    // requirements with the other contexts or satisfied by existing
-    // `ChatViewModel` members. The single-writer intent op
-    // `unmarkReadReceiptsSent(_:)` lives next to its backing state in
-    // `ChatViewModel`. The members below flatten nested service accesses into
-    // intent-named calls.
-
-    func unifiedPeer(for peerID: PeerID) -> BitchatPeer? {
-        unifiedPeerService.getPeer(by: peerID)
-    }
-
-    func registerEphemeralSession(peerID: PeerID) {
-        identityManager.registerEphemeralSession(peerID: peerID, handshakeState: .none)
-    }
-
-    func removeEphemeralSession(peerID: PeerID) {
-        identityManager.removeEphemeralSession(peerID: peerID)
-    }
-
-    func noiseSessionPublicKeyData(for peerID: PeerID) -> Data? {
-        meshService.noiseSessionPublicKeyData(for: peerID)
-    }
-
-    func flushRouterOutbox(for peerID: PeerID) {
-        messageRouter.flushOutbox(for: peerID)
-    }
-
-    func sendMeshDeliveryAck(for messageID: String, to peerID: PeerID) {
-        meshService.sendDeliveryAck(for: messageID, to: peerID)
-    }
-
-    @discardableResult
-    func applyMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool {
-        deliveryCoordinator.updateMessageDeliveryStatus(messageID, status: status)
-    }
-
-    func deliveryStatus(for messageID: String) -> DeliveryStatus? {
-        deliveryCoordinator.deliveryStatus(for: messageID)
-    }
-
-    func handleVerifyChallengePayload(from peerID: PeerID, payload: Data) {
-        verificationCoordinator.handleVerifyChallengePayload(from: peerID, payload: payload)
-    }
-
-    func handleVerifyResponsePayload(from peerID: PeerID, payload: Data) {
-        verificationCoordinator.handleVerifyResponsePayload(from: peerID, payload: payload)
-    }
-}
-
 final class ChatTransportEventCoordinator {
-    private unowned let context: any ChatTransportEventContext
+    private unowned let viewModel: ChatViewModel
 
-    init(context: any ChatTransportEventContext) {
-        self.context = context
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
     }
 
     func didReceiveMessage(_ message: BitchatMessage) {
-        runOnMain { context in
-            guard !context.isMessageBlocked(message) else { return }
+        runOnMain { viewModel in
+            guard !viewModel.isMessageBlocked(message) else { return }
             guard !message.content.trimmed.isEmpty || message.isPrivate else { return }
 
             if message.isPrivate {
-                context.handlePrivateMessage(message)
+                viewModel.handlePrivateMessage(message)
             } else {
-                context.handlePublicMessage(message)
+                viewModel.handlePublicMessage(message)
             }
 
-            context.checkForMentions(message)
-            context.sendHapticFeedback(for: message)
+            viewModel.checkForMentions(message)
+            viewModel.sendHapticFeedback(for: message)
         }
     }
 
@@ -155,9 +32,9 @@ final class ChatTransportEventCoordinator {
         timestamp: Date,
         messageID: String?
     ) {
-        runOnMain { context in
+        runOnMain { viewModel in
             let normalized = content.trimmed
-            let mentions = context.parseMentions(from: normalized)
+            let mentions = viewModel.parseMentions(from: normalized)
             let message = BitchatMessage(
                 id: messageID,
                 sender: nickname,
@@ -171,9 +48,9 @@ final class ChatTransportEventCoordinator {
                 mentions: mentions.isEmpty ? nil : mentions
             )
 
-            context.handlePublicMessage(message)
-            context.checkForMentions(message)
-            context.sendHapticFeedback(for: message)
+            viewModel.handlePublicMessage(message)
+            viewModel.checkForMentions(message)
+            viewModel.sendHapticFeedback(for: message)
         }
     }
 
@@ -183,13 +60,13 @@ final class ChatTransportEventCoordinator {
         payload: Data,
         timestamp: Date
     ) {
-        runOnMain { [self] context in
+        runOnMain { [self] viewModel in
             handleNoisePayload(
                 from: peerID,
                 type: type,
                 payload: payload,
                 timestamp: timestamp,
-                in: context
+                in: viewModel
             )
         }
     }
@@ -197,59 +74,60 @@ final class ChatTransportEventCoordinator {
     func didConnectToPeer(_ peerID: PeerID) {
         SecureLogger.debug("🤝 Peer connected: \(peerID)", category: .session)
 
-        runOnMain { context in
-            context.isConnected = true
-            context.registerEphemeralSession(peerID: peerID)
-            context.notifyUIChanged()
+        runOnMain { viewModel in
+            viewModel.isConnected = true
+            viewModel.identityManager.registerEphemeralSession(peerID: peerID, handshakeState: .none)
+            viewModel.objectWillChange.send()
 
-            if let peer = context.unifiedPeer(for: peerID) {
+            if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
                 let stablePeerID = PeerID(hexData: peer.noisePublicKey)
-                context.cacheStablePeerID(stablePeerID, for: peerID)
+                viewModel.cacheStablePeerID(stablePeerID, for: peerID)
             }
 
-            context.flushRouterOutbox(for: peerID)
+            viewModel.messageRouter.flushOutbox(for: peerID)
         }
     }
 
     func didDisconnectFromPeer(_ peerID: PeerID) {
         SecureLogger.debug("👋 Peer disconnected: \(peerID)", category: .session)
 
-        runOnMain { context in
-            context.removeEphemeralSession(peerID: peerID)
+        runOnMain { viewModel in
+            viewModel.identityManager.removeEphemeralSession(peerID: peerID)
 
-            var stablePeerID = context.cachedStablePeerID(for: peerID)
+            var stablePeerID = viewModel.cachedStablePeerID(for: peerID)
             if stablePeerID == nil,
-               let key = context.noiseSessionPublicKeyData(for: peerID) {
+               let key = viewModel.meshService.getNoiseService().getPeerPublicKeyData(peerID) {
                 let derivedPeerID = PeerID(hexData: key)
-                context.cacheStablePeerID(derivedPeerID, for: peerID)
+                viewModel.cacheStablePeerID(derivedPeerID, for: peerID)
                 stablePeerID = derivedPeerID
             }
 
-            if let currentPeerID = context.selectedPrivateChatPeer,
+            if let currentPeerID = viewModel.selectedPrivateChatPeer,
                currentPeerID == peerID,
                let stablePeerID {
                 self.migrateSelectedConversationIfNeeded(
                     from: peerID,
                     to: stablePeerID,
-                    in: context
+                    in: viewModel
                 )
             }
 
-            let receiptIDs = context.privateMessages(for: peerID)
-                .filter { $0.senderPeerID == peerID }
-                .map(\.id)
-            context.unmarkReadReceiptsSent(receiptIDs)
+            if let messages = viewModel.privateChats[peerID] {
+                for message in messages where message.senderPeerID == peerID {
+                    viewModel.sentReadReceipts.remove(message.id)
+                }
+            }
 
-            context.notifyUIChanged()
+            viewModel.objectWillChange.send()
         }
     }
 }
 
 private extension ChatTransportEventCoordinator {
-    func runOnMain(_ action: @escaping @MainActor (any ChatTransportEventContext) -> Void) {
-        Task { @MainActor [weak context = self.context] in
-            guard let context else { return }
-            action(context)
+    func runOnMain(_ action: @escaping @MainActor (ChatViewModel) -> Void) {
+        Task { @MainActor [weak viewModel = self.viewModel] in
+            guard let viewModel else { return }
+            action(viewModel)
         }
     }
 
@@ -257,15 +135,15 @@ private extension ChatTransportEventCoordinator {
     func migrateSelectedConversationIfNeeded(
         from shortPeerID: PeerID,
         to stablePeerID: PeerID,
-        in context: any ChatTransportEventContext
+        in viewModel: ChatViewModel
     ) {
-        let hadUnread = context.unreadPrivateMessages.contains(shortPeerID)
+        if let messages = viewModel.privateChats[shortPeerID] {
+            if viewModel.privateChats[stablePeerID] == nil {
+                viewModel.privateChats[stablePeerID] = []
+            }
 
-        let shortPeerMessages = context.privateMessages(for: shortPeerID)
-        if !shortPeerMessages.isEmpty {
-            for message in shortPeerMessages {
-                // Rewrite senderPeerID to the stable key so read receipts
-                // keep working; store append dedups by ID and keeps order.
+            let existingIDs = Set(viewModel.privateChats[stablePeerID]?.map(\.id) ?? [])
+            for message in messages where !existingIDs.contains(message.id) {
                 let migrated = BitchatMessage(
                     id: message.id,
                     sender: message.sender,
@@ -275,24 +153,25 @@ private extension ChatTransportEventCoordinator {
                     originalSender: message.originalSender,
                     isPrivate: message.isPrivate,
                     recipientNickname: message.recipientNickname,
-                    senderPeerID: message.senderPeerID == context.myPeerID
-                        ? context.myPeerID
+                    senderPeerID: message.senderPeerID == viewModel.meshService.myPeerID
+                        ? viewModel.meshService.myPeerID
                         : stablePeerID,
                     mentions: message.mentions,
                     deliveryStatus: message.deliveryStatus
                 )
-                context.appendPrivateMessage(migrated, to: stablePeerID)
+                viewModel.privateChats[stablePeerID]?.append(migrated)
             }
 
-            context.removePrivateChat(shortPeerID)
+            viewModel.privateChats[stablePeerID]?.sort { $0.timestamp < $1.timestamp }
+            viewModel.privateChats.removeValue(forKey: shortPeerID)
         }
 
-        if hadUnread {
-            context.markPrivateChatRead(shortPeerID)
-            context.markPrivateChatUnread(stablePeerID)
+        if viewModel.unreadPrivateMessages.contains(shortPeerID) {
+            viewModel.unreadPrivateMessages.remove(shortPeerID)
+            viewModel.unreadPrivateMessages.insert(stablePeerID)
         }
 
-        context.selectedPrivateChatPeer = stablePeerID
+        viewModel.selectedPrivateChatPeer = stablePeerID
     }
 
     @MainActor
@@ -301,19 +180,19 @@ private extension ChatTransportEventCoordinator {
         type: NoisePayloadType,
         payload: Data,
         timestamp: Date,
-        in context: any ChatTransportEventContext
+        in viewModel: ChatViewModel
     ) {
         switch type {
         case .privateMessage:
             guard let packet = PrivateMessagePacket.decode(from: payload) else { return }
 
-            guard !context.isPeerBlocked(peerID) else {
+            guard !viewModel.isPeerBlocked(peerID) else {
                 SecureLogger.debug("🚫 Ignoring Noise payload from blocked peer: \(peerID)", category: .security)
                 return
             }
 
-            let senderName = context.unifiedPeer(for: peerID)?.nickname ?? "Unknown"
-            let mentions = context.parseMentions(from: packet.content)
+            let senderName = viewModel.unifiedPeerService.getPeer(by: peerID)?.nickname ?? "Unknown"
+            let mentions = viewModel.parseMentions(from: packet.content)
             let message = BitchatMessage(
                 id: packet.messageID,
                 sender: senderName,
@@ -322,24 +201,24 @@ private extension ChatTransportEventCoordinator {
                 isRelay: false,
                 originalSender: nil,
                 isPrivate: true,
-                recipientNickname: context.nickname,
+                recipientNickname: viewModel.nickname,
                 senderPeerID: peerID,
                 mentions: mentions.isEmpty ? nil : mentions
             )
-            context.handlePrivateMessage(message)
-            context.sendMeshDeliveryAck(for: packet.messageID, to: peerID)
+            viewModel.handlePrivateMessage(message)
+            viewModel.meshService.sendDeliveryAck(for: packet.messageID, to: peerID)
 
         case .delivered:
             guard let messageID = String(data: payload, encoding: .utf8) else { return }
 
-            let name = deliveryStatusName(for: peerID, in: context)
-            let didUpdate = context.applyMessageDeliveryStatus(
+            let name = deliveryStatusName(for: peerID, in: viewModel)
+            let didUpdate = viewModel.deliveryCoordinator.updateMessageDeliveryStatus(
                 messageID,
                 status: .delivered(to: name, at: Date())
             )
 
             if !didUpdate {
-                if case .read? = context.deliveryStatus(for: messageID) {
+                if case .read? = viewModel.deliveryCoordinator.deliveryStatus(for: messageID) {
                     SecureLogger.debug("📬 Ignored stale delivered ACK for already-read message id=\(messageID.prefix(8))… from \(peerID.id.prefix(8))…", category: .session)
                 } else {
                     SecureLogger.debug("📬 Delivered ACK for unknown message id=\(messageID.prefix(8))… from \(peerID.id.prefix(8))…", category: .session)
@@ -349,8 +228,8 @@ private extension ChatTransportEventCoordinator {
         case .readReceipt:
             guard let messageID = String(data: payload, encoding: .utf8) else { return }
 
-            let name = deliveryStatusName(for: peerID, in: context)
-            let didUpdate = context.applyMessageDeliveryStatus(
+            let name = deliveryStatusName(for: peerID, in: viewModel)
+            let didUpdate = viewModel.deliveryCoordinator.updateMessageDeliveryStatus(
                 messageID,
                 status: .read(by: name, at: Date())
             )
@@ -360,15 +239,15 @@ private extension ChatTransportEventCoordinator {
             }
 
         case .verifyChallenge:
-            context.handleVerifyChallengePayload(from: peerID, payload: payload)
+            viewModel.verificationCoordinator.handleVerifyChallengePayload(from: peerID, payload: payload)
 
         case .verifyResponse:
-            context.handleVerifyResponsePayload(from: peerID, payload: payload)
+            viewModel.verificationCoordinator.handleVerifyResponsePayload(from: peerID, payload: payload)
         }
     }
 
     @MainActor
-    func deliveryStatusName(for peerID: PeerID, in context: any ChatTransportEventContext) -> String {
-        context.unifiedPeer(for: peerID)?.nickname ?? context.resolveNickname(for: peerID)
+    func deliveryStatusName(for peerID: PeerID, in viewModel: ChatViewModel) -> String {
+        viewModel.unifiedPeerService.getPeer(by: peerID)?.nickname ?? viewModel.resolveNickname(for: peerID)
     }
 }

bitchat/ViewModels/ChatVerificationCoordinator.swift

@@ -3,124 +3,6 @@ import BitLogger
 import Foundation
 import Security
 
-/// The narrow surface `ChatVerificationCoordinator` needs from its owner.
-///
-/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
-/// minimal context it actually uses instead of holding an `unowned` back-ref
-/// to the whole `ChatViewModel`. This keeps the coordinator independently
-/// testable (see `ChatVerificationCoordinatorContextTests`) and makes its true
-/// dependencies explicit.
-@MainActor
-protocol ChatVerificationContext: AnyObject {
-    // MARK: Fingerprints & verification state
-    func getFingerprint(for peerID: PeerID) -> String?
-    /// The UI-facing verified-fingerprint set (peer identity store backed).
-    var verifiedFingerprints: Set<String> { get set }
-    /// The persisted verified-fingerprint set from the identity manager.
-    func persistedVerifiedFingerprints() -> Set<String>
-    /// Persists the verified flag in the identity manager.
-    func setIdentityVerified(fingerprint: String, verified: Bool)
-    /// Updates the UI-facing verified flag in the peer identity store.
-    func setStoredVerified(_ fingerprint: String, verified: Bool)
-    func isVerifiedFingerprint(_ fingerprint: String) -> Bool
-    func saveIdentityState()
-
-    // MARK: Encryption status
-    func setEncryptionStatus(_ status: EncryptionStatus?, for peerID: PeerID)
-    func updateEncryptionStatus(for peerID: PeerID)
-    func invalidateEncryptionCache(for peerID: PeerID?)
-    /// Signals that verification state changed so observers refresh (e.g. `objectWillChange.send()`).
-    func notifyUIChanged()
-
-    // MARK: Peers
-    var unifiedPeers: [BitchatPeer] { get }
-    var unifiedFavorites: [BitchatPeer] { get }
-    /// The peer's current entry in the unified peer service, if known.
-    func unifiedPeer(for peerID: PeerID) -> BitchatPeer?
-    func unifiedFingerprint(for peerID: PeerID) -> String?
-    func resolveNickname(for peerID: PeerID) -> String
-    func cachedStablePeerID(for shortPeerID: PeerID) -> PeerID?
-    func cacheStablePeerID(_ stablePeerID: PeerID, for shortPeerID: PeerID)
-
-    // MARK: Noise sessions & verification transport
-    /// Installs the Noise service's session callbacks (single registration point).
-    func installNoiseSessionCallbacks(
-        onPeerAuthenticated: @escaping (PeerID, String) -> Void,
-        onHandshakeRequired: @escaping (PeerID) -> Void
-    )
-    /// Resolves the peer's Noise static key from the active Noise session, if any.
-    func noiseSessionPublicKeyData(for peerID: PeerID) -> Data?
-    /// Our own Noise static public key.
-    func noiseStaticPublicKeyData() -> Data
-    func hasEstablishedNoiseSession(with peerID: PeerID) -> Bool
-    func triggerHandshake(with peerID: PeerID)
-    func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data)
-    func sendVerifyResponse(to peerID: PeerID, noiseKeyHex: String, nonceA: Data)
-
-    // MARK: Notifications (shared with `ChatNostrContext`)
-    /// Posts a generic local user notification.
-    func postLocalNotification(title: String, body: String, identifier: String)
-}
-
-extension ChatViewModel: ChatVerificationContext {
-    // `getFingerprint(for:)`, `verifiedFingerprints`, `saveIdentityState()`,
-    // `updateEncryptionStatus(for:)`, `invalidateEncryptionCache(for:)`,
-    // `notifyUIChanged()`, `unifiedPeer(for:)`, `unifiedFingerprint(for:)`,
-    // `isVerifiedFingerprint(_:)`, `setEncryptionStatus(_:for:)`,
-    // `resolveNickname(for:)`, `cachedStablePeerID(for:)`,
-    // `cacheStablePeerID(_:for:)`, `noiseSessionPublicKeyData(for:)`,
-    // `hasEstablishedNoiseSession(with:)`, and `triggerHandshake(with:)` are
-    // shared requirements with the other contexts or satisfied by existing
-    // `ChatViewModel` members. The members below flatten nested service
-    // accesses into intent-named calls.
-
-    func persistedVerifiedFingerprints() -> Set<String> {
-        identityManager.getVerifiedFingerprints()
-    }
-
-    func setIdentityVerified(fingerprint: String, verified: Bool) {
-        identityManager.setVerified(fingerprint: fingerprint, verified: verified)
-    }
-
-    func setStoredVerified(_ fingerprint: String, verified: Bool) {
-        peerIdentityStore.setVerified(fingerprint, verified: verified)
-    }
-
-    var unifiedPeers: [BitchatPeer] {
-        unifiedPeerService.peers
-    }
-
-    var unifiedFavorites: [BitchatPeer] {
-        unifiedPeerService.favorites
-    }
-
-    func installNoiseSessionCallbacks(
-        onPeerAuthenticated: @escaping (PeerID, String) -> Void,
-        onHandshakeRequired: @escaping (PeerID) -> Void
-    ) {
-        meshService.installNoiseSessionCallbacks(
-            onPeerAuthenticated: onPeerAuthenticated,
-            onHandshakeRequired: onHandshakeRequired
-        )
-    }
-
-    func noiseStaticPublicKeyData() -> Data {
-        meshService.noiseStaticPublicKeyData()
-    }
-
-    func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {
-        meshService.sendVerifyChallenge(to: peerID, noiseKeyHex: noiseKeyHex, nonceA: nonceA)
-    }
-
-    func sendVerifyResponse(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {
-        meshService.sendVerifyResponse(to: peerID, noiseKeyHex: noiseKeyHex, nonceA: nonceA)
-    }
-
-    func postLocalNotification(title: String, body: String, identifier: String) {
-        NotificationService.shared.sendLocalNotification(title: title, body: body, identifier: identifier)
-    }
-}
-
 @MainActor
 final class ChatVerificationCoordinator {
     struct PendingVerification {
@@ -131,44 +13,44 @@ final class ChatVerificationCoordinator {
         var sent: Bool
     }
 
-    private unowned let context: any ChatVerificationContext
+    private unowned let viewModel: ChatViewModel
     private var pendingQRVerifications: [PeerID: PendingVerification] = [:]
     private var lastVerifyNonceByPeer: [PeerID: Data] = [:]
     private var lastInboundVerifyChallengeAt: [String: Date] = [:]
     private var lastMutualToastAt: [String: Date] = [:]
 
-    init(context: any ChatVerificationContext) {
-        self.context = context
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
     }
 
     func verifyFingerprint(for peerID: PeerID) {
-        guard let fingerprint = context.getFingerprint(for: peerID) else { return }
+        guard let fingerprint = viewModel.getFingerprint(for: peerID) else { return }
 
-        context.setIdentityVerified(fingerprint: fingerprint, verified: true)
-        context.saveIdentityState()
-        context.setStoredVerified(fingerprint, verified: true)
-        context.updateEncryptionStatus(for: peerID)
+        viewModel.identityManager.setVerified(fingerprint: fingerprint, verified: true)
+        viewModel.saveIdentityState()
+        viewModel.peerIdentityStore.setVerified(fingerprint, verified: true)
+        viewModel.updateEncryptionStatus(for: peerID)
     }
 
     func unverifyFingerprint(for peerID: PeerID) {
-        guard let fingerprint = context.getFingerprint(for: peerID) else { return }
-        context.setIdentityVerified(fingerprint: fingerprint, verified: false)
-        context.saveIdentityState()
-        context.setStoredVerified(fingerprint, verified: false)
-        context.updateEncryptionStatus(for: peerID)
+        guard let fingerprint = viewModel.getFingerprint(for: peerID) else { return }
+        viewModel.identityManager.setVerified(fingerprint: fingerprint, verified: false)
+        viewModel.saveIdentityState()
+        viewModel.peerIdentityStore.setVerified(fingerprint, verified: false)
+        viewModel.updateEncryptionStatus(for: peerID)
     }
 
     func loadVerifiedFingerprints() {
-        context.verifiedFingerprints = context.persistedVerifiedFingerprints()
-        let sample = Array(context.verifiedFingerprints.prefix(TransportConfig.uiFingerprintSampleCount))
+        viewModel.peerIdentityStore.setVerifiedFingerprints(viewModel.identityManager.getVerifiedFingerprints())
+        let sample = Array(viewModel.peerIdentityStore.verifiedFingerprints.prefix(TransportConfig.uiFingerprintSampleCount))
             .map { $0.prefix(8) }
             .joined(separator: ", ")
-        SecureLogger.info("🔐 Verified loaded: \(context.verifiedFingerprints.count) [\(sample)]", category: .security)
+        SecureLogger.info("🔐 Verified loaded: \(viewModel.peerIdentityStore.verifiedFingerprints.count) [\(sample)]", category: .security)
 
-        let offlineFavorites = context.unifiedFavorites.filter { !$0.isConnected }
+        let offlineFavorites = viewModel.unifiedPeerService.favorites.filter { !$0.isConnected }
         for favorite in offlineFavorites {
-            let fingerprint = context.unifiedFingerprint(for: favorite.peerID)
-            let isVerified = fingerprint.flatMap { context.isVerifiedFingerprint($0) } ?? false
+            let fingerprint = viewModel.unifiedPeerService.getFingerprint(for: favorite.peerID)
+            let isVerified = fingerprint.flatMap { viewModel.peerIdentityStore.isVerified($0) } ?? false
             let shortFingerprint = fingerprint?.prefix(8) ?? "nil"
             SecureLogger.info(
                 "⭐️ Favorite offline: \(favorite.nickname) fp=\(shortFingerprint) verified=\(isVerified)",
@@ -176,61 +58,62 @@ final class ChatVerificationCoordinator {
             )
         }
 
-        context.invalidateEncryptionCache(for: nil)
-        context.notifyUIChanged()
+        viewModel.invalidateEncryptionCache()
+        viewModel.objectWillChange.send()
     }
 
     func setupNoiseCallbacks() {
-        context.installNoiseSessionCallbacks(
-            onPeerAuthenticated: { [weak self] peerID, fingerprint in
-                DispatchQueue.main.async { [weak self] in
-                    guard let self else { return }
+        let noiseService = viewModel.meshService.getNoiseService()
 
-                    SecureLogger.debug("🔐 Authenticated: \(peerID)", category: .security)
+        noiseService.onPeerAuthenticated = { [weak self] peerID, fingerprint in
+            DispatchQueue.main.async {
+                guard let self else { return }
 
-                    if self.context.isVerifiedFingerprint(fingerprint) {
-                        self.context.setEncryptionStatus(.noiseVerified, for: peerID)
-                    } else {
-                        self.context.setEncryptionStatus(.noiseSecured, for: peerID)
-                    }
+                SecureLogger.debug("🔐 Authenticated: \(peerID)", category: .security)
 
-                    self.context.invalidateEncryptionCache(for: peerID)
-
-                    if self.context.cachedStablePeerID(for: peerID) == nil,
-                       let keyData = self.context.noiseSessionPublicKeyData(for: peerID) {
-                        let stablePeerID = PeerID(hexData: keyData)
-                        self.context.cacheStablePeerID(stablePeerID, for: peerID)
-                        SecureLogger.debug(
-                            "🗺️ Mapped short peerID to Noise key for header continuity: \(peerID) -> \(stablePeerID.id.prefix(8))…",
-                            category: .session
-                        )
-                    }
-
-                    if var pending = self.pendingQRVerifications[peerID], pending.sent == false {
-                        self.context.sendVerifyChallenge(
-                            to: peerID,
-                            noiseKeyHex: pending.noiseKeyHex,
-                            nonceA: pending.nonceA
-                        )
-                        pending.sent = true
-                        self.pendingQRVerifications[peerID] = pending
-                        SecureLogger.debug("📤 Sent deferred verify challenge to \(peerID) after handshake", category: .security)
-                    }
+                if self.viewModel.peerIdentityStore.isVerified(fingerprint) {
+                    self.viewModel.peerIdentityStore.setEncryptionStatus(.noiseVerified, for: peerID)
+                } else {
+                    self.viewModel.peerIdentityStore.setEncryptionStatus(.noiseSecured, for: peerID)
                 }
-            },
-            onHandshakeRequired: { [weak self] peerID in
-                DispatchQueue.main.async { [weak self] in
-                    guard let self else { return }
-                    self.context.setEncryptionStatus(.noiseHandshaking, for: peerID)
-                    self.context.invalidateEncryptionCache(for: peerID)
+
+                self.viewModel.invalidateEncryptionCache(for: peerID)
+
+                if self.viewModel.cachedStablePeerID(for: peerID) == nil,
+                   let keyData = self.viewModel.meshService.getNoiseService().getPeerPublicKeyData(peerID) {
+                    let stablePeerID = PeerID(hexData: keyData)
+                    self.viewModel.cacheStablePeerID(stablePeerID, for: peerID)
+                    SecureLogger.debug(
+                        "🗺️ Mapped short peerID to Noise key for header continuity: \(peerID) -> \(stablePeerID.id.prefix(8))…",
+                        category: .session
+                    )
+                }
+
+                if var pending = self.pendingQRVerifications[peerID], pending.sent == false {
+                    self.viewModel.meshService.sendVerifyChallenge(
+                        to: peerID,
+                        noiseKeyHex: pending.noiseKeyHex,
+                        nonceA: pending.nonceA
+                    )
+                    pending.sent = true
+                    self.pendingQRVerifications[peerID] = pending
+                    SecureLogger.debug("📤 Sent deferred verify challenge to \(peerID) after handshake", category: .security)
                 }
             }
-        )
+        }
+
+        noiseService.onHandshakeRequired = { [weak self] peerID in
+            DispatchQueue.main.async {
+                guard let self else { return }
+                self.viewModel.peerIdentityStore.setEncryptionStatus(.noiseHandshaking, for: peerID)
+                self.viewModel.invalidateEncryptionCache(for: peerID)
+            }
+        }
     }
 
     func beginQRVerification(with qr: VerificationService.VerificationQR) -> Bool {
         let targetNoise = qr.noiseKeyHex.lowercased()
-        guard let peer = context.unifiedPeers.first(where: {
+        guard let peer = viewModel.unifiedPeerService.peers.first(where: {
             $0.noisePublicKey.hexEncodedString().lowercased() == targetNoise
         }) else {
             return false
@@ -252,12 +135,13 @@ final class ChatVerificationCoordinator {
         )
         pendingQRVerifications[peerID] = pending
 
-        if context.hasEstablishedNoiseSession(with: peerID) {
-            context.sendVerifyChallenge(to: peerID, noiseKeyHex: qr.noiseKeyHex, nonceA: nonce)
+        let noise = viewModel.meshService.getNoiseService()
+        if noise.hasEstablishedSession(with: peerID) {
+            viewModel.meshService.sendVerifyChallenge(to: peerID, noiseKeyHex: qr.noiseKeyHex, nonceA: nonce)
             pending.sent = true
             pendingQRVerifications[peerID] = pending
         } else {
-            context.triggerHandshake(with: peerID)
+            viewModel.meshService.triggerHandshake(with: peerID)
         }
 
         return true
@@ -266,7 +150,9 @@ final class ChatVerificationCoordinator {
     func handleVerifyChallengePayload(from peerID: PeerID, payload: Data) {
         guard let challenge = VerificationService.shared.parseVerifyChallenge(payload) else { return }
 
-        let myNoiseHex = context.noiseStaticPublicKeyData()
+        let myNoiseHex = viewModel.meshService
+            .getNoiseService()
+            .getStaticPublicKeyData()
             .hexEncodedString()
             .lowercased()
         guard challenge.noiseKeyHex.lowercased() == myNoiseHex else { return }
@@ -274,22 +160,22 @@ final class ChatVerificationCoordinator {
 
         lastVerifyNonceByPeer[peerID] = challenge.nonceA
 
-        if let fingerprint = context.getFingerprint(for: peerID) {
+        if let fingerprint = viewModel.getFingerprint(for: peerID) {
             lastInboundVerifyChallengeAt[fingerprint] = Date()
 
-            if context.isVerifiedFingerprint(fingerprint) {
+            if viewModel.peerIdentityStore.isVerified(fingerprint) {
                 maybeSendMutualVerificationNotification(
                     fingerprint: fingerprint,
                     peerID: peerID,
                     title: "Mutual verification",
-                    bodyName: context.unifiedPeer(for: peerID)?.nickname
-                        ?? context.resolveNickname(for: peerID),
+                    bodyName: viewModel.unifiedPeerService.getPeer(by: peerID)?.nickname
+                        ?? viewModel.resolveNickname(for: peerID),
                     notificationPrefix: "verify-mutual"
                 )
             }
         }
 
-        context.sendVerifyResponse(
+        viewModel.meshService.sendVerifyResponse(
             to: peerID,
             noiseKeyHex: challenge.noiseKeyHex,
             nonceA: challenge.nonceA
@@ -312,17 +198,17 @@ final class ChatVerificationCoordinator {
 
         pendingQRVerifications.removeValue(forKey: peerID)
 
-        guard let fingerprint = context.getFingerprint(for: peerID) else { return }
+        guard let fingerprint = viewModel.getFingerprint(for: peerID) else { return }
 
         let shortFingerprint = fingerprint.prefix(8)
         SecureLogger.info("🔐 Marking verified fingerprint: \(shortFingerprint)", category: .security)
-        context.setIdentityVerified(fingerprint: fingerprint, verified: true)
-        context.saveIdentityState()
-        context.setStoredVerified(fingerprint, verified: true)
+        viewModel.identityManager.setVerified(fingerprint: fingerprint, verified: true)
+        viewModel.saveIdentityState()
+        viewModel.peerIdentityStore.setVerified(fingerprint, verified: true)
 
-        let peerName = context.unifiedPeer(for: peerID)?.nickname
-            ?? context.resolveNickname(for: peerID)
-        context.postLocalNotification(
+        let peerName = viewModel.unifiedPeerService.getPeer(by: peerID)?.nickname
+            ?? viewModel.resolveNickname(for: peerID)
+        NotificationService.shared.sendLocalNotification(
             title: "Verified",
             body: "You verified \(peerName)",
             identifier: "verify-success-\(peerID)-\(UUID().uuidString)"
@@ -339,7 +225,7 @@ final class ChatVerificationCoordinator {
             )
         }
 
-        context.updateEncryptionStatus(for: peerID)
+        viewModel.updateEncryptionStatus(for: peerID)
     }
 }
 
@@ -356,7 +242,7 @@ private extension ChatVerificationCoordinator {
         guard now.timeIntervalSince(lastToast) > 60 else { return }
 
         lastMutualToastAt[fingerprint] = now
-        context.postLocalNotification(
+        NotificationService.shared.sendLocalNotification(
             title: title,
             body: "You and \(bodyName) verified each other",
             identifier: "\(notificationPrefix)-\(peerID)-\(UUID().uuidString)"

bitchat/ViewModels/ChatViewModel.swift

@@ -119,27 +119,9 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
 
     // MARK: - Published Properties
 
-    /// Read-only derived view of the ACTIVE public channel's conversation in
-    /// the single-writer `ConversationStore`. SwiftUI renders through
-    /// `PublicChatModel` (which observes the `Conversation` object directly);
-    /// this view serves the coordinators/commands that need "the visible
-    /// timeline" plus tests. Hot enough that the array is cached and
-    /// invalidated from the store's `changes` subject (filtered to the
-    /// active conversation) and on channel switches. `objectWillChange`
-    /// fires on every store change via the sink in `init`.
-    @MainActor
-    var messages: [BitchatMessage] {
-        if let cached = visibleMessagesCache { return cached }
-        // Read-only lookup (never creates the conversation): this getter
-        // runs during SwiftUI renders, where mutating the store's
-        // `@Published` collections would publish mid-view-update.
-        let current = conversations.conversationsByID[ConversationID(channelID: activeChannel)]?.messages ?? []
-        visibleMessagesCache = current
-        return current
-    }
-    private var visibleMessagesCache: [BitchatMessage]?
+    @Published var messages: [BitchatMessage] = []
     @Published var currentColorScheme: ColorScheme = .light
-    @Published var currentTheme: AppTheme = .matrix
+    private let maxMessages = TransportConfig.meshTimelineCap // Maximum messages before oldest are removed
     @Published var isConnected = false
     @Published var nickname: String = "" {
         didSet {
@@ -164,39 +146,31 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     let unifiedPeerService: UnifiedPeerService
     let autocompleteService: AutocompleteService
     let deduplicationService: MessageDeduplicationService  // internal for test access
-    private lazy var outgoingCoordinator = ChatOutgoingCoordinator(context: self)
-    private lazy var lifecycleCoordinator = ChatLifecycleCoordinator(context: self)
-    private lazy var transportEventCoordinator = ChatTransportEventCoordinator(context: self)
-    private lazy var peerListCoordinator = ChatPeerListCoordinator(context: self)
+    private lazy var outgoingCoordinator = ChatOutgoingCoordinator(viewModel: self)
+    private lazy var lifecycleCoordinator = ChatLifecycleCoordinator(viewModel: self)
+    private lazy var transportEventCoordinator = ChatTransportEventCoordinator(viewModel: self)
+    private lazy var peerListCoordinator = ChatPeerListCoordinator(viewModel: self)
     private lazy var messageFormatter = ChatMessageFormatter(viewModel: self)
-    lazy var peerIdentityCoordinator = ChatPeerIdentityCoordinator(context: self)
-    lazy var deliveryCoordinator = ChatDeliveryCoordinator(context: self)
-    lazy var composerCoordinator = ChatComposerCoordinator(context: self)
-    lazy var publicConversationCoordinator = ChatPublicConversationCoordinator(context: self)
-    lazy var privateConversationCoordinator = ChatPrivateConversationCoordinator(context: self)
-    lazy var nostrCoordinator = ChatNostrCoordinator(context: self)
-    lazy var mediaTransferCoordinator = ChatMediaTransferCoordinator(context: self)
-    lazy var verificationCoordinator = ChatVerificationCoordinator(context: self)
+    lazy var peerIdentityCoordinator = ChatPeerIdentityCoordinator(viewModel: self)
+    lazy var deliveryCoordinator = ChatDeliveryCoordinator(viewModel: self)
+    lazy var composerCoordinator = ChatComposerCoordinator(viewModel: self)
+    lazy var publicConversationCoordinator = ChatPublicConversationCoordinator(viewModel: self)
+    lazy var privateConversationCoordinator = ChatPrivateConversationCoordinator(viewModel: self)
+    lazy var nostrCoordinator = ChatNostrCoordinator(viewModel: self)
+    lazy var mediaTransferCoordinator = ChatMediaTransferCoordinator(viewModel: self)
+    lazy var verificationCoordinator = ChatVerificationCoordinator(viewModel: self)
 
     // Computed properties for compatibility
     @MainActor
     var connectedPeers: Set<PeerID> { unifiedPeerService.connectedPeerIDs }
     @Published var allPeers: [BitchatPeer] = []
-
-    /// Read-only derived view of all direct conversations in the
-    /// `ConversationStore`, keyed by routing peer ID. Serves the coordinator
-    /// reads that genuinely need the whole dictionary (migration scans,
-    /// unread resolution); simple per-peer reads go through
-    /// `privateMessages(for:)` instead. All mutations go through the
-    /// private-chat intent ops below. Rebuilt per access —
-    /// O(#conversations) thanks to COW message arrays; measured equal to a
-    /// change-invalidated cache on `pipeline.privateIngest`, so the simpler
-    /// form wins.
-    @MainActor
     var privateChats: [PeerID: [BitchatMessage]] {
-        conversations.directMessagesByRoutingPeerID()
+        get { privateChatManager.privateChats }
+        set {
+            privateChatManager.privateChats = newValue
+            synchronizePrivateConversationStore()
+        }
     }
-    @MainActor
     var selectedPrivateChatPeer: PeerID? {
         get { privateChatManager.selectedPeer }
         set {
@@ -205,17 +179,19 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
             } else {
                 privateChatManager.endChat()
             }
+            synchronizePrivateConversationStore()
+            synchronizeConversationSelectionStore()
         }
     }
-    /// Read-only derived view of the store's unread direct conversations.
-    /// Mutate via `markPrivateChatUnread(_:)` / `markPrivateChatRead(_:)`.
-    @MainActor
     var unreadPrivateMessages: Set<PeerID> {
-        conversations.unreadDirectRoutingPeerIDs()
+        get { privateChatManager.unreadMessages }
+        set {
+            privateChatManager.unreadMessages = newValue
+            synchronizePrivateConversationStore()
+        }
     }
 
     /// Check if there are any unread messages (including from temporary Nostr peer IDs)
-    @MainActor
     var hasAnyUnreadMessages: Bool {
         !unreadPrivateMessages.isEmpty
     }
@@ -243,7 +219,7 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         if let mapped = peerIdentityStore.stablePeerID(forShortID: shortPeerID) { return mapped }
         // Fallback: derive from active Noise session if available
         if shortPeerID.id.count == 16,
-           let key = meshService.noiseSessionPublicKeyData(for: shortPeerID) {
+           let key = meshService.getNoiseService().getPeerPublicKeyData(shortPeerID) {
             let stable = PeerID(hexData: key)
             peerIdentityStore.setStablePeerID(stable, forShortID: shortPeerID)
             return stable
@@ -294,10 +270,8 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     let meshService: Transport
     let idBridge: NostrIdentityBridge
     let identityManager: SecureIdentityStateManagerProtocol
-    /// Single source of truth for conversation message state and selection
-    /// (docs/CONVERSATION-STORE-DESIGN.md). Owned by `AppRuntime` and passed
-    /// through.
-    let conversations: ConversationStore
+    let conversationStore: ConversationStore
+    let identityResolver: IdentityResolver
     let peerIdentityStore: PeerIdentityStore
     let locationPresenceStore: LocationPresenceStore
     let locationManager: LocationChannelManager
@@ -308,17 +282,18 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     private let nicknameKey = "bitchat.nickname"
     // Location channel state (macOS supports manual geohash selection)
     var activeChannel: ChannelID {
-        get { conversations.activeChannel }
+        get { conversationStore.activeChannel }
         set {
-            guard conversations.activeChannel != newValue else { return }
-            conversations.setActiveChannel(newValue)
-            visibleMessagesCache = nil
+            guard conversationStore.activeChannel != newValue else { return }
+            publicMessagePipeline.updateActiveChannel(newValue)
+            conversationStore.setActiveChannel(newValue)
+            synchronizePublicConversationStore(for: newValue)
+            synchronizeConversationSelectionStore()
             objectWillChange.send()
         }
     }
-    // Single-writer: mutate only via `setGeoChatSubscriptionID(_:)` / `setGeoDmSubscriptionID(_:)` below.
-    private(set) var geoSubscriptionID: String? = nil
-    private(set) var geoDmSubscriptionID: String? = nil
+    var geoSubscriptionID: String? = nil
+    var geoDmSubscriptionID: String? = nil
     var currentGeohash: String? {
         get { locationPresenceStore.currentGeohash }
         set { locationPresenceStore.setCurrentGeohash(newValue) }
@@ -363,6 +338,11 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     @Published var bluetoothAlertMessage = ""
     @Published var bluetoothState: CBManagerState = .unknown
 
+    var timelineStore = PublicTimelineStore(
+        meshCap: TransportConfig.meshTimelineCap,
+        geohashCap: TransportConfig.geoTimelineCap
+    )
+
     private func performDeliveryUpdate(_ update: @escaping @MainActor (ChatDeliveryCoordinator) -> Void) {
         if Thread.isMainThread {
             MainActor.assumeIsolated {
@@ -386,8 +366,7 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         set { locationPresenceStore.replaceTeleportedGeo(newValue) }
     }  // lowercased pubkey hex
     // Sampling subscriptions for multiple geohashes (when channel sheet is open)
-    // Single-writer: mutate only via `addGeoSamplingSub` / `removeGeoSamplingSub` / `clearGeoSamplingSubs` below.
-    private(set) var geoSamplingSubs: [String: String] = [:] // subID -> geohash
+    var geoSamplingSubs: [String: String] = [:] // subID -> geohash
     var lastGeoNotificationAt: [String: Date] = [:] // geohash -> last notify time
 
     // MARK: - Message Delivery Tracking
@@ -404,25 +383,7 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
 
     // MARK: - Public message batching (UI perf)
     let publicMessagePipeline: PublicMessagePipeline
-    // Single-writer: mutate only via `setPublicBatching(_:)` below.
-    @Published private(set) var isBatchingPublic: Bool = false
-
-    // Backing store for `sentReadReceipts` persistence. `.standard` in
-    // production; injectable so tests can use a scratch suite that does not
-    // leak state between runs.
-    let readReceiptsDefaults: UserDefaults
-
-    /// Default read-receipt persistence store. Production uses `.standard`.
-    /// Under test, a dedicated scratch suite is used instead — wiped at first
-    /// use per process — so back-to-back local test runs never see each
-    /// other's persisted receipts (and tests never pollute `.standard`).
-    static let defaultReadReceiptsDefaults: UserDefaults = {
-        guard TestEnvironment.isRunningTests else { return .standard }
-        let suiteName = "chat.bitchat.tests.readReceipts"
-        guard let scratch = UserDefaults(suiteName: suiteName) else { return .standard }
-        scratch.removePersistentDomain(forName: suiteName)
-        return scratch
-    }()
+    @Published var isBatchingPublic: Bool = false
 
     // Track sent read receipts to avoid duplicates (persisted across launches)
     // Note: Persistence happens automatically in didSet, no lifecycle observers needed
@@ -431,9 +392,9 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
             // Only persist if there are changes
             guard oldValue != sentReadReceipts else { return }
 
-            // Persist whenever it changes (no manual synchronize/verify re-read)
+            // Persist to UserDefaults whenever it changes (no manual synchronize/verify re-read)
             if let data = try? JSONEncoder().encode(Array(sentReadReceipts)) {
-                readReceiptsDefaults.set(data, forKey: "sentReadReceipts")
+                UserDefaults.standard.set(data, forKey: "sentReadReceipts")
             } else {
                 SecureLogger.error("❌ Failed to encode read receipts for persistence", category: .session)
             }
@@ -441,316 +402,15 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     }
 
     // Track which GeoDM messages we've already sent a delivery ACK for (by messageID)
-    // Single-writer: mutate only via `markGeoDeliveryAckSent(_:)` below.
-    private(set) var sentGeoDeliveryAcks: Set<String> = []
+    var sentGeoDeliveryAcks: Set<String> = []
 
     // Track app startup phase to prevent marking old messages as unread
     var isStartupPhase = true
-
-    // ConversationStore field audit bookkeeping (see auditConversationStore()):
-    // runs on the read-receipt cleanup cadence, heartbeat sampled first +
-    // every `TransportConfig.conversationStoreAuditLogInterval`th audit.
-    private var storeAuditCount = 0
-    private var storeAuditLastAppendCount = 0
     // Announce Tor initial readiness once per launch to avoid duplicates
     var torInitialReadyAnnounced: Bool = false
 
     // Track Nostr pubkey mappings for unknown senders
-    // Single-writer: mutate only via `registerNostrKeyMapping` / `removeNostrKeyMappings` below.
-    private(set) var nostrKeyMapping: [PeerID: String] = [:]  // senderPeerID -> nostrPubkey
-
-    // MARK: - Single-Writer Intent Operations
-    // Owner-side mutation paths for state the coordinator contexts may read
-    // but not write directly. Each op is the sole way to mutate its backing
-    // state, so check-then-mutate races between coordinators cannot occur.
-
-    /// Records the Nostr pubkey behind a (possibly virtual) peer ID.
-    @MainActor
-    func registerNostrKeyMapping(_ pubkey: String, for peerID: PeerID) {
-        nostrKeyMapping[peerID] = pubkey
-    }
-
-    /// Drops every key mapping that resolves to the given (lowercased) Nostr pubkey.
-    @MainActor
-    func removeNostrKeyMappings(matchingPubkeyHexLowercased hex: String) {
-        for (key, value) in nostrKeyMapping where value.lowercased() == hex {
-            nostrKeyMapping.removeValue(forKey: key)
-        }
-    }
-
-    /// Records that a read receipt is being sent for `messageID`.
-    /// Returns `false` when one was already recorded — the caller must skip sending.
-    @MainActor
-    @discardableResult
-    func markReadReceiptSent(_ messageID: String) -> Bool {
-        sentReadReceipts.insert(messageID).inserted
-    }
-
-    /// Records that a GeoDM delivery ACK is being sent for `messageID`.
-    /// Returns `false` when one was already recorded — the caller must skip sending.
-    @MainActor
-    @discardableResult
-    func markGeoDeliveryAckSent(_ messageID: String) -> Bool {
-        sentGeoDeliveryAcks.insert(messageID).inserted
-    }
-
-    /// Forgets that read receipts were sent for `ids` so READ acks can be
-    /// re-sent after the peer reconnects.
-    @MainActor
-    func unmarkReadReceiptsSent(_ ids: [String]) {
-        sentReadReceipts.subtract(ids)
-    }
-
-    /// Marks read receipts as sent for own messages already delivered/read in
-    /// `peerID`'s chat, syncing the chat manager's tracking with the persisted
-    /// set. (Wraps the manager's `inout` sync so the raw set never leaks.)
-    @MainActor
-    func syncReadReceiptsForSentMessages(for peerID: PeerID) {
-        privateChatManager.syncReadReceiptsForSentMessages(
-            peerID: peerID,
-            nickname: nickname,
-            externalReceipts: &sentReadReceipts
-        )
-    }
-
-    /// Drops every recorded read receipt whose message ID is no longer valid.
-    /// Returns the number of receipts removed.
-    @MainActor
-    func pruneSentReadReceipts(keeping validMessageIDs: Set<String>) -> Int {
-        let oldCount = sentReadReceipts.count
-        sentReadReceipts = sentReadReceipts.intersection(validMessageIDs)
-        return oldCount - sentReadReceipts.count
-    }
-
-    /// Publishes the public-timeline batching state (UI animation suppression).
-    @MainActor
-    func setPublicBatching(_ isBatching: Bool) {
-        isBatchingPublic = isBatching
-    }
-
-    @MainActor
-    func setGeoChatSubscriptionID(_ id: String?) {
-        geoSubscriptionID = id
-    }
-
-    @MainActor
-    func setGeoDmSubscriptionID(_ id: String?) {
-        geoDmSubscriptionID = id
-    }
-
-    @MainActor
-    func addGeoSamplingSub(_ subID: String, forGeohash geohash: String) {
-        geoSamplingSubs[subID] = geohash
-    }
-
-    @MainActor
-    func removeGeoSamplingSub(_ subID: String) {
-        geoSamplingSubs.removeValue(forKey: subID)
-    }
-
-    /// Clears all sampling subscriptions and returns the removed subscription IDs
-    /// so the caller can unsubscribe them from the relay manager.
-    @MainActor
-    func clearGeoSamplingSubs() -> [String] {
-        let subIDs = Array(geoSamplingSubs.keys)
-        geoSamplingSubs.removeAll()
-        return subIDs
-    }
-
-    /// Moves the open private chat to `newPeerID` when the current selection is
-    /// one of the peer IDs being migrated away (side-effectful: re-targets the
-    /// private chat session — fingerprint refresh, read receipts).
-    ///
-    /// Note: when this runs after a store `migrateConversation`, the store has
-    /// already handed the selection itself off to `newPeerID` (and the manager
-    /// mirrors it), so a selection that reads `newPeerID` is also re-targeted
-    /// to run the session side effects. Selections on unrelated peers are
-    /// untouched.
-    @MainActor
-    func handOffSelectedPrivateChat(from oldPeerIDs: [PeerID], to newPeerID: PeerID) {
-        guard oldPeerIDs.contains(where: { selectedPrivateChatPeer == $0 })
-                || selectedPrivateChatPeer == newPeerID else { return }
-        selectedPrivateChatPeer = newPeerID
-    }
-
-    // MARK: - Private Conversation Store Intents
-    // The sole mutation paths for private (direct) message state. Each op
-    // forwards to the single-writer `ConversationStore`
-    // (docs/CONVERSATION-STORE-DESIGN.md); the read-only `privateChats` /
-    // `unreadPrivateMessages` views above are derived from the same store.
-
-    /// Appends a private message in timestamp order. Returns `false` when a
-    /// message with the same ID is already in that chat (O(1) dedup via the
-    /// conversation's ID index).
-    @MainActor
-    @discardableResult
-    func appendPrivateMessage(_ message: BitchatMessage, to peerID: PeerID) -> Bool {
-        conversations.append(message, to: .directPeer(peerID))
-    }
-
-    /// Replace-or-append a private message by ID (media progress, mirrored
-    /// copies); an existing message keeps its timeline position.
-    @MainActor
-    func upsertPrivateMessage(_ message: BitchatMessage, in peerID: PeerID) {
-        conversations.upsertByID(message, in: .directPeer(peerID))
-    }
-
-    /// Applies a delivery status to a private message by ID. Returns `false`
-    /// when the message is unknown or the update would downgrade the status
-    /// (read beats delivered beats sent).
-    @MainActor
-    @discardableResult
-    func setPrivateDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String, peerID: PeerID) -> Bool {
-        conversations.setDeliveryStatus(status, forMessageID: messageID, in: .directPeer(peerID))
-    }
-
-    /// Flags the peer's chat as unread (store unread state).
-    @MainActor
-    func markPrivateChatUnread(_ peerID: PeerID) {
-        conversations.markUnread(.directPeer(peerID))
-    }
-
-    /// Clears the peer's unread flag (store unread state only; read-receipt
-    /// sending stays in `PrivateChatManager.markAsRead`).
-    @MainActor
-    func markPrivateChatRead(_ peerID: PeerID) {
-        conversations.markRead(.directPeer(peerID))
-    }
-
-    /// Empties the peer's chat but keeps the conversation alive (`/clear`).
-    @MainActor
-    func clearPrivateChat(_ peerID: PeerID) {
-        conversations.clear(.directPeer(peerID))
-    }
-
-    /// Removes the peer's chat entirely, including unread state.
-    @MainActor
-    func removePrivateChat(_ peerID: PeerID) {
-        conversations.removeConversation(.directPeer(peerID))
-    }
-
-    /// Moves all messages from `oldPeerID`'s chat into `newPeerID`'s chat
-    /// (ephemeral↔stable peer-ID handoff): dedups by ID, preserves order,
-    /// carries unread state, removes the old chat.
-    @MainActor
-    func migratePrivateChat(from oldPeerID: PeerID, to newPeerID: PeerID) {
-        conversations.migrateConversation(from: .directPeer(oldPeerID), to: .directPeer(newPeerID))
-    }
-
-    /// A single private chat's timeline, read straight from the store —
-    /// an O(1) lookup that skips the `privateChats` dictionary build. The
-    /// context protocols' simple per-peer reads dispatch here.
-    @MainActor
-    func privateMessages(for peerID: PeerID) -> [BitchatMessage] {
-        conversations.conversationsByID[.directPeer(peerID)]?.messages ?? []
-    }
-
-    /// `true` when any private chat contains a message with `messageID`
-    /// (O(1) per conversation via the store's ID indexes).
-    @MainActor
-    func privateChatsContainMessage(withID messageID: String) -> Bool {
-        conversations.directConversationsContainMessage(withID: messageID)
-    }
-
-    /// `true` when `peerID`'s chat contains a message with `messageID`.
-    @MainActor
-    func privateChat(_ peerID: PeerID, containsMessageWithID messageID: String) -> Bool {
-        conversations.conversationsByID[.directPeer(peerID)]?.containsMessage(withID: messageID) ?? false
-    }
-
-    /// Removes a message by ID from every private chat that contains it,
-    /// dropping chats that become empty. Returns the removed message, if any.
-    @MainActor
-    @discardableResult
-    func removePrivateMessage(withID messageID: String) -> BitchatMessage? {
-        var removed: BitchatMessage?
-        for (id, conversation) in conversations.conversationsByID {
-            guard case .direct = id, conversation.containsMessage(withID: messageID) else { continue }
-            let message = conversations.removeMessage(withID: messageID, from: id)
-            removed = removed ?? message
-            if conversation.messages.isEmpty {
-                conversations.removeConversation(id)
-            }
-        }
-        return removed
-    }
-
-    // MARK: - Public Conversation Store Intents
-    // The sole mutation paths for public (mesh/geohash) message state,
-    // mirroring the private intents above. The store's per-conversation cap
-    // and timestamp-ordered insert replace `PublicTimelineStore`'s trim and
-    // the pipeline's late-insert positioning; the read-only `messages` shim
-    // above is derived from the same store.
-
-    /// Appends a public message in timestamp order. Returns `false` when a
-    /// message with the same ID is already in that conversation (O(1) dedup
-    /// via the conversation's ID index).
-    @MainActor
-    @discardableResult
-    func appendPublicMessage(_ message: BitchatMessage, to conversationID: ConversationID) -> Bool {
-        conversations.append(message, to: conversationID)
-    }
-
-    /// Appends a geohash message if absent. Returns `true` when stored
-    /// (the legacy `PublicTimelineStore.appendIfAbsent` contract).
-    @MainActor
-    @discardableResult
-    func appendGeohashMessageIfAbsent(_ message: BitchatMessage, toGeohash geohash: String) -> Bool {
-        conversations.append(message, to: .geohash(geohash.lowercased()))
-    }
-
-    /// A public (mesh/geohash) channel's full timeline.
-    @MainActor
-    func publicMessages(for channel: ChannelID) -> [BitchatMessage] {
-        conversations.conversation(for: ConversationID(channelID: channel)).messages
-    }
-
-    /// `true` when the conversation contains a message with `messageID`.
-    @MainActor
-    func publicConversationContainsMessage(withID messageID: String, in conversationID: ConversationID) -> Bool {
-        conversations.conversationsByID[conversationID]?.containsMessage(withID: messageID) ?? false
-    }
-
-    /// Removes a message by ID from whichever public conversation contains
-    /// it. Returns the removed message, if any.
-    @MainActor
-    @discardableResult
-    func removePublicMessage(withID messageID: String) -> BitchatMessage? {
-        conversations.removePublicMessage(withID: messageID)
-    }
-
-    /// Removes every message matching `predicate` from a geohash
-    /// conversation (block-user purge).
-    @MainActor
-    func removePublicMessages(fromGeohash geohash: String, where predicate: (BitchatMessage) -> Bool) {
-        conversations.removeMessages(from: .geohash(geohash.lowercased()), where: predicate)
-    }
-
-    /// Empties a public conversation's timeline (`/clear`).
-    @MainActor
-    func clearPublicConversation(_ conversationID: ConversationID) {
-        conversations.clear(conversationID)
-    }
-
-    /// Queues a system message for the next geohash channel visit. (Tiny
-    /// UI-flow queue formerly on `PublicTimelineStore`; it is notice text,
-    /// not conversation state, so it stays on the owner.)
-    @MainActor
-    func queueGeohashSystemMessage(_ content: String) {
-        pendingGeohashSystemMessages.append(content)
-    }
-
-    /// Drains the queued geohash system messages (single consumer:
-    /// `GeohashSubscriptionManager.switchLocationChannel`).
-    @MainActor
-    func drainPendingGeohashSystemMessages() -> [String] {
-        defer { pendingGeohashSystemMessages.removeAll(keepingCapacity: false) }
-        return pendingGeohashSystemMessages
-    }
-
-    // Single-writer: mutate only via `queueGeohashSystemMessage(_:)` /
-    // `drainPendingGeohashSystemMessages()` above.
-    private var pendingGeohashSystemMessages: [String] = []
+    var nostrKeyMapping: [PeerID: String] = [:]  // senderPeerID -> nostrPubkey
 
     // MARK: - Initialization
 
@@ -759,17 +419,21 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         keychain: KeychainManagerProtocol,
         idBridge: NostrIdentityBridge,
         identityManager: SecureIdentityStateManagerProtocol,
-        conversations: ConversationStore? = nil,
+        conversationStore: ConversationStore? = nil,
+        identityResolver: IdentityResolver? = nil,
         peerIdentityStore: PeerIdentityStore? = nil,
         locationPresenceStore: LocationPresenceStore? = nil,
         locationManager: LocationChannelManager = .shared
     ) {
+        let conversationStore = conversationStore ?? ConversationStore()
+        let identityResolver = identityResolver ?? IdentityResolver()
         self.init(
             keychain: keychain,
             idBridge: idBridge,
             identityManager: identityManager,
             transport: BLEService(keychain: keychain, idBridge: idBridge, identityManager: identityManager),
-            conversations: conversations,
+            conversationStore: conversationStore,
+            identityResolver: identityResolver,
             peerIdentityStore: peerIdentityStore ?? PeerIdentityStore(),
             locationPresenceStore: locationPresenceStore ?? LocationPresenceStore(),
             locationManager: locationManager
@@ -784,13 +448,14 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         idBridge: NostrIdentityBridge,
         identityManager: SecureIdentityStateManagerProtocol,
         transport: Transport,
-        conversations: ConversationStore? = nil,
+        conversationStore: ConversationStore? = nil,
+        identityResolver: IdentityResolver? = nil,
         peerIdentityStore: PeerIdentityStore? = nil,
         locationPresenceStore: LocationPresenceStore? = nil,
-        locationManager: LocationChannelManager = .shared,
-        readReceiptsDefaults: UserDefaults? = nil
+        locationManager: LocationChannelManager = .shared
     ) {
-        let conversations = conversations ?? ConversationStore()
+        let conversationStore = conversationStore ?? ConversationStore()
+        let identityResolver = identityResolver ?? IdentityResolver()
         let peerIdentityStore = peerIdentityStore ?? PeerIdentityStore()
         let locationPresenceStore = locationPresenceStore ?? LocationPresenceStore()
         let services = ChatViewModelServiceBundle(
@@ -803,7 +468,8 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         self.keychain = keychain
         self.idBridge = idBridge
         self.identityManager = identityManager
-        self.conversations = conversations
+        self.conversationStore = conversationStore
+        self.identityResolver = identityResolver
         self.peerIdentityStore = peerIdentityStore
         self.locationPresenceStore = locationPresenceStore
         self.locationManager = locationManager
@@ -815,27 +481,10 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         self.autocompleteService = services.autocompleteService
         self.deduplicationService = services.deduplicationService
         self.publicMessagePipeline = services.publicMessagePipeline
-        let readReceiptsDefaults = readReceiptsDefaults ?? Self.defaultReadReceiptsDefaults
-        self.readReceiptsDefaults = readReceiptsDefaults
-        self.sentReadReceipts = ChatViewModelBootstrapper.loadPersistedReadReceipts(userDefaults: readReceiptsDefaults)
-
-        // Republish on every store change so SwiftUI observers of the
-        // view model refresh. This replaces the UI-update role of the old
-        // `PrivateChatManager.@Published` dictionaries and the old
-        // `@Published var messages`. Changes touching the ACTIVE public
-        // conversation also invalidate the derived `messages` cache before
-        // observers re-read it.
-        conversations.changes
-            .sink { [weak self] change in
-                guard let self else { return }
-                if self.changeAffectsActivePublicConversation(change) {
-                    self.visibleMessagesCache = nil
-                }
-                self.objectWillChange.send()
-            }
-            .store(in: &cancellables)
+        self.sentReadReceipts = ChatViewModelBootstrapper.loadPersistedReadReceipts()
 
         ChatViewModelBootstrapper(viewModel: self).configure()
+        initializeConversationStore()
     }
 
     // MARK: - Deinitialization
@@ -1027,7 +676,8 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
             recipientNickname: meshService.peerNickname(peerID: peerID),
             senderPeerID: meshService.myPeerID
         )
-        appendPrivateMessage(systemMessage, to: peerID)
+        if privateChats[peerID] == nil { privateChats[peerID] = [] }
+        privateChats[peerID]?.append(systemMessage)
         objectWillChange.send()
     }
 
@@ -1116,11 +766,14 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     func panicClearAllData() {
         // Messages are processed immediately - nothing to flush
 
-        // Clear all messages (public timelines and private chats live in the
-        // single-writer ConversationStore; the derived `messages` view and
-        // the legacy mirror empty with it)
-        conversations.clearAll()
-        pendingGeohashSystemMessages.removeAll()
+        // Clear all messages
+        messages.removeAll()
+        timelineStore = PublicTimelineStore(
+            meshCap: TransportConfig.meshTimelineCap,
+            geohashCap: TransportConfig.geoTimelineCap
+        )
+        privateChatManager.privateChats.removeAll()
+        privateChatManager.unreadMessages.removeAll()
 
         // Delete all keychain data (including Noise and Nostr keys)
         _ = keychain.deleteAllKeychainData()
@@ -1129,11 +782,6 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         userDefaults.removeObject(forKey: "bitchat.noiseIdentityKey")
         userDefaults.removeObject(forKey: "bitchat.messageRetentionKey")
 
-        // Wipe persisted location state (selected channel, teleport set,
-        // bookmarks). For an activist-safety wipe, where the user has been is
-        // exactly the data an adversary inspecting the device wants.
-        LocationStateManager.shared.panicWipe()
-
         // Reset nickname to anonymous
         nickname = "anon\(Int.random(in: 1000...9999))"
         saveNickname()
@@ -1158,25 +806,13 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         // Clear selected private chat
         selectedPrivateChatPeer = nil
 
-        // Clear live location/geohash session state. Persisted location state
-        // was wiped above, but the running view model can still be scoped to a
-        // geohash channel and hold subscriptions tied to the old Nostr identity.
-        activeChannel = .mesh
-        setGeoChatSubscriptionID(nil)
-        setGeoDmSubscriptionID(nil)
-        _ = clearGeoSamplingSubs()
-        cachedGeohashIdentity = nil
-        nostrKeyMapping.removeAll()
-
         // Clear read receipt tracking
         sentReadReceipts.removeAll()
         deduplicationService.clearAll()
 
         // IMPORTANT: Clear Nostr-related state
-        // Drop relay subscriptions, handlers, pending sends, and replay state.
-        // Geohash DM handlers can capture pre-wipe Nostr identities, so a plain
-        // disconnect is not enough here.
-        NostrRelayManager.shared.resetForPanicWipe()
+        // Disconnect from Nostr relays and clear subscriptions
+        nostrRelayManager?.disconnect()
         nostrRelayManager = nil
 
         // Clear Nostr identity associations
@@ -1189,28 +825,20 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
             bleService.resetIdentityForPanic(currentNickname: nickname)
         }
 
+        initializeConversationStore()
+
         // No need to force UserDefaults synchronization
 
         // Reinitialize Nostr with new identity
-        // This will generate new Nostr keys derived from new Noise keys.
-        // Skipped under tests: connecting the shared relay singleton starts
-        // real network/reconnect work that never completes and would keep the
-        // test process alive (the singleton, unlike a discardable instance, is
-        // never deallocated to cancel it).
-        if !TestEnvironment.isRunningTests {
-            Task { @MainActor in
-                // Small delay to ensure cleanup completes
-                try? await Task.sleep(nanoseconds: TransportConfig.uiAsyncShortSleepNs) // 0.1 seconds
+        // This will generate new Nostr keys derived from new Noise keys
+        Task { @MainActor in
+            // Small delay to ensure cleanup completes
+            try? await Task.sleep(nanoseconds: TransportConfig.uiAsyncShortSleepNs) // 0.1 seconds
 
-                // Reinitialize Nostr relay manager with new identity. Reuse the
-                // shared singleton — every other component (NostrTransport, geohash
-                // subscriptions, AppRuntime observers) is bound to `.shared`, so
-                // creating a fresh instance here would split relay state and leave
-                // sends running against a disconnected manager.
-                nostrRelayManager = NostrRelayManager.shared
-                setupNostrMessageHandling()
-                nostrRelayManager?.connect()
-            }
+            // Reinitialize Nostr relay manager with new identity
+            nostrRelayManager = NostrRelayManager()
+            setupNostrMessageHandling()
+            nostrRelayManager?.connect()
         }
 
         // Delete ALL media files (incoming and outgoing) in background
@@ -1285,13 +913,13 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     // MARK: - Message Formatting
 
     @MainActor
-    func formatMessageAsText(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme? = nil) -> AttributedString {
-        messageFormatter.formatMessageAsText(message, colorScheme: colorScheme, theme: theme ?? currentTheme)
+    func formatMessageAsText(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
+        messageFormatter.formatMessageAsText(message, colorScheme: colorScheme)
     }
 
     @MainActor
-    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme? = nil) -> AttributedString {
-        messageFormatter.formatMessageHeader(message, colorScheme: colorScheme, theme: theme ?? currentTheme)
+    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
+        messageFormatter.formatMessageHeader(message, colorScheme: colorScheme)
     }
 
     // MARK: - Noise Protocol Support
@@ -1319,36 +947,55 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
 
     // MARK: - Message Handling
 
-    /// Invalidates the derived `messages` cache and notifies observers.
-    /// (Formerly pulled the channel's timeline into a stored `messages`
-    /// array; `messages` is now derived from the `ConversationStore`, so
-    /// only the invalidation remains. The `channel` parameter is kept for
-    /// call-site compatibility — every caller passes the active channel.)
     @MainActor
-    func refreshVisibleMessages(from channel: ChannelID? = nil) {
-        visibleMessagesCache = nil
-        objectWillChange.send()
+    func initializeConversationStore() {
+        publicConversationCoordinator.initializeConversationStore()
     }
 
-    /// `true` when a store change touches the active public conversation
-    /// (so the derived `messages` cache must be invalidated).
     @MainActor
-    private func changeAffectsActivePublicConversation(_ change: ConversationChange) -> Bool {
-        let activeID = ConversationID(channelID: activeChannel)
-        switch change {
-        case .appended(let id, _),
-             .updated(let id, _),
-             .statusChanged(let id, _, _),
-             .messageRemoved(let id, _),
-             .cleared(let id),
-             .removed(let id),
-             .unreadChanged(let id, _):
-            return id == activeID
-        case .migrated(let source, let destination):
-            return source == activeID || destination == activeID
+    func synchronizePublicConversationStore(for channel: ChannelID) {
+        publicConversationCoordinator.synchronizePublicConversationStore(for: channel)
+    }
+
+    @MainActor
+    func synchronizePublicConversationStore(forGeohash geohash: String) {
+        publicConversationCoordinator.synchronizePublicConversationStore(forGeohash: geohash)
+    }
+
+    @MainActor
+    func synchronizeAllPublicConversationStores() {
+        publicConversationCoordinator.synchronizeAllPublicConversationStores()
+    }
+
+    @MainActor
+    func synchronizePrivateConversationStore() {
+        conversationStore.synchronizePrivateChats(
+            privateChatManager.privateChats,
+            unreadPeerIDs: privateChatManager.unreadMessages,
+            identityResolver: identityResolver
+        )
+    }
+
+    @MainActor
+    func synchronizeConversationSelectionStore() {
+        conversationStore.setSelectedPeerID(
+            privateChatManager.selectedPeer,
+            activeChannel: activeChannel,
+            identityResolver: identityResolver
+        )
+    }
+
+    func trimMessagesIfNeeded() {
+        if messages.count > maxMessages {
+            messages = Array(messages.suffix(maxMessages))
         }
     }
 
+    @MainActor
+    func refreshVisibleMessages(from channel: ChannelID? = nil) {
+        publicConversationCoordinator.refreshVisibleMessages(from: channel)
+    }
+
     @MainActor
     private func peerColor(for message: BitchatMessage, isDark: Bool) -> Color {
         messageFormatter.senderColor(for: message, isDark: isDark)
@@ -1388,6 +1035,15 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
         publicConversationCoordinator.clearCurrentPublicTimeline()
     }
 
+    // MARK: - Message Management
+
+    private func addMessage(_ message: BitchatMessage) {
+        // Check for duplicates
+        guard !messages.contains(where: { $0.id == message.id }) else { return }
+        messages.append(message)
+        trimMessagesIfNeeded()
+    }
+
     // MARK: - Peer Lookup Helpers
 
     func getPeer(byID peerID: PeerID) -> BitchatPeer? {
@@ -1516,35 +1172,6 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, TransportEventDele
     @MainActor
     func cleanupOldReadReceipts() {
         deliveryCoordinator.cleanupOldReadReceipts()
-        auditConversationStore()
-    }
-
-    /// Periodic on-device verification of the `ConversationStore`'s
-    /// correctness invariants, piggybacked on the read-receipt cleanup
-    /// cadence (peer-list updates) so no extra timer exists. Loud on
-    /// violation (one error line each), near-silent when healthy (sampled
-    /// heartbeat: first + every Nth audit). The audit is O(total messages)
-    /// and allocation-free while healthy — measured ~0.5 ms at 5k messages
-    /// (see `PerformanceBaselineTests.testConversationStoreAudit`), cheap
-    /// relative to its cadence, so it always runs.
-    @MainActor
-    private func auditConversationStore() {
-        storeAuditCount += 1
-        let violations = conversations.auditInvariants()
-        guard violations.isEmpty else {
-            for violation in violations {
-                SecureLogger.error("🚨 ConversationStore invariant violated: \(violation)", category: .session)
-            }
-            return
-        }
-        let appendCount = conversations.appendCount
-        if storeAuditCount == 1 || storeAuditCount.isMultiple(of: TransportConfig.conversationStoreAuditLogInterval) {
-            SecureLogger.debug(
-                "Store audit OK: \(conversations.conversationsByID.count) conversations, \(conversations.totalMessageCount) messages, map=\(conversations.messageIDMapCount), appends since last audit=\(appendCount - storeAuditLastAppendCount)",
-                category: .session
-            )
-        }
-        storeAuditLastAppendCount = appendCount
     }
 
     func parseMentions(from content: String) -> [String] {

bitchat/ViewModels/ChatViewModelBootstrapper.swift

@@ -74,37 +74,9 @@ final class ChatViewModelBootstrapper {
 
 private extension ChatViewModelBootstrapper {
     func wireServiceGraph() {
-        viewModel.privateChatManager.conversationStore = viewModel.conversations
         viewModel.privateChatManager.messageRouter = viewModel.messageRouter
         viewModel.privateChatManager.unifiedPeerService = viewModel.unifiedPeerService
         viewModel.unifiedPeerService.messageRouter = viewModel.messageRouter
-        // Surface silent outbox drops (attempt cap, TTL expiry, overflow
-        // eviction) as a visible failure. The store's no-downgrade rule does
-        // not cover `.failed` over confirmed receipts, so guard here: a drop
-        // of an already-delivered/read message (e.g. a stale retained copy)
-        // must not downgrade its status.
-        viewModel.messageRouter.onMessageDropped = { [weak viewModel] messageID, peerID in
-            guard let viewModel else { return }
-            switch viewModel.conversations.deliveryStatus(forMessageID: messageID) {
-            case .delivered, .read:
-                // Field proof of the no-downgrade guard: the drop arrived
-                // after a confirmed receipt, so the `.failed` write is
-                // deliberately skipped.
-                SecureLogger.warning(
-                    "📤 Router dropped message \(messageID.prefix(8))… for \(peerID.id.prefix(8))… → .failed skipped (already delivered/read)",
-                    category: .session
-                )
-            default:
-                SecureLogger.warning(
-                    "📤 Router dropped message \(messageID.prefix(8))… for \(peerID.id.prefix(8))… → marked failed",
-                    category: .session
-                )
-                viewModel.conversations.setDeliveryStatus(
-                    .failed(reason: "Not delivered"),
-                    forMessageID: messageID
-                )
-            }
-        }
         viewModel.commandProcessor.contextProvider = viewModel
         viewModel.commandProcessor.meshService = viewModel.meshService
         viewModel.participantTracker.configure(context: viewModel)
@@ -117,10 +89,33 @@ private extension ChatViewModelBootstrapper {
             }
             .store(in: &viewModel.cancellables)
 
-        // Private message state flows through the single-writer
-        // `ConversationStore` intents and its `changes` subject; selection
-        // is owned by the store too (`PrivateChatManager.selectedPeer` is a
-        // read-only mirror), so no selection bridge is needed here.
+        viewModel.privateChatManager.$privateChats
+            .receive(on: DispatchQueue.main)
+            .sink { [weak viewModel] _ in
+                Task { @MainActor [weak viewModel] in
+                    viewModel?.synchronizePrivateConversationStore()
+                }
+            }
+            .store(in: &viewModel.cancellables)
+
+        viewModel.privateChatManager.$unreadMessages
+            .receive(on: DispatchQueue.main)
+            .sink { [weak viewModel] _ in
+                Task { @MainActor [weak viewModel] in
+                    viewModel?.synchronizePrivateConversationStore()
+                }
+            }
+            .store(in: &viewModel.cancellables)
+
+        viewModel.privateChatManager.$selectedPeer
+            .receive(on: DispatchQueue.main)
+            .sink { [weak viewModel] _ in
+                Task { @MainActor [weak viewModel] in
+                    viewModel?.synchronizeConversationSelectionStore()
+                }
+            }
+            .store(in: &viewModel.cancellables)
+
         viewModel.participantTracker.objectWillChange
             .sink { [weak viewModel] _ in
                 viewModel?.objectWillChange.send()
@@ -149,6 +144,7 @@ private extension ChatViewModelBootstrapper {
         viewModel.meshService.startServices()
 
         viewModel.publicMessagePipeline.delegate = viewModel.publicConversationCoordinator
+        viewModel.publicMessagePipeline.updateActiveChannel(viewModel.activeChannel)
 
         DispatchQueue.main.asyncAfter(deadline: .now() + 0.1) { [weak viewModel] in
             guard let viewModel,
@@ -177,6 +173,7 @@ private extension ChatViewModelBootstrapper {
                     guard let viewModel else { return }
 
                     viewModel.allPeers = peers
+                    viewModel.identityResolver.register(peers: peers)
 
                     var uniquePeers: [PeerID: BitchatPeer] = [:]
                     for peer in peers {
@@ -194,6 +191,9 @@ private extension ChatViewModelBootstrapper {
                     if viewModel.hasTrackedPrivateChatSelection {
                         viewModel.updatePrivateChatPeerIfNeeded()
                     }
+
+                    viewModel.synchronizePrivateConversationStore()
+                    viewModel.synchronizeConversationSelectionStore()
                 }
             }
             .store(in: &viewModel.cancellables)
@@ -217,7 +217,15 @@ private extension ChatViewModelBootstrapper {
     func configureGeoChannels() {
         viewModel.geoChannelCoordinator = GeoChannelCoordinator(
             locationManager: viewModel.locationManager,
-            context: viewModel
+            onChannelSwitch: { [weak viewModel] channel in
+                viewModel?.switchLocationChannel(to: channel)
+            },
+            beginSampling: { [weak viewModel] geohashes in
+                viewModel?.beginGeohashSampling(for: geohashes)
+            },
+            endSampling: { [weak viewModel] in
+                viewModel?.endGeohashSampling()
+            }
         )
     }
 

bitchat/ViewModels/Extensions/ChatViewModel+Nostr.swift

@@ -12,86 +12,86 @@ extension ChatViewModel {
 
     @MainActor
     func resubscribeCurrentGeohash() {
-        nostrCoordinator.subscriptions.resubscribeCurrentGeohash()
+        nostrCoordinator.resubscribeCurrentGeohash()
     }
 
     @MainActor
     func subscribeNostrEvent(_ event: NostrEvent) {
-        nostrCoordinator.inbound.subscribeNostrEvent(event)
+        nostrCoordinator.subscribeNostrEvent(event)
     }
 
     @MainActor
     func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        nostrCoordinator.inbound.subscribeGiftWrap(giftWrap, id: id)
+        nostrCoordinator.subscribeGiftWrap(giftWrap, id: id)
     }
 
     @MainActor
     func switchLocationChannel(to channel: ChannelID) {
-        nostrCoordinator.subscriptions.switchLocationChannel(to: channel)
+        nostrCoordinator.switchLocationChannel(to: channel)
     }
 
     @MainActor
     func handleNostrEvent(_ event: NostrEvent) {
-        nostrCoordinator.inbound.handleNostrEvent(event)
+        nostrCoordinator.handleNostrEvent(event)
     }
 
     @MainActor
     func subscribeToGeoChat(_ ch: GeohashChannel) {
-        nostrCoordinator.subscriptions.subscribeToGeoChat(ch)
+        nostrCoordinator.subscribeToGeoChat(ch)
     }
 
     @MainActor
     func handleGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        nostrCoordinator.inbound.handleGiftWrap(giftWrap, id: id)
+        nostrCoordinator.handleGiftWrap(giftWrap, id: id)
     }
 
     @MainActor
     func sendGeohash(context: GeoOutgoingContext) {
-        nostrCoordinator.subscriptions.sendGeohash(context: context)
+        nostrCoordinator.sendGeohash(context: context)
     }
 
     @MainActor
     func beginGeohashSampling(for geohashes: [String]) {
-        nostrCoordinator.subscriptions.beginGeohashSampling(for: geohashes)
+        nostrCoordinator.beginGeohashSampling(for: geohashes)
     }
 
     @MainActor
     func subscribe(_ gh: String) {
-        nostrCoordinator.subscriptions.subscribe(gh)
+        nostrCoordinator.subscribe(gh)
     }
 
     @MainActor
     func subscribeNostrEvent(_ event: NostrEvent, gh: String) {
-        nostrCoordinator.presence.subscribeNostrEvent(event, gh: gh)
+        nostrCoordinator.subscribeNostrEvent(event, gh: gh)
     }
 
     @MainActor
     func cooldownPerGeohash(_ gh: String, content: String, event: NostrEvent) {
-        nostrCoordinator.presence.cooldownPerGeohash(gh, content: content, event: event)
+        nostrCoordinator.cooldownPerGeohash(gh, content: content, event: event)
     }
 
     @MainActor
     func endGeohashSampling() {
-        nostrCoordinator.subscriptions.endGeohashSampling()
+        nostrCoordinator.endGeohashSampling()
     }
 
     @MainActor
     func setupNostrMessageHandling() {
-        nostrCoordinator.subscriptions.setupNostrMessageHandling()
+        nostrCoordinator.setupNostrMessageHandling()
     }
 
     @MainActor
     func handleNostrMessage(_ giftWrap: NostrEvent) {
-        nostrCoordinator.inbound.handleNostrMessage(giftWrap)
+        nostrCoordinator.handleNostrMessage(giftWrap)
     }
 
     func processNostrMessage(_ giftWrap: NostrEvent) async {
-        await nostrCoordinator.inbound.processNostrMessage(giftWrap)
+        await nostrCoordinator.processNostrMessage(giftWrap)
     }
 
     @MainActor
     func findNoiseKey(for nostrPubkey: String) -> Data? {
-        nostrCoordinator.inbound.findNoiseKey(for: nostrPubkey)
+        nostrCoordinator.findNoiseKey(for: nostrPubkey)
     }
 
     @MainActor

bitchat/ViewModels/GeoChannelCoordinator.swift

@@ -9,32 +9,15 @@ import Combine
 import Foundation
 import Tor
 
-/// The narrow surface `GeoChannelCoordinator` needs from its owner.
-///
-/// Follows the `ChatDeliveryContext` exemplar: the coordinator depends on the
-/// minimal context it actually uses instead of capturing `ChatViewModel` in
-/// per-callback closures. This keeps the coordinator independently testable
-/// (see `GeoChannelCoordinatorContextTests`) and makes its true dependencies
-/// explicit. Held `weak` — the owner retains the coordinator, and every
-/// callback was previously a `[weak viewModel]` capture.
-@MainActor
-protocol GeoChannelContext: AnyObject {
-    func switchLocationChannel(to channel: ChannelID)
-    func beginGeohashSampling(for geohashes: [String])
-    func endGeohashSampling()
-}
-
-// `switchLocationChannel(to:)`, `beginGeohashSampling(for:)`, and
-// `endGeohashSampling()` are satisfied by existing `ChatViewModel` members.
-extension ChatViewModel: GeoChannelContext {}
-
 @MainActor
 final class GeoChannelCoordinator {
     private let locationManager: LocationChannelManager
     private let bookmarksStore: GeohashBookmarksStore
     private let torManager: TorManager
 
-    private weak var context: (any GeoChannelContext)?
+    private let onChannelSwitch: (ChannelID) -> Void
+    private let beginSampling: ([String]) -> Void
+    private let endSampling: () -> Void
 
     private var cancellables = Set<AnyCancellable>()
     private var regionalGeohashes: [String] = []
@@ -44,12 +27,16 @@ final class GeoChannelCoordinator {
         locationManager: LocationChannelManager? = nil,
         bookmarksStore: GeohashBookmarksStore? = nil,
         torManager: TorManager? = nil,
-        context: any GeoChannelContext
+        onChannelSwitch: @escaping (ChannelID) -> Void,
+        beginSampling: @escaping ([String]) -> Void,
+        endSampling: @escaping () -> Void
     ) {
         self.locationManager = locationManager ?? Self.defaultLocationManager()
         self.bookmarksStore = bookmarksStore ?? GeohashBookmarksStore.shared
         self.torManager = torManager ?? Self.defaultTorManager()
-        self.context = context
+        self.onChannelSwitch = onChannelSwitch
+        self.beginSampling = beginSampling
+        self.endSampling = endSampling
 
         start()
     }
@@ -63,7 +50,7 @@ final class GeoChannelCoordinator {
             .sink { [weak self] channel in
                 guard let self else { return }
                 Task { @MainActor in
-                    self.context?.switchLocationChannel(to: channel)
+                    self.onChannelSwitch(channel)
                 }
             }
             .store(in: &cancellables)
@@ -97,7 +84,7 @@ final class GeoChannelCoordinator {
             .store(in: &cancellables)
 
         Task { @MainActor in
-            self.context?.switchLocationChannel(to: self.locationManager.selectedChannel)
+            self.onChannelSwitch(self.locationManager.selectedChannel)
         }
         updateSampling()
     }
@@ -106,13 +93,13 @@ final class GeoChannelCoordinator {
         let union = Array(Set(regionalGeohashes).union(bookmarkedGeohashes))
         Task { @MainActor in
             guard !union.isEmpty else {
-                context?.endGeohashSampling()
+                endSampling()
                 return
             }
             if torManager.isForeground() {
-                context?.beginGeohashSampling(for: union)
+                beginSampling(union)
             } else {
-                context?.endGeohashSampling()
+                endSampling()
             }
         }
     }

bitchat/ViewModels/GeoPresenceTracker.swift

@@ -1,197 +0,0 @@
-import BitFoundation
-import BitLogger
-import Foundation
-import SwiftUI
-
-/// The narrow surface `GeoPresenceTracker` needs from its owner.
-///
-/// Split out of `ChatNostrContext`: member names are shared with the sibling
-/// component contexts so `ChatViewModel` provides a single witness for each.
-@MainActor
-protocol GeoPresenceContext: AnyObject {
-    var activeChannel: ChannelID { get }
-    /// Per-geohash notification cooldown: geohash -> last notify time.
-    var lastGeoNotificationAt: [String: Date] { get set }
-    var geoNicknames: [String: String] { get }
-    var teleportedGeoCount: Int { get }
-
-    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
-    func isNostrBlocked(pubkeyHexLowercased: String) -> Bool
-    func parseMentions(from content: String) -> [String]
-
-    func recordGeoParticipant(pubkeyHex: String, geohash: String)
-    func geoParticipantCount(for geohash: String) -> Int
-    func markGeoTeleported(_ pubkeyHexLowercased: String)
-
-    /// Appends a geohash message if absent (single-writer store intent).
-    /// Returns `true` when stored.
-    @discardableResult
-    func appendGeohashMessageIfAbsent(_ message: BitchatMessage, toGeohash geohash: String) -> Bool
-
-    /// Posts the sampled-geohash-activity local notification.
-    func notifyGeohashActivity(geohash: String, bodyPreview: String)
-}
-
-extension ChatViewModel: GeoPresenceContext {
-    // `activeChannel`, `lastGeoNotificationAt`, `geoNicknames`, the Nostr
-    // identity/blocking members, and the
-    // `appendGeohashMessageIfAbsent(_:toGeohash:)` store intent already have
-    // witnesses on `ChatViewModel`. The members below flatten nested service
-    // accesses into intent-named calls.
-
-    var teleportedGeoCount: Int {
-        locationPresenceStore.teleportedGeo.count
-    }
-
-    func recordGeoParticipant(pubkeyHex: String, geohash: String) {
-        participantTracker.recordParticipant(pubkeyHex: pubkeyHex, geohash: geohash)
-    }
-
-    func geoParticipantCount(for geohash: String) -> Int {
-        participantTracker.participantCount(for: geohash)
-    }
-
-    func markGeoTeleported(_ pubkeyHexLowercased: String) {
-        locationPresenceStore.markTeleported(pubkeyHexLowercased)
-    }
-
-    func notifyGeohashActivity(geohash: String, bodyPreview: String) {
-        NotificationService.shared.sendGeohashActivityNotification(geohash: geohash, bodyPreview: bodyPreview)
-    }
-}
-
-/// Geohash presence bookkeeping that is independent of relay subscriptions:
-/// teleport-tag detection and marking, the sampling-event LRU dedup, and the
-/// per-geohash notification cooldown for sampled activity.
-final class GeoPresenceTracker {
-    private weak var context: (any GeoPresenceContext)?
-    private var recentGeoSamplingEventIDs = Set<String>()
-    private var recentGeoSamplingEventIDOrder: [String] = []
-
-    init(context: any GeoPresenceContext) {
-        self.context = context
-    }
-
-    /// True when the event carries a `["t", "teleport"]` tag.
-    static func hasTeleportTag(_ event: NostrEvent) -> Bool {
-        event.tags.contains { tag in
-            tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
-        }
-    }
-
-    /// Marks a peer teleported on a follow-up main-actor hop (keeps the
-    /// inbound hot path free of presence-store writes).
-    @MainActor
-    func scheduleMarkPeerTeleported(_ key: String, logged: Bool) {
-        Task { @MainActor [weak context] in
-            guard let context else { return }
-            context.markGeoTeleported(key)
-            if logged {
-                SecureLogger.info(
-                    "GeoTeleport: mark peer teleported key=\(key.prefix(8))… total=\(context.teleportedGeoCount)",
-                    category: .session
-                )
-            }
-        }
-    }
-
-    @MainActor
-    func subscribeNostrEvent(_ event: NostrEvent, gh: String) {
-        guard let context else { return }
-        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
-            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue)
-        else {
-            return
-        }
-        guard event.isValidSignature() else { return }
-        guard shouldProcessGeoSamplingEvent(event.id) else { return }
-
-        let existingCount = context.geoParticipantCount(for: gh)
-        context.recordGeoParticipant(pubkeyHex: event.pubkey, geohash: gh)
-
-        guard let content = event.content.trimmedOrNilIfEmpty else { return }
-        if context.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased()) { return }
-        if let my = try? context.deriveNostrIdentity(forGeohash: gh),
-           my.publicKeyHex.lowercased() == event.pubkey.lowercased() {
-            return
-        }
-        guard existingCount == 0 else { return }
-
-        let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-        if Date().timeIntervalSince(eventTime) > 30 { return }
-
-        #if os(iOS)
-        guard UIApplication.shared.applicationState == .active else { return }
-        if case .location(let channel) = context.activeChannel, channel.geohash == gh { return }
-        #elseif os(macOS)
-        guard NSApplication.shared.isActive else { return }
-        if case .location(let channel) = context.activeChannel, channel.geohash == gh { return }
-        #endif
-
-        cooldownPerGeohash(gh, content: content, event: event)
-    }
-
-    @MainActor
-    func cooldownPerGeohash(_ gh: String, content: String, event: NostrEvent) {
-        guard let context else { return }
-        let now = Date()
-        let last = context.lastGeoNotificationAt[gh] ?? .distantPast
-        if now.timeIntervalSince(last) < TransportConfig.uiGeoNotifyCooldownSeconds { return }
-
-        let preview: String = {
-            let maxLen = TransportConfig.uiGeoNotifySnippetMaxLen
-            if content.count <= maxLen { return content }
-            let idx = content.index(content.startIndex, offsetBy: maxLen)
-            return String(content[..<idx]) + "…"
-        }()
-
-        Task { @MainActor [weak context] in
-            guard let context else { return }
-            context.lastGeoNotificationAt[gh] = now
-            let senderSuffix = String(event.pubkey.suffix(4))
-            let nick = context.geoNicknames[event.pubkey.lowercased()]
-            let senderName = (nick?.isEmpty == false ? nick! : "anon") + "#" + senderSuffix
-
-            let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-            let ts = min(rawTs, Date())
-            let mentions = context.parseMentions(from: content)
-            let message = BitchatMessage(
-                id: event.id,
-                sender: senderName,
-                content: content,
-                timestamp: ts,
-                isRelay: false,
-                senderPeerID: PeerID(nostr: event.pubkey),
-                mentions: mentions.isEmpty ? nil : mentions
-            )
-            if context.appendGeohashMessageIfAbsent(message, toGeohash: gh) {
-                context.notifyGeohashActivity(geohash: gh, bodyPreview: preview)
-            }
-        }
-    }
-
-    /// First-seen check for sampled geohash events with LRU eviction so the
-    /// dedup set stays bounded across long sampling sessions.
-    func shouldProcessGeoSamplingEvent(_ eventID: String) -> Bool {
-        guard !eventID.isEmpty else { return true }
-        guard recentGeoSamplingEventIDs.insert(eventID).inserted else {
-            return false
-        }
-        recentGeoSamplingEventIDOrder.append(eventID)
-
-        let cap = TransportConfig.geoSamplingEventLRUCap
-        if recentGeoSamplingEventIDOrder.count > cap {
-            let removeCount = recentGeoSamplingEventIDOrder.count - cap
-            for staleID in recentGeoSamplingEventIDOrder.prefix(removeCount) {
-                recentGeoSamplingEventIDs.remove(staleID)
-            }
-            recentGeoSamplingEventIDOrder.removeFirst(removeCount)
-        }
-        return true
-    }
-
-    func clearGeoSamplingEventDedup() {
-        recentGeoSamplingEventIDs.removeAll()
-        recentGeoSamplingEventIDOrder.removeAll()
-    }
-}

bitchat/ViewModels/GeohashSubscriptionManager.swift

@@ -1,376 +0,0 @@
-import BitFoundation
-import BitLogger
-import Foundation
-import Tor
-
-/// The narrow surface `GeohashSubscriptionManager` needs from its owner.
-///
-/// Split out of `ChatNostrContext`: member names are shared with the sibling
-/// component contexts so `ChatViewModel` provides a single witness for each.
-@MainActor
-protocol GeohashSubscriptionContext: AnyObject {
-    // MARK: Channel & subscription state
-    var activeChannel: ChannelID { get set }
-    var currentGeohash: String? { get set }
-    var geoSubscriptionID: String? { get }
-    var geoDmSubscriptionID: String? { get }
-    func setGeoChatSubscriptionID(_ id: String?)
-    func setGeoDmSubscriptionID(_ id: String?)
-    /// Geohash sampling subscriptions: subscription ID -> geohash.
-    var geoSamplingSubs: [String: String] { get }
-    func addGeoSamplingSub(_ subID: String, forGeohash geohash: String)
-    func removeGeoSamplingSub(_ subID: String)
-    /// Clears all sampling subscriptions and returns the removed subscription IDs
-    /// so the caller can unsubscribe them from the relay manager.
-    func clearGeoSamplingSubs() -> [String]
-    var nostrRelayManager: NostrRelayManager? { get }
-
-    // MARK: Public timeline & pipeline
-    var messages: [BitchatMessage] { get }
-    /// Commits any batched-but-unflushed public messages to the store so a
-    /// channel switch never strands them in the pipeline buffer.
-    func flushPublicMessagePipeline()
-    func refreshVisibleMessages(from channel: ChannelID?)
-    func addPublicSystemMessage(_ content: String)
-    func drainPendingGeohashSystemMessages() -> [String]
-
-    // MARK: Nostr identity & dedup
-    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
-    func currentNostrIdentity() -> NostrIdentity?
-    func recordProcessedNostrEvent(_ eventID: String)
-    func clearProcessedNostrEvents()
-    /// Records the Nostr pubkey behind a (possibly virtual) peer ID.
-    func registerNostrKeyMapping(_ pubkey: String, for peerID: PeerID)
-
-    // MARK: Geo participants & presence
-    var teleportedGeoCount: Int { get }
-    func startGeoParticipantRefreshTimer()
-    func stopGeoParticipantRefreshTimer()
-    func setActiveParticipantGeohash(_ geohash: String?)
-    func recordGeoParticipant(pubkeyHex: String)
-    func markGeoTeleported(_ pubkeyHexLowercased: String)
-    func clearGeoTeleported(_ pubkeyHexLowercased: String)
-    func clearTeleportedGeo()
-    func clearGeoNicknames()
-
-    // MARK: Location channels
-    var isTeleported: Bool { get }
-    /// True when regional channels are known and the geohash is not one of them.
-    func isGeohashOutsideRegionalChannels(_ geohash: String) -> Bool
-}
-
-extension ChatViewModel: GeohashSubscriptionContext {
-    // `activeChannel`, `currentGeohash`, the subscription-ID accessors, the
-    // identity members, and the timeline members already have witnesses on
-    // `ChatViewModel`. The members below flatten nested service accesses into
-    // intent-named calls.
-
-    func flushPublicMessagePipeline() {
-        publicMessagePipeline.flushIfNeeded()
-    }
-
-    func clearProcessedNostrEvents() {
-        deduplicationService.clearNostrCaches()
-    }
-
-    func startGeoParticipantRefreshTimer() {
-        participantTracker.startRefreshTimer()
-    }
-
-    func stopGeoParticipantRefreshTimer() {
-        participantTracker.stopRefreshTimer()
-    }
-
-    func setActiveParticipantGeohash(_ geohash: String?) {
-        participantTracker.setActiveGeohash(geohash)
-    }
-
-    func clearGeoTeleported(_ pubkeyHexLowercased: String) {
-        locationPresenceStore.clearTeleported(pubkeyHexLowercased)
-    }
-
-    func clearTeleportedGeo() {
-        locationPresenceStore.clearTeleportedGeo()
-    }
-
-    func clearGeoNicknames() {
-        locationPresenceStore.clearGeoNicknames()
-    }
-
-    var isTeleported: Bool {
-        locationManager.teleported
-    }
-
-    func isGeohashOutsideRegionalChannels(_ geohash: String) -> Bool {
-        let channels = locationManager.availableChannels
-        return !channels.isEmpty && !channels.contains { $0.geohash == geohash }
-    }
-}
-
-/// Owns subscription IDs and relay lifecycle for geohash channels, geohash
-/// DMs, the account gift-wrap mailbox, and background geohash sampling. The
-/// only component that talks to `NostrRelayManager`; inbound events are
-/// forwarded to `NostrInboundPipeline` / `GeoPresenceTracker`.
-final class GeohashSubscriptionManager {
-    private weak var context: (any GeohashSubscriptionContext)?
-    private let inbound: NostrInboundPipeline
-    private let presence: GeoPresenceTracker
-
-    init(context: any GeohashSubscriptionContext, inbound: NostrInboundPipeline, presence: GeoPresenceTracker) {
-        self.context = context
-        self.inbound = inbound
-        self.presence = presence
-    }
-
-    @MainActor
-    func resubscribeCurrentGeohash() {
-        guard let context else { return }
-        guard case .location(let channel) = context.activeChannel else { return }
-        guard let subID = context.geoSubscriptionID else {
-            switchLocationChannel(to: context.activeChannel)
-            return
-        }
-
-        context.startGeoParticipantRefreshTimer()
-        NostrRelayManager.shared.unsubscribe(id: subID)
-        let filter = NostrFilter.geohashEphemeral(
-            channel.geohash,
-            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds),
-            limit: TransportConfig.nostrGeohashInitialLimit
-        )
-        let subRelays = GeoRelayDirectory.shared.closestRelays(
-            toGeohash: channel.geohash,
-            count: TransportConfig.nostrGeoRelayCount
-        )
-        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
-            Task { @MainActor [weak self] in
-                self?.inbound.subscribeNostrEvent(event)
-            }
-        }
-
-        if let dmSub = context.geoDmSubscriptionID {
-            NostrRelayManager.shared.unsubscribe(id: dmSub)
-            context.setGeoDmSubscriptionID(nil)
-        }
-
-        if let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
-            let dmSub = "geo-dm-\(channel.geohash)"
-            context.setGeoDmSubscriptionID(dmSub)
-            let dmFilter = NostrFilter.giftWrapsFor(
-                pubkey: identity.publicKeyHex,
-                since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
-            )
-            NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
-                Task { @MainActor [weak self] in
-                    self?.inbound.subscribeGiftWrap(giftWrap, id: identity)
-                }
-            }
-        }
-    }
-
-    @MainActor
-    func switchLocationChannel(to channel: ChannelID) {
-        guard let context else { return }
-        context.flushPublicMessagePipeline()
-        context.activeChannel = channel
-
-        context.clearProcessedNostrEvents()
-        switch channel {
-        case .mesh:
-            context.refreshVisibleMessages(from: .mesh)
-            let emptyMesh = context.messages.filter { $0.content.trimmed.isEmpty }.count
-            if emptyMesh > 0 {
-                SecureLogger.debug("RenderGuard: mesh timeline contains \(emptyMesh) empty messages", category: .session)
-            }
-            context.stopGeoParticipantRefreshTimer()
-            context.setActiveParticipantGeohash(nil)
-            context.clearTeleportedGeo()
-
-        case .location:
-            context.refreshVisibleMessages(from: channel)
-        }
-
-        if case .location = channel {
-            for content in context.drainPendingGeohashSystemMessages() {
-                context.addPublicSystemMessage(content)
-            }
-        }
-
-        if let sub = context.geoSubscriptionID {
-            NostrRelayManager.shared.unsubscribe(id: sub)
-            context.setGeoChatSubscriptionID(nil)
-        }
-        if let dmSub = context.geoDmSubscriptionID {
-            NostrRelayManager.shared.unsubscribe(id: dmSub)
-            context.setGeoDmSubscriptionID(nil)
-        }
-        context.currentGeohash = nil
-        context.setActiveParticipantGeohash(nil)
-        context.clearGeoNicknames()
-
-        guard case .location(let channel) = channel else { return }
-        context.currentGeohash = channel.geohash
-        context.setActiveParticipantGeohash(channel.geohash)
-
-        if let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) {
-            context.recordGeoParticipant(pubkeyHex: identity.publicKeyHex)
-            let key = identity.publicKeyHex.lowercased()
-            if context.isTeleported && context.isGeohashOutsideRegionalChannels(channel.geohash) {
-                context.markGeoTeleported(key)
-                SecureLogger.info(
-                    "GeoTeleport: channel switch mark self teleported key=\(key.prefix(8))… total=\(context.teleportedGeoCount)",
-                    category: .session
-                )
-            } else {
-                context.clearGeoTeleported(key)
-            }
-        }
-
-        let subID = "geo-\(channel.geohash)"
-        context.setGeoChatSubscriptionID(subID)
-        context.startGeoParticipantRefreshTimer()
-        let ts = Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds)
-        let filter = NostrFilter.geohashEphemeral(channel.geohash, since: ts, limit: TransportConfig.nostrGeohashInitialLimit)
-        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: channel.geohash, count: 5)
-        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
-            Task { @MainActor [weak self] in
-                self?.inbound.handleNostrEvent(event)
-            }
-        }
-
-        subscribeToGeoChat(channel)
-    }
-
-    @MainActor
-    func subscribeToGeoChat(_ channel: GeohashChannel) {
-        guard let context else { return }
-        guard let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) else { return }
-
-        let dmSub = "geo-dm-\(channel.geohash)"
-        context.setGeoDmSubscriptionID(dmSub)
-        if TorManager.shared.isReady {
-            SecureLogger.debug("GeoDM: subscribing DMs pub=\(identity.publicKeyHex.prefix(8))… sub=\(dmSub)", category: .session)
-        }
-        let dmFilter = NostrFilter.giftWrapsFor(
-            pubkey: identity.publicKeyHex,
-            since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
-        )
-        NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
-            Task { @MainActor [weak self] in
-                self?.inbound.handleGiftWrap(giftWrap, id: identity)
-            }
-        }
-    }
-
-    @MainActor
-    func sendGeohash(context geoContext: ChatViewModel.GeoOutgoingContext) {
-        guard let context else { return }
-        let channel = geoContext.channel
-        let event = geoContext.event
-        let identity = geoContext.identity
-
-        let targetRelays = GeoRelayDirectory.shared.closestRelays(
-            toGeohash: channel.geohash,
-            count: TransportConfig.nostrGeoRelayCount
-        )
-
-        if targetRelays.isEmpty {
-            SecureLogger.warning("Geo: no geohash relays available for \(channel.geohash); not sending", category: .session)
-        } else {
-            NostrRelayManager.shared.sendEvent(event, to: targetRelays)
-        }
-
-        context.recordGeoParticipant(pubkeyHex: identity.publicKeyHex)
-        context.registerNostrKeyMapping(identity.publicKeyHex, for: PeerID(nostr: identity.publicKeyHex))
-        SecureLogger.debug(
-            "GeoTeleport: sent geo message pub=\(identity.publicKeyHex.prefix(8))… teleported=\(geoContext.teleported)",
-            category: .session
-        )
-
-        if geoContext.teleported && context.isGeohashOutsideRegionalChannels(channel.geohash) {
-            let key = identity.publicKeyHex.lowercased()
-            context.markGeoTeleported(key)
-            SecureLogger.info(
-                "GeoTeleport: mark self teleported key=\(key.prefix(8))… total=\(context.teleportedGeoCount)",
-                category: .session
-            )
-        }
-
-        context.recordProcessedNostrEvent(event.id)
-    }
-
-    @MainActor
-    func beginGeohashSampling(for geohashes: [String]) {
-        guard let context else { return }
-        if !TorManager.shared.isForeground() {
-            endGeohashSampling()
-            return
-        }
-
-        let desired = Set(geohashes)
-        let current = Set(context.geoSamplingSubs.values)
-        let toAdd = desired.subtracting(current)
-        let toRemove = current.subtracting(desired)
-
-        for (subID, gh) in context.geoSamplingSubs where toRemove.contains(gh) {
-            NostrRelayManager.shared.unsubscribe(id: subID)
-            context.removeGeoSamplingSub(subID)
-        }
-
-        for gh in toAdd {
-            subscribe(gh)
-        }
-    }
-
-    @MainActor
-    func subscribe(_ gh: String) {
-        guard let context else { return }
-        let subID = "geo-sample-\(gh)"
-        context.addGeoSamplingSub(subID, forGeohash: gh)
-        let filter = NostrFilter.geohashEphemeral(
-            gh,
-            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashSampleLookbackSeconds),
-            limit: TransportConfig.nostrGeohashSampleLimit
-        )
-        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: gh, count: 5)
-        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
-            Task { @MainActor [weak self] in
-                self?.presence.subscribeNostrEvent(event, gh: gh)
-            }
-        }
-    }
-
-    @MainActor
-    func endGeohashSampling() {
-        guard let context else { return }
-        for subID in context.clearGeoSamplingSubs() {
-            NostrRelayManager.shared.unsubscribe(id: subID)
-        }
-        presence.clearGeoSamplingEventDedup()
-    }
-
-    @MainActor
-    func setupNostrMessageHandling() {
-        guard let context else { return }
-        guard let currentIdentity = context.currentNostrIdentity() else {
-            SecureLogger.warning("⚠️ No Nostr identity available for message handling", category: .session)
-            return
-        }
-
-        SecureLogger.debug(
-            "🔑 Setting up Nostr subscription for pubkey: \(currentIdentity.publicKeyHex.prefix(16))...",
-            category: .session
-        )
-
-        let filter = NostrFilter.giftWrapsFor(
-            pubkey: currentIdentity.publicKeyHex,
-            since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
-        )
-
-        context.nostrRelayManager?.subscribe(filter: filter, id: "chat-messages") { [weak self] event in
-            Task { @MainActor [weak self] in
-                self?.inbound.handleNostrMessage(event)
-            }
-        }
-    }
-}

bitchat/ViewModels/MessageRateLimiter.swift

@@ -26,6 +26,10 @@ struct MessageRateLimiter {
             }
             return false
         }
+
+        func isIdle(since now: Date, idleTTL: TimeInterval) -> Bool {
+            now.timeIntervalSince(lastRefill) >= idleTTL
+        }
     }
 
     private var senderBuckets: [String: TokenBucket] = [:]
@@ -35,43 +39,93 @@ struct MessageRateLimiter {
     private let senderRefill: Double
     private let contentCapacity: Double
     private let contentRefill: Double
+    private let maxSenderBuckets: Int
+    private let maxContentBuckets: Int
+    private let bucketIdleTTL: TimeInterval
 
     init(
         senderCapacity: Double,
         senderRefillPerSec: Double,
         contentCapacity: Double,
-        contentRefillPerSec: Double
+        contentRefillPerSec: Double,
+        maxSenderBuckets: Int = TransportConfig.uiSenderRateBucketMaxEntries,
+        maxContentBuckets: Int = TransportConfig.uiContentRateBucketMaxEntries,
+        bucketIdleTTL: TimeInterval = TransportConfig.uiRateBucketIdleTTL
     ) {
         self.senderCapacity = senderCapacity
         self.senderRefill = senderRefillPerSec
         self.contentCapacity = contentCapacity
         self.contentRefill = contentRefillPerSec
+        self.maxSenderBuckets = max(1, maxSenderBuckets)
+        self.maxContentBuckets = max(1, maxContentBuckets)
+        self.bucketIdleTTL = bucketIdleTTL
     }
 
     mutating func allow(senderKey: String, contentKey: String, now: Date = Date()) -> Bool {
-        var senderBucket = senderBuckets[senderKey] ?? TokenBucket(
+        var senderBucket = bucket(
+            for: senderKey,
+            in: &senderBuckets,
             capacity: senderCapacity,
-            tokens: senderCapacity,
             refillPerSec: senderRefill,
-            lastRefill: now
+            maxBuckets: maxSenderBuckets,
+            now: now
         )
         let senderAllowed = senderBucket.allow(now: now)
         senderBuckets[senderKey] = senderBucket
+        guard senderAllowed else { return false }
 
-        var contentBucket = contentBuckets[contentKey] ?? TokenBucket(
+        var contentBucket = bucket(
+            for: contentKey,
+            in: &contentBuckets,
             capacity: contentCapacity,
-            tokens: contentCapacity,
             refillPerSec: contentRefill,
-            lastRefill: now
+            maxBuckets: maxContentBuckets,
+            now: now
         )
         let contentAllowed = contentBucket.allow(now: now)
         contentBuckets[contentKey] = contentBucket
 
-        return senderAllowed && contentAllowed
+        return contentAllowed
     }
 
     mutating func reset() {
         senderBuckets.removeAll()
         contentBuckets.removeAll()
     }
+
+    var bucketCountsForTesting: (sender: Int, content: Int) {
+        (senderBuckets.count, contentBuckets.count)
+    }
+
+    private mutating func bucket(
+        for key: String,
+        in buckets: inout [String: TokenBucket],
+        capacity: Double,
+        refillPerSec: Double,
+        maxBuckets: Int,
+        now: Date
+    ) -> TokenBucket {
+        if let bucket = buckets[key] {
+            return bucket
+        }
+
+        evictIfNeeded(from: &buckets, maxBuckets: maxBuckets, now: now)
+        return TokenBucket(
+            capacity: capacity,
+            tokens: capacity,
+            refillPerSec: refillPerSec,
+            lastRefill: now
+        )
+    }
+
+    private func evictIfNeeded(from buckets: inout [String: TokenBucket], maxBuckets: Int, now: Date) {
+        guard buckets.count >= maxBuckets else { return }
+
+        buckets = buckets.filter { !$0.value.isIdle(since: now, idleTTL: bucketIdleTTL) }
+        guard buckets.count >= maxBuckets else { return }
+
+        if let oldestKey = buckets.min(by: { $0.value.lastRefill < $1.value.lastRefill })?.key {
+            buckets.removeValue(forKey: oldestKey)
+        }
+    }
 }

bitchat/ViewModels/NostrInboundPipeline.swift

@@ -1,500 +0,0 @@
-import BitFoundation
-import BitLogger
-import Foundation
-
-/// The narrow surface `NostrInboundPipeline` needs from its owner.
-///
-/// Split out of `ChatNostrContext`: member names are shared with the sibling
-/// component contexts so `ChatViewModel` provides a single witness for each.
-@MainActor
-protocol NostrInboundPipelineContext: AnyObject {
-    var currentGeohash: String? { get }
-
-    // MARK: Event dedup
-    func hasProcessedNostrEvent(_ eventID: String) -> Bool
-    func recordProcessedNostrEvent(_ eventID: String)
-
-    // MARK: Nostr identity & blocking
-    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
-    func currentNostrIdentity() -> NostrIdentity?
-    func isNostrBlocked(pubkeyHexLowercased: String) -> Bool
-    func displayNameForNostrPubkey(_ pubkeyHex: String) -> String
-
-    // MARK: Favorites bridge
-    /// All favorite relationships, used to bridge a Nostr pubkey back to a
-    /// Noise key on the inbound DM path.
-    func allFavoriteRelationships() -> [FavoritesPersistenceService.FavoriteRelationship]
-
-    // MARK: Presence & key mapping
-    func setGeoNickname(_ nickname: String, forPubkey pubkeyHex: String)
-    /// Records the Nostr pubkey behind a (possibly virtual) peer ID.
-    func registerNostrKeyMapping(_ pubkey: String, for peerID: PeerID)
-    func recordGeoParticipant(pubkeyHex: String)
-
-    // MARK: Inbound public messages
-    func handlePublicMessage(_ message: BitchatMessage)
-    func checkForMentions(_ message: BitchatMessage)
-    func sendHapticFeedback(for message: BitchatMessage)
-    func parseMentions(from content: String) -> [String]
-
-    // MARK: Inbound private (DM) payloads
-    func handlePrivateMessage(
-        _ payload: NoisePayload,
-        senderPubkey: String,
-        convKey: PeerID,
-        id: NostrIdentity,
-        messageTimestamp: Date
-    )
-    func handleDelivered(_ payload: NoisePayload, senderPubkey: String, convKey: PeerID)
-    func handleReadReceipt(_ payload: NoisePayload, senderPubkey: String, convKey: PeerID)
-}
-
-extension ChatViewModel: NostrInboundPipelineContext {
-    // `currentGeohash`, the identity/blocking members, key mapping, and the
-    // inbound message handlers already have witnesses on `ChatViewModel`.
-    // The members below flatten nested service accesses into intent-named calls.
-
-    func hasProcessedNostrEvent(_ eventID: String) -> Bool {
-        deduplicationService.hasProcessedNostrEvent(eventID)
-    }
-
-    func allFavoriteRelationships() -> [FavoritesPersistenceService.FavoriteRelationship] {
-        Array(FavoritesPersistenceService.shared.favorites.values)
-    }
-
-    func recordProcessedNostrEvent(_ eventID: String) {
-        deduplicationService.recordNostrEvent(eventID)
-    }
-
-    func setGeoNickname(_ nickname: String, forPubkey pubkeyHex: String) {
-        locationPresenceStore.setNickname(nickname, for: pubkeyHex)
-    }
-
-    func recordGeoParticipant(pubkeyHex: String) {
-        participantTracker.recordParticipant(pubkeyHex: pubkeyHex)
-    }
-}
-
-/// The inbound Nostr hot path: raw relay events in, chat messages / Noise
-/// payloads out. Pure transformation plus dedup — no relay lifecycle.
-///
-/// Ordering is deliberate and performance-critical: cheap rejects (kind,
-/// dedup lookup) run BEFORE Schnorr signature verification because duplicates
-/// dominate real relay traffic; events are recorded only AFTER verification so
-/// a forged-signature copy can never poison the dedup set; gift-wrap
-/// verification for the account mailbox runs off-main with an atomic
-/// main-actor check-and-record.
-final class NostrInboundPipeline {
-    private weak var context: (any NostrInboundPipelineContext)?
-    private let presence: GeoPresenceTracker
-    private var geoEventLogCount = 0
-
-    init(context: any NostrInboundPipelineContext, presence: GeoPresenceTracker) {
-        self.context = context
-        self.presence = presence
-    }
-
-    @MainActor
-    func subscribeNostrEvent(_ event: NostrEvent) {
-        guard let context else { return }
-        // Cheap rejects (kind, dedup lookup) before Schnorr verification —
-        // duplicates dominate real traffic and must not pay for crypto.
-        // Only verified events are recorded, so a forged-signature copy can
-        // never poison the dedup set and suppress the genuine event.
-        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
-            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue),
-              !context.hasProcessedNostrEvent(event.id)
-        else {
-            return
-        }
-        guard event.isValidSignature() else { return }
-
-        context.recordProcessedNostrEvent(event.id)
-
-        if let gh = context.currentGeohash,
-           let myGeoIdentity = try? context.deriveNostrIdentity(forGeohash: gh),
-           myGeoIdentity.publicKeyHex.lowercased() == event.pubkey.lowercased() {
-            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-            if Date().timeIntervalSince(eventTime) < 15 {
-                return
-            }
-        }
-
-        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
-            let nick = nickTag[1].trimmed
-            context.setGeoNickname(nick, forPubkey: event.pubkey)
-        }
-
-        context.registerNostrKeyMapping(event.pubkey, for: PeerID(nostr_: event.pubkey))
-        context.registerNostrKeyMapping(event.pubkey, for: PeerID(nostr: event.pubkey))
-        context.recordGeoParticipant(pubkeyHex: event.pubkey)
-
-        if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
-            return
-        }
-
-        if GeoPresenceTracker.hasTeleportTag(event) {
-            let key = event.pubkey.lowercased()
-            let isSelf: Bool = {
-                if let gh = context.currentGeohash,
-                   let myIdentity = try? context.deriveNostrIdentity(forGeohash: gh) {
-                    return myIdentity.publicKeyHex.lowercased() == key
-                }
-                return false
-            }()
-            if !isSelf {
-                presence.scheduleMarkPeerTeleported(key, logged: false)
-            }
-        }
-
-        let senderName = context.displayNameForNostrPubkey(event.pubkey)
-        let content = event.content.trimmed
-        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-        let timestamp = min(rawTs, Date())
-        let mentions = context.parseMentions(from: content)
-        let message = BitchatMessage(
-            id: event.id,
-            sender: senderName,
-            content: content,
-            timestamp: timestamp,
-            isRelay: false,
-            senderPeerID: PeerID(nostr: event.pubkey),
-            mentions: mentions.isEmpty ? nil : mentions
-        )
-
-        Task { @MainActor [weak context] in
-            guard let context else { return }
-            let isBlocked = context.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased())
-            context.handlePublicMessage(message)
-            if !isBlocked {
-                context.checkForMentions(message)
-                context.sendHapticFeedback(for: message)
-            }
-        }
-    }
-
-    @MainActor
-    func handleNostrEvent(_ event: NostrEvent) {
-        guard let context else { return }
-        // Cheap rejects (kind, dedup lookup) before Schnorr verification —
-        // duplicates dominate real traffic and must not pay for crypto.
-        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
-            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue)
-        else {
-            return
-        }
-        if context.hasProcessedNostrEvent(event.id) { return }
-        guard event.isValidSignature() else { return }
-        context.recordProcessedNostrEvent(event.id)
-
-        // Sampled: fires for every geo event and floods dev logs in busy geohashes.
-        geoEventLogCount += 1
-        if geoEventLogCount == 1 || geoEventLogCount.isMultiple(of: TransportConfig.nostrInboundEventLogInterval) {
-            SecureLogger.debug("GeoTeleport: recv #\(geoEventLogCount) pub=\(event.pubkey.prefix(8))… tags=\(event.tags.map { "[" + $0.joined(separator: ",") + "]" }.joined(separator: ","))", category: .session)
-        }
-
-        if context.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
-            return
-        }
-
-        let hasTeleportTag = GeoPresenceTracker.hasTeleportTag(event)
-
-        let isSelf: Bool = {
-            if let gh = context.currentGeohash,
-               let my = try? context.deriveNostrIdentity(forGeohash: gh) {
-                return my.publicKeyHex.lowercased() == event.pubkey.lowercased()
-            }
-            return false
-        }()
-
-        if hasTeleportTag, !isSelf {
-            presence.scheduleMarkPeerTeleported(event.pubkey.lowercased(), logged: true)
-        }
-
-        context.recordGeoParticipant(pubkeyHex: event.pubkey)
-
-        if isSelf {
-            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-            if Date().timeIntervalSince(eventTime) < 15 {
-                return
-            }
-        }
-
-        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
-            context.setGeoNickname(nickTag[1].trimmed, forPubkey: event.pubkey)
-        }
-
-        context.registerNostrKeyMapping(event.pubkey, for: PeerID(nostr_: event.pubkey))
-        context.registerNostrKeyMapping(event.pubkey, for: PeerID(nostr: event.pubkey))
-
-        if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
-            return
-        }
-
-        let senderName = context.displayNameForNostrPubkey(event.pubkey)
-        let content = event.content
-
-        if let teleTag = event.tags.first(where: { $0.first == "t" }),
-           teleTag.count >= 2,
-           teleTag[1] == "teleport",
-           content.trimmed.isEmpty {
-            return
-        }
-
-        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-        let mentions = context.parseMentions(from: content)
-        let message = BitchatMessage(
-            id: event.id,
-            sender: senderName,
-            content: content,
-            timestamp: min(rawTs, Date()),
-            isRelay: false,
-            senderPeerID: PeerID(nostr: event.pubkey),
-            mentions: mentions.isEmpty ? nil : mentions
-        )
-
-        Task { @MainActor [weak context] in
-            guard let context else { return }
-            context.handlePublicMessage(message)
-            context.checkForMentions(message)
-            context.sendHapticFeedback(for: message)
-        }
-    }
-
-    @MainActor
-    func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        guard let context else { return }
-        // Dedup lookup before Schnorr verification; record only after it passes.
-        guard !context.hasProcessedNostrEvent(giftWrap.id) else { return }
-        guard giftWrap.isValidSignature() else { return }
-        context.recordProcessedNostrEvent(giftWrap.id)
-
-        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
-            giftWrap: giftWrap,
-            recipientIdentity: id
-        ),
-        let packet = Self.decodeEmbeddedBitChatPacket(from: content),
-        packet.type == MessageType.noiseEncrypted.rawValue,
-        let noisePayload = NoisePayload.decode(packet.payload)
-        else {
-            return
-        }
-
-        let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
-        let convKey = PeerID(nostr_: senderPubkey)
-        context.registerNostrKeyMapping(senderPubkey, for: convKey)
-
-        switch noisePayload.type {
-        case .privateMessage:
-            context.handlePrivateMessage(
-                noisePayload,
-                senderPubkey: senderPubkey,
-                convKey: convKey,
-                id: id,
-                messageTimestamp: messageTimestamp
-            )
-        case .delivered:
-            context.handleDelivered(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
-        case .readReceipt:
-            context.handleReadReceipt(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
-        case .verifyChallenge, .verifyResponse:
-            break
-        }
-    }
-
-    @MainActor
-    func handleGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        guard let context else { return }
-        // Dedup lookup before Schnorr verification; record only after it passes.
-        if context.hasProcessedNostrEvent(giftWrap.id) {
-            return
-        }
-        guard giftWrap.isValidSignature() else { return }
-        context.recordProcessedNostrEvent(giftWrap.id)
-
-        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
-            giftWrap: giftWrap,
-            recipientIdentity: id
-        ) else {
-            SecureLogger.warning("GeoDM: failed decrypt giftWrap id=\(giftWrap.id.prefix(8))…", category: .session)
-            return
-        }
-
-        SecureLogger.debug(
-            "GeoDM: decrypted gift-wrap id=\(giftWrap.id.prefix(16))... from=\(senderPubkey.prefix(8))...",
-            category: .session
-        )
-
-        guard let packet = Self.decodeEmbeddedBitChatPacket(from: content),
-              packet.type == MessageType.noiseEncrypted.rawValue,
-              let payload = NoisePayload.decode(packet.payload)
-        else {
-            return
-        }
-
-        let convKey = PeerID(nostr_: senderPubkey)
-        context.registerNostrKeyMapping(senderPubkey, for: convKey)
-
-        switch payload.type {
-        case .privateMessage:
-            let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
-            context.handlePrivateMessage(
-                payload,
-                senderPubkey: senderPubkey,
-                convKey: convKey,
-                id: id,
-                messageTimestamp: messageTimestamp
-            )
-        case .delivered:
-            context.handleDelivered(payload, senderPubkey: senderPubkey, convKey: convKey)
-        case .readReceipt:
-            context.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: convKey)
-        case .verifyChallenge, .verifyResponse:
-            break
-        }
-    }
-
-    @MainActor
-    func handleNostrMessage(_ giftWrap: NostrEvent) {
-        guard let context else { return }
-        // Cheap dedup pre-check only; Schnorr verification runs off-main in
-        // processNostrMessage, which then does the authoritative
-        // check-and-record. Recording stays after verification so a
-        // forged-signature copy can never poison the dedup set and suppress
-        // the genuine event.
-        if context.hasProcessedNostrEvent(giftWrap.id) { return }
-
-        Task.detached(priority: .userInitiated) { [weak self] in
-            await self?.processNostrMessage(giftWrap)
-        }
-    }
-
-    func processNostrMessage(_ giftWrap: NostrEvent) async {
-        guard giftWrap.isValidSignature() else { return }
-        guard let context else { return }
-        // Authoritative check-and-record, atomic on the main actor so two
-        // concurrent detached tasks can't both process the same event.
-        let alreadyProcessed: Bool = await MainActor.run {
-            if context.hasProcessedNostrEvent(giftWrap.id) { return true }
-            context.recordProcessedNostrEvent(giftWrap.id)
-            return false
-        }
-        if alreadyProcessed { return }
-        let currentIdentity: NostrIdentity? = await MainActor.run {
-            context.currentNostrIdentity()
-        }
-        guard let currentIdentity else { return }
-
-        do {
-            let (content, senderPubkey, rumorTimestamp) = try NostrProtocol.decryptPrivateMessage(
-                giftWrap: giftWrap,
-                recipientIdentity: currentIdentity
-            )
-
-            if content.hasPrefix("verify:") {
-                return
-            }
-
-            if content.hasPrefix("bitchat1:") {
-                let packet: BitchatPacket? = await MainActor.run {
-                    Self.decodeEmbeddedBitChatPacket(from: content)
-                }
-                guard let packet else {
-                    SecureLogger.error("Failed to decode embedded BitChat packet from Nostr DM", category: .session)
-                    return
-                }
-
-                let actualSenderNoiseKey: Data? = await MainActor.run {
-                    self.findNoiseKey(for: senderPubkey)
-                }
-                let targetPeerID = PeerID(str: actualSenderNoiseKey?.hexEncodedString()) ?? PeerID(nostr_: senderPubkey)
-
-                if packet.type == MessageType.noiseEncrypted.rawValue,
-                   let payload = NoisePayload.decode(packet.payload) {
-                    let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTimestamp))
-                    await MainActor.run {
-                        context.registerNostrKeyMapping(senderPubkey, for: targetPeerID)
-
-                        switch payload.type {
-                        case .privateMessage:
-                            context.handlePrivateMessage(
-                                payload,
-                                senderPubkey: senderPubkey,
-                                convKey: targetPeerID,
-                                id: currentIdentity,
-                                messageTimestamp: messageTimestamp
-                            )
-                        case .delivered:
-                            context.handleDelivered(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
-                        case .readReceipt:
-                            context.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
-                        case .verifyChallenge, .verifyResponse:
-                            break
-                        }
-                    }
-                }
-            } else {
-                SecureLogger.debug("Ignoring non-embedded Nostr DM content", category: .session)
-            }
-        } catch {
-            SecureLogger.error("Failed to decrypt Nostr message: \(error)", category: .session)
-        }
-    }
-
-    /// Resolves the Noise static key behind a Nostr pubkey via the favorites
-    /// store. Lives here because the inbound DM path needs it per message;
-    /// the favorites glue in `ChatNostrCoordinator` delegates to it.
-    @MainActor
-    func findNoiseKey(for nostrPubkey: String) -> Data? {
-        guard let context else { return nil }
-        let favorites = context.allFavoriteRelationships()
-        var npubToMatch = nostrPubkey
-
-        if !nostrPubkey.hasPrefix("npub") {
-            if let pubkeyData = Data(hexString: nostrPubkey),
-               let encoded = try? Bech32.encode(hrp: "npub", data: pubkeyData) {
-                npubToMatch = encoded
-            } else {
-                SecureLogger.warning(
-                    "⚠️ Invalid hex public key format or encoding failed: \(nostrPubkey.prefix(16))...",
-                    category: .session
-                )
-            }
-        }
-
-        for relationship in favorites {
-            if let storedNostrKey = relationship.peerNostrPublicKey {
-                if storedNostrKey == npubToMatch {
-                    return relationship.peerNoisePublicKey
-                }
-                if !storedNostrKey.hasPrefix("npub") && storedNostrKey == nostrPubkey {
-                    SecureLogger.debug("✅ Found Noise key for Nostr sender (hex match)", category: .session)
-                    return relationship.peerNoisePublicKey
-                }
-            }
-        }
-
-        SecureLogger.debug(
-            "⚠️ No matching Noise key found for Nostr pubkey: \(nostrPubkey.prefix(16))... (tried npub: \(npubToMatch.prefix(16))...)",
-            category: .session
-        )
-        return nil
-    }
-}
-
-private extension NostrInboundPipeline {
-    @MainActor
-    static func decodeEmbeddedBitChatPacket(from content: String) -> BitchatPacket? {
-        guard content.hasPrefix("bitchat1:") else { return nil }
-        let encoded = String(content.dropFirst("bitchat1:".count))
-        let maxBytes = FileTransferLimits.maxFramedFileBytes
-        let maxEncoded = ((maxBytes + 2) / 3) * 4
-        guard encoded.count <= maxEncoded else { return nil }
-        guard let packetData = Base64URLCoding.decode(encoded),
-              packetData.count <= maxBytes
-        else {
-            return nil
-        }
-        return BitchatPacket.from(packetData)
-    }
-}

bitchat/ViewModels/PublicMessagePipeline.swift

@@ -2,11 +2,7 @@
 // PublicMessagePipeline.swift
 // bitchat
 //
-// Batches visible-channel public messages before committing them to the
-// ConversationStore: the deliberate ~80 ms UI flush cadence survives the
-// store cutover, while ordering, dedup, and caps live in the store itself
-// (its timestamp-ordered insert replaced this pipeline's late-insert
-// threshold positioning; see docs/CONVERSATION-STORE-DESIGN.md).
+// Handles batching and deduplication of public chat messages before surfacing them to the UI.
 //
 
 import BitFoundation
@@ -14,13 +10,12 @@ import Foundation
 
 @MainActor
 protocol PublicMessagePipelineDelegate: AnyObject {
+    func pipelineCurrentMessages(_ pipeline: PublicMessagePipeline) -> [BitchatMessage]
+    func pipeline(_ pipeline: PublicMessagePipeline, setMessages messages: [BitchatMessage])
     func pipeline(_ pipeline: PublicMessagePipeline, normalizeContent content: String) -> String
     func pipeline(_ pipeline: PublicMessagePipeline, contentTimestampForKey key: String) -> Date?
     func pipeline(_ pipeline: PublicMessagePipeline, recordContentKey key: String, timestamp: Date)
-    /// Commits a batched message to its conversation in the store.
-    /// Returns `false` when the message was already present (ID dedup).
-    @discardableResult
-    func pipeline(_ pipeline: PublicMessagePipeline, commit message: BitchatMessage, to conversationID: ConversationID) -> Bool
+    func pipelineTrimMessages(_ pipeline: PublicMessagePipeline)
     func pipelinePrewarmMessage(_ pipeline: PublicMessagePipeline, message: BitchatMessage)
     func pipelineSetBatchingState(_ pipeline: PublicMessagePipeline, isBatching: Bool)
 }
@@ -29,13 +24,14 @@ protocol PublicMessagePipelineDelegate: AnyObject {
 final class PublicMessagePipeline {
     weak var delegate: PublicMessagePipelineDelegate?
 
-    private var buffer: [(message: BitchatMessage, conversationID: ConversationID)] = []
+    private var buffer: [BitchatMessage] = []
     private var timer: Timer?
     private let baseFlushInterval: TimeInterval
     private var dynamicFlushInterval: TimeInterval
     private var recentBatchSizes: [Int] = []
     private let maxRecentBatchSamples: Int
     private let dedupWindow: TimeInterval
+    private var activeChannel: ChannelID = .mesh
 
     init(
         baseFlushInterval: TimeInterval = TransportConfig.basePublicFlushInterval,
@@ -52,17 +48,25 @@ final class PublicMessagePipeline {
         timer?.invalidate()
     }
 
-    /// Buffers a message destined for `conversationID`; the next batched
-    /// flush commits it to the store. Each entry carries its destination so
-    /// a channel switch mid-batch can never misroute buffered messages.
-    func enqueue(_ message: BitchatMessage, to conversationID: ConversationID) {
-        buffer.append((message, conversationID))
+    func updateActiveChannel(_ channel: ChannelID) {
+        activeChannel = channel
+    }
+
+    func enqueue(_ message: BitchatMessage) {
+        buffer.append(message)
         scheduleFlush()
     }
 
     func flushIfNeeded() {
         flushBuffer()
     }
+
+    func reset() {
+        timer?.invalidate()
+        timer = nil
+        buffer.removeAll(keepingCapacity: false)
+    }
+
 }
 
 private extension PublicMessagePipeline {
@@ -87,38 +91,57 @@ private extension PublicMessagePipeline {
 
         delegate.pipelineSetBatchingState(self, isBatching: true)
 
-        // Content-window dedup against recorded keys and within the batch;
-        // ID dedup happens in the store at commit time.
-        var pending: [(message: BitchatMessage, conversationID: ConversationID, contentKey: String)] = []
+        var existingIDs = Set(delegate.pipelineCurrentMessages(self).map { $0.id })
+        var pending: [(message: BitchatMessage, contentKey: String)] = []
         var batchContentLatest: [String: Date] = [:]
 
-        for item in buffer {
-            let contentKey = delegate.pipeline(self, normalizeContent: item.message.content)
+        for message in buffer {
+            if existingIDs.contains(message.id) { continue }
+            let contentKey = delegate.pipeline(self, normalizeContent: message.content)
             if let ts = delegate.pipeline(self, contentTimestampForKey: contentKey),
-               abs(ts.timeIntervalSince(item.message.timestamp)) < dedupWindow {
+               abs(ts.timeIntervalSince(message.timestamp)) < dedupWindow {
                 continue
             }
             if let ts = batchContentLatest[contentKey],
-               abs(ts.timeIntervalSince(item.message.timestamp)) < dedupWindow {
+               abs(ts.timeIntervalSince(message.timestamp)) < dedupWindow {
                 continue
             }
-            pending.append((item.message, item.conversationID, contentKey))
-            batchContentLatest[contentKey] = item.message.timestamp
+            existingIDs.insert(message.id)
+            pending.append((message, contentKey))
+            batchContentLatest[contentKey] = message.timestamp
         }
 
         buffer.removeAll(keepingCapacity: true)
         guard !pending.isEmpty else {
             delegate.pipelineSetBatchingState(self, isBatching: false)
+            if !buffer.isEmpty { scheduleFlush() }
             return
         }
 
         pending.sort { $0.message.timestamp < $1.message.timestamp }
 
+        var messages = delegate.pipelineCurrentMessages(self)
+        let threshold = lateInsertThreshold(for: activeChannel)
+        let lastTimestamp = messages.last?.timestamp ?? .distantPast
+
         for item in pending {
-            guard delegate.pipeline(self, commit: item.message, to: item.conversationID) else { continue }
-            delegate.pipeline(self, recordContentKey: item.contentKey, timestamp: item.message.timestamp)
+            let message = item.message
+            if threshold == 0 || message.timestamp < lastTimestamp.addingTimeInterval(-threshold) {
+                let index = insertionIndex(for: message.timestamp, in: messages)
+                if index >= messages.count {
+                    messages.append(message)
+                } else {
+                    messages.insert(message, at: index)
+                }
+            } else {
+                messages.append(message)
+            }
+            delegate.pipeline(self, recordContentKey: item.contentKey, timestamp: message.timestamp)
         }
 
+        delegate.pipeline(self, setMessages: messages)
+        delegate.pipelineTrimMessages(self)
+
         updateFlushInterval(withBatchSize: pending.count)
 
         for item in pending {
@@ -142,4 +165,27 @@ private extension PublicMessagePipeline {
             : Double(recentBatchSizes.reduce(0, +)) / Double(recentBatchSizes.count)
         dynamicFlushInterval = avg > 100.0 ? 0.12 : baseFlushInterval
     }
+
+    func lateInsertThreshold(for channel: ChannelID) -> TimeInterval {
+        switch channel {
+        case .mesh:
+            return TransportConfig.uiLateInsertThreshold
+        case .location:
+            return TransportConfig.uiLateInsertThresholdGeo
+        }
+    }
+
+    func insertionIndex(for timestamp: Date, in messages: [BitchatMessage]) -> Int {
+        var low = 0
+        var high = messages.count
+        while low < high {
+            let mid = (low + high) / 2
+            if messages[mid].timestamp < timestamp {
+                low = mid + 1
+            } else {
+                high = mid
+            }
+        }
+        return low
+    }
 }

bitchat/ViewModels/PublicTimelineStore.swift

@@ -0,0 +1,125 @@
+//
+// PublicTimelineStore.swift
+// bitchat
+//
+// Maintains mesh and geohash public timelines with simple caps and helpers.
+//
+
+import BitFoundation
+import Foundation
+
+struct PublicTimelineStore {
+    private var meshTimeline: [BitchatMessage] = []
+    private var geohashTimelines: [String: [BitchatMessage]] = [:]
+    private var pendingGeohashSystemMessages: [String] = []
+
+    private let meshCap: Int
+    private let geohashCap: Int
+
+    init(meshCap: Int, geohashCap: Int) {
+        self.meshCap = meshCap
+        self.geohashCap = geohashCap
+    }
+
+    mutating func append(_ message: BitchatMessage, to channel: ChannelID) {
+        switch channel {
+        case .mesh:
+            guard !meshTimeline.contains(where: { $0.id == message.id }) else { return }
+            meshTimeline.append(message)
+            trimMeshTimelineIfNeeded()
+        case .location(let channel):
+            append(message, toGeohash: channel.geohash)
+        }
+    }
+
+    mutating func append(_ message: BitchatMessage, toGeohash geohash: String) {
+        var timeline = geohashTimelines[geohash] ?? []
+        guard !timeline.contains(where: { $0.id == message.id }) else { return }
+        timeline.append(message)
+        trimGeohashTimelineIfNeeded(&timeline)
+        geohashTimelines[geohash] = timeline
+    }
+
+    /// Append message if absent, returning true when stored.
+    mutating func appendIfAbsent(_ message: BitchatMessage, toGeohash geohash: String) -> Bool {
+        var timeline = geohashTimelines[geohash] ?? []
+        guard !timeline.contains(where: { $0.id == message.id }) else { return false }
+        timeline.append(message)
+        trimGeohashTimelineIfNeeded(&timeline)
+        geohashTimelines[geohash] = timeline
+        return true
+    }
+
+    mutating func messages(for channel: ChannelID) -> [BitchatMessage] {
+        switch channel {
+        case .mesh:
+            return meshTimeline
+        case .location(let channel):
+            let cleaned = geohashTimelines[channel.geohash]?.cleanedAndDeduped() ?? []
+            geohashTimelines[channel.geohash] = cleaned
+            return cleaned
+        }
+    }
+
+    mutating func clear(channel: ChannelID) {
+        switch channel {
+        case .mesh:
+            meshTimeline.removeAll()
+        case .location(let channel):
+            geohashTimelines[channel.geohash] = []
+        }
+    }
+
+    @discardableResult
+    mutating func removeMessage(withID id: String) -> BitchatMessage? {
+        if let index = meshTimeline.firstIndex(where: { $0.id == id }) {
+            return meshTimeline.remove(at: index)
+        }
+
+        for key in Array(geohashTimelines.keys) {
+            var timeline = geohashTimelines[key] ?? []
+            if let index = timeline.firstIndex(where: { $0.id == id }) {
+                let removed = timeline.remove(at: index)
+                geohashTimelines[key] = timeline.isEmpty ? nil : timeline
+                return removed
+            }
+        }
+
+        return nil
+    }
+
+    mutating func removeMessages(in geohash: String, where predicate: (BitchatMessage) -> Bool) {
+        var timeline = geohashTimelines[geohash] ?? []
+        timeline.removeAll(where: predicate)
+        geohashTimelines[geohash] = timeline.isEmpty ? nil : timeline
+    }
+
+    mutating func mutateGeohash(_ geohash: String, _ transform: (inout [BitchatMessage]) -> Void) {
+        var timeline = geohashTimelines[geohash] ?? []
+        transform(&timeline)
+        geohashTimelines[geohash] = timeline.isEmpty ? nil : timeline
+    }
+
+    mutating func queueGeohashSystemMessage(_ content: String) {
+        pendingGeohashSystemMessages.append(content)
+    }
+
+    mutating func drainPendingGeohashSystemMessages() -> [String] {
+        defer { pendingGeohashSystemMessages.removeAll(keepingCapacity: false) }
+        return pendingGeohashSystemMessages
+    }
+
+    func geohashKeys() -> [String] {
+        Array(geohashTimelines.keys)
+    }
+
+    private mutating func trimMeshTimelineIfNeeded() {
+        guard meshTimeline.count > meshCap else { return }
+        meshTimeline = Array(meshTimeline.suffix(meshCap))
+    }
+
+    private func trimGeohashTimelineIfNeeded(_ timeline: inout [BitchatMessage]) {
+        guard timeline.count > geohashCap else { return }
+        timeline = Array(timeline.suffix(geohashCap))
+    }
+}

bitchat/Views/AppInfoView.swift

@@ -2,24 +2,24 @@ import SwiftUI
 
 struct AppInfoView: View {
     @Environment(\.dismiss) var dismiss
-    @ThemedPalette private var palette
-    @AppStorage(AppTheme.storageKey) private var appThemeRawValue = AppTheme.matrix.rawValue
-
-    private var selectedTheme: AppTheme {
-        AppTheme(rawValue: appThemeRawValue) ?? .matrix
+    @Environment(\.colorScheme) var colorScheme
+    
+    private var backgroundColor: Color {
+        colorScheme == .dark ? Color.black : Color.white
+    }
+    
+    private var textColor: Color {
+        colorScheme == .dark ? Color.green : Color(red: 0, green: 0.5, blue: 0)
+    }
+    
+    private var secondaryTextColor: Color {
+        colorScheme == .dark ? Color.green.opacity(0.8) : Color(red: 0, green: 0.5, blue: 0).opacity(0.8)
     }
-
-    private var backgroundColor: Color { palette.background }
-
-    private var textColor: Color { palette.primary }
-
-    private var secondaryTextColor: Color { palette.secondary }
     
     // MARK: - Constants
     private enum Strings {
         static let appName: LocalizedStringKey = "app_info.app_name"
         static let tagline: LocalizedStringKey = "app_info.tagline"
-        static let appearanceTitle: LocalizedStringKey = "app_info.appearance.title"
 
         enum Features {
             static let title: LocalizedStringKey = "app_info.features.title"
@@ -101,12 +101,12 @@ struct AppInfoView: View {
                 .foregroundColor(textColor)
                 .padding()
             }
-            .themedSurface(opacity: 0.95)
-
+            .background(backgroundColor.opacity(0.95))
+            
             ScrollView {
                 infoContent
             }
-            .themedSheetBackground()
+            .background(backgroundColor)
         }
         .frame(width: 600, height: 700)
         #else
@@ -114,13 +114,13 @@ struct AppInfoView: View {
             ScrollView {
                 infoContent
             }
-            .themedSheetBackground()
+            .background(backgroundColor)
             .navigationBarTitleDisplayMode(.inline)
             .toolbar {
                 ToolbarItem(placement: .navigationBarTrailing) {
                     Button(action: { dismiss() }) {
                         Image(systemName: "xmark")
-                            .bitchatFont(size: 13, weight: .semibold)
+                            .font(.bitchatSystem(size: 13, weight: .semibold, design: .monospaced))
                             .foregroundColor(textColor)
                             .frame(width: 32, height: 32)
                     }
@@ -138,40 +138,16 @@ struct AppInfoView: View {
             // Header
             VStack(alignment: .center, spacing: 8) {
                 Text(Strings.appName)
-                    .bitchatFont(size: 32, weight: .bold)
+                    .font(.bitchatSystem(size: 32, weight: .bold, design: .monospaced))
                     .foregroundColor(textColor)
                 
                 Text(Strings.tagline)
-                    .bitchatFont(size: 16)
+                    .font(.bitchatSystem(size: 16, design: .monospaced))
                     .foregroundColor(secondaryTextColor)
             }
             .frame(maxWidth: .infinity)
             .padding(.vertical)
-
-            // Appearance — single row: label left, theme chips right
-            HStack(spacing: 12) {
-                SectionHeader(Strings.appearanceTitle)
-                Spacer()
-                ForEach(AppTheme.allCases) { theme in
-                    Button {
-                        appThemeRawValue = theme.rawValue
-                    } label: {
-                        Text(theme.displayNameKey)
-                            .bitchatFont(size: 13, weight: selectedTheme == theme ? .semibold : .regular)
-                            .foregroundColor(selectedTheme == theme ? palette.accent : secondaryTextColor)
-                            .padding(.horizontal, 10)
-                            .padding(.vertical, 6)
-                            .background(
-                                RoundedRectangle(cornerRadius: 8, style: .continuous)
-                                    .fill(selectedTheme == theme ? palette.accent.opacity(0.15) : Color.clear)
-                            )
-                            .contentShape(Rectangle())
-                    }
-                    .buttonStyle(.plain)
-                    .accessibilityAddTraits(selectedTheme == theme ? .isSelected : [])
-                }
-            }
-
+            
             // How to Use
             VStack(alignment: .leading, spacing: 16) {
                 SectionHeader(Strings.HowToUse.title)
@@ -181,7 +157,7 @@ struct AppInfoView: View {
                         Text(instruction)
                     }
                 }
-                .bitchatFont(size: 14)
+                .font(.bitchatSystem(size: 14, design: .monospaced))
                 .foregroundColor(textColor)
             }
 
@@ -225,17 +201,19 @@ struct AppInfoFeatureInfo {
 
 struct SectionHeader: View {
     let title: LocalizedStringKey
-    @ThemedPalette private var palette
-
-    private var textColor: Color { palette.primary }
-
+    @Environment(\.colorScheme) var colorScheme
+    
+    private var textColor: Color {
+        colorScheme == .dark ? Color.green : Color(red: 0, green: 0.5, blue: 0)
+    }
+    
     init(_ title: LocalizedStringKey) {
         self.title = title
     }
     
     var body: some View {
         Text(title)
-            .bitchatFont(size: 16, weight: .bold)
+            .font(.bitchatSystem(size: 16, weight: .bold, design: .monospaced))
             .foregroundColor(textColor)
             .padding(.top, 8)
     }
@@ -243,12 +221,16 @@ struct SectionHeader: View {
 
 struct FeatureRow: View {
     let info: AppInfoFeatureInfo
-    @ThemedPalette private var palette
-
-    private var textColor: Color { palette.primary }
-
-    private var secondaryTextColor: Color { palette.secondary }
-
+    @Environment(\.colorScheme) var colorScheme
+    
+    private var textColor: Color {
+        colorScheme == .dark ? Color.green : Color(red: 0, green: 0.5, blue: 0)
+    }
+    
+    private var secondaryTextColor: Color {
+        colorScheme == .dark ? Color.green.opacity(0.8) : Color(red: 0, green: 0.5, blue: 0).opacity(0.8)
+    }
+    
     var body: some View {
         HStack(alignment: .top, spacing: 12) {
             Image(systemName: info.icon)
@@ -258,11 +240,11 @@ struct FeatureRow: View {
             
             VStack(alignment: .leading, spacing: 4) {
                 Text(info.title)
-                    .bitchatFont(size: 14, weight: .semibold)
+                    .font(.bitchatSystem(size: 14, weight: .semibold, design: .monospaced))
                     .foregroundColor(textColor)
                 
                 Text(info.description)
-                    .bitchatFont(size: 12)
+                    .font(.bitchatSystem(size: 12, design: .monospaced))
                     .foregroundColor(secondaryTextColor)
                     .fixedSize(horizontal: false, vertical: true)
             }

bitchat/Views/Components/CommandSuggestionsView.swift

@@ -10,10 +10,13 @@ import SwiftUI
 struct CommandSuggestionsView: View {
     @EnvironmentObject private var privateConversationModel: PrivateConversationModel
     @EnvironmentObject private var locationChannelsModel: LocationChannelsModel
-    @ThemedPalette private var palette
-
+    
     @Binding var messageText: String
-
+    
+    let textColor: Color
+    let backgroundColor: Color
+    let secondaryTextColor: Color
+    
     private var filteredCommands: [CommandInfo] {
         guard messageText.hasPrefix("/") && !messageText.contains(" ") else { return [] }
         let isGeoPublic = locationChannelsModel.selectedChannel.isLocation
@@ -24,43 +27,42 @@ struct CommandSuggestionsView: View {
     }
     
     var body: some View {
-        // Render nothing when there are no matches: a zero-height view would
-        // still receive the composer VStack's spacing and push the input row
-        // off-center.
-        if !filteredCommands.isEmpty {
-            VStack(alignment: .leading, spacing: 0) {
-                ForEach(filteredCommands) { command in
-                    Button {
-                        messageText = command.alias + " "
-                    } label: {
-                        buttonRow(for: command)
-                    }
-                    .buttonStyle(.plain)
-                    .background(Color.gray.opacity(0.1))
+        VStack(alignment: .leading, spacing: 0) {
+            ForEach(filteredCommands) { command in
+                Button {
+                    messageText = command.alias + " "
+                } label: {
+                    buttonRow(for: command)
                 }
+                .buttonStyle(.plain)
+                .background(Color.gray.opacity(0.1))
             }
-            .themedOverlayPanel()
         }
+        .background(backgroundColor)
+        .overlay(
+            RoundedRectangle(cornerRadius: 4)
+                .stroke(secondaryTextColor.opacity(0.3), lineWidth: 1)
+        )
     }
     
     private func buttonRow(for command: CommandInfo) -> some View {
         HStack {
             Text(command.alias)
-                .bitchatFont(size: 11)
-                .foregroundColor(palette.primary)
+                .font(.bitchatSystem(size: 11, design: .monospaced))
+                .foregroundColor(textColor)
                 .fontWeight(.medium)
-
+            
             if let placeholder = command.placeholder {
                 Text(placeholder)
-                    .bitchatFont(size: 10)
-                    .foregroundColor(palette.secondary.opacity(0.8))
+                    .font(.bitchatSystem(size: 10, design: .monospaced))
+                    .foregroundColor(secondaryTextColor.opacity(0.8))
             }
 
             Spacer()
-
+            
             Text(command.description)
-                .bitchatFont(size: 10)
-                .foregroundColor(palette.secondary)
+                .font(.bitchatSystem(size: 10, design: .monospaced))
+                .foregroundColor(secondaryTextColor)
         }
         .padding(.horizontal, 12)
         .padding(.vertical, 3)
@@ -79,11 +81,16 @@ struct CommandSuggestionsView: View {
     )
     let privateConversationModel = PrivateConversationModel(
         chatViewModel: viewModel,
-        conversations: viewModel.conversations
+        conversationStore: viewModel.conversationStore
     )
     let locationChannelsModel = LocationChannelsModel()
     
-    CommandSuggestionsView(messageText: $messageText)
-        .environmentObject(privateConversationModel)
-        .environmentObject(locationChannelsModel)
+    CommandSuggestionsView(
+        messageText: $messageText,
+        textColor: .green,
+        backgroundColor: .primary,
+        secondaryTextColor: .secondary
+    )
+    .environmentObject(privateConversationModel)
+    .environmentObject(locationChannelsModel)
 }

bitchat/Views/Components/DeliveryStatusView.swift

@@ -10,14 +10,18 @@ import SwiftUI
 import BitFoundation
 
 struct DeliveryStatusView: View {
-    @ThemedPalette private var palette
+    @Environment(\.colorScheme) private var colorScheme
     let status: DeliveryStatus
 
     // MARK: - Computed Properties
-
-    private var textColor: Color { palette.primary }
-
-    private var secondaryTextColor: Color { palette.secondary }
+    
+    private var textColor: Color {
+        colorScheme == .dark ? Color.green : Color(red: 0, green: 0.5, blue: 0)
+    }
+    
+    private var secondaryTextColor: Color {
+        colorScheme == .dark ? Color.green.opacity(0.8) : Color(red: 0, green: 0.5, blue: 0).opacity(0.8)
+    }
 
     private enum Strings {
         static func delivered(to nickname: String) -> String {
@@ -85,7 +89,7 @@ struct DeliveryStatusView: View {
                 Image(systemName: "checkmark")
                     .font(.bitchatSystem(size: 10, weight: .bold))
             }
-            .foregroundColor(palette.accentBlue)
+            .foregroundColor(Color(red: 0.0, green: 0.478, blue: 1.0))  // Bright blue
             .help(Strings.read(by: nickname))
             
         case .failed(let reason):
@@ -99,7 +103,7 @@ struct DeliveryStatusView: View {
                 Image(systemName: "checkmark")
                     .font(.bitchatSystem(size: 10))
                 Text(verbatim: "\(reached)/\(total)")
-                    .bitchatFont(size: 10)
+                    .font(.bitchatSystem(size: 10, design: .monospaced))
             }
             .foregroundColor(secondaryTextColor.opacity(0.6))
             .help(Strings.deliveredToMembers(reached, total))

bitchat/Views/Components/PaymentChipView.swift

@@ -11,7 +11,6 @@ import SwiftUI
 struct PaymentChipView: View {
     @Environment(\.colorScheme) private var colorScheme
     @Environment(\.openURL) private var openURL
-    @ThemedPalette private var palette
     
     enum PaymentType {
         case cashu(String)
@@ -55,7 +54,9 @@ struct PaymentChipView: View {
     
     let paymentType: PaymentType
     
-    private var fgColor: Color { palette.primary }
+    private var fgColor: Color {
+        colorScheme == .dark ? Color.green : Color(red: 0, green: 0.5, blue: 0)
+    }
     private var bgColor: Color {
         colorScheme == .dark ? Color.gray.opacity(0.18) : Color.gray.opacity(0.12)
     }
@@ -72,7 +73,7 @@ struct PaymentChipView: View {
             HStack(spacing: 6) {
                 Text(paymentType.emoji)
                 Text(paymentType.label)
-                    .bitchatFont(size: 12, weight: .semibold)
+                    .font(.bitchatSystem(size: 12, weight: .semibold, design: .monospaced))
             }
             .padding(.vertical, 6)
             .padding(.horizontal, 12)

bitchat/Views/Components/TextMessageView.swift

@@ -11,25 +11,11 @@ import BitFoundation
 
 struct TextMessageView: View {
     @Environment(\.colorScheme) private var colorScheme: ColorScheme
-    @Environment(\.appTheme) private var theme
     @EnvironmentObject private var conversationUIModel: ConversationUIModel
-
+    
     let message: BitchatMessage
-    /// Value snapshot of the message's mutable delivery status, captured at
-    /// construction. `BitchatMessage` is a reference type mutated in place by
-    /// `ConversationStore`, and SwiftUI compares reference-typed view fields
-    /// by identity — so a status-only change (e.g. delivered → read) on the
-    /// SAME instance would otherwise compare "unchanged" and this row's body
-    /// would be skipped even though the parent list re-rendered. Snapshotting
-    /// the enum makes the change visible to SwiftUI's structural diff.
-    private let deliveryStatus: DeliveryStatus?
     @State private var expandedMessageIDs: Set<String> = []
-
-    init(message: BitchatMessage) {
-        self.message = message
-        self.deliveryStatus = message.deliveryStatus
-    }
-
+    
     var body: some View {
         VStack(alignment: .leading, spacing: 0) {
             // Precompute heavy token scans once per row
@@ -38,14 +24,14 @@ struct TextMessageView: View {
             HStack(alignment: .top, spacing: 0) {
                 let isLong = (message.content.count > TransportConfig.uiLongMessageLengthThreshold || message.content.hasVeryLongToken(threshold: TransportConfig.uiVeryLongTokenThreshold)) && cashuLinks.isEmpty
                 let isExpanded = expandedMessageIDs.contains(message.id)
-                Text(conversationUIModel.formatMessage(message, colorScheme: colorScheme, theme: theme))
+                Text(conversationUIModel.formatMessage(message, colorScheme: colorScheme))
                     .fixedSize(horizontal: false, vertical: true)
                     .lineLimit(isLong && !isExpanded ? TransportConfig.uiLongMessageLineLimit : nil)
                     .frame(maxWidth: .infinity, alignment: .leading)
                 
                 // Delivery status indicator for private messages
                 if message.isPrivate && conversationUIModel.isSentByCurrentUser(message),
-                   let status = deliveryStatus {
+                   let status = message.deliveryStatus {
                     DeliveryStatusView(status: status)
                         .padding(.leading, 4)
                 }
@@ -59,7 +45,7 @@ struct TextMessageView: View {
                     if isExpanded { expandedMessageIDs.remove(message.id) }
                     else { expandedMessageIDs.insert(message.id) }
                 }
-                .bitchatFont(size: 11, weight: .medium)
+                .font(.bitchatSystem(size: 11, weight: .medium, design: .monospaced))
                 .foregroundColor(Color.blue)
                 .padding(.top, 4)
             }
@@ -81,10 +67,6 @@ struct TextMessageView: View {
     }
 }
 
-// Wrapped in #if DEBUG because the preview depends on _PreviewHelpers
-// (PreviewKeychainManager, BitchatMessage.preview), a development asset
-// excluded from archive builds.
-#if DEBUG
 #Preview {
     let keychain = PreviewKeychainManager()
     let viewModel = ChatViewModel(
@@ -94,12 +76,12 @@ struct TextMessageView: View {
     )
     let privateConversationModel = PrivateConversationModel(
         chatViewModel: viewModel,
-        conversations: viewModel.conversations
+        conversationStore: viewModel.conversationStore
     )
     let conversationUIModel = ConversationUIModel(
         chatViewModel: viewModel,
         privateConversationModel: privateConversationModel,
-        conversations: viewModel.conversations
+        conversationStore: viewModel.conversationStore
     )
     
     Group {
@@ -121,4 +103,3 @@ struct TextMessageView: View {
     }
     .environmentObject(conversationUIModel)
 }
-#endif

bitchat/Views/ContentComposerView.swift

@@ -6,14 +6,16 @@ import UIKit
 struct ContentComposerView: View {
     @EnvironmentObject private var conversationUIModel: ConversationUIModel
     @EnvironmentObject private var privateConversationModel: PrivateConversationModel
-    @Environment(\.appTheme) private var theme
-    @ThemedPalette private var palette
+    @Environment(\.colorScheme) private var colorScheme
 
     @Binding var messageText: String
     var isTextFieldFocused: FocusState<Bool>.Binding
     @ObservedObject var voiceRecordingVM: VoiceRecordingViewModel
     @Binding var autocompleteDebounceTimer: Timer?
 
+    let backgroundColor: Color
+    let textColor: Color
+    let secondaryTextColor: Color
     let onSendMessage: () -> Void
 
     #if os(iOS)
@@ -33,8 +35,8 @@ struct ContentComposerView: View {
                         }) {
                             HStack {
                                 Text(suggestion)
-                                    .bitchatFont(size: 11)
-                                    .foregroundColor(palette.primary)
+                                    .font(.bitchatSystem(size: 11, design: .monospaced))
+                                    .foregroundColor(textColor)
                                     .fontWeight(.medium)
                                 Spacer()
                             }
@@ -46,11 +48,20 @@ struct ContentComposerView: View {
                         .background(Color.gray.opacity(0.1))
                     }
                 }
-                .themedOverlayPanel()
+                .background(backgroundColor)
+                .overlay(
+                    RoundedRectangle(cornerRadius: 4)
+                        .stroke(secondaryTextColor.opacity(0.3), lineWidth: 1)
+                )
                 .padding(.horizontal, 12)
             }
 
-            CommandSuggestionsView(messageText: $messageText)
+            CommandSuggestionsView(
+                messageText: $messageText,
+                textColor: textColor,
+                backgroundColor: backgroundColor,
+                secondaryTextColor: secondaryTextColor
+            )
 
             if voiceRecordingVM.state.isActive {
                 recordingIndicator
@@ -63,11 +74,11 @@ struct ContentComposerView: View {
                     prompt: Text(
                         String(localized: "content.input.message_placeholder", comment: "Placeholder shown in the chat composer")
                     )
-                    .foregroundColor(palette.secondary.opacity(0.6))
+                    .foregroundColor(secondaryTextColor.opacity(0.6))
                 )
                 .textFieldStyle(.plain)
-                .bitchatFont(size: 15)
-                .foregroundColor(palette.primary)
+                .font(.bitchatSystem(size: 15, design: .monospaced))
+                .foregroundColor(textColor)
                 .focused(isTextFieldFocused)
                 .autocorrectionDisabled(true)
                 #if os(iOS)
@@ -75,9 +86,12 @@ struct ContentComposerView: View {
                 #endif
                 .submitLabel(.send)
                 .onSubmit(onSendMessage)
-                .padding(.vertical, theme.usesGlassChrome ? 8 : 4)
+                .padding(.vertical, 4)
                 .padding(.horizontal, 6)
-                .themedInputBackground()
+                .background(
+                    RoundedRectangle(cornerRadius: 14, style: .continuous)
+                        .fill(colorScheme == .dark ? Color.black.opacity(0.35) : Color.white.opacity(0.7))
+                )
                 .modifier(FocusEffectDisabledModifier())
                 .frame(maxWidth: .infinity, alignment: .leading)
                 .onChange(of: messageText) { newValue in
@@ -100,9 +114,9 @@ struct ContentComposerView: View {
             }
         }
         .padding(.horizontal, 6)
-        .padding(.top, theme.usesGlassChrome ? 8 : 6)
+        .padding(.top, 6)
         .padding(.bottom, 8)
-        .themedChromePanel(edge: .bottom)
+        .background(backgroundColor.opacity(0.95))
         .onDisappear {
             autocompleteDebounceTimer?.invalidate()
         }
@@ -120,7 +134,7 @@ private extension ContentComposerView {
                     "recording \(voiceRecordingVM.formattedDuration(for: context.date))",
                     comment: "Voice note recording duration indicator"
                 )
-                .bitchatFont(size: 13)
+                .font(.bitchatSystem(size: 13, design: .monospaced))
                 .foregroundColor(.red)
             }
             Spacer()
@@ -140,7 +154,7 @@ private extension ContentComposerView {
     }
 
     var composerAccentColor: Color {
-        privateConversationModel.selectedPeerID != nil ? Color.orange : palette.accent
+        privateConversationModel.selectedPeerID != nil ? Color.orange : textColor
     }
 
     var attachmentButton: some View {

bitchat/Views/ContentHeaderView.swift

@@ -8,9 +8,8 @@ struct ContentHeaderView: View {
     @EnvironmentObject private var verificationModel: VerificationModel
     @EnvironmentObject private var locationChannelsModel: LocationChannelsModel
     @EnvironmentObject private var peerListModel: PeerListModel
+    @Environment(\.colorScheme) private var colorScheme
     @Environment(\.dynamicTypeSize) private var dynamicTypeSize
-    @Environment(\.appTheme) private var theme
-    @ThemedPalette private var palette
 
     @Binding var showSidebar: Bool
     @Binding var showVerifySheet: Bool
@@ -21,12 +20,15 @@ struct ContentHeaderView: View {
     let headerHeight: CGFloat
     let headerPeerIconSize: CGFloat
     let headerPeerCountFontSize: CGFloat
+    let backgroundColor: Color
+    let textColor: Color
+    let secondaryTextColor: Color
 
     var body: some View {
         HStack(spacing: 0) {
             Text(verbatim: "bitchat/")
-                .bitchatFont(size: 18, weight: .medium)
-                .foregroundColor(palette.primary)
+                .font(.bitchatSystem(size: 18, weight: .medium, design: .monospaced))
+                .foregroundColor(textColor)
                 .onTapGesture(count: 3) {
                     appChromeModel.panicClearAllData()
                 }
@@ -36,8 +38,8 @@ struct ContentHeaderView: View {
 
             HStack(spacing: 0) {
                 Text(verbatim: "@")
-                    .bitchatFont(size: 14)
-                    .foregroundColor(palette.secondary)
+                    .font(.bitchatSystem(size: 14, design: .monospaced))
+                    .foregroundColor(secondaryTextColor)
 
                 TextField(
                     "content.input.nickname_placeholder",
@@ -47,9 +49,9 @@ struct ContentHeaderView: View {
                     )
                 )
                 .textFieldStyle(.plain)
-                .bitchatFont(size: 14)
+                .font(.bitchatSystem(size: 14, design: .monospaced))
                 .frame(maxWidth: 80)
-                .foregroundColor(palette.primary)
+                .foregroundColor(textColor)
                 .focused(isNicknameFieldFocused)
                 .autocorrectionDisabled(true)
                 #if os(iOS)
@@ -77,13 +79,12 @@ struct ContentHeaderView: View {
                 return countAndColor.0
             }()
 
-            HStack(spacing: 2) {
+            HStack(spacing: 10) {
                 if appChromeModel.hasUnreadPrivateMessages {
                     Button(action: { appChromeModel.openMostRelevantPrivateChat() }) {
                         Image(systemName: "envelope.fill")
                             .font(.bitchatSystem(size: 12))
                             .foregroundColor(Color.orange)
-                            .headerTapTarget()
                     }
                     .buttonStyle(.plain)
                     .accessibilityLabel(
@@ -98,10 +99,13 @@ struct ContentHeaderView: View {
                         notesGeohash = locationChannelsModel.currentBuildingGeohash
                         showLocationNotes = true
                     }) {
-                        Image(systemName: "note.text")
-                            .font(.bitchatSystem(size: 12))
-                            .foregroundColor(Color.orange.opacity(0.8))
-                            .headerTapTarget()
+                        HStack(alignment: .center, spacing: 4) {
+                            Image(systemName: "note.text")
+                                .font(.bitchatSystem(size: 12))
+                                .foregroundColor(Color.orange.opacity(0.8))
+                                .padding(.top, 1)
+                        }
+                        .fixedSize(horizontal: true, vertical: false)
                     }
                     .buttonStyle(.plain)
                     .accessibilityLabel(
@@ -113,7 +117,6 @@ struct ContentHeaderView: View {
                     Button(action: { locationChannelsModel.toggleBookmark(channel.geohash) }) {
                         Image(systemName: locationChannelsModel.isBookmarked(channel.geohash) ? "bookmark.fill" : "bookmark")
                             .font(.bitchatSystem(size: 12))
-                            .headerTapTarget()
                     }
                     .buttonStyle(.plain)
                     .accessibilityLabel(
@@ -137,54 +140,49 @@ struct ContentHeaderView: View {
                         case .mesh:
                             return Color(hue: 0.60, saturation: 0.85, brightness: 0.82)
                         case .location:
-                            return palette.locationAccent
+                            return colorScheme == .dark ? Color.green : Color(red: 0, green: 0.5, blue: 0)
                         }
                     }()
 
                     Text(badgeText)
-                        .bitchatFont(size: 14)
+                        .font(.bitchatSystem(size: 14, design: .monospaced))
                         .foregroundColor(badgeColor)
                         .lineLimit(headerLineLimit)
                         .fixedSize(horizontal: true, vertical: false)
                         .layoutPriority(2)
-                        .padding(.horizontal, 6)
-                        .frame(maxHeight: .infinity)
-                        .contentShape(Rectangle())
                         .accessibilityLabel(
                             String(localized: "content.accessibility.location_channels", comment: "Accessibility label for the location channels button")
                         )
                 }
                 .buttonStyle(.plain)
+                .padding(.leading, 4)
+                .padding(.trailing, 2)
 
-                Button(action: {
-                    withAnimation(.easeInOut(duration: TransportConfig.uiAnimationMediumSeconds)) {
-                        showSidebar.toggle()
-                    }
-                }) {
-                    HStack(spacing: 4) {
-                        Image(systemName: "person.2.fill")
-                            .font(.system(size: headerPeerIconSize, weight: .regular))
-                        Text("\(headerOtherPeersCount)")
-                            .font(.system(size: headerPeerCountFontSize, weight: .regular, design: theme.bodyFontDesign))
-                            .accessibilityHidden(true)
-                    }
-                    .foregroundColor(headerCountColor)
-                    .lineLimit(headerLineLimit)
-                    .fixedSize(horizontal: true, vertical: false)
-                    .padding(.leading, 6)
-                    .frame(maxHeight: .infinity)
-                    .contentShape(Rectangle())
+                HStack(spacing: 4) {
+                    Image(systemName: "person.2.fill")
+                        .font(.system(size: headerPeerIconSize, weight: .regular))
+                        .accessibilityLabel(
+                            String(
+                                format: String(localized: "content.accessibility.people_count", comment: "Accessibility label announcing number of people in header"),
+                                locale: .current,
+                                headerOtherPeersCount
+                            )
+                        )
+                    Text("\(headerOtherPeersCount)")
+                        .font(.system(size: headerPeerCountFontSize, weight: .regular, design: .monospaced))
+                        .accessibilityHidden(true)
                 }
-                .buttonStyle(.plain)
-                .accessibilityLabel(
-                    String(
-                        format: String(localized: "content.accessibility.people_count", comment: "Accessibility label announcing number of people in header"),
-                        locale: .current,
-                        headerOtherPeersCount
-                    )
-                )
+                .foregroundColor(headerCountColor)
+                .padding(.leading, 2)
+                .lineLimit(headerLineLimit)
+                .fixedSize(horizontal: true, vertical: false)
             }
             .layoutPriority(3)
+            .onTapGesture {
+                withAnimation(.easeInOut(duration: TransportConfig.uiAnimationMediumSeconds)) {
+                    showSidebar.toggle()
+                }
+            }
             .sheet(isPresented: $showVerifySheet) {
                 VerificationSheetView(isPresented: $showVerifySheet)
                     .environmentObject(verificationModel)
@@ -210,7 +208,10 @@ struct ContentHeaderView: View {
                 } else {
                     ContentLocationNotesUnavailableView(
                         showLocationNotes: $showLocationNotes,
-                        headerHeight: headerHeight
+                        headerHeight: headerHeight,
+                        backgroundColor: backgroundColor,
+                        textColor: textColor,
+                        secondaryTextColor: secondaryTextColor
                     )
                     .environmentObject(locationChannelsModel)
                 }
@@ -248,16 +249,7 @@ struct ContentHeaderView: View {
         } message: {
             Text("content.alert.screenshot.message")
         }
-        .themedChromePanel(edge: .top)
-    }
-}
-
-private extension View {
-    /// Expands a small header icon to a comfortably tappable, full-bar-height
-    /// hit area without changing its visual size.
-    func headerTapTarget() -> some View {
-        frame(minWidth: 30, maxHeight: .infinity)
-            .contentShape(Rectangle())
+        .background(backgroundColor.opacity(0.95))
     }
 }
 
@@ -270,7 +262,8 @@ private extension ContentHeaderView {
         switch locationChannelsModel.selectedChannel {
         case .location:
             let count = peerListModel.visibleGeohashPeerCount
-            return (count, count > 0 ? palette.locationAccent : Color.secondary)
+            let standardGreen = colorScheme == .dark ? Color.green : Color(red: 0, green: 0.5, blue: 0)
+            return (count, count > 0 ? standardGreen : Color.secondary)
         case .mesh:
             let meshBlue = Color(hue: 0.60, saturation: 0.85, brightness: 0.82)
             let color: Color = peerListModel.connectedMeshPeerCount > 0 ? meshBlue : Color.secondary
@@ -281,22 +274,24 @@ private extension ContentHeaderView {
 
 private struct ContentLocationNotesUnavailableView: View {
     @EnvironmentObject private var locationChannelsModel: LocationChannelsModel
-    @ThemedPalette private var palette
 
     @Binding var showLocationNotes: Bool
 
     let headerHeight: CGFloat
+    let backgroundColor: Color
+    let textColor: Color
+    let secondaryTextColor: Color
 
     var body: some View {
         VStack(spacing: 12) {
             HStack {
                 Text("content.notes.title")
-                    .bitchatFont(size: 16, weight: .bold)
+                    .font(.bitchatSystem(size: 16, weight: .bold, design: .monospaced))
                 Spacer()
                 Button(action: { showLocationNotes = false }) {
                     Image(systemName: "xmark")
-                        .bitchatFont(size: 13, weight: .semibold)
-                        .foregroundColor(palette.primary)
+                        .font(.bitchatSystem(size: 13, weight: .semibold, design: .monospaced))
+                        .foregroundColor(textColor)
                         .frame(width: 32, height: 32)
                 }
                 .buttonStyle(.plain)
@@ -304,17 +299,17 @@ private struct ContentLocationNotesUnavailableView: View {
             }
             .frame(height: headerHeight)
             .padding(.horizontal, 12)
-            .themedChromePanel(edge: .top)
+            .background(backgroundColor.opacity(0.95))
             Text("content.notes.location_unavailable")
-                .bitchatFont(size: 14)
-                .foregroundColor(palette.secondary)
+                .font(.bitchatSystem(size: 14, design: .monospaced))
+                .foregroundColor(secondaryTextColor)
             Button("content.location.enable") {
                 locationChannelsModel.enableAndRefresh()
             }
             .buttonStyle(.bordered)
             Spacer()
         }
-        .themedSheetBackground()
-        .foregroundColor(palette.primary)
+        .background(backgroundColor)
+        .foregroundColor(textColor)
     }
 }

bitchat/Views/ContentSheetViews.swift

@@ -25,8 +25,10 @@ struct ContentPeopleSheetView: View {
     var isTextFieldFocused: FocusState<Bool>.Binding
     @ObservedObject var voiceRecordingVM: VoiceRecordingViewModel
     @Binding var autocompleteDebounceTimer: Timer?
-    @ThemedPalette private var palette
 
+    let backgroundColor: Color
+    let textColor: Color
+    let secondaryTextColor: Color
     let headerHeight: CGFloat
     let onSendMessage: () -> Void
 
@@ -54,6 +56,9 @@ struct ContentPeopleSheetView: View {
                         isTextFieldFocused: isTextFieldFocused,
                         voiceRecordingVM: voiceRecordingVM,
                         autocompleteDebounceTimer: $autocompleteDebounceTimer,
+                        backgroundColor: backgroundColor,
+                        textColor: textColor,
+                        secondaryTextColor: secondaryTextColor,
                         headerHeight: headerHeight,
                         onSendMessage: onSendMessage,
                         showImagePicker: $showImagePicker,
@@ -72,6 +77,9 @@ struct ContentPeopleSheetView: View {
                         isTextFieldFocused: isTextFieldFocused,
                         voiceRecordingVM: voiceRecordingVM,
                         autocompleteDebounceTimer: $autocompleteDebounceTimer,
+                        backgroundColor: backgroundColor,
+                        textColor: textColor,
+                        secondaryTextColor: secondaryTextColor,
                         headerHeight: headerHeight,
                         onSendMessage: onSendMessage,
                         showMacImagePicker: $showMacImagePicker
@@ -80,6 +88,9 @@ struct ContentPeopleSheetView: View {
                 } else {
                     ContentPeopleListView(
                         showSidebar: $showSidebar,
+                        backgroundColor: backgroundColor,
+                        textColor: textColor,
+                        secondaryTextColor: secondaryTextColor,
                         headerHeight: headerHeight
                     )
                 }
@@ -98,8 +109,8 @@ struct ContentPeopleSheetView: View {
                 }
             }
         }
-        .themedSheetBackground()
-        .foregroundColor(palette.primary)
+        .background(backgroundColor)
+        .foregroundColor(textColor)
         #if os(macOS)
         .frame(minWidth: 420, minHeight: 520)
         #endif
@@ -137,10 +148,12 @@ private struct ContentPeopleListView: View {
     @EnvironmentObject private var locationChannelsModel: LocationChannelsModel
     @EnvironmentObject private var peerListModel: PeerListModel
     @Environment(\.dismiss) private var dismiss
-    @ThemedPalette private var palette
 
     @Binding var showSidebar: Bool
 
+    let backgroundColor: Color
+    let textColor: Color
+    let secondaryTextColor: Color
     let headerHeight: CGFloat
 
     @State private var showVerifySheet = false
@@ -150,8 +163,8 @@ private struct ContentPeopleListView: View {
             VStack(alignment: .leading, spacing: 8) {
                 HStack(spacing: 12) {
                     Text(peopleSheetTitle)
-                        .bitchatFont(size: 18)
-                        .foregroundColor(palette.primary)
+                        .font(.bitchatSystem(size: 18, design: .monospaced))
+                        .foregroundColor(textColor)
                     Spacer()
                     if case .mesh = locationChannelsModel.selectedChannel {
                         Button(action: { showVerifySheet = true }) {
@@ -172,7 +185,7 @@ private struct ContentPeopleListView: View {
                         }
                     }) {
                         Image(systemName: "xmark")
-                            .bitchatFont(size: 12, weight: .semibold)
+                            .font(.bitchatSystem(size: 12, weight: .semibold, design: .monospaced))
                             .frame(width: 32, height: 32)
                     }
                     .buttonStyle(.plain)
@@ -188,9 +201,9 @@ private struct ContentPeopleListView: View {
                     let subtitleColor: Color = {
                         switch locationChannelsModel.selectedChannel {
                         case .mesh:
-                            return palette.accentBlue
+                            return Color.blue
                         case .location:
-                            return palette.locationAccent
+                            return Color.green
                         }
                     }()
 
@@ -200,28 +213,32 @@ private struct ContentPeopleListView: View {
                         Text(activeText)
                             .foregroundColor(.secondary)
                     }
-                    .bitchatFont(size: 12)
+                    .font(.bitchatSystem(size: 12, design: .monospaced))
                 } else {
                     Text(activeText)
-                        .bitchatFont(size: 12)
+                        .font(.bitchatSystem(size: 12, design: .monospaced))
                         .foregroundColor(.secondary)
                 }
             }
             .padding(.horizontal, 16)
             .padding(.top, 16)
             .padding(.bottom, 12)
-            .themedSurface()
+            .background(backgroundColor)
 
             ScrollView {
                 VStack(alignment: .leading, spacing: 6) {
                     if case .location = locationChannelsModel.selectedChannel {
                         GeohashPeopleList(
+                            textColor: textColor,
+                            secondaryTextColor: secondaryTextColor,
                             onTapPerson: {
                                 showSidebar = true
                             }
                         )
                     } else {
                         MeshPeerList(
+                            textColor: textColor,
+                            secondaryTextColor: secondaryTextColor,
                             onTapPeer: { peerID in
                                 peerListModel.startConversation(with: peerID)
                                 showSidebar = true
@@ -285,9 +302,10 @@ private struct ContentPrivateChatSheetView: View {
     var isTextFieldFocused: FocusState<Bool>.Binding
     @ObservedObject var voiceRecordingVM: VoiceRecordingViewModel
     @Binding var autocompleteDebounceTimer: Timer?
-    @Environment(\.appTheme) private var theme
-    @ThemedPalette private var palette
 
+    let backgroundColor: Color
+    let textColor: Color
+    let secondaryTextColor: Color
     let headerHeight: CGFloat
     let onSendMessage: () -> Void
 
@@ -309,7 +327,7 @@ private struct ContentPrivateChatSheetView: View {
                     }) {
                         Image(systemName: "chevron.left")
                             .font(.bitchatSystem(size: 12))
-                            .foregroundColor(palette.primary)
+                            .foregroundColor(textColor)
                             .frame(width: 44, height: 44)
                             .contentShape(Rectangle())
                     }
@@ -323,7 +341,8 @@ private struct ContentPrivateChatSheetView: View {
                     HStack(spacing: 8) {
                         ContentPrivateHeaderInfoButton(
                             headerState: headerState,
-                            headerHeight: headerHeight
+                            headerHeight: headerHeight,
+                            textColor: textColor
                         )
 
                         if headerState.supportsFavoriteToggle {
@@ -332,7 +351,7 @@ private struct ContentPrivateChatSheetView: View {
                             }) {
                                 Image(systemName: headerState.isFavorite ? "star.fill" : "star")
                                     .font(.bitchatSystem(size: 14))
-                                    .foregroundColor(headerState.isFavorite ? Color.yellow : palette.primary)
+                                    .foregroundColor(headerState.isFavorite ? Color.yellow : textColor)
                             }
                             .buttonStyle(.plain)
                             .accessibilityLabel(
@@ -353,7 +372,7 @@ private struct ContentPrivateChatSheetView: View {
                         }
                     }) {
                         Image(systemName: "xmark")
-                            .bitchatFont(size: 12, weight: .semibold)
+                            .font(.bitchatSystem(size: 12, weight: .semibold, design: .monospaced))
                             .frame(width: 32, height: 32)
                     }
                     .buttonStyle(.plain)
@@ -363,7 +382,7 @@ private struct ContentPrivateChatSheetView: View {
                 .padding(.horizontal, 16)
                 .padding(.top, 10)
                 .padding(.bottom, 12)
-                .themedSurface()
+                .background(backgroundColor)
             }
 
             MessageListView(
@@ -378,12 +397,10 @@ private struct ContentPrivateChatSheetView: View {
                 showSidebar: $showSidebar,
                 isTextFieldFocused: isTextFieldFocused
             )
-            .themedSurface()
+            .background(backgroundColor)
             .frame(maxWidth: .infinity, maxHeight: .infinity)
 
-            if !theme.usesGlassChrome {
-                Divider()
-            }
+            Divider()
 
             #if os(iOS)
             ContentComposerView(
@@ -391,6 +408,9 @@ private struct ContentPrivateChatSheetView: View {
                 isTextFieldFocused: isTextFieldFocused,
                 voiceRecordingVM: voiceRecordingVM,
                 autocompleteDebounceTimer: $autocompleteDebounceTimer,
+                backgroundColor: backgroundColor,
+                textColor: textColor,
+                secondaryTextColor: secondaryTextColor,
                 onSendMessage: onSendMessage,
                 showImagePicker: $showImagePicker,
                 imagePickerSourceType: $imagePickerSourceType
@@ -401,13 +421,16 @@ private struct ContentPrivateChatSheetView: View {
                 isTextFieldFocused: isTextFieldFocused,
                 voiceRecordingVM: voiceRecordingVM,
                 autocompleteDebounceTimer: $autocompleteDebounceTimer,
+                backgroundColor: backgroundColor,
+                textColor: textColor,
+                secondaryTextColor: secondaryTextColor,
                 onSendMessage: onSendMessage,
                 showMacImagePicker: $showMacImagePicker
             )
             #endif
         }
-        .themedSheetBackground()
-        .foregroundColor(palette.primary)
+        .background(backgroundColor)
+        .foregroundColor(textColor)
         .highPriorityGesture(
             DragGesture(minimumDistance: 25, coordinateSpace: .local)
                 .onEnded { value in
@@ -425,10 +448,10 @@ private struct ContentPrivateChatSheetView: View {
 
 private struct ContentPrivateHeaderInfoButton: View {
     @EnvironmentObject private var appChromeModel: AppChromeModel
-    @ThemedPalette private var palette
 
     let headerState: PrivateConversationHeaderState
     let headerHeight: CGFloat
+    let textColor: Color
 
     var body: some View {
         Button(action: {
@@ -439,12 +462,12 @@ private struct ContentPrivateHeaderInfoButton: View {
                 case .bluetoothConnected:
                     Image(systemName: "dot.radiowaves.left.and.right")
                         .font(.bitchatSystem(size: 14))
-                        .foregroundColor(palette.primary)
+                        .foregroundColor(textColor)
                         .accessibilityLabel(String(localized: "content.accessibility.connected_mesh", comment: "Accessibility label for mesh-connected peer indicator"))
                 case .meshReachable:
                     Image(systemName: "point.3.filled.connected.trianglepath.dotted")
                         .font(.bitchatSystem(size: 14))
-                        .foregroundColor(palette.primary)
+                        .foregroundColor(textColor)
                         .accessibilityLabel(String(localized: "content.accessibility.reachable_mesh", comment: "Accessibility label for mesh-reachable peer indicator"))
                 case .nostrAvailable:
                     Image(systemName: "globe")
@@ -456,8 +479,8 @@ private struct ContentPrivateHeaderInfoButton: View {
                 }
 
                 Text(headerState.displayName)
-                    .bitchatFont(size: 16, weight: .medium)
-                    .foregroundColor(palette.primary)
+                    .font(.bitchatSystem(size: 16, weight: .medium, design: .monospaced))
+                    .foregroundColor(textColor)
 
                 if let encryptionStatus = headerState.encryptionStatus,
                    let icon = encryptionStatus.icon {
@@ -465,7 +488,7 @@ private struct ContentPrivateHeaderInfoButton: View {
                         .font(.bitchatSystem(size: 14))
                         .foregroundColor(
                             encryptionStatus == .noiseVerified || encryptionStatus == .noiseSecured
-                            ? palette.primary
+                            ? textColor
                             : Color.red
                         )
                         .accessibilityLabel(

bitchat/Views/ContentView.swift

@@ -40,7 +40,6 @@ struct ContentView: View {
     @State private var messageText = ""
     @FocusState private var isTextFieldFocused: Bool
     @Environment(\.colorScheme) var colorScheme
-    @Environment(\.appTheme) private var appTheme
     @State private var showSidebar = false
     @State private var selectedMessageSender: String?
     @State private var selectedMessageSenderID: PeerID?
@@ -64,19 +63,39 @@ struct ContentView: View {
     @State private var windowCountPublic: Int = 300
     @State private var windowCountPrivate: [PeerID: Int] = [:]
 
-    @ThemedPalette private var palette
+    private var backgroundColor: Color {
+        colorScheme == .dark ? Color.black : Color.white
+    }
+
+    private var textColor: Color {
+        colorScheme == .dark ? Color.green : Color(red: 0, green: 0.5, blue: 0)
+    }
+
+    private var secondaryTextColor: Color {
+        colorScheme == .dark ? Color.green.opacity(0.8) : Color(red: 0, green: 0.5, blue: 0).opacity(0.8)
+    }
 
     private var selectedPrivatePeerID: PeerID? {
         privateConversationModel.selectedPeerID
     }
 
-    private var usesGlassLayout: Bool { appTheme.usesGlassChrome }
-
     var body: some View {
-        mainContent
+        VStack(spacing: 0) {
+            ContentHeaderView(
+                showSidebar: $showSidebar,
+                showVerifySheet: $showVerifySheet,
+                showLocationNotes: $showLocationNotes,
+                notesGeohash: $notesGeohash,
+                isNicknameFieldFocused: $isNicknameFieldFocused,
+                headerHeight: headerHeight,
+                headerPeerIconSize: headerPeerIconSize,
+                headerPeerCountFontSize: headerPeerCountFontSize,
+                backgroundColor: backgroundColor,
+                textColor: textColor,
+                secondaryTextColor: secondaryTextColor
+            )
             .onAppear {
                 conversationUIModel.setCurrentColorScheme(colorScheme)
-                conversationUIModel.setCurrentTheme(appTheme)
                 #if os(macOS)
                 DispatchQueue.main.async {
                     isNicknameFieldFocused = false
@@ -87,11 +106,62 @@ struct ContentView: View {
             .onChange(of: colorScheme) { newValue in
                 conversationUIModel.setCurrentColorScheme(newValue)
             }
-            .onChange(of: appTheme) { newValue in
-                conversationUIModel.setCurrentTheme(newValue)
+
+            Divider()
+
+            GeometryReader { geometry in
+                VStack(spacing: 0) {
+                    MessageListView(
+                        privatePeer: nil,
+                        isAtBottom: $isAtBottomPublic,
+                        messageText: $messageText,
+                        selectedMessageSender: $selectedMessageSender,
+                        selectedMessageSenderID: $selectedMessageSenderID,
+                        imagePreviewURL: $imagePreviewURL,
+                        windowCountPublic: $windowCountPublic,
+                        windowCountPrivate: $windowCountPrivate,
+                        showSidebar: $showSidebar,
+                        isTextFieldFocused: $isTextFieldFocused
+                    )
+                    .background(backgroundColor)
+                    .frame(maxWidth: .infinity, maxHeight: .infinity)
+                }
+                .frame(width: geometry.size.width, height: geometry.size.height)
             }
-        .background(ThemedRootBackground())
-        .foregroundColor(palette.primary)
+
+            Divider()
+
+            if selectedPrivatePeerID == nil {
+                #if os(iOS)
+                ContentComposerView(
+                    messageText: $messageText,
+                    isTextFieldFocused: $isTextFieldFocused,
+                    voiceRecordingVM: voiceRecordingVM,
+                    autocompleteDebounceTimer: $autocompleteDebounceTimer,
+                    backgroundColor: backgroundColor,
+                    textColor: textColor,
+                    secondaryTextColor: secondaryTextColor,
+                    onSendMessage: sendMessage,
+                    showImagePicker: $showImagePicker,
+                    imagePickerSourceType: $imagePickerSourceType
+                )
+                #else
+                ContentComposerView(
+                    messageText: $messageText,
+                    isTextFieldFocused: $isTextFieldFocused,
+                    voiceRecordingVM: voiceRecordingVM,
+                    autocompleteDebounceTimer: $autocompleteDebounceTimer,
+                    backgroundColor: backgroundColor,
+                    textColor: textColor,
+                    secondaryTextColor: secondaryTextColor,
+                    onSendMessage: sendMessage,
+                    showMacImagePicker: $showMacImagePicker
+                )
+                #endif
+            }
+        }
+        .background(backgroundColor)
+        .foregroundColor(textColor)
         #if os(macOS)
         .frame(minWidth: 600, minHeight: 400)
         #endif
@@ -124,6 +194,9 @@ struct ContentView: View {
                 isTextFieldFocused: $isTextFieldFocused,
                 voiceRecordingVM: voiceRecordingVM,
                 autocompleteDebounceTimer: $autocompleteDebounceTimer,
+                backgroundColor: backgroundColor,
+                textColor: textColor,
+                secondaryTextColor: secondaryTextColor,
                 headerHeight: headerHeight,
                 onSendMessage: sendMessage,
                 showImagePicker: $showImagePicker,
@@ -142,6 +215,9 @@ struct ContentView: View {
                 isTextFieldFocused: $isTextFieldFocused,
                 voiceRecordingVM: voiceRecordingVM,
                 autocompleteDebounceTimer: $autocompleteDebounceTimer,
+                backgroundColor: backgroundColor,
+                textColor: textColor,
+                secondaryTextColor: secondaryTextColor,
                 headerHeight: headerHeight,
                 onSendMessage: sendMessage,
                 showMacImagePicker: $showMacImagePicker
@@ -226,96 +302,6 @@ struct ContentView: View {
         }
     }
 
-    /// Matrix: classic opaque bars with dividers. Glass: full-bleed message
-    /// list scrolling underneath floating chrome panels (safe-area insets),
-    /// so the translucency gains usable space instead of losing it.
-    @ViewBuilder
-    private var mainContent: some View {
-        if usesGlassLayout {
-            publicMessageList
-                .safeAreaInset(edge: .top, spacing: 0) {
-                    headerView
-                }
-                .safeAreaInset(edge: .bottom, spacing: 0) {
-                    if selectedPrivatePeerID == nil {
-                        composerView
-                    }
-                }
-        } else {
-            VStack(spacing: 0) {
-                headerView
-
-                Divider()
-
-                GeometryReader { geometry in
-                    VStack(spacing: 0) {
-                        publicMessageList
-                            .background(palette.background)
-                            .frame(maxWidth: .infinity, maxHeight: .infinity)
-                    }
-                    .frame(width: geometry.size.width, height: geometry.size.height)
-                }
-
-                Divider()
-
-                if selectedPrivatePeerID == nil {
-                    composerView
-                }
-            }
-        }
-    }
-
-    private var headerView: some View {
-        ContentHeaderView(
-            showSidebar: $showSidebar,
-            showVerifySheet: $showVerifySheet,
-            showLocationNotes: $showLocationNotes,
-            notesGeohash: $notesGeohash,
-            isNicknameFieldFocused: $isNicknameFieldFocused,
-            headerHeight: headerHeight,
-            headerPeerIconSize: headerPeerIconSize,
-            headerPeerCountFontSize: headerPeerCountFontSize
-        )
-    }
-
-    private var publicMessageList: some View {
-        MessageListView(
-            privatePeer: nil,
-            isAtBottom: $isAtBottomPublic,
-            messageText: $messageText,
-            selectedMessageSender: $selectedMessageSender,
-            selectedMessageSenderID: $selectedMessageSenderID,
-            imagePreviewURL: $imagePreviewURL,
-            windowCountPublic: $windowCountPublic,
-            windowCountPrivate: $windowCountPrivate,
-            showSidebar: $showSidebar,
-            isTextFieldFocused: $isTextFieldFocused
-        )
-    }
-
-    private var composerView: some View {
-        #if os(iOS)
-        ContentComposerView(
-            messageText: $messageText,
-            isTextFieldFocused: $isTextFieldFocused,
-            voiceRecordingVM: voiceRecordingVM,
-            autocompleteDebounceTimer: $autocompleteDebounceTimer,
-            onSendMessage: sendMessage,
-            showImagePicker: $showImagePicker,
-            imagePickerSourceType: $imagePickerSourceType
-        )
-        #else
-        ContentComposerView(
-            messageText: $messageText,
-            isTextFieldFocused: $isTextFieldFocused,
-            voiceRecordingVM: voiceRecordingVM,
-            autocompleteDebounceTimer: $autocompleteDebounceTimer,
-            onSendMessage: sendMessage,
-            showMacImagePicker: $showMacImagePicker
-        )
-        #endif
-    }
-
     private func sendMessage() {
         guard let trimmed = messageText.trimmedOrNilIfEmpty else { return }
 

bitchat/Views/FingerprintView.swift

@@ -13,11 +13,15 @@ struct FingerprintView: View {
     @EnvironmentObject private var verificationModel: VerificationModel
     let peerID: PeerID
     @Environment(\.dismiss) var dismiss
-    @ThemedPalette private var palette
-
-    private var textColor: Color { palette.primary }
-
-    private var backgroundColor: Color { palette.background }
+    @Environment(\.colorScheme) var colorScheme
+    
+    private var textColor: Color {
+        colorScheme == .dark ? Color.green : Color(red: 0, green: 0.5, blue: 0)
+    }
+    
+    private var backgroundColor: Color {
+        colorScheme == .dark ? Color.black : Color.white
+    }
 
     private enum Strings {
         static let title: LocalizedStringKey = "fingerprint.title"
@@ -49,7 +53,7 @@ struct FingerprintView: View {
             // Header
             HStack {
                 Text(Strings.title)
-                    .bitchatFont(size: 16, weight: .bold)
+                    .font(.bitchatSystem(size: 16, weight: .bold, design: .monospaced))
                     .foregroundColor(textColor)
                 
                 Spacer()
@@ -72,11 +76,11 @@ struct FingerprintView: View {
                     
                     VStack(alignment: .leading, spacing: 4) {
                         Text(fingerprintState.peerNickname)
-                            .bitchatFont(size: 18, weight: .semibold)
+                            .font(.bitchatSystem(size: 18, weight: .semibold, design: .monospaced))
                             .foregroundColor(textColor)
                         
                         Text(fingerprintState.encryptionStatus.description)
-                            .bitchatFont(size: 12)
+                            .font(.bitchatSystem(size: 12, design: .monospaced))
                             .foregroundColor(textColor.opacity(0.7))
                     }
                     
@@ -89,12 +93,12 @@ struct FingerprintView: View {
                 // Their fingerprint
                 VStack(alignment: .leading, spacing: 8) {
                     Text(Strings.theirFingerprint)
-                        .bitchatFont(size: 12, weight: .bold)
+                        .font(.bitchatSystem(size: 12, weight: .bold, design: .monospaced))
                         .foregroundColor(textColor.opacity(0.7))
                     
                     if let fingerprint = fingerprintState.theirFingerprint {
                         Text(formatFingerprint(fingerprint))
-                            .bitchatFont(size: 14)
+                            .font(.bitchatSystem(size: 14, design: .monospaced))
                             .foregroundColor(textColor)
                             .multilineTextAlignment(.leading)
                             .lineLimit(nil)
@@ -115,7 +119,7 @@ struct FingerprintView: View {
                             }
                     } else {
                         Text(Strings.handshakePending)
-                            .bitchatFont(size: 14)
+                            .font(.bitchatSystem(size: 14, design: .monospaced))
                             .foregroundColor(Color.orange)
                             .padding()
                     }
@@ -124,11 +128,11 @@ struct FingerprintView: View {
                 // My fingerprint
                 VStack(alignment: .leading, spacing: 8) {
                     Text(Strings.yourFingerprint)
-                        .bitchatFont(size: 12, weight: .bold)
+                        .font(.bitchatSystem(size: 12, weight: .bold, design: .monospaced))
                         .foregroundColor(textColor.opacity(0.7))
                     
                     Text(formatFingerprint(fingerprintState.myFingerprint))
-                        .bitchatFont(size: 14)
+                        .font(.bitchatSystem(size: 14, design: .monospaced))
                         .foregroundColor(textColor)
                         .multilineTextAlignment(.leading)
                         .lineLimit(nil)
@@ -153,7 +157,7 @@ struct FingerprintView: View {
                 if fingerprintState.canToggleVerification {
                     VStack(spacing: 12) {
                         Text(fingerprintState.isVerified ? Strings.verifiedBadge : Strings.notVerifiedBadge)
-                            .bitchatFont(size: 14, weight: .bold)
+                            .font(.bitchatSystem(size: 14, weight: .bold, design: .monospaced))
                             .foregroundColor(fingerprintState.isVerified ? Color.green : Color.orange)
                             .frame(maxWidth: .infinity)
                         
@@ -164,7 +168,7 @@ struct FingerprintView: View {
                                 Text(Strings.verifyHint(fingerprintState.peerNickname))
                             }
                         }
-                            .bitchatFont(size: 12)
+                            .font(.bitchatSystem(size: 12, design: .monospaced))
                             .foregroundColor(textColor.opacity(0.7))
                             .multilineTextAlignment(.center)
                             .lineLimit(nil)
@@ -177,7 +181,7 @@ struct FingerprintView: View {
                                 dismiss()
                             }) {
                                 Text(Strings.markVerified)
-                                    .bitchatFont(size: 14, weight: .bold)
+                                    .font(.bitchatSystem(size: 14, weight: .bold, design: .monospaced))
                                     .foregroundColor(.white)
                                     .padding(.horizontal, 20)
                                     .padding(.vertical, 10)
@@ -191,7 +195,7 @@ struct FingerprintView: View {
                                 dismiss()
                             }) {
                                 Text(Strings.removeVerification)
-                                    .bitchatFont(size: 14, weight: .bold)
+                                    .font(.bitchatSystem(size: 14, weight: .bold, design: .monospaced))
                                     .foregroundColor(.white)
                                     .padding(.horizontal, 20)
                                     .padding(.vertical, 10)
@@ -212,7 +216,7 @@ struct FingerprintView: View {
         }
         .padding()
         .frame(maxWidth: .infinity, maxHeight: .infinity)
-        .themedSheetBackground()
+        .background(backgroundColor)
     }
     
     private func formatFingerprint(_ fingerprint: String) -> String {

bitchat/Views/GeohashPeopleList.swift

@@ -2,7 +2,8 @@ import SwiftUI
 
 struct GeohashPeopleList: View {
     @EnvironmentObject private var peerListModel: PeerListModel
-    @ThemedPalette private var palette
+    let textColor: Color
+    let secondaryTextColor: Color
     let onTapPerson: () -> Void
     @Environment(\.colorScheme) var colorScheme
     @State private var orderedIDs: [String] = []
@@ -19,8 +20,8 @@ struct GeohashPeopleList: View {
         if peerListModel.geohashPeople.isEmpty {
             VStack(alignment: .leading, spacing: 0) {
                 Text(Strings.noneNearby)
-                    .bitchatFont(size: 14)
-                    .foregroundColor(palette.secondary)
+                    .font(.bitchatSystem(size: 14, design: .monospaced))
+                    .foregroundColor(secondaryTextColor)
                     .padding(.horizontal)
                     .padding(.top, 12)
             }
@@ -51,18 +52,18 @@ struct GeohashPeopleList: View {
                         let (base, suffix) = person.displayName.splitSuffix()
                         HStack(spacing: 0) {
                             Text(base)
-                                .bitchatFont(size: 14)
+                                .font(.bitchatSystem(size: 14, design: .monospaced))
                                 .fontWeight(person.isMe ? .bold : .regular)
                                 .foregroundColor(rowColor)
                             if !suffix.isEmpty {
                                 let suffixColor = person.isMe ? Color.orange.opacity(0.6) : rowColor.opacity(0.6)
                                 Text(suffix)
-                                    .bitchatFont(size: 14)
+                                    .font(.bitchatSystem(size: 14, design: .monospaced))
                                     .foregroundColor(suffixColor)
                             }
                             if person.isMe {
                                 Text(Strings.youSuffix)
-                                    .bitchatFont(size: 14)
+                                    .font(.bitchatSystem(size: 14, design: .monospaced))
                                     .foregroundColor(rowColor)
                             }
                         }

bitchat/Views/LocationChannelsSheet.swift

@@ -9,11 +9,11 @@ struct LocationChannelsSheet: View {
     @Binding var isPresented: Bool
     @EnvironmentObject private var locationChannelsModel: LocationChannelsModel
     @EnvironmentObject private var peerListModel: PeerListModel
-    @ThemedPalette private var palette
+    @Environment(\.colorScheme) var colorScheme
     @State private var customGeohash: String = ""
     @State private var customError: String? = nil
 
-    private var backgroundColor: Color { palette.background }
+    private var backgroundColor: Color { colorScheme == .dark ? .black : .white }
 
     private enum Strings {
         static let title: LocalizedStringKey = "location_channels.title"
@@ -97,12 +97,12 @@ struct LocationChannelsSheet: View {
             VStack(alignment: .leading, spacing: 12) {
                 HStack(spacing: 12) {
                     Text(Strings.title)
-                        .bitchatFont(size: 18)
+                        .font(.bitchatSystem(size: 18, design: .monospaced))
                     Spacer()
                     closeButton
                 }
                 Text(Strings.description)
-                    .bitchatFont(size: 12)
+                    .font(.bitchatSystem(size: 12, design: .monospaced))
                     .foregroundColor(.secondary)
 
                 Group {
@@ -110,7 +110,7 @@ struct LocationChannelsSheet: View {
                     case .notDetermined:
                         Button(action: { locationChannelsModel.enableLocationChannels() }) {
                             Text(Strings.requestPermissions)
-                                .bitchatFont(size: 12)
+                                .font(.bitchatSystem(size: 12, design: .monospaced))
                                 .foregroundColor(standardGreen)
                                 .frame(maxWidth: .infinity)
                                 .padding(.vertical, 6)
@@ -121,7 +121,7 @@ struct LocationChannelsSheet: View {
                     case .denied, .restricted:
                         VStack(alignment: .leading, spacing: 8) {
                             Text(Strings.permissionDenied)
-                                .bitchatFont(size: 12)
+                                .font(.bitchatSystem(size: 12, design: .monospaced))
                                 .foregroundColor(.secondary)
                             Button(Strings.openSettings, action: SystemSettings.location.open)
                             .buttonStyle(.plain)
@@ -136,7 +136,7 @@ struct LocationChannelsSheet: View {
             }
             .padding(.horizontal, 16)
             .padding(.vertical, 12)
-            .themedSurface()
+            .background(backgroundColor)
             #if os(iOS)
             .navigationBarTitleDisplayMode(.inline)
             .navigationBarHidden(true)
@@ -147,7 +147,7 @@ struct LocationChannelsSheet: View {
         #if os(macOS)
         .frame(minWidth: 420, minHeight: 520)
         #endif
-        .themedSheetBackground()
+        .background(backgroundColor)
         .onAppear {
             // Refresh channels when opening
             if locationChannelsModel.permissionState == .authorized {
@@ -171,7 +171,7 @@ struct LocationChannelsSheet: View {
     private var closeButton: some View {
         Button(action: { isPresented = false }) {
             Image(systemName: "xmark")
-                .bitchatFont(size: 13, weight: .semibold)
+                .font(.bitchatSystem(size: 13, weight: .semibold, design: .monospaced))
                 .frame(width: 32, height: 32)
         }
         .buttonStyle(.plain)
@@ -223,7 +223,7 @@ struct LocationChannelsSheet: View {
                     HStack(spacing: 8) {
                         ProgressView()
                         Text(Strings.loadingNearby)
-                            .bitchatFont(size: 12)
+                            .font(.bitchatSystem(size: 12, design: .monospaced))
                     }
                     .frame(maxWidth: .infinity, alignment: .leading)
                     .padding(.vertical, 10)
@@ -246,8 +246,8 @@ struct LocationChannelsSheet: View {
                         .padding(.top, 12)
                     Button(action: SystemSettings.location.open) {
                         Text(Strings.removeAccess)
-                            .bitchatFont(size: 12)
-                            .foregroundColor(palette.alertRed)
+                            .font(.bitchatSystem(size: 12, design: .monospaced))
+                            .foregroundColor(Color(red: 0.75, green: 0.1, blue: 0.1))
                             .frame(maxWidth: .infinity)
                             .padding(.vertical, 6)
                             .background(Color.red.opacity(0.08))
@@ -259,9 +259,9 @@ struct LocationChannelsSheet: View {
             }
             .frame(maxWidth: .infinity, alignment: .leading)
             .padding(.vertical, 6)
-            .themedSurface()
+            .background(backgroundColor)
         }
-        .themedSurface()
+        .background(backgroundColor)
     }
 
     private var sectionDivider: some View {
@@ -270,13 +270,15 @@ struct LocationChannelsSheet: View {
             .frame(height: 1)
     }
 
-    private var dividerColor: Color { palette.divider }
+    private var dividerColor: Color {
+        colorScheme == .dark ? Color.white.opacity(0.12) : Color.black.opacity(0.08)
+    }
 
     private var customTeleportSection: some View {
         VStack(alignment: .leading, spacing: 6) {
             HStack(spacing: 2) {
                 Text(verbatim: "#")
-                    .bitchatFont(size: 14)
+                    .font(.bitchatSystem(size: 14, design: .monospaced))
                     .foregroundColor(.secondary)
                 TextField("geohash", text: $customGeohash)
                     #if os(iOS)
@@ -284,7 +286,7 @@ struct LocationChannelsSheet: View {
                     .autocorrectionDisabled(true)
                     .keyboardType(.asciiCapable)
                     #endif
-                    .bitchatFont(size: 14)
+                    .font(.bitchatSystem(size: 14, design: .monospaced))
                     .onChange(of: customGeohash) { newValue in
                         let allowed = Set("0123456789bcdefghjkmnpqrstuvwxyz")
                         let filtered = newValue
@@ -310,13 +312,13 @@ struct LocationChannelsSheet: View {
                 }) {
                     HStack(spacing: 6) {
                         Text(Strings.teleport)
-                            .bitchatFont(size: 14)
+                            .font(.bitchatSystem(size: 14, design: .monospaced))
                         Image(systemName: "face.dashed")
                             .font(.bitchatSystem(size: 14))
                     }
                 }
                 .buttonStyle(.plain)
-                .bitchatFont(size: 14)
+                .font(.bitchatSystem(size: 14, design: .monospaced))
                 .padding(.vertical, 6)
                 .padding(.horizontal, 10)
                 .background(Color.secondary.opacity(0.12))
@@ -326,7 +328,7 @@ struct LocationChannelsSheet: View {
             }
             if let err = customError {
                 Text(err)
-                    .bitchatFont(size: 12)
+                    .font(.bitchatSystem(size: 12, design: .monospaced))
                     .foregroundColor(.red)
             }
         }
@@ -335,7 +337,7 @@ struct LocationChannelsSheet: View {
     private func bookmarkedSection(_ entries: [String]) -> some View {
         VStack(alignment: .leading, spacing: 8) {
             Text(Strings.bookmarked)
-                .bitchatFont(size: 12)
+                .font(.bitchatSystem(size: 12, design: .monospaced))
                 .foregroundColor(.secondary)
             LazyVStack(spacing: 0) {
                 ForEach(Array(entries.enumerated()), id: \.offset) { index, gh in
@@ -407,18 +409,18 @@ struct LocationChannelsSheet: View {
                 let parts = splitTitleAndCount(title)
                 HStack(spacing: 4) {
                     Text(parts.base)
-                            .bitchatFont(size: 14)
+                            .font(.bitchatSystem(size: 14, design: .monospaced))
                             .fontWeight(titleBold ? .bold : .regular)
                             .foregroundColor(titleColor ?? Color.primary)
                         if let count = parts.countSuffix, !count.isEmpty {
                             Text(count)
-                                .bitchatFont(size: 11)
+                                .font(.bitchatSystem(size: 11, design: .monospaced))
                                 .foregroundColor(.secondary)
                         }
                     }
                 let subtitleFull = Strings.subtitle(prefix: subtitlePrefix, name: subtitleName)
                 Text(subtitleFull)
-                    .bitchatFont(size: 12)
+                    .font(.bitchatSystem(size: 12, design: .monospaced))
                     .foregroundColor(.secondary)
                     .lineLimit(1)
                     .truncationMode(.tail)
@@ -426,7 +428,7 @@ struct LocationChannelsSheet: View {
                 Spacer()
                 if isSelected {
                     Text(verbatim: "✔︎")
-                        .bitchatFont(size: 16)
+                        .font(.bitchatSystem(size: 16, design: .monospaced))
                         .foregroundColor(standardGreen)
                 }
                 trailingAccessory()
@@ -476,22 +478,26 @@ extension LocationChannelsSheet {
             Toggle(isOn: torToggleBinding) {
                 VStack(alignment: .leading, spacing: 2) {
                     Text(Strings.torTitle)
-                        .bitchatFont(size: 12, weight: .semibold)
+                        .font(.bitchatSystem(size: 12, weight: .semibold, design: .monospaced))
                         .foregroundColor(.primary)
                     Text(Strings.torSubtitle)
-                        .bitchatFont(size: 11)
+                        .font(.bitchatSystem(size: 11, design: .monospaced))
                         .foregroundColor(.secondary)
                 }
             }
-            .toggleStyle(IRCToggleStyle(accent: palette.accent, onLabel: Strings.toggleOn, offLabel: Strings.toggleOff))
+            .toggleStyle(IRCToggleStyle(accent: standardGreen, onLabel: Strings.toggleOn, offLabel: Strings.toggleOff))
         }
         .padding(12)
         .background(Color.secondary.opacity(0.12))
         .cornerRadius(8)
     }
 
-    private var standardGreen: Color { palette.primary }
-    private var standardBlue: Color { palette.accentBlue }
+    private var standardGreen: Color {
+        (colorScheme == .dark) ? Color.green : Color(red: 0, green: 0.5, blue: 0)
+    }
+    private var standardBlue: Color {
+        Color(red: 0.0, green: 0.478, blue: 1.0)
+    }
 }
 
 private struct IRCToggleStyle: ToggleStyle {
@@ -506,7 +512,7 @@ private struct IRCToggleStyle: ToggleStyle {
                 Spacer()
                 Text(configuration.isOn ? onLabel : offLabel)
                     .textCase(.uppercase)
-                    .bitchatFont(size: 12, weight: .semibold)
+                    .font(.bitchatSystem(size: 12, weight: .semibold, design: .monospaced))
                     .foregroundColor(configuration.isOn ? accent : .secondary)
                     .padding(.vertical, 4)
                     .padding(.horizontal, 10)

bitchat/Views/LocationNotesView.swift

@@ -6,7 +6,7 @@ struct LocationNotesView: View {
     let senderNickname: String
     let onNotesCountChanged: ((Int) -> Void)?
 
-    @ThemedPalette private var palette
+    @Environment(\.colorScheme) var colorScheme
     @Environment(\.dynamicTypeSize) private var dynamicTypeSize
     @EnvironmentObject private var locationChannelsModel: LocationChannelsModel
     @Environment(\.dismiss) private var dismiss
@@ -25,8 +25,8 @@ struct LocationNotesView: View {
         _manager = StateObject(wrappedValue: manager ?? LocationNotesManager(geohash: gh))
     }
 
-    private var backgroundColor: Color { palette.background }
-    private var accentGreen: Color { palette.accent }
+    private var backgroundColor: Color { colorScheme == .dark ? .black : .white }
+    private var accentGreen: Color { colorScheme == .dark ? .green : Color(red: 0, green: 0.5, blue: 0) }
     private var maxDraftLines: Int { dynamicTypeSize.isAccessibilitySize ? 5 : 3 }
 
     private enum Strings {
@@ -53,11 +53,11 @@ struct LocationNotesView: View {
                     notesContent
                 }
             }
-            .themedSurface()
+            .background(backgroundColor)
             inputSection
         }
         .frame(minWidth: 420, idealWidth: 440, minHeight: 620, idealHeight: 680)
-        .themedSheetBackground()
+        .background(backgroundColor)
         .onDisappear { manager.cancel() }
         .onChange(of: geohash) { newValue in
             manager.setGeohash(newValue)
@@ -76,7 +76,7 @@ struct LocationNotesView: View {
                 .frame(maxWidth: .infinity, maxHeight: .infinity)
                 inputSection
             }
-            .themedSurface()
+            .background(backgroundColor)
             #if os(iOS)
             .navigationBarTitleDisplayMode(.inline)
             .navigationBarHidden(true)
@@ -84,7 +84,7 @@ struct LocationNotesView: View {
             .navigationTitle("")
             #endif
         }
-        .themedSheetBackground()
+        .background(backgroundColor)
         .onDisappear { manager.cancel() }
         .onChange(of: geohash) { newValue in
             manager.setGeohash(newValue)
@@ -99,7 +99,7 @@ struct LocationNotesView: View {
     private var closeButton: some View {
         Button(action: { dismiss() }) {
             Image(systemName: "xmark")
-                .bitchatFont(size: 13, weight: .semibold)
+                .font(.bitchatSystem(size: 13, weight: .semibold, design: .monospaced))
                 .frame(width: 32, height: 32)
         }
         .buttonStyle(.plain)
@@ -111,33 +111,33 @@ struct LocationNotesView: View {
         return VStack(alignment: .leading, spacing: 8) {
             HStack(spacing: 12) {
                 Text(headerTitle(for: count))
-                    .bitchatFont(size: 18)
+                    .font(.bitchatSystem(size: 18, design: .monospaced))
                 Spacer()
                 closeButton
             }
             if let building = locationChannelsModel.locationName(for: .building), !building.isEmpty {
                 Text(building)
-                    .bitchatFont(size: 12)
+                    .font(.bitchatSystem(size: 12, design: .monospaced))
                     .foregroundColor(accentGreen)
             } else if let block = locationChannelsModel.locationName(for: .block), !block.isEmpty {
                 Text(block)
-                    .bitchatFont(size: 12)
+                    .font(.bitchatSystem(size: 12, design: .monospaced))
                     .foregroundColor(accentGreen)
             }
             Text(Strings.description)
-                .bitchatFont(size: 12)
+                .font(.bitchatSystem(size: 12, design: .monospaced))
                 .foregroundColor(.secondary)
                 .fixedSize(horizontal: false, vertical: true)
             if manager.state == .noRelays {
                 Text(Strings.relaysPaused)
-                    .bitchatFont(size: 11)
+                    .font(.bitchatSystem(size: 11, design: .monospaced))
                     .foregroundColor(.secondary)
             }
         }
         .padding(.horizontal, 16)
         .padding(.top, 16)
         .padding(.bottom, 12)
-        .themedSurface()
+        .background(backgroundColor)
     }
 
     private func headerTitle(for count: Int) -> String {
@@ -176,16 +176,16 @@ struct LocationNotesView: View {
         return VStack(alignment: .leading, spacing: 2) {
             HStack(spacing: 6) {
                 Text(verbatim: "@\(baseName)")
-                    .bitchatFont(size: 12, weight: .semibold)
+                    .font(.bitchatSystem(size: 12, weight: .semibold, design: .monospaced))
                 if !ts.isEmpty {
                     Text(ts)
-                        .bitchatFont(size: 11)
+                        .font(.bitchatSystem(size: 11, design: .monospaced))
                         .foregroundColor(.secondary)
                 }
                 Spacer()
             }
             Text(note.content)
-                .bitchatFont(size: 14)
+                .font(.bitchatSystem(size: 14, design: .monospaced))
                 .fixedSize(horizontal: false, vertical: true)
         }
         .padding(.vertical, 4)
@@ -194,12 +194,12 @@ struct LocationNotesView: View {
     private var noRelaysRow: some View {
         VStack(alignment: .leading, spacing: 4) {
             Text(Strings.noRelaysNearby)
-                .bitchatFont(size: 13, weight: .semibold)
+                .font(.bitchatSystem(size: 13, weight: .semibold, design: .monospaced))
             Text(Strings.relaysRetryHint)
-                .bitchatFont(size: 12)
+                .font(.bitchatSystem(size: 12, design: .monospaced))
                 .foregroundColor(.secondary)
             Button(Strings.retry) { manager.refresh() }
-                .bitchatFont(size: 12)
+                .font(.bitchatSystem(size: 12, design: .monospaced))
                 .buttonStyle(.plain)
         }
         .padding(.vertical, 6)
@@ -209,7 +209,7 @@ struct LocationNotesView: View {
         HStack(spacing: 10) {
             ProgressView()
             Text(Strings.loadingNotes)
-                .bitchatFont(size: 12)
+                .font(.bitchatSystem(size: 12, design: .monospaced))
                 .foregroundColor(.secondary)
             Spacer()
         }
@@ -219,9 +219,9 @@ struct LocationNotesView: View {
     private var emptyRow: some View {
         VStack(alignment: .leading, spacing: 4) {
             Text(Strings.emptyTitle)
-                .bitchatFont(size: 13, weight: .semibold)
+                .font(.bitchatSystem(size: 13, weight: .semibold, design: .monospaced))
             Text(Strings.emptySubtitle)
-                .bitchatFont(size: 12)
+                .font(.bitchatSystem(size: 12, design: .monospaced))
                 .foregroundColor(.secondary)
         }
         .padding(.vertical, 6)
@@ -231,13 +231,13 @@ struct LocationNotesView: View {
         VStack(alignment: .leading, spacing: 4) {
             HStack(spacing: 6) {
                 Image(systemName: "exclamationmark.triangle.fill")
-                    .bitchatFont(size: 12)
+                    .font(.bitchatSystem(size: 12, design: .monospaced))
                 Text(message)
-                    .bitchatFont(size: 12)
+                    .font(.bitchatSystem(size: 12, design: .monospaced))
                 Spacer()
             }
             Button(Strings.dismissError) { manager.clearError() }
-                .bitchatFont(size: 12)
+                .font(.bitchatSystem(size: 12, design: .monospaced))
                 .buttonStyle(.plain)
         }
         .padding(.vertical, 6)
@@ -247,7 +247,7 @@ struct LocationNotesView: View {
         HStack(alignment: .top, spacing: 10) {
             TextField(Strings.addPlaceholder, text: $draft, axis: .vertical)
                 .textFieldStyle(.plain)
-                .bitchatFont(size: 14)
+                .font(.bitchatSystem(size: 14, design: .monospaced))
                 .lineLimit(maxDraftLines, reservesSpace: true)
                 .padding(.vertical, 6)
             Button(action: send) {
@@ -261,7 +261,7 @@ struct LocationNotesView: View {
         }
         .padding(.horizontal, 16)
         .padding(.vertical, 14)
-        .themedSurface()
+        .background(backgroundColor)
         .overlay(Divider(), alignment: .top)
     }
 

bitchat/Views/Media/MediaMessageView.swift

@@ -10,38 +10,24 @@ import BitFoundation
 
 struct MediaMessageView: View {
     @Environment(\.colorScheme) private var colorScheme
-    @Environment(\.appTheme) private var theme
     @EnvironmentObject private var conversationUIModel: ConversationUIModel
     let message: BitchatMessage
     let media: BitchatMessage.Media
-    /// Value snapshot of the message's mutable delivery status, captured at
-    /// construction (see `TextMessageView.deliveryStatus`): `BitchatMessage`
-    /// is a reference type mutated in place, and SwiftUI compares reference
-    /// fields by identity, so without the snapshot a status-only change
-    /// (send progress, delivered → read) would not re-render this row.
-    private let deliveryStatus: DeliveryStatus?
 
     @Binding var imagePreviewURL: URL?
 
-    init(message: BitchatMessage, media: BitchatMessage.Media, imagePreviewURL: Binding<URL?>) {
-        self.message = message
-        self.media = media
-        self.deliveryStatus = message.deliveryStatus
-        self._imagePreviewURL = imagePreviewURL
-    }
-
     var body: some View {
-        let state = mediaSendState(for: deliveryStatus)
+        let state = mediaSendState(for: message)
         let isFromMe = conversationUIModel.isMediaMessageFromCurrentUser(message)
         let cancelAction: (() -> Void)? = state.canCancel ? { conversationUIModel.cancelMediaSend(messageID: message.id) } : nil
 
         VStack(alignment: .leading, spacing: 2) {
             HStack(alignment: .center, spacing: 4) {
-                Text(conversationUIModel.formatMessageHeader(message, colorScheme: colorScheme, theme: theme))
+                Text(conversationUIModel.formatMessageHeader(message, colorScheme: colorScheme))
                     .fixedSize(horizontal: false, vertical: true)
                     .frame(maxWidth: .infinity, alignment: .leading)
                 if message.isPrivate && conversationUIModel.isSentByCurrentUser(message),
-                   let status = deliveryStatus {
+                   let status = message.deliveryStatus {
                     DeliveryStatusView(status: status)
                         .padding(.leading, 4)
                 }
@@ -77,10 +63,10 @@ struct MediaMessageView: View {
         .padding(.vertical, 4)
     }
 
-    private func mediaSendState(for deliveryStatus: DeliveryStatus?) -> (isSending: Bool, progress: Double?, canCancel: Bool) {
+    private func mediaSendState(for message: BitchatMessage) -> (isSending: Bool, progress: Double?, canCancel: Bool) {
         var isSending = false
         var progress: Double?
-        if let status = deliveryStatus {
+        if let status = message.deliveryStatus {
             switch status {
             case .sending:
                 isSending = true

bitchat/Views/Media/VoiceNoteView.swift

@@ -8,7 +8,6 @@ struct VoiceNoteView: View {
     private let onCancel: (() -> Void)?
 
     @Environment(\.colorScheme) private var colorScheme
-    @ThemedPalette private var palette
     @StateObject private var playback: VoiceNotePlaybackController
     @State private var waveform: [Float] = []
 
@@ -32,7 +31,7 @@ struct VoiceNoteView: View {
     }
 
     private var borderColor: Color {
-        colorScheme == .dark ? palette.accent.opacity(0.3) : palette.accent.opacity(0.2)
+        colorScheme == .dark ? Color.green.opacity(0.3) : Color.green.opacity(0.2)
     }
 
     private var playbackLabel: String {
@@ -47,7 +46,7 @@ struct VoiceNoteView: View {
                 Image(systemName: playback.isPlaying ? "pause.fill" : "play.fill")
                     .foregroundColor(.white)
                     .frame(width: 36, height: 36)
-                    .background(Circle().fill(palette.accent))
+                    .background(Circle().fill(Color.green))
             }
             .buttonStyle(.plain)
 
@@ -62,7 +61,7 @@ struct VoiceNoteView: View {
             )
 
             Text(playbackLabel)
-                .bitchatFont(size: 13)
+                .font(.bitchatSystem(size: 13, design: .monospaced))
                 .foregroundColor(Color.secondary)
 
             if let onCancel = onCancel, isSending {

bitchat/Views/Media/WaveformView.swift

@@ -6,7 +6,6 @@ struct WaveformView: View {
     let sendProgress: Double?
     let onSeek: ((Double) -> Void)?
     let isInteractive: Bool
-    @ThemedPalette private var palette
 
     private var clampedPlayback: Double {
         max(0, min(1, playbackProgress))
@@ -38,9 +37,9 @@ struct WaveformView: View {
                         let binPosition = Double(index) / Double(samples.count)
                         let color: Color
                         if binPosition <= clampedPlayback {
-                            color = palette.accent
+                            color = Color.green
                         } else if let send = clampedSend, binPosition <= send {
-                            color = palette.accentBlue
+                            color = Color.blue
                         } else {
                             color = Color.gray.opacity(0.35)
                         }

bitchat/Views/MeshPeerList.swift

@@ -3,7 +3,8 @@ import BitFoundation
 
 struct MeshPeerList: View {
     @EnvironmentObject private var peerListModel: PeerListModel
-    @ThemedPalette private var palette
+    let textColor: Color
+    let secondaryTextColor: Color
     let onTapPeer: (PeerID) -> Void
     let onToggleFavorite: (PeerID) -> Void
     let onShowFingerprint: (PeerID) -> Void
@@ -27,8 +28,8 @@ struct MeshPeerList: View {
         if peerListModel.meshRows.isEmpty {
             VStack(alignment: .leading, spacing: 0) {
                 Text(Strings.noneNearby)
-                    .bitchatFont(size: 14)
-                    .foregroundColor(palette.secondary)
+                    .font(.bitchatSystem(size: 14, design: .monospaced))
+                    .foregroundColor(secondaryTextColor)
                     .padding(.horizontal)
                     .padding(.top, 12)
             }
@@ -63,18 +64,18 @@ struct MeshPeerList: View {
                             // Fallback icon for others (dimmed)
                             Image(systemName: "person")
                                 .font(.bitchatSystem(size: 10))
-                                .foregroundColor(palette.secondary)
+                                .foregroundColor(secondaryTextColor)
                         }
 
                         let (base, suffix) = peer.displayName.splitSuffix()
                         HStack(spacing: 0) {
                             Text(base)
-                                .bitchatFont(size: 14)
+                                .font(.bitchatSystem(size: 14, design: .monospaced))
                                 .foregroundColor(baseColor)
                             if !suffix.isEmpty {
                                 let suffixColor = isMe ? Color.orange.opacity(0.6) : baseColor.opacity(0.6)
                                 Text(suffix)
-                                    .bitchatFont(size: 14)
+                                    .font(.bitchatSystem(size: 14, design: .monospaced))
                                     .foregroundColor(suffixColor)
                             }
                         }
@@ -122,7 +123,7 @@ struct MeshPeerList: View {
                             Button(action: { onToggleFavorite(peer.peerID) }) {
                                 Image(systemName: peer.isFavorite ? "star.fill" : "star")
                                     .font(.bitchatSystem(size: 12))
-                                    .foregroundColor(peer.isFavorite ? .yellow : palette.secondary)
+                                    .foregroundColor(peer.isFavorite ? .yellow : secondaryTextColor)
                             }
                             .buttonStyle(.plain)
                         }

bitchat/Views/MessageListView.swift

@@ -21,7 +21,6 @@ struct MessageListView: View {
     @EnvironmentObject private var locationChannelsModel: LocationChannelsModel
 
     @Environment(\.colorScheme) private var colorScheme
-    @Environment(\.appTheme) private var theme
 
     let privatePeer: PeerID?
     @Binding var isAtBottom: Bool
@@ -223,7 +222,7 @@ private extension MessageListView {
 
     @ViewBuilder
     func systemMessageRow(_ message: BitchatMessage) -> some View {
-        Text(conversationUIModel.formatMessage(message, colorScheme: colorScheme, theme: theme))
+        Text(conversationUIModel.formatMessage(message, colorScheme: colorScheme))
             .fixedSize(horizontal: false, vertical: true)
             .frame(maxWidth: .infinity, alignment: .leading)
     }
@@ -306,10 +305,10 @@ private extension MessageListView {
 
     var targetPeerID: String? {
         if let peer = privatePeer,
-           let last = privateInboxModel.messages(for: peer).last?.id {
+           let last = privateInboxModel.messages(for: peer).suffix(300).last?.id {
             return "dm:\(peer)|\(last)"
         }
-        if let last = publicChatModel.messages.last?.id {
+        if let last = publicChatModel.messages.suffix(300).last?.id {
             return "\(locationChannelsModel.selectedChannel.contextKey)|\(last)"
         }
         return nil
@@ -330,7 +329,7 @@ private extension MessageListView {
         func scrollIfNeeded(date: Date) {
             lastScrollTime = date
             let contextKey = locationChannelsModel.selectedChannel.contextKey
-            if let target = messages.last.map({ "\(contextKey)|\($0.id)" }) {
+            if let target = messages.suffix(windowCountPublic).last.map({ "\(contextKey)|\($0.id)" }) {
                 proxy.scrollTo(target, anchor: .bottom)
             }
         }
@@ -369,7 +368,8 @@ private extension MessageListView {
         func scrollIfNeeded(date: Date) {
             lastScrollTime = date
             let contextKey = "dm:\(peerID)"
-            if let target = messages.last.map({ "\(contextKey)|\($0.id)" }) {
+            let count = windowCountPrivate[peerID] ?? 300
+            if let target = messages.suffix(count).last.map({ "\(contextKey)|\($0.id)" }){
                 proxy.scrollTo(target, anchor: .bottom)
             }
         }
@@ -399,7 +399,7 @@ private extension MessageListView {
             isAtBottom = true
             windowCountPublic = TransportConfig.uiWindowInitialCountPublic
             let contextKey = "geo:\(ch.geohash)"
-            if let target = publicChatModel.messages.last?.id.map({ "\(contextKey)|\($0)" }) {
+            if let target = publicChatModel.messages.suffix(windowCountPublic).last?.id.map({ "\(contextKey)|\($0)" }) {
                 proxy.scrollTo(target, anchor: .bottom)
             }
         }

bitchat/Views/VerificationViews.swift

@@ -21,7 +21,7 @@ struct MyQRView: View {
     var body: some View {
         VStack(spacing: 12) {
             Text(Strings.title)
-                .bitchatFont(size: 16, weight: .bold)
+                .font(.bitchatSystem(size: 16, weight: .bold, design: .monospaced))
 
             VStack(spacing: 10) {
                 QRCodeImage(data: qrString, size: 240)
@@ -29,7 +29,7 @@ struct MyQRView: View {
 
                 // Non-scrolling, fully visible URL (wraps across lines)
                 Text(qrString)
-                    .bitchatFont(size: 11)
+                    .font(.bitchatSystem(size: 11, design: .monospaced))
                     .textSelection(.enabled)
                     .multilineTextAlignment(.leading)
                     .fixedSize(horizontal: false, vertical: true)
@@ -69,7 +69,7 @@ struct QRCodeImage: View {
                     .frame(width: size, height: size)
                     .overlay(
                         Text(Strings.unavailable)
-                            .bitchatFont(size: 12)
+                            .font(.bitchatSystem(size: 12, design: .monospaced))
                             .foregroundColor(.gray)
                     )
             }
@@ -150,7 +150,7 @@ struct QRScanView: View {
             .clipShape(RoundedRectangle(cornerRadius: 8))
             #else
             Text(Strings.pastePrompt)
-                .bitchatFont(size: 14, weight: .medium)
+                .font(.bitchatSystem(size: 14, weight: .medium, design: .monospaced))
             TextEditor(text: $input)
                 .frame(height: 100)
                 .border(Color.gray.opacity(0.4))
@@ -281,10 +281,10 @@ struct VerificationSheetView: View {
     @EnvironmentObject private var verificationModel: VerificationModel
     @Binding var isPresented: Bool
     @State private var showingScanner = false
-    @ThemedPalette private var palette
+    @Environment(\.colorScheme) var colorScheme
 
-    private var backgroundColor: Color { palette.background }
-    private var accentColor: Color { palette.accent }
+    private var backgroundColor: Color { colorScheme == .dark ? Color.black : Color.white }
+    private var accentColor: Color { colorScheme == .dark ? Color.green : Color(red: 0, green: 0.5, blue: 0) }
     private var boxColor: Color { Color.gray.opacity(0.1) }
 
     var body: some View {
@@ -292,7 +292,7 @@ struct VerificationSheetView: View {
             // Top header (always at top)
             HStack {
                 Text("verification.sheet.title")
-                    .bitchatFont(size: 14, weight: .bold)
+                    .font(.bitchatSystem(size: 14, weight: .bold, design: .monospaced))
                     .foregroundColor(accentColor)
                 Spacer()
                 Button(action: {
@@ -316,7 +316,7 @@ struct VerificationSheetView: View {
                 if showingScanner {
                     VStack(alignment: .leading, spacing: 12) {
                         Text("verification.scan.prompt_friend")
-                            .bitchatFont(size: 16, weight: .bold)
+                            .font(.bitchatSystem(size: 16, weight: .bold, design: .monospaced))
                             .frame(maxWidth: .infinity)
                             .multilineTextAlignment(.center)
                             .foregroundColor(accentColor)
@@ -350,13 +350,13 @@ struct VerificationSheetView: View {
                 if showingScanner {
                     Button(action: { showingScanner = false }) {
                         Label("show my qr", systemImage: "qrcode")
-                            .bitchatFont(size: 13)
+                            .font(.bitchatSystem(size: 13, design: .monospaced))
                     }
                     .buttonStyle(.bordered)
                 } else {
                     Button(action: { showingScanner = true }) {
                         Label("scan someone else's qr", systemImage: "camera.viewfinder")
-                            .bitchatFont(size: 13, weight: .medium)
+                            .font(.bitchatSystem(size: 13, weight: .medium, design: .monospaced))
                     }
                     .buttonStyle(.bordered)
                     .tint(.gray)
@@ -367,7 +367,7 @@ struct VerificationSheetView: View {
                    verificationModel.isVerified(peerID: peerID) {
                     Button(action: { verificationModel.unverifyFingerprint(for: peerID) }) {
                         Label("remove verification", systemImage: "minus.circle")
-                            .bitchatFont(size: 12)
+                            .font(.bitchatSystem(size: 12, design: .monospaced))
                     }
                     .buttonStyle(.bordered)
                     .tint(.gray)
@@ -376,7 +376,7 @@ struct VerificationSheetView: View {
             .frame(maxWidth: .infinity)
             .padding(.vertical, 14)
         }
-        .themedSheetBackground()
+        .background(backgroundColor)
         .onDisappear { showingScanner = false }
     }
 }

bitchatTests/AppArchitectureTests.swift

@@ -1,5 +1,4 @@
 import BitFoundation
-import Combine
 import Foundation
 import Testing
 @testable import bitchat
@@ -46,27 +45,6 @@ private func makeArchitectureSnapshot(
     )
 }
 
-@MainActor
-private func makeArchitectureMessage(
-    id: String,
-    timestamp: TimeInterval = 0,
-    content: String? = nil,
-    isPrivate: Bool = false,
-    senderPeerID: PeerID = PeerID(str: "peer-a")
-) -> BitchatMessage {
-    BitchatMessage(
-        id: id,
-        sender: "alice",
-        content: content ?? "message \(id)",
-        timestamp: Date(timeIntervalSince1970: timestamp),
-        isRelay: false,
-        originalSender: nil,
-        isPrivate: isPrivate,
-        recipientNickname: isPrivate ? "builder" : nil,
-        senderPeerID: senderPeerID
-    )
-}
-
 @MainActor
 private func waitUntil(
     timeoutNanoseconds: UInt64 = 3_000_000_000,
@@ -149,119 +127,251 @@ struct AppArchitectureTests {
 
     @Test("PeerHandle equality and hashing use the canonical identity only")
     func peerHandleEqualityUsesCanonicalIdentity() {
-        let first = PeerHandle(id: "noise:abc123", routingPeerID: PeerID(str: "peer-a"))
-        let second = PeerHandle(id: "noise:abc123", routingPeerID: PeerID(str: "peer-b"))
+        let first = PeerHandle(
+            id: "noise:abc123",
+            routingPeerID: PeerID(str: "peer-a"),
+            displayName: "alice",
+            noisePublicKeyHex: "abc123",
+            nostrPublicKey: nil
+        )
+        let second = PeerHandle(
+            id: "noise:abc123",
+            routingPeerID: PeerID(str: "peer-b"),
+            displayName: "alice-renamed",
+            noisePublicKeyHex: nil,
+            nostrPublicKey: "npub123"
+        )
 
         #expect(first == second)
         #expect(Set([first, second]).count == 1)
     }
 
-    @Test("ConversationStore orders timelines and replaces duplicates by message ID")
+    @Test("ConversationStore normalizes timeline ordering and duplicates")
     @MainActor
-    func conversationStoreOrdersAndDedupsMessages() {
+    func conversationStoreNormalizesMessages() {
         let store = ConversationStore()
-        let older = makeArchitectureMessage(id: "m1", timestamp: 1, content: "first")
-        let newer = makeArchitectureMessage(id: "m2", timestamp: 2, content: "second")
-        let replacement = makeArchitectureMessage(id: "m2", timestamp: 2, content: "second-updated")
+        let older = BitchatMessage(
+            id: "m1",
+            sender: "alice",
+            content: "first",
+            timestamp: Date(timeIntervalSince1970: 1),
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: false,
+            recipientNickname: nil,
+            senderPeerID: PeerID(str: "peer-a")
+        )
+        let newer = BitchatMessage(
+            id: "m2",
+            sender: "alice",
+            content: "second",
+            timestamp: Date(timeIntervalSince1970: 2),
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: false,
+            recipientNickname: nil,
+            senderPeerID: PeerID(str: "peer-a")
+        )
+        let replacement = BitchatMessage(
+            id: "m2",
+            sender: "alice",
+            content: "second-updated",
+            timestamp: Date(timeIntervalSince1970: 2),
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: false,
+            recipientNickname: nil,
+            senderPeerID: PeerID(str: "peer-a")
+        )
 
-        store.append(newer, to: .mesh)
-        store.append(older, to: .mesh)
-        store.upsertByID(replacement, in: .mesh)
+        store.replaceMessages([newer, older, replacement], for: ConversationID.mesh)
 
-        let messages = store.conversation(for: .mesh).messages
+        let messages = store.messages(for: ConversationID.mesh)
         #expect(messages.map(\.id) == ["m1", "m2"])
         #expect(messages.last?.content == "second-updated")
     }
 
-    @Test("ConversationStore tracks unread direct conversations by routing peer ID")
+    @Test("ConversationStore tracks unread direct conversations with canonical IDs")
     @MainActor
     func conversationStoreTracksUnreadDirectConversations() {
         let store = ConversationStore()
+        let resolver = IdentityResolver()
         let peerID = PeerID(str: "peer-1")
-        let message = makeArchitectureMessage(id: "dm-1", isPrivate: true, senderPeerID: peerID)
+        let message = BitchatMessage(
+            id: "dm-1",
+            sender: "alice",
+            content: "hello",
+            timestamp: Date(),
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: true,
+            recipientNickname: "bob",
+            senderPeerID: peerID
+        )
 
-        store.append(message, to: .directPeer(peerID))
-        store.markUnread(.directPeer(peerID))
+        store.synchronizePrivateChats(
+            [peerID: [message]],
+            unreadPeerIDs: Set([peerID]),
+            identityResolver: resolver
+        )
 
-        #expect(store.conversation(for: .directPeer(peerID)).messages.map(\.id) == ["dm-1"])
-        #expect(store.unreadDirectRoutingPeerIDs() == Set([peerID]))
-        #expect(store.conversation(for: .directPeer(peerID)).isUnread)
+        let conversationID = ConversationID.direct(
+            resolver.canonicalHandle(for: peerID, displayName: "alice")
+        )
 
-        store.markRead(.directPeer(peerID))
-        #expect(store.unreadDirectRoutingPeerIDs().isEmpty)
-        #expect(!store.conversation(for: .directPeer(peerID)).isUnread)
+        #expect(store.messages(for: conversationID).map(\.id) == ["dm-1"])
+        #expect(store.unreadConversations.contains(conversationID))
+
+        store.markRead(conversationID)
+        #expect(!store.unreadConversations.contains(conversationID))
     }
 
-    @Test("ConversationStore derives the selected conversation from channel and private peer")
+    @Test("ConversationStore tracks the selected app conversation context")
     @MainActor
     func conversationStoreTracksSelectedConversationContext() {
         let store = ConversationStore()
-        let peerID = PeerID(str: "0011223344556677")
+        let resolver = IdentityResolver()
+        let noiseKey = Data((0..<32).map(UInt8.init))
+        let shortPeerID = PeerID(str: "0011223344556677")
         let geohashChannel = ChannelID.location(GeohashChannel(level: .city, geohash: "9q8yy"))
+        let peer = BitchatPeer(
+            peerID: shortPeerID,
+            noisePublicKey: noiseKey,
+            nickname: "alice",
+            isConnected: true,
+            isReachable: true
+        )
 
-        store.setActiveChannel(geohashChannel)
-        store.setSelectedPrivatePeer(peerID)
+        resolver.register(peers: [peer])
+        store.synchronizeSelection(
+            activeChannel: geohashChannel,
+            selectedPeerID: shortPeerID,
+            identityResolver: resolver
+        )
+
+        let expectedConversationID = ConversationID.direct(
+            resolver.canonicalHandle(for: shortPeerID, displayName: "alice")
+        )
 
         #expect(store.activeChannel == geohashChannel)
-        #expect(store.selectedPrivatePeerID == peerID)
-        // The open private chat wins the derived selection.
-        #expect(store.selectedConversationID == ConversationID.directPeer(peerID))
+        #expect(store.selectedPrivatePeerID == shortPeerID)
+        #expect(store.selectedConversationID == expectedConversationID)
 
-        store.setSelectedPrivatePeer(nil)
-        // Selection falls back to the active public channel.
-        #expect(store.selectedConversationID == ConversationID(channelID: geohashChannel))
+        store.synchronizeSelection(
+            activeChannel: ChannelID.mesh,
+            selectedPeerID: nil,
+            identityResolver: resolver
+        )
 
-        store.setActiveChannel(.mesh)
         #expect(store.activeChannel == ChannelID.mesh)
         #expect(store.selectedPrivatePeerID == nil)
         #expect(store.selectedConversationID == ConversationID.mesh)
     }
 
-    @Test("ConversationStore re-keys a direct conversation via the migrate intent")
+    @Test("ConversationStore exposes direct conversations by the latest routing peer ID")
     @MainActor
-    func conversationStoreMigratesDirectConversationsBetweenPeerIDs() {
+    func conversationStoreExposesDirectConversationsByLatestRoutingPeerID() {
         let store = ConversationStore()
+        let resolver = IdentityResolver()
         let noiseKey = Data((0..<32).map(UInt8.init))
         let shortPeerID = PeerID(str: "0011223344556677")
         let fullPeerID = PeerID(hexData: noiseKey)
-
-        store.append(
-            makeArchitectureMessage(id: "dm-1", timestamp: 1, isPrivate: true, senderPeerID: shortPeerID),
-            to: .directPeer(shortPeerID)
+        let firstMessage = BitchatMessage(
+            id: "dm-1",
+            sender: "alice",
+            content: "short id",
+            timestamp: Date(timeIntervalSince1970: 1),
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: true,
+            recipientNickname: "builder",
+            senderPeerID: shortPeerID
+        )
+        let secondMessage = BitchatMessage(
+            id: "dm-2",
+            sender: "alice",
+            content: "full id",
+            timestamp: Date(timeIntervalSince1970: 2),
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: true,
+            recipientNickname: "builder",
+            senderPeerID: fullPeerID
         )
-        store.markUnread(.directPeer(shortPeerID))
-        store.setSelectedPrivatePeer(shortPeerID)
 
-        store.migrateConversation(from: .directPeer(shortPeerID), to: .directPeer(fullPeerID))
+        resolver.register(
+            peer: BitchatPeer(
+                peerID: shortPeerID,
+                noisePublicKey: noiseKey,
+                nickname: "alice",
+                isConnected: true,
+                isReachable: true
+            )
+        )
+        store.synchronizePrivateChats(
+            [shortPeerID: [firstMessage]],
+            unreadPeerIDs: Set([shortPeerID]),
+            identityResolver: resolver
+        )
 
-        // Raw keying: the old peer's conversation is gone, the new peer's
-        // conversation holds the timeline, unread and selection carried over.
-        #expect(store.conversationsByID[.directPeer(shortPeerID)] == nil)
-        #expect(Set(store.directMessagesByRoutingPeerID().keys) == Set([fullPeerID]))
-        #expect(store.directMessagesByRoutingPeerID()[fullPeerID]?.map(\.id) == ["dm-1"])
-        #expect(store.unreadDirectRoutingPeerIDs() == Set([fullPeerID]))
-        #expect(store.selectedPrivatePeerID == fullPeerID)
-        #expect(store.selectedConversationID == ConversationID.directPeer(fullPeerID))
+        resolver.register(
+            peer: BitchatPeer(
+                peerID: fullPeerID,
+                noisePublicKey: noiseKey,
+                nickname: "alice",
+                isConnected: true,
+                isReachable: true
+            )
+        )
+        store.synchronizePrivateChats(
+            [fullPeerID: [secondMessage]],
+            unreadPeerIDs: Set([fullPeerID]),
+            identityResolver: resolver
+        )
+
+        #expect(Set(store.directMessagesByPeerID().keys) == Set([fullPeerID]))
+        #expect(store.directMessagesByPeerID()[fullPeerID]?.map(\.id) == ["dm-2"])
+        #expect(store.unreadDirectPeerIDs() == Set([fullPeerID]))
     }
 
-    @Test("PrivateInboxModel reads direct message state from the ConversationStore")
+    @Test("PrivateInboxModel mirrors direct message state from ConversationStore")
     @MainActor
-    func privateInboxModelReadsDirectMessageStateFromConversationStore() {
+    func privateInboxModelMirrorsDirectMessageStateFromConversationStore() async {
         let store = ConversationStore()
-        let inboxModel = PrivateInboxModel(conversations: store)
+        let resolver = IdentityResolver()
+        let inboxModel = PrivateInboxModel(conversationStore: store)
         let messagePeerID = PeerID(str: "peer-1")
         let unreadOnlyPeerID = PeerID(str: "peer-2")
         let selectedOnlyPeerID = PeerID(str: "peer-3")
-
-        store.append(
-            makeArchitectureMessage(id: "dm-1", isPrivate: true, senderPeerID: messagePeerID),
-            to: .directPeer(messagePeerID)
+        let message = BitchatMessage(
+            id: "dm-1",
+            sender: "alice",
+            content: "hello",
+            timestamp: Date(),
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: true,
+            recipientNickname: "builder",
+            senderPeerID: messagePeerID
         )
-        store.markUnread(.directPeer(messagePeerID))
-        store.markUnread(.directPeer(unreadOnlyPeerID))
-        store.setSelectedPrivatePeer(selectedOnlyPeerID)
 
-        // Reads are synchronous against the single-writer store.
+        store.synchronizePrivateChats(
+            [messagePeerID: [message]],
+            unreadPeerIDs: Set([messagePeerID, unreadOnlyPeerID]),
+            identityResolver: resolver
+        )
+        store.synchronizeSelection(
+            activeChannel: ChannelID.mesh,
+            selectedPeerID: selectedOnlyPeerID,
+            identityResolver: resolver
+        )
+
+        await waitUntil {
+            inboxModel.selectedPeerID == selectedOnlyPeerID &&
+            inboxModel.unreadPeerIDs == Set([messagePeerID, unreadOnlyPeerID]) &&
+            Set(inboxModel.messagesByPeerID.keys) == Set([messagePeerID, unreadOnlyPeerID, selectedOnlyPeerID])
+        }
+
         #expect(inboxModel.selectedPeerID == selectedOnlyPeerID)
         #expect(inboxModel.unreadPeerIDs == Set([messagePeerID, unreadOnlyPeerID]))
         #expect(inboxModel.messages(for: messagePeerID).map(\.id) == ["dm-1"])
@@ -269,115 +379,13 @@ struct AppArchitectureTests {
         #expect(inboxModel.messages(for: selectedOnlyPeerID).isEmpty)
     }
 
-    @Test("PrivateInboxModel republishes only for the selected conversation")
-    @MainActor
-    func privateInboxModelIsolatesBackgroundConversations() {
-        let store = ConversationStore()
-        let inboxModel = PrivateInboxModel(conversations: store)
-        let selectedPeerID = PeerID(str: "peer-selected")
-        let backgroundPeerID = PeerID(str: "peer-background")
-        store.setSelectedPrivatePeer(selectedPeerID)
-
-        var emissions = 0
-        let cancellable = inboxModel.objectWillChange.sink { _ in emissions += 1 }
-        defer { cancellable.cancel() }
-
-        let baseline = emissions
-        store.append(
-            makeArchitectureMessage(id: "dm-bg-1", isPrivate: true, senderPeerID: backgroundPeerID),
-            to: .directPeer(backgroundPeerID)
-        )
-        // An append to a background chat does not republish the model.
-        #expect(emissions == baseline)
-
-        store.append(
-            makeArchitectureMessage(id: "dm-sel-1", isPrivate: true, senderPeerID: selectedPeerID),
-            to: .directPeer(selectedPeerID)
-        )
-        #expect(emissions == baseline + 1)
-        #expect(inboxModel.messages(for: selectedPeerID).map(\.id) == ["dm-sel-1"])
-    }
-
-    @Test("PrivateInboxModel republishes read receipts for the selected DM (ephemeral- and stable-keyed)")
-    @MainActor
-    func privateInboxModelRepublishesReadReceiptsForSelectedConversation() {
-        // A DM's messages can live under BOTH .directPeer(ephemeral) and
-        // .directPeer(stableKey) (mirroring shares one BitchatMessage
-        // instance); the view's read-receipt update must fire no matter
-        // which of the two keys the selection holds.
-        let ephemeralPeerID = PeerID(str: "abcdef1234567890")
-        let stablePeerID = PeerID(str: String(repeating: "ab", count: 32))
-
-        for selectedPeerID in [ephemeralPeerID, stablePeerID] {
-            let store = ConversationStore()
-            let inboxModel = PrivateInboxModel(conversations: store)
-            store.setSelectedPrivatePeer(selectedPeerID)
-
-            // One shared instance mirrored into both direct conversations,
-            // exactly like `mirrorToEphemeralIfNeeded`.
-            let message = makeArchitectureMessage(
-                id: "dm-read-1",
-                isPrivate: true,
-                senderPeerID: ephemeralPeerID
-            )
-            store.append(message, to: .directPeer(ephemeralPeerID))
-            store.upsertByID(message, in: .directPeer(stablePeerID))
-
-            var emissions = 0
-            let cancellable = inboxModel.objectWillChange.sink { _ in emissions += 1 }
-            defer { cancellable.cancel() }
-
-            // ID-only intent — the exact call `ChatDeliveryCoordinator`
-            // makes when a READ ack arrives.
-            let read = DeliveryStatus.read(by: "builder", at: Date(timeIntervalSince1970: 100))
-            #expect(store.setDeliveryStatus(read, forMessageID: "dm-read-1"))
-
-            // The fan-out emits .statusChanged for both containing
-            // conversations; exactly the selected one republishes the model.
-            #expect(emissions == 1)
-            #expect(inboxModel.messages(for: selectedPeerID).first?.deliveryStatus == read)
-        }
-    }
-
-    @Test("PublicChatModel ignores appends to background conversations")
-    @MainActor
-    func publicChatModelIsolatesBackgroundConversations() {
-        let store = ConversationStore()
-        store.setActiveChannel(.mesh)
-        let model = PublicChatModel(conversations: store)
-
-        var emissions = 0
-        let cancellable = model.objectWillChange.sink { _ in emissions += 1 }
-        defer { cancellable.cancel() }
-
-        store.append(makeArchitectureMessage(id: "mesh-1"), to: .mesh)
-        let afterActiveAppend = emissions
-        #expect(afterActiveAppend >= 1)
-        #expect(model.messages.map(\.id) == ["mesh-1"])
-
-        // Appends to a background geohash channel and to a private chat do
-        // not invalidate the observer of the active conversation.
-        store.append(makeArchitectureMessage(id: "geo-1"), to: .geohash("u4pruyd"))
-        store.append(
-            makeArchitectureMessage(id: "dm-1", isPrivate: true),
-            to: .directPeer(PeerID(str: "peer-1"))
-        )
-        #expect(emissions == afterActiveAppend)
-        #expect(model.messages.map(\.id) == ["mesh-1"])
-
-        // Switching the channel retargets the observation.
-        store.setActiveChannel(.location(GeohashChannel(level: .neighborhood, geohash: "u4pruyd")))
-        #expect(model.messages.map(\.id) == ["geo-1"])
-        store.append(makeArchitectureMessage(id: "geo-2", timestamp: 1), to: .geohash("u4pruyd"))
-        #expect(model.messages.map(\.id) == ["geo-1", "geo-2"])
-    }
-
     @Test("AppChromeModel mirrors nickname and unread state through focused models")
     @MainActor
     func appChromeModelMirrorsNicknameAndUnreadState() async {
         let viewModel = makeArchitectureViewModel()
-        let conversations = ConversationStore()
-        let privateInboxModel = PrivateInboxModel(conversations: conversations)
+        let conversationStore = ConversationStore()
+        let resolver = IdentityResolver()
+        let privateInboxModel = PrivateInboxModel(conversationStore: conversationStore)
         let chromeModel = AppChromeModel(chatViewModel: viewModel, privateInboxModel: privateInboxModel)
 
         chromeModel.setNickname("builder")
@@ -390,7 +398,11 @@ struct AppArchitectureTests {
         #expect(!chromeModel.hasUnreadPrivateMessages)
 
         let peerID = PeerID(str: "peer-1")
-        conversations.markUnread(.directPeer(peerID))
+        conversationStore.synchronizePrivateChats(
+            [:],
+            unreadPeerIDs: Set([peerID]),
+            identityResolver: resolver
+        )
         await waitUntil {
             chromeModel.hasUnreadPrivateMessages
         }
@@ -402,7 +414,8 @@ struct AppArchitectureTests {
     @MainActor
     func appChromeModelOwnsPresentationState() {
         let viewModel = makeArchitectureViewModel()
-        let privateInboxModel = PrivateInboxModel(conversations: ConversationStore())
+        let conversationStore = ConversationStore()
+        let privateInboxModel = PrivateInboxModel(conversationStore: conversationStore)
         let chromeModel = AppChromeModel(chatViewModel: viewModel, privateInboxModel: privateInboxModel)
         let peerID = PeerID(str: "peer-2")
 
@@ -428,10 +441,11 @@ struct AppArchitectureTests {
             Issue.record("Expected ChatViewModel meshService to be a MockTransport in architecture tests")
             return
         }
+        let conversationStore = viewModel.conversationStore
         let locationChannelsModel = LocationChannelsModel(manager: makeArchitectureLocationManager())
         let conversationModel = PrivateConversationModel(
             chatViewModel: viewModel,
-            conversations: viewModel.conversations,
+            conversationStore: conversationStore,
             locationChannelsModel: locationChannelsModel
         )
 
@@ -479,17 +493,18 @@ struct AppArchitectureTests {
             return
         }
 
+        let conversationStore = viewModel.conversationStore
         locationManager.select(.mesh)
         let locationChannelsModel = LocationChannelsModel(manager: locationManager)
         let privateConversationModel = PrivateConversationModel(
             chatViewModel: viewModel,
-            conversations: viewModel.conversations,
+            conversationStore: conversationStore,
             locationChannelsModel: locationChannelsModel
         )
         let uiModel = ConversationUIModel(
             chatViewModel: viewModel,
             privateConversationModel: privateConversationModel,
-            conversations: viewModel.conversations
+            conversationStore: conversationStore
         )
         let geohashChannel = ChannelID.location(GeohashChannel(level: .city, geohash: "9q8yy"))
         defer {
@@ -543,10 +558,11 @@ struct AppArchitectureTests {
 
         let peerID = PeerID(str: "0011223344556677")
         let fingerprint = "verified-fingerprint"
+        let conversationStore = viewModel.conversationStore
         let locationChannelsModel = LocationChannelsModel(manager: makeArchitectureLocationManager())
         let privateConversationModel = PrivateConversationModel(
             chatViewModel: viewModel,
-            conversations: viewModel.conversations,
+            conversationStore: conversationStore,
             locationChannelsModel: locationChannelsModel
         )
         let verificationModel = VerificationModel(
@@ -615,7 +631,7 @@ struct AppArchitectureTests {
         transport.reachablePeers.insert(otherPeerID)
         viewModel.nickname = "builder"
         viewModel.verifiedFingerprints.insert(verifiedFingerprint)
-        viewModel.markPrivateChatUnread(otherPeerID)
+        viewModel.unreadPrivateMessages = Set([otherPeerID])
         transport.updatePeerSnapshots([
             makeArchitectureSnapshot(
                 peerID: myPeerID,
@@ -648,7 +664,7 @@ struct AppArchitectureTests {
 
         let peerListModel = PeerListModel(
             chatViewModel: viewModel,
-            conversations: viewModel.conversations,
+            conversationStore: viewModel.conversationStore,
             locationChannelsModel: locationChannelsModel
         )
 

bitchatTests/BLEServiceCoreTests.swift

@@ -14,29 +14,23 @@ import BitFoundation
 struct BLEServiceCoreTests {
 
     @Test
-    func duplicatePacket_isDeduped() async throws {
+    func duplicatePacket_isDeduped() async {
         let ble = makeService()
         let delegate = PublicCaptureDelegate()
         ble.delegate = delegate
 
-        // Public messages must carry a valid signature from the claimed sender;
-        // sign the packet and preseed the sender's signing key so the receiver
-        // can verify it (production `sendMessage` signs public broadcasts too).
-        let signer = NoiseEncryptionService(keychain: MockKeychain())
         let sender = PeerID(str: "1122334455667788")
         let timestamp = UInt64(Date().timeIntervalSince1970 * 1000)
-        let unsigned = makePublicPacket(content: "Hello", sender: sender, timestamp: timestamp)
-        let packet = try #require(signer.signPacket(unsigned), "Failed to sign public message")
-        let signingKey = signer.getSigningPublicKeyData()
+        let packet = makePublicPacket(content: "Hello", sender: sender, timestamp: timestamp)
 
-        ble._test_handlePacket(packet, fromPeerID: sender, signingPublicKey: signingKey)
+        ble._test_handlePacket(packet, fromPeerID: sender)
         let receivedFirst = await TestHelpers.waitUntil(
             { delegate.publicMessagesSnapshot().count == 1 },
             timeout: TestConstants.defaultTimeout
         )
         #expect(receivedFirst)
 
-        ble._test_handlePacket(packet, fromPeerID: sender, signingPublicKey: signingKey)
+        ble._test_handlePacket(packet, fromPeerID: sender)
         let receivedDuplicate = await TestHelpers.waitUntil(
             { delegate.publicMessagesSnapshot().count > 1 },
             timeout: TestConstants.shortTimeout
@@ -170,23 +164,6 @@ struct BLEServiceCoreTests {
         #expect(!ble._test_recordIngressIfNew(packet: packet, linkID: "central-b"))
     }
 
-    @Test
-    func panicReset_rotatesPeerIDDerivedFromNewNoiseFingerprint() async throws {
-        let ble = makeService()
-        let originalPeerID = ble.myPeerID
-        let originalFingerprint = ble.noiseIdentityFingerprint()
-        #expect(originalPeerID == PeerID(str: originalFingerprint.prefix(16)))
-
-        ble.resetIdentityForPanic(currentNickname: "anon")
-
-        // The Noise identity is regenerated and the peer ID swaps with it
-        // (atomically, behind a messageQueue barrier).
-        let newFingerprint = ble.noiseIdentityFingerprint()
-        #expect(newFingerprint != originalFingerprint)
-        #expect(ble.myPeerID != originalPeerID)
-        #expect(ble.myPeerID == PeerID(str: newFingerprint.prefix(16)))
-    }
-
     @Test
     func modifiedServices_rediscoverWhenBitChatServiceIsInvalidated() async throws {
         let otherService = CBUUID(string: "0000180F-0000-1000-8000-00805F9B34FB")

bitchatTests/ChatComposerCoordinatorContextTests.swift

@@ -1,157 +0,0 @@
-//
-// ChatComposerCoordinatorContextTests.swift
-// bitchatTests
-//
-// Exercises `ChatComposerCoordinator` against a mock `ChatComposerContext` —
-// proving the coordinator works without a `ChatViewModel`, following the
-// `ChatDeliveryCoordinatorContextTests` exemplar.
-//
-// Scope note: mention parsing uses the shared, precompiled
-// `ChatViewModel.Patterns.mention` regex (a static, stateless singleton);
-// everything else flows through the mock context.
-//
-
-import Testing
-import Foundation
-import BitFoundation
-@testable import bitchat
-
-// MARK: - Mock Context
-
-/// Lightweight stand-in for `ChatComposerContext` proving that
-/// `ChatComposerCoordinator` is testable without a `ChatViewModel`.
-@MainActor
-private final class MockChatComposerContext: ChatComposerContext {
-    // Autocomplete UI state
-    var autocompleteSuggestions: [String] = []
-    var autocompleteRange: NSRange?
-    var showAutocomplete = false
-    var selectedAutocompleteIndex = -1
-    var queryResult: (suggestions: [String], range: NSRange?) = ([], nil)
-    private(set) var queriedPeerCandidates: [[String]] = []
-    private(set) var appliedSuggestions: [(suggestion: String, text: String, range: NSRange)] = []
-
-    func autocompleteQuery(
-        for text: String,
-        peers: [String],
-        cursorPosition: Int
-    ) -> (suggestions: [String], range: NSRange?) {
-        queriedPeerCandidates.append(peers.sorted())
-        return queryResult
-    }
-
-    func applyAutocompleteSuggestion(_ suggestion: String, to text: String, range: NSRange) -> String {
-        appliedSuggestions.append((suggestion, text, range))
-        guard let textRange = Range(range, in: text) else { return text }
-        return text.replacingCharacters(in: textRange, with: suggestion)
-    }
-
-    // Identity & channel state
-    var nickname = "me"
-    var myPeerID = PeerID(str: "0011223344556677")
-    var activeChannel: ChannelID = .mesh
-    var meshNickname = "me"
-    var meshNicknamesByPeerID: [PeerID: String] = [:]
-
-    func meshPeerNicknames() -> [PeerID: String] { meshNicknamesByPeerID }
-
-    // Geohash identity
-    var geoNicknames: [String: String] = [:]
-    static let dummyIdentity = NostrIdentity(
-        privateKey: Data(repeating: 0x11, count: 32),
-        publicKey: Data(repeating: 0x22, count: 32),
-        npub: "npub1mock",
-        createdAt: Date(timeIntervalSince1970: 0)
-    )
-
-    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity {
-        Self.dummyIdentity
-    }
-}
-
-// MARK: - Coordinator Tests Against Mock Context
-
-/// Exercises `ChatComposerCoordinator` against `MockChatComposerContext` with
-/// no `ChatViewModel`.
-struct ChatComposerCoordinatorContextTests {
-
-    @Test @MainActor
-    func updateAutocomplete_onMesh_excludesOwnNicknameAndPublishesSuggestions() {
-        let context = MockChatComposerContext()
-        let coordinator = ChatComposerCoordinator(context: context)
-        context.meshNicknamesByPeerID = [
-            PeerID(str: "1111111111111111"): "alice",
-            PeerID(str: "2222222222222222"): "bob",
-            PeerID(str: "3333333333333333"): "me",
-        ]
-
-        // Matching query: suggestions and range are published, index resets.
-        context.queryResult = (["@alice"], NSRange(location: 0, length: 3))
-        coordinator.updateAutocomplete(for: "@al", cursorPosition: 3)
-        #expect(context.queriedPeerCandidates == [["alice", "bob"]])
-        #expect(context.autocompleteSuggestions == ["@alice"])
-        #expect(context.autocompleteRange == NSRange(location: 0, length: 3))
-        #expect(context.showAutocomplete)
-        #expect(context.selectedAutocompleteIndex == 0)
-
-        // No match: all autocomplete state is cleared.
-        context.queryResult = ([], nil)
-        context.selectedAutocompleteIndex = 3
-        coordinator.updateAutocomplete(for: "plain text", cursorPosition: 5)
-        #expect(context.autocompleteSuggestions.isEmpty)
-        #expect(context.autocompleteRange == nil)
-        #expect(!context.showAutocomplete)
-        #expect(context.selectedAutocompleteIndex == 0)
-    }
-
-    @Test @MainActor
-    func updateAutocomplete_onLocationChannel_buildsGeoTokensWithoutOwnToken() {
-        let context = MockChatComposerContext()
-        let coordinator = ChatComposerCoordinator(context: context)
-        context.activeChannel = .location(GeohashChannel(level: .city, geohash: "u4pruydq"))
-        context.geoNicknames = [
-            "aaaabbbbccccdddd": "carol",
-            // Own token (nickname#last-4-of-pubkey) must be removed; the dummy
-            // identity's public key hex ends in "2222".
-            "ffffeeeeddddcccc2222": "me",
-        ]
-
-        coordinator.updateAutocomplete(for: "@ca", cursorPosition: 3)
-        #expect(context.queriedPeerCandidates == [["carol#dddd"]])
-    }
-
-    @Test @MainActor
-    func completeNickname_appliesSuggestionResetsStateAndReturnsCursor() {
-        let context = MockChatComposerContext()
-        let coordinator = ChatComposerCoordinator(context: context)
-
-        // Without an active range the text is untouched.
-        var text = "hello @al"
-        #expect(coordinator.completeNickname("@alice", in: &text) == text.count)
-        #expect(context.appliedSuggestions.isEmpty)
-
-        // With a range the suggestion is applied and state cleared.
-        context.autocompleteRange = NSRange(location: 6, length: 3)
-        context.autocompleteSuggestions = ["@alice"]
-        context.showAutocomplete = true
-        let cursor = coordinator.completeNickname("@alice", in: &text)
-        #expect(text == "hello @alice")
-        #expect(cursor == 6 + "@alice".count + 1)
-        #expect(!context.showAutocomplete)
-        #expect(context.autocompleteSuggestions.isEmpty)
-        #expect(context.autocompleteRange == nil)
-        #expect(context.selectedAutocompleteIndex == 0)
-    }
-
-    @Test @MainActor
-    func parseMentions_acceptsKnownPeersOwnNicknameAndHashSuffix() {
-        let context = MockChatComposerContext()
-        let coordinator = ChatComposerCoordinator(context: context)
-        context.meshNicknamesByPeerID = [PeerID(str: "1111111111111111"): "alice"]
-
-        let mentions = coordinator.parseMentions(
-            from: "hi @alice and @me and @me#0011 but not @stranger"
-        )
-        #expect(Set(mentions) == ["alice", "me", "me#0011"])
-    }
-}

bitchatTests/ChatLifecycleCoordinatorContextTests.swift

@@ -1,362 +0,0 @@
-//
-// ChatLifecycleCoordinatorContextTests.swift
-// bitchatTests
-//
-// Exercises `ChatLifecycleCoordinator` against a mock `ChatLifecycleContext`
-// — proving the coordinator works without a `ChatViewModel`, following the
-// `ChatDeliveryCoordinatorContextTests` /
-// `ChatPrivateConversationCoordinatorContextTests` exemplars.
-//
-// Scope note: the geohash-screenshot branch publishes via
-// `NostrRelayManager.shared` / `GeoRelayDirectory.shared`; that stays covered
-// by the full view-model tests. The GeoDM read pass, the favorites-backed
-// mesh/Nostr read-receipt branch (favorites are injected through the
-// context), message merging, screenshot notices, and lifecycle persistence
-// flows are covered here.
-//
-
-import Testing
-import Foundation
-import BitFoundation
-@testable import bitchat
-
-// MARK: - Mock Context
-
-/// Lightweight stand-in for `ChatLifecycleContext` proving that
-/// `ChatLifecycleCoordinator` is testable without a `ChatViewModel`.
-@MainActor
-private final class MockChatLifecycleContext: ChatLifecycleContext {
-    // Chat & receipt state
-    var messages: [BitchatMessage] = []
-    var privateChats: [PeerID: [BitchatMessage]] = [:]
-
-    func privateMessages(for peerID: PeerID) -> [BitchatMessage] {
-        privateChats[peerID] ?? []
-    }
-    var unreadPrivateMessages: Set<PeerID> = []
-    var selectedPrivateChatPeer: PeerID?
-    var sentReadReceipts: Set<String> = []
-    var nickname = "me"
-    var myPeerID = PeerID(str: "0011223344556677")
-    var activeChannel: ChannelID = .mesh
-    var nostrKeyMapping: [PeerID: String] = [:]
-    private(set) var ownerLevelReadPasses: [PeerID] = []
-    private(set) var managerReadMarks: [PeerID] = []
-    private(set) var systemMessages: [String] = []
-
-    // Conversation store intents
-    @discardableResult
-    func appendPrivateMessage(_ message: BitchatMessage, to peerID: PeerID) -> Bool {
-        var chat = privateChats[peerID] ?? []
-        guard !chat.contains(where: { $0.id == message.id }) else { return false }
-        let index = chat.firstIndex(where: { $0.timestamp > message.timestamp }) ?? chat.count
-        chat.insert(message, at: index)
-        privateChats[peerID] = chat
-        return true
-    }
-
-    func markPrivateChatRead(_ peerID: PeerID) {
-        unreadPrivateMessages.remove(peerID)
-    }
-
-    @discardableResult
-    func markReadReceiptSent(_ messageID: String) -> Bool {
-        sentReadReceipts.insert(messageID).inserted
-    }
-
-    func markPrivateMessagesAsRead(from peerID: PeerID) {
-        ownerLevelReadPasses.append(peerID)
-    }
-
-    func markChatAsRead(from peerID: PeerID) {
-        managerReadMarks.append(peerID)
-    }
-
-    // Scheduled work runs synchronously so tests never poll wall-clock queues.
-    private(set) var scheduledDelays: [TimeInterval] = []
-    func scheduleOnMainAfter(_ delay: TimeInterval, _ work: @escaping @MainActor () -> Void) {
-        scheduledDelays.append(delay)
-        work()
-    }
-
-    func addSystemMessage(_ content: String) { systemMessages.append(content) }
-
-    // Peers & sessions
-    var nicknamesByPeerID: [PeerID: String] = [:]
-    var peersByID: [PeerID: BitchatPeer] = [:]
-    var noiseSessionStates: [PeerID: LazyHandshakeState] = [:]
-    private(set) var stopMeshServicesCount = 0
-    private(set) var refreshBluetoothStateCount = 0
-
-    func peerNickname(for peerID: PeerID) -> String? { nicknamesByPeerID[peerID] }
-    func unifiedPeer(for peerID: PeerID) -> BitchatPeer? { peersByID[peerID] }
-    func noiseSessionState(for peerID: PeerID) -> LazyHandshakeState {
-        noiseSessionStates[peerID] ?? .none
-    }
-    func stopMeshServices() { stopMeshServicesCount += 1 }
-    func refreshBluetoothState() { refreshBluetoothStateCount += 1 }
-
-    // Routing & receipts
-    private(set) var routedPrivateMessages: [(content: String, peerID: PeerID, recipientNickname: String)] = []
-    private(set) var routedReadReceipts: [(messageID: String, peerID: PeerID)] = []
-    private(set) var meshBroadcasts: [String] = []
-    private(set) var geoReadReceipts: [(messageID: String, recipientHex: String)] = []
-
-    func routePrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
-        routedPrivateMessages.append((content, peerID, recipientNickname))
-    }
-
-    func routeReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
-        routedReadReceipts.append((receipt.originalMessageID, peerID))
-    }
-
-    func sendMeshMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date) {
-        meshBroadcasts.append(content)
-    }
-
-    func sendGeohashReadReceipt(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity) {
-        geoReadReceipts.append((messageID, recipientHex))
-    }
-
-    // Nostr & geohash
-    var isTeleported = false
-    private(set) var recordedGeoParticipants: [String] = []
-
-    func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity { Self.dummyIdentity }
-    func recordGeoParticipant(pubkeyHex: String) { recordedGeoParticipants.append(pubkeyHex) }
-
-    // Favorites
-    var favoriteRelationshipsByNoiseKey: [Data: FavoritesPersistenceService.FavoriteRelationship] = [:]
-
-    func favoriteRelationship(forNoiseKey noiseKey: Data) -> FavoritesPersistenceService.FavoriteRelationship? {
-        favoriteRelationshipsByNoiseKey[noiseKey]
-    }
-
-    // Identity persistence
-    private(set) var forceSaveIdentityCount = 0
-    private(set) var verifyIdentityKeyExistsCount = 0
-
-    func forceSaveIdentity() { forceSaveIdentityCount += 1 }
-
-    @discardableResult
-    func verifyIdentityKeyExists() -> Bool {
-        verifyIdentityKeyExistsCount += 1
-        return true
-    }
-
-    static let dummyIdentity = NostrIdentity(
-        privateKey: Data(repeating: 0x11, count: 32),
-        publicKey: Data(repeating: 0x22, count: 32),
-        npub: "npub1mock",
-        createdAt: Date(timeIntervalSince1970: 0)
-    )
-}
-
-// MARK: - Helpers
-
-private func makeFavoriteRelationship(
-    noiseKey: Data,
-    nostrPublicKey: String? = nil,
-    nickname: String = "alice",
-    isFavorite: Bool = false,
-    theyFavoritedUs: Bool = false
-) -> FavoritesPersistenceService.FavoriteRelationship {
-    FavoritesPersistenceService.FavoriteRelationship(
-        peerNoisePublicKey: noiseKey,
-        peerNostrPublicKey: nostrPublicKey,
-        peerNickname: nickname,
-        isFavorite: isFavorite,
-        theyFavoritedUs: theyFavoritedUs,
-        favoritedAt: Date(timeIntervalSince1970: 0),
-        lastUpdated: Date(timeIntervalSince1970: 0)
-    )
-}
-
-@MainActor
-private func makePrivateMessage(
-    id: String,
-    sender: String = "alice",
-    timestamp: Date = Date(),
-    senderPeerID: PeerID? = nil,
-    isRelay: Bool = false,
-    deliveryStatus: DeliveryStatus? = nil
-) -> BitchatMessage {
-    BitchatMessage(
-        id: id,
-        sender: sender,
-        content: "hello",
-        timestamp: timestamp,
-        isRelay: isRelay,
-        isPrivate: true,
-        recipientNickname: "me",
-        senderPeerID: senderPeerID,
-        deliveryStatus: deliveryStatus
-    )
-}
-
-// MARK: - Coordinator Tests Against Mock Context
-
-/// Exercises `ChatLifecycleCoordinator` against `MockChatLifecycleContext`
-/// with no `ChatViewModel`.
-struct ChatLifecycleCoordinatorContextTests {
-
-    @Test @MainActor
-    func getPrivateChatMessages_mergesEphemeralAndStableKeepingBestStatus() async {
-        let context = MockChatLifecycleContext()
-        let coordinator = ChatLifecycleCoordinator(context: context)
-        let peerID = PeerID(str: "1122334455667788")
-        let noiseKey = Data(repeating: 0xAB, count: 32)
-        let stablePeerID = PeerID(hexData: noiseKey)
-        context.peersByID[peerID] = BitchatPeer(peerID: peerID, noisePublicKey: noiseKey, nickname: "alice")
-
-        let t1 = Date(timeIntervalSince1970: 1)
-        let t2 = Date(timeIntervalSince1970: 2)
-        // Same message under both keys: the read copy must win over sent.
-        context.privateChats[peerID] = [
-            makePrivateMessage(id: "m1", timestamp: t1, deliveryStatus: .sent),
-            makePrivateMessage(id: "m2", timestamp: t2),
-        ]
-        context.privateChats[stablePeerID] = [
-            makePrivateMessage(id: "m1", timestamp: t1, deliveryStatus: .read(by: "alice", at: t2)),
-        ]
-
-        let merged = coordinator.getPrivateChatMessages(for: peerID)
-        #expect(merged.map(\.id) == ["m1", "m2"])
-        if case .read? = merged.first?.deliveryStatus {
-        } else {
-            Issue.record("expected the .read copy of m1 to win the merge")
-        }
-
-        // getMessages(for: nil) falls back to the public timeline.
-        context.messages = [makePrivateMessage(id: "pub")]
-        #expect(coordinator.getMessages(for: nil).map(\.id) == ["pub"])
-    }
-
-    @Test @MainActor
-    func markPrivateMessagesAsRead_geoDM_sendsReadReceiptsOnce() async {
-        let context = MockChatLifecycleContext()
-        let coordinator = ChatLifecycleCoordinator(context: context)
-        let convKey = PeerID(nostr_: "feedface00112233")
-        let recipientHex = "feedface00112233"
-        context.activeChannel = .location(GeohashChannel(level: .city, geohash: "u4pruy"))
-        context.nostrKeyMapping[convKey] = recipientHex
-        context.sentReadReceipts = ["already-acked"]
-        context.privateChats[convKey] = [
-            makePrivateMessage(id: "m1", senderPeerID: convKey),
-            makePrivateMessage(id: "already-acked", senderPeerID: convKey),
-            makePrivateMessage(id: "relay", senderPeerID: convKey, isRelay: true),
-            makePrivateMessage(id: "mine", sender: "me", senderPeerID: context.myPeerID),
-        ]
-
-        coordinator.markPrivateMessagesAsRead(from: convKey)
-
-        #expect(context.managerReadMarks == [convKey])
-        // Only the peer's own un-acked, non-relay message gets a READ.
-        #expect(context.geoReadReceipts.map(\.messageID) == ["m1"])
-        #expect(context.geoReadReceipts.first?.recipientHex == recipientHex)
-        #expect(context.sentReadReceipts.contains("m1"))
-
-        // Second pass: nothing new to send.
-        coordinator.markPrivateMessagesAsRead(from: convKey)
-        #expect(context.geoReadReceipts.count == 1)
-    }
-
-    @Test @MainActor
-    func handleScreenshotCaptured_privateChat_appendsNoticeAndRoutesWhenEstablished() async {
-        let context = MockChatLifecycleContext()
-        let coordinator = ChatLifecycleCoordinator(context: context)
-        let peerID = PeerID(str: "1122334455667788")
-        context.selectedPrivateChatPeer = peerID
-        context.nicknamesByPeerID[peerID] = "alice"
-
-        // No established session: local notice only, no network send.
-        coordinator.handleScreenshotCaptured()
-        #expect(context.routedPrivateMessages.isEmpty)
-        #expect(context.privateChats[peerID]?.map(\.content) == ["you took a screenshot"])
-        #expect(context.privateChats[peerID]?.first?.sender == "system")
-
-        // Established session: the peer is notified too.
-        context.noiseSessionStates[peerID] = .established
-        coordinator.handleScreenshotCaptured()
-        #expect(context.routedPrivateMessages.count == 1)
-        #expect(context.routedPrivateMessages.first?.content == "* me took a screenshot *")
-        #expect(context.routedPrivateMessages.first?.recipientNickname == "alice")
-        #expect(context.privateChats[peerID]?.count == 2)
-        // The public-channel system message is not used for private chats.
-        #expect(context.systemMessages.isEmpty)
-        #expect(context.meshBroadcasts.isEmpty)
-    }
-
-    @Test @MainActor
-    func handleScreenshotCaptured_meshChannel_broadcastsAndConfirmsLocally() async {
-        let context = MockChatLifecycleContext()
-        let coordinator = ChatLifecycleCoordinator(context: context)
-
-        coordinator.handleScreenshotCaptured()
-
-        #expect(context.meshBroadcasts == ["* me took a screenshot *"])
-        #expect(context.systemMessages == ["you took a screenshot"])
-        #expect(context.privateChats.isEmpty)
-    }
-
-    @Test @MainActor
-    func lifecycleEvents_persistIdentityAndScheduleReadPasses() async {
-        let context = MockChatLifecycleContext()
-        let coordinator = ChatLifecycleCoordinator(context: context)
-
-        coordinator.applicationWillTerminate()
-        #expect(context.stopMeshServicesCount == 1)
-        #expect(context.forceSaveIdentityCount == 1)
-        #expect(context.verifyIdentityKeyExistsCount == 1)
-
-        // Becoming active with no open chat only refreshes Bluetooth state.
-        coordinator.handleDidBecomeActive()
-        #expect(context.refreshBluetoothStateCount == 1)
-        #expect(context.managerReadMarks.isEmpty)
-
-        // With an open chat the read pass runs immediately (manager-level) and
-        // a delayed owner-level pass is scheduled.
-        let peerID = PeerID(nostr_: "feedface00112233")
-        context.selectedPrivateChatPeer = peerID
-        coordinator.handleDidBecomeActive()
-        #expect(context.refreshBluetoothStateCount == 2)
-        #expect(context.managerReadMarks == [peerID])
-
-        // The mock executes scheduled work synchronously, so the delayed
-        // owner-level pass has already run - no wall-clock polling.
-        #expect(context.scheduledDelays == [TransportConfig.uiAnimationMediumSeconds])
-        #expect(context.ownerLevelReadPasses == [peerID])
-    }
-    @Test @MainActor
-    func markPrivateMessagesAsRead_routesReceiptsOnlyForNostrReachableFavorites() {
-        let context = MockChatLifecycleContext()
-        let coordinator = ChatLifecycleCoordinator(context: context)
-        let noiseKey = Data(repeating: 0xAB, count: 32)
-        let peerID = PeerID(hexData: noiseKey)
-        context.favoriteRelationshipsByNoiseKey[noiseKey] = makeFavoriteRelationship(
-            noiseKey: noiseKey,
-            nostrPublicKey: "npub1alice"
-        )
-        context.privateChats[peerID] = [
-            makePrivateMessage(id: "in-1", senderPeerID: peerID),
-            makePrivateMessage(id: "in-relay", senderPeerID: peerID, isRelay: true),
-        ]
-
-        coordinator.markPrivateMessagesAsRead(from: peerID)
-
-        // Favorite with a Nostr key: READ receipts routed for non-relay
-        // inbound messages and recorded as sent.
-        #expect(context.managerReadMarks == [peerID])
-        #expect(context.routedReadReceipts.map(\.messageID) == ["in-1"])
-        #expect(context.routedReadReceipts.map(\.peerID) == [peerID])
-        #expect(context.sentReadReceipts.contains("in-1"))
-
-        // No favorite relationship (no Nostr key): the receipt pass is skipped.
-        let otherKey = Data(repeating: 0xCD, count: 32)
-        let otherPeer = PeerID(hexData: otherKey)
-        context.privateChats[otherPeer] = [makePrivateMessage(id: "in-2", senderPeerID: otherPeer)]
-        coordinator.markPrivateMessagesAsRead(from: otherPeer)
-        #expect(context.routedReadReceipts.map(\.messageID) == ["in-1"])
-    }
-
-}