Extract Nostr into a dedicated module

Extract Noise into a dedicated module
BitFoundation module to centralize shared components (#1089 )
2026-07-25 06:05:20 +00:00 · 2026-04-14 20:23:16 +01:00 · 2026-04-14 20:16:45 +01:00 · 2026-04-14 14:10:03 -05:00 · 2026-04-12 06:32:24 +00:00 · 2026-04-10 22:31:49 +01:00
2479 changed files with 31241 additions and 362726 deletions
@@ -25,47 +25,18 @@ jobs:
          wget -q https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv
          mv nostr_relays.csv ./relays/online_relays_gps.csv

-      - name: Configure git
+      - name: Check for changes
+        id: git-check
        run: |
-          git config user.email "action@github.com"
-          git config user.name "GitHub Action"
-
-      - name: Create update branch if changes
-        id: create_branch
+          git diff --exit-code || echo "changes=true" >> $GITHUB_OUTPUT
+    
+      - name: Commit and push changes
+        if: steps.git-check.outputs.changes == 'true'
        run: |
-          # exit early if no changes
-          if git diff --quiet --relays/online_relays_gps.csv; then
-            echo "changed=false" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-
-          # branch name with timestamp
-          BRANCH="update-georelays-$(date -u +%Y%m%dT%H%M%SZ)"
-          git checkout -b "$BRANCH"
-
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
          git add relays/online_relays_gps.csv
-          git commit -m "Automated update of relay data - $(date -u --rfc-3339=seconds)"
-          echo "changed=true" >> $GITHUB_OUTPUT
-          echo "branch=$BRANCH" >> $GITHUB_OUTPUT
-
-      - name: Push branch
-        if: steps.create_branch.outputs.changed == 'true'
-        run: |
-          git push --set-upstream origin "${{ steps.create_branch.outputs.branch }}"
-
-      - name: Create pull request
-        if: steps.create_branch.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@v5
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: Automated update of relay data
-          branch: ${{ steps.create_branch.outputs.branch }}
-          base: main
-          title: Automated update of relay data
-          body: |
-            This PR was created automatically by the scheduled workflow. It updates relays/online_relays_gps.csv from the GeoRelays source.
-          labels: automated, georelays
-
-      - name: No changes
-        if: steps.create_branch.outputs.changed != 'true'
-        run: echo "No changes to relays/online_relays_gps.csv"
+          git commit -m "Automated update of relay data - $(date -u)"
+          git push
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -5,14 +5,27 @@ on:
    branches:
      - main
  pull_request:
-    branches:
-      - main

 jobs:
  test:
-    name: Run Swift Tests
+    name: Run Swift Tests (${{ matrix.name }})
    runs-on: macos-latest

+    strategy:
+      fail-fast: false # Don't cancel other matrix jobs when one fails
+      matrix:
+        include:
+          - name: app
+            path: .
+          - name: BitLogger
+            path: localPackages/BitLogger
+          - name: BitFoundation
+            path: localPackages/BitFoundation
+          - name: Noise
+            path: localPackages/Noise
+          - name: Nostr
+            path: localPackages/Nostr
+
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
@@ -20,8 +33,14 @@ jobs:
      - name: Set up Swift
        uses: swift-actions/setup-swift@v2

-      - name: Build the package
-        run: swift build
+      - name: Cache build artifacts
+        uses: actions/cache@v4
+        with:
+          path: ${{ matrix.path }}/.build
+          key: ${{ runner.os }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/*.swift', matrix.path), format('{0}/**/Package.resolved', matrix.path)) }}
+          restore-keys: |
+            ${{ runner.os }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/Package.resolved', matrix.path)) }}
+            ${{ runner.os }}-${{ matrix.name }}-

      - name: Run Tests
-        run: swift test --parallel
+        run: swift test --parallel --quiet --package-path ${{ matrix.path }}
@@ -8,6 +8,7 @@ plans/
 ## AI
 CLAUDE.md
 AGENTS.md
+.claude/

 ## compatibility with Xcode 8 and earlier (ignoring not required starting Xcode 9)
 *.xcscmblueprint
@@ -1,4 +1,4 @@
-MARKETING_VERSION = 1.5.0
+MARKETING_VERSION = 1.5.1
 CURRENT_PROJECT_VERSION = 1

 IPHONEOS_DEPLOYMENT_TARGET = 16.0
@@ -9,3 +9,4 @@ DEVELOPMENT_TEAM = L3N5LHJD5Y
 CODE_SIGN_STYLE = Automatic

 PRODUCT_BUNDLE_IDENTIFIER = chat.bitchat
+APP_GROUP_ID = group.chat.bitchat
@@ -47,7 +47,7 @@ patch-for-macos: backup
 # Build the macOS app
 build: #check generate
    @echo "Building BitChat for macOS..."
-    @xcodebuild -project bitchat.xcodeproj -scheme "bitchat_macOS" -configuration Debug CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CODE_SIGN_ENTITLEMENTS="" build
+    @xcodebuild -project bitchat.xcodeproj -scheme "bitchat (macOS)" -configuration Debug CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CODE_SIGN_ENTITLEMENTS="" build

 # Run the macOS app
 run: build
@@ -16,8 +16,11 @@ let package = Package(
        ),
    ],
    dependencies:[
-        .package(path: "localPackages/Tor"),
+        .package(path: "localPackages/Arti"),
+        .package(path: "localPackages/Noise"),
+        .package(path: "localPackages/BitFoundation"),
        .package(path: "localPackages/BitLogger"),
+        .package(path: "localPackages/Nostr"),
        .package(url: "https://github.com/21-DOT-DEV/swift-secp256k1", exact: "0.21.1")
    ],
    targets: [
@@ -25,16 +28,21 @@ let package = Package(
            name: "bitchat",
            dependencies: [
                .product(name: "P256K", package: "swift-secp256k1"),
+                .product(name: "BitFoundation", package: "BitFoundation"),
                .product(name: "BitLogger", package: "BitLogger"),
-                .product(name: "Tor", package: "Tor")
+                .product(name: "Noise", package: "Noise"),
+                .product(name: "Nostr", package: "Nostr"),
+                .product(name: "Tor", package: "Arti")
            ],
            path: "bitchat",
            exclude: [
                "Info.plist",
                "Assets.xcassets",
+                "_PreviewHelpers/PreviewAssets.xcassets",
                "bitchat.entitlements",
                "bitchat-macOS.entitlements",
-                "LaunchScreen.storyboard"
+                "LaunchScreen.storyboard",
+                "ViewModels/Extensions/README.md"
            ],
            resources: [
                .process("Localizable.xcstrings")
@@ -42,7 +50,11 @@ let package = Package(
        ),
        .testTarget(
            name: "bitchatTests",
-            dependencies: ["bitchat"],
+            dependencies: [
+                "bitchat",
+                .product(name: "BitFoundation", package: "BitFoundation"),
+                .product(name: "Nostr", package: "Nostr")
+            ],
            path: "bitchatTests",
            exclude: [
                "Info.plist",
@@ -8,9 +8,6 @@ A decentralized peer-to-peer messaging app with dual transport architecture: loc

 📲 [App Store](https://apps.apple.com/us/app/bitchat-mesh/id6748219622)

-> [!WARNING]
-> Private messages have not received external security review and may contain vulnerabilities. Do not use for sensitive use cases, and do not rely on its security until it has been reviewed. Now uses the [Noise Protocol](https://www.noiseprotocol.org) for identity and encryption. Public local chat (the main feature) has no security concerns.
-
 ## License

 This project is released into the public domain. See the [LICENSE](LICENSE) file for details.
@@ -10,11 +10,16 @@
 		17901751FD8010AFC8E750F2 /* bitchatShareExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = 61F92EBA29C47C0FCC482F1F /* bitchatShareExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		3EE336D150427F736F32B56C /* P256K in Frameworks */ = {isa = PBXBuildFile; productRef = B1D9136AA0083366353BFA2F /* P256K */; };
 		885BBED78092484A5B069461 /* P256K in Frameworks */ = {isa = PBXBuildFile; productRef = 4EB6BA1B8464F1EA38F4E286 /* P256K */; };
+		A63163B62F80CB2500B8B128 /* Noise in Frameworks */ = {isa = PBXBuildFile; productRef = A63163B52F80CB2500B8B128 /* Noise */; };
+		A63163B82F80CB2D00B8B128 /* Noise in Frameworks */ = {isa = PBXBuildFile; productRef = A63163B72F80CB2D00B8B128 /* Noise */; };
+		A63180832F8103AB00B8B128 /* Nostr in Frameworks */ = {isa = PBXBuildFile; productRef = A63180822F8103AB00B8B128 /* Nostr */; };
+		A63180852F8103B600B8B128 /* Nostr in Frameworks */ = {isa = PBXBuildFile; productRef = A63180842F8103B600B8B128 /* Nostr */; };
+		A6BCF9482F80953E001CF9B9 /* BitFoundation in Frameworks */ = {isa = PBXBuildFile; productRef = A6BCF9472F80953E001CF9B9 /* BitFoundation */; };
+		A6BCF94A2F809550001CF9B9 /* BitFoundation in Frameworks */ = {isa = PBXBuildFile; productRef = A6BCF9492F809550001CF9B9 /* BitFoundation */; };
 		A6E3E5702E77036A0032EA8A /* BitLogger in Frameworks */ = {isa = PBXBuildFile; productRef = A6E3E56F2E77036A0032EA8A /* BitLogger */; };
 		A6E3E5722E7703760032EA8A /* BitLogger in Frameworks */ = {isa = PBXBuildFile; productRef = A6E3E5712E7703760032EA8A /* BitLogger */; };
 		A6E3EA7F2E7706720032EA8A /* Tor in Frameworks */ = {isa = PBXBuildFile; productRef = A6E3EA7E2E7706720032EA8A /* Tor */; };
 		A6E3EA812E7706A80032EA8A /* Tor in Frameworks */ = {isa = PBXBuildFile; productRef = A6E3EA802E7706A80032EA8A /* Tor */; };
-		A6F183FD2E948783006A9046 /* tor-nolzma.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A6F183FC2E948783006A9046 /* tor-nolzma.xcframework */; };
 		E0A1B2C3D4E5F6012345678D /* relays/online_relays_gps.csv in Resources */ = {isa = PBXBuildFile; fileRef = E0A1B2C3D4E5F6012345678A /* relays/online_relays_gps.csv */; };
 		E0A1B2C3D4E5F6012345678E /* relays/online_relays_gps.csv in Resources */ = {isa = PBXBuildFile; fileRef = E0A1B2C3D4E5F6012345678A /* relays/online_relays_gps.csv */; };
 /* End PBXBuildFile section */
@@ -95,6 +100,24 @@
 			);
 			target = 57CA17A36A2532A6CFF367BB /* bitchatShareExtension */;
 		};
+		C5E027A52ECCDFD700BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_macOS" target */ = {
+			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
+			membershipExceptions = (
+				Info.plist,
+				Localization/PrimaryLocalizationKeys.json,
+				README.md,
+			);
+			target = 47FF23248747DD7CB666CB91 /* bitchatTests_macOS */;
+		};
+		C5E027A82ECCDFE200BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_iOS" target */ = {
+			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
+			membershipExceptions = (
+				Info.plist,
+				Localization/PrimaryLocalizationKeys.json,
+				README.md,
+			);
+			target = 6CB97DF2EA57234CB3E563B8 /* bitchatTests_iOS */;
+		};
 /* End PBXFileSystemSynchronizedBuildFileExceptionSet section */

 /* Begin PBXFileSystemSynchronizedRootGroup section */
@@ -118,6 +141,10 @@
 		};
 		A6E32D412E762EAE0032EA8A /* bitchatTests */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
+			exceptions = (
+				C5E027A82ECCDFE200BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_iOS" target */,
+				C5E027A52ECCDFD700BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_macOS" target */,
+			);
 			path = bitchatTests;
 			sourceTree = "<group>";
 		};
@@ -133,17 +160,22 @@
 			isa = PBXFrameworksBuildPhase;
 			files = (
 				A6E3E5722E7703760032EA8A /* BitLogger in Frameworks */,
+				A63163B82F80CB2D00B8B128 /* Noise in Frameworks */,
 				3EE336D150427F736F32B56C /* P256K in Frameworks */,
+				A63180852F8103B600B8B128 /* Nostr in Frameworks */,
 				A6E3EA812E7706A80032EA8A /* Tor in Frameworks */,
+				A6BCF94A2F809550001CF9B9 /* BitFoundation in Frameworks */,
 			);
 		};
 		B5A5CC493FFB3D8966548140 /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			files = (
-				A6F183FD2E948783006A9046 /* tor-nolzma.xcframework in Frameworks */,
 				A6E3E5702E77036A0032EA8A /* BitLogger in Frameworks */,
+				A63163B62F80CB2500B8B128 /* Noise in Frameworks */,
 				885BBED78092484A5B069461 /* P256K in Frameworks */,
+				A63180832F8103AB00B8B128 /* Nostr in Frameworks */,
 				A6E3EA7F2E7706720032EA8A /* Tor in Frameworks */,
+				A6BCF9482F80953E001CF9B9 /* BitFoundation in Frameworks */,
 			);
 		};
 /* End PBXFrameworksBuildPhase section */
@@ -203,6 +235,9 @@
 				B1D9136AA0083366353BFA2F /* P256K */,
 				A6E3E5712E7703760032EA8A /* BitLogger */,
 				A6E3EA802E7706A80032EA8A /* Tor */,
+				A6BCF9492F809550001CF9B9 /* BitFoundation */,
+				A63163B72F80CB2D00B8B128 /* Noise */,
+				A63180842F8103B600B8B128 /* Nostr */,
 			);
 			productName = bitchat_macOS;
 			productReference = 8F3A7C058C2C8E1A06C8CF8B /* bitchat.app */;
@@ -213,6 +248,7 @@
 			buildConfigurationList = 1C27B5BA3DB46DDF0DBFEF62 /* Build configuration list for PBXNativeTarget "bitchatTests_macOS" */;
 			buildPhases = (
 				5C22AA7B9ACC5A861445C769 /* Sources */,
+				C5E027A42ECCDFD700BD6012 /* Resources */,
 			);
 			buildRules = (
 			);
@@ -245,6 +281,7 @@
 			buildConfigurationList = 38C4AF6313E5037F25CEF30B /* Build configuration list for PBXNativeTarget "bitchatTests_iOS" */;
 			buildPhases = (
 				865C8403EF02C089369A9FCB /* Sources */,
+				C5E027A72ECCDFE200BD6012 /* Resources */,
 			);
 			buildRules = (
 			);
@@ -281,6 +318,9 @@
 				4EB6BA1B8464F1EA38F4E286 /* P256K */,
 				A6E3E56F2E77036A0032EA8A /* BitLogger */,
 				A6E3EA7E2E7706720032EA8A /* Tor */,
+				A6BCF9472F80953E001CF9B9 /* BitFoundation */,
+				A63163B52F80CB2500B8B128 /* Noise */,
+				A63180822F8103AB00B8B128 /* Nostr */,
 			);
 			productName = bitchat_iOS;
 			productReference = 96D0D41CA19EE5A772AA8434 /* bitchat.app */;
@@ -321,7 +361,10 @@
 			packageReferences = (
 				B8C407587481BBB190741C93 /* XCRemoteSwiftPackageReference "swift-secp256k1" */,
 				A6E3E56E2E77036A0032EA8A /* XCLocalSwiftPackageReference "localPackages/BitLogger" */,
-				A6E3EA7D2E7706720032EA8A /* XCLocalSwiftPackageReference "localPackages/Tor" */,
+				A6E3EA7D2E7706720032EA8A /* XCLocalSwiftPackageReference "localPackages/Arti" */,
+				A6BCF9462F80953E001CF9B9 /* XCLocalSwiftPackageReference "localPackages/BitFoundation" */,
+				A63163B42F80CB2500B8B128 /* XCLocalSwiftPackageReference "localPackages/Noise" */,
+				A63180812F8103AB00B8B128 /* XCLocalSwiftPackageReference "localPackages/Nostr" */,
 			);
 			preferredProjectObjectVersion = 90;
 			projectDirPath = "";
@@ -343,6 +386,16 @@
 				E0A1B2C3D4E5F6012345678D /* relays/online_relays_gps.csv in Resources */,
 			);
 		};
+		C5E027A42ECCDFD700BD6012 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			files = (
+			);
+		};
+		C5E027A72ECCDFE200BD6012 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			files = (
+			);
+		};
 		CD6E8F32BC38357473954F97 /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			files = (
@@ -516,6 +569,7 @@
 				CODE_SIGNING_REQUIRED = YES;
 				CODE_SIGN_ENTITLEMENTS = bitchat/bitchat.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
+				DEVELOPMENT_ASSET_PATHS = bitchat/_PreviewHelpers;
 				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = NO;
 				INFOPLIST_FILE = bitchat/Info.plist;
@@ -526,7 +580,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = "$(MARKETING_VERSION)";
+				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				SDKROOT = iphoneos;
@@ -576,6 +630,7 @@
 				CODE_SIGNING_REQUIRED = YES;
 				CODE_SIGN_ENTITLEMENTS = bitchat/bitchat.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
+				DEVELOPMENT_ASSET_PATHS = bitchat/_PreviewHelpers;
 				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = bitchat/Info.plist;
@@ -586,7 +641,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = "$(MARKETING_VERSION)";
+				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				SDKROOT = iphoneos;
@@ -622,7 +677,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
-				MARKETING_VERSION = "$(MARKETING_VERSION)";
+				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				REGISTER_APP_GROUPS = YES;
@@ -714,7 +769,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
-				MARKETING_VERSION = "$(MARKETING_VERSION)";
+				MARKETING_VERSION = 1.5.1;
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				REGISTER_APP_GROUPS = YES;
@@ -875,13 +930,25 @@
 /* End XCConfigurationList section */

 /* Begin XCLocalSwiftPackageReference section */
+		A63163B42F80CB2500B8B128 /* XCLocalSwiftPackageReference "localPackages/Noise" */ = {
+			isa = XCLocalSwiftPackageReference;
+			relativePath = localPackages/Noise;
+		};
+		A63180812F8103AB00B8B128 /* XCLocalSwiftPackageReference "localPackages/Nostr" */ = {
+			isa = XCLocalSwiftPackageReference;
+			relativePath = localPackages/Nostr;
+		};
+		A6BCF9462F80953E001CF9B9 /* XCLocalSwiftPackageReference "localPackages/BitFoundation" */ = {
+			isa = XCLocalSwiftPackageReference;
+			relativePath = localPackages/BitFoundation;
+		};
 		A6E3E56E2E77036A0032EA8A /* XCLocalSwiftPackageReference "localPackages/BitLogger" */ = {
 			isa = XCLocalSwiftPackageReference;
 			relativePath = localPackages/BitLogger;
 		};
-		A6E3EA7D2E7706720032EA8A /* XCLocalSwiftPackageReference "localPackages/Tor" */ = {
+		A6E3EA7D2E7706720032EA8A /* XCLocalSwiftPackageReference "localPackages/Arti" */ = {
 			isa = XCLocalSwiftPackageReference;
-			relativePath = localPackages/Tor;
+			relativePath = localPackages/Arti;
 		};
 /* End XCLocalSwiftPackageReference section */

@@ -890,8 +957,8 @@
 			isa = XCRemoteSwiftPackageReference;
 			repositoryURL = "https://github.com/21-DOT-DEV/swift-secp256k1";
 			requirement = {
-				kind = upToNextMajorVersion;
-				minimumVersion = 0.21.1;
+				kind = exactVersion;
+				version = 0.21.1;
 			};
 		};
 /* End XCRemoteSwiftPackageReference section */
@@ -902,6 +969,33 @@
 			package = B8C407587481BBB190741C93 /* XCRemoteSwiftPackageReference "swift-secp256k1" */;
 			productName = P256K;
 		};
+		A63163B52F80CB2500B8B128 /* Noise */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = Noise;
+		};
+		A63163B72F80CB2D00B8B128 /* Noise */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = A63163B42F80CB2500B8B128 /* XCLocalSwiftPackageReference "localPackages/Noise" */;
+			productName = Noise;
+		};
+		A63180822F8103AB00B8B128 /* Nostr */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = Nostr;
+		};
+		A63180842F8103B600B8B128 /* Nostr */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = A63180812F8103AB00B8B128 /* XCLocalSwiftPackageReference "localPackages/Nostr" */;
+			productName = Nostr;
+		};
+		A6BCF9472F80953E001CF9B9 /* BitFoundation */ = {
+			isa = XCSwiftPackageProductDependency;
+			productName = BitFoundation;
+		};
+		A6BCF9492F809550001CF9B9 /* BitFoundation */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = A6BCF9462F80953E001CF9B9 /* XCLocalSwiftPackageReference "localPackages/BitFoundation" */;
+			productName = BitFoundation;
+		};
 		A6E3E56F2E77036A0032EA8A /* BitLogger */ = {
 			isa = XCSwiftPackageProductDependency;
 			productName = BitLogger;
@@ -6,8 +6,10 @@
 // For more information, see <https://unlicense.org>
 //

+import Nostr
 import Tor
 import SwiftUI
+import BitFoundation
 import UserNotifications

@main
@@ -26,9 +28,11 @@ struct BitchatApp: App {
    @NSApplicationDelegateAdaptor(MacAppDelegate.self) var appDelegate
    #endif
    
-    private let idBridge = NostrIdentityBridge()
+    private let idBridge = NostrIdentityBridge(keychain: KeychainManager())
    
    init() {
+        GeoRelayDirectory.setupShared(dependencies: .live())
+        NostrRelayManager.setupShared(dependencies: .live())
        let keychain = KeychainManager()
        let idBridge = self.idBridge
        _chatViewModel = StateObject(
@@ -53,15 +57,20 @@ struct BitchatApp: App {
                    // Inject live Noise service into VerificationService to avoid creating new BLE instances
                    VerificationService.shared.configure(with: chatViewModel.meshService.getNoiseService())
                    // Prewarm Nostr identity and QR to make first VERIFY sheet fast
+                    let nickname = chatViewModel.nickname
                    DispatchQueue.global(qos: .utility).async {
                        let npub = try? idBridge.getCurrentNostrIdentity()?.npub
-                        _ = VerificationService.shared.buildMyQRString(nickname: chatViewModel.nickname, npub: npub)
+                        _ = VerificationService.shared.buildMyQRString(nickname: nickname, npub: npub)
                    }

                    appDelegate.chatViewModel = chatViewModel

                    // Initialize network activation policy; will start Tor/Nostr only when allowed
                    NetworkActivationService.shared.start()
+                    
+                    // Start presence service (will wait for Tor readiness)
+                    GeohashPresenceService.shared.start()
+
                    // Check for shared content
                    checkForSharedContent()
                }
@@ -248,10 +257,15 @@ final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate {
            // Get peer ID from userInfo
            if let peerID = userInfo["peerID"] as? String {
                // Don't show notification if the private chat is already open
-                if chatViewModel?.selectedPrivateChatPeer == PeerID(str: peerID) {
-                    completionHandler([])
-                    return
+                // Access main-actor-isolated property via Task
+                Task { @MainActor in
+                    if self.chatViewModel?.selectedPrivateChatPeer == PeerID(str: peerID) {
+                        completionHandler([])
+                    } else {
+                        completionHandler([.banner, .sound])
+                    }
                }
+                return
            }
        }
        // Suppress geohash activity notification if we're already in that geohash channel
@@ -269,8 +283,3 @@ final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate {
    }
 }

-extension String {
-    var nilIfEmpty: String? {
-        self.isEmpty ? nil : self
-    }
-}
@@ -9,6 +9,18 @@ final class VoiceNotePlaybackController: NSObject, ObservableObject, AVAudioPlay
    @Published private(set) var duration: TimeInterval = 0
    @Published private(set) var progress: Double = 0

+    /// rounded so 4.9s shows "00:05"
+    var roundedDuration: Int {
+        guard duration.isFinite else { return 0 }
+        return Int(duration.rounded())
+    }
+
+    /// ceil so "00:01" stays visible until playback ends, capped to rounded duration
+    var remainingSeconds: Int {
+        let remaining = max(0, duration - currentTime)
+        return min(roundedDuration, Int(ceil(remaining)))
+    }
+
    private var player: AVAudioPlayer?
    private var timer: Timer?
    private var url: URL
@@ -2,8 +2,7 @@ import Foundation
 import AVFoundation

 /// Manages audio capture for mesh voice notes with predictable encoding settings.
-/// Recording runs on an internal serial queue to avoid AVAudioSession contention.
-final class VoiceRecorder: NSObject, AVAudioRecorderDelegate {
+actor VoiceRecorder {
    enum RecorderError: Error {
        case microphoneAccessDenied
        case recorderInitializationFailed
@@ -12,21 +11,16 @@ final class VoiceRecorder: NSObject, AVAudioRecorderDelegate {

    static let shared = VoiceRecorder()

-    private let queue = DispatchQueue(label: "com.bitchat.voice-recorder")
    private let paddingInterval: TimeInterval = 0.5
    private let maxRecordingDuration: TimeInterval = 120
+    static let minRecordingDuration: TimeInterval = 1

    private var recorder: AVAudioRecorder?
    private var currentURL: URL?
-    private var stopWorkItem: DispatchWorkItem?
-
-    private override init() {
-        super.init()
-    }

    // MARK: - Permissions

-    @discardableResult
+    nonisolated
    func requestPermission() async -> Bool {
        #if os(iOS)
        return await withCheckedContinuation { continuation in
@@ -47,97 +41,88 @@ final class VoiceRecorder: NSObject, AVAudioRecorderDelegate {

    // MARK: - Recording Lifecycle

+    @discardableResult
    func startRecording() throws -> URL {
-        try queue.sync {
-            if recorder?.isRecording == true {
-                throw RecorderError.recordingInProgress
-            }
-
-            #if os(iOS)
-            let session = AVAudioSession.sharedInstance()
-            guard session.recordPermission == .granted else {
-                throw RecorderError.microphoneAccessDenied
-            }
-            try session.setCategory(
-                .playAndRecord,
-                mode: .default,
-                options: [.defaultToSpeaker, .allowBluetoothA2DP, .allowBluetoothHFP]
-            )
-            try session.setActive(true, options: .notifyOthersOnDeactivation)
-            #endif
-            #if os(macOS)
-            guard AVCaptureDevice.authorizationStatus(for: .audio) == .authorized else {
-                throw RecorderError.microphoneAccessDenied
-            }
-            #endif
-
-            let outputURL = try makeOutputURL()
-            let settings: [String: Any] = [
-                AVFormatIDKey: kAudioFormatMPEG4AAC,
-                AVSampleRateKey: 16_000,
-                AVNumberOfChannelsKey: 1,
-                AVEncoderBitRateKey: 16_000
-            ]
-
-            let audioRecorder = try AVAudioRecorder(url: outputURL, settings: settings)
-            audioRecorder.delegate = self
-            audioRecorder.isMeteringEnabled = true
-            audioRecorder.prepareToRecord()
-            audioRecorder.record(forDuration: maxRecordingDuration)
-
-            recorder = audioRecorder
-            currentURL = outputURL
-            stopWorkItem?.cancel()
-            stopWorkItem = nil
-            return outputURL
+        if recorder?.isRecording == true {
+            throw RecorderError.recordingInProgress
        }
+
+        #if os(iOS)
+        let session = AVAudioSession.sharedInstance()
+        guard session.recordPermission == .granted else {
+            throw RecorderError.microphoneAccessDenied
+        }
+        #if targetEnvironment(simulator)
+        // allowBluetoothHFP is not available on iOS Simulator
+        try session.setCategory(
+            .playAndRecord,
+            mode: .default,
+            options: [.defaultToSpeaker, .allowBluetoothA2DP]
+        )
+        #else
+        try session.setCategory(
+            .playAndRecord,
+            mode: .default,
+            options: [.defaultToSpeaker, .allowBluetoothA2DP, .allowBluetoothHFP]
+        )
+        #endif
+        try session.setActive(true, options: .notifyOthersOnDeactivation)
+        #endif
+        #if os(macOS)
+        guard AVCaptureDevice.authorizationStatus(for: .audio) == .authorized else {
+            throw RecorderError.microphoneAccessDenied
+        }
+        #endif
+
+        let outputURL = try makeOutputURL()
+        let settings: [String: Any] = [
+            AVFormatIDKey: kAudioFormatMPEG4AAC,
+            AVSampleRateKey: 16_000,
+            AVNumberOfChannelsKey: 1,
+            AVEncoderBitRateKey: 16_000
+        ]
+
+        let audioRecorder = try AVAudioRecorder(url: outputURL, settings: settings)
+        audioRecorder.isMeteringEnabled = true
+        audioRecorder.prepareToRecord()
+        audioRecorder.record(forDuration: maxRecordingDuration)
+
+        recorder = audioRecorder
+        currentURL = outputURL
+        return outputURL
    }

-    func stopRecording(completion: @escaping (URL?) -> Void) {
-        queue.async { [weak self] in
-            guard let self = self, let recorder = self.recorder, recorder.isRecording else {
-                completion(self?.currentURL)
-                return
-            }
-
-            let item = DispatchWorkItem { [weak self] in
-                guard let self = self else { return }
-                recorder.stop()
-                self.cleanupSession()
-                let url = self.currentURL
-                self.recorder = nil
-                self.currentURL = url
-                completion(url)
-            }
-            self.stopWorkItem = item
-            self.queue.asyncAfter(deadline: .now() + self.paddingInterval, execute: item)
+    func stopRecording() async -> URL? {
+        guard let recorder, recorder.isRecording else {
+            return currentURL
        }
+
+        let sessionURL = currentURL
+
+        try? await Task.sleep(nanoseconds: UInt64(paddingInterval * 1_000_000_000))
+
+        recorder.stop()
+
+        // A new session may have started during the sleep — don't touch its state
+        if self.recorder === recorder {
+            cleanupSession()
+            self.recorder = nil
+            currentURL = nil
+        }
+
+        return sessionURL
    }

    func cancelRecording() {
-        queue.async { [weak self] in
-            guard let self = self else { return }
-            self.stopWorkItem?.cancel()
-            self.stopWorkItem = nil
-            if let recorder = self.recorder, recorder.isRecording {
-                recorder.stop()
-            }
-            self.cleanupSession()
-            if let url = self.currentURL {
-                try? FileManager.default.removeItem(at: url)
-            }
-            self.recorder = nil
-            self.currentURL = nil
+        if let recorder, recorder.isRecording {
+            recorder.stop()
        }
-    }
-
-    // MARK: - Metering
-
-    func currentAveragePower() -> Float {
-        queue.sync {
-            recorder?.updateMeters()
-            return recorder?.averagePower(forChannel: 0) ?? -160
+        cleanupSession()
+        if let currentURL {
+            try? FileManager.default.removeItem(at: currentURL)
        }
+        recorder = nil
+        currentURL = nil
    }

    // MARK: - Helpers
@@ -81,6 +81,7 @@
 ///

 import Foundation
+import BitFoundation

 // MARK: - Three-Layer Identity Model

@@ -91,6 +91,7 @@
 ///

 import BitLogger
+import BitFoundation
 import Foundation
 import CryptoKit

@@ -331,16 +332,15 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
    
    func updateSocialIdentity(_ identity: SocialIdentity) {
        queue.async(flags: .barrier) {
+            let previousClaimedNickname = self.cache.socialIdentities[identity.fingerprint]?.claimedNickname
            self.cache.socialIdentities[identity.fingerprint] = identity
            
            // Update nickname index
-            if let existingIdentity = self.cache.socialIdentities[identity.fingerprint] {
-                // Remove old nickname from index if changed
-                if existingIdentity.claimedNickname != identity.claimedNickname {
-                    self.cache.nicknameIndex[existingIdentity.claimedNickname]?.remove(identity.fingerprint)
-                    if self.cache.nicknameIndex[existingIdentity.claimedNickname]?.isEmpty == true {
-                        self.cache.nicknameIndex.removeValue(forKey: existingIdentity.claimedNickname)
-                    }
+            if let previousClaimedNickname,
+               previousClaimedNickname != identity.claimedNickname {
+                self.cache.nicknameIndex[previousClaimedNickname]?.remove(identity.fingerprint)
+                if self.cache.nicknameIndex[previousClaimedNickname]?.isEmpty == true {
+                    self.cache.nicknameIndex.removeValue(forKey: previousClaimedNickname)
                }
            }
            
@@ -532,4 +532,16 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
            return cache.verifiedFingerprints
        }
    }
+
+    var debugNicknameIndex: [String: Set<String>] {
+        queue.sync { cache.nicknameIndex }
+    }
+
+    func debugEphemeralSession(for peerID: PeerID) -> EphemeralIdentity? {
+        queue.sync { ephemeralSessions[peerID] }
+    }
+
+    func debugLastInteraction(for fingerprint: String) -> Date? {
+        queue.sync { cache.lastInteractions[fingerprint] }
+    }
 }
@@ -2,6 +2,8 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>AppGroupID</key>
+	<string>$(APP_GROUP_ID)</string>
 	<key>CFBundleDevelopmentRegion</key>
 	<string>$(DEVELOPMENT_LANGUAGE)</string>
 	<key>CFBundleDisplayName</key>
@@ -37,12 +39,12 @@
 	<string>bitchat uses Bluetooth to discover and connect with other bitchat users nearby.</string>
 	<key>NSCameraUsageDescription</key>
 	<string>bitchat uses the camera to scan QR codes to verify peers.</string>
-	<key>NSPhotoLibraryUsageDescription</key>
-	<string>bitchat lets you pick images from your photo library to share with nearby peers.</string>
-	<key>NSMicrophoneUsageDescription</key>
-	<string>bitchat uses the microphone to record voice notes that relay across the mesh.</string>
 	<key>NSLocationWhenInUseUsageDescription</key>
 	<string>bitchat uses your approximate location to compute local geohash channels for optional public chats. Exact GPS is never shared.</string>
+	<key>NSMicrophoneUsageDescription</key>
+	<string>bitchat uses the microphone to record voice notes that relay across the mesh.</string>
+	<key>NSPhotoLibraryUsageDescription</key>
+	<string>bitchat lets you pick images from your photo library to share with nearby peers.</string>
 	<key>UIBackgroundModes</key>
 	<array>
 		<string>bluetooth-central</string>
@@ -0,0 +1,68 @@
+//
+// BitchatMessage+Media.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import Foundation
+
+extension BitchatMessage {
+    enum Media {
+        case voice(URL)
+        case image(URL)
+
+        var url: URL {
+            switch self {
+            case .voice(let url), .image(let url):
+                return url
+            }
+        }
+    }
+
+    // Cache the directory lookup to avoid repeated FileManager calls during view rendering
+    private struct Cache {
+        let filesDir: URL?
+
+        static let shared = Cache()
+        private init() {
+            do {
+                let base = try FileManager.default.url(for: .applicationSupportDirectory, in: .userDomainMask, appropriateFor: nil, create: true)
+                let filesDir = base.appendingPathComponent("files", isDirectory: true)
+                try FileManager.default.createDirectory(at: filesDir, withIntermediateDirectories: true, attributes: nil)
+                self.filesDir = filesDir
+            } catch {
+                filesDir = nil
+            }
+        }
+    }
+
+    func mediaAttachment(for nickname: String) -> Media? {
+        guard let baseDirectory = Cache.shared.filesDir else { return nil }
+
+        func url(for category: MimeType.Category) -> URL? {
+            guard content.hasPrefix(category.messagePrefix),
+                  let filename = String(content.dropFirst(category.messagePrefix.count)).trimmedOrNilIfEmpty
+            else {
+                return nil
+            }
+
+            // Check outgoing first for sent messages, incoming for received
+            let subdir = sender == nickname ? "\(category.mediaDir)/outgoing" : "\(category.mediaDir)/incoming"
+
+            // Construct URL directly without fileExists check (avoids blocking disk I/O in view body)
+            // Files are checked during playback/display, so missing files fail gracefully
+            let directory = baseDirectory.appendingPathComponent(subdir, isDirectory: true)
+            return directory.appendingPathComponent(filename)
+        }
+
+        if let url = url(for: .audio) {
+            return .voice(url)
+        }
+        if let url = url(for: .image) {
+            return .image(url)
+        }
+        return nil
+    }
+}
@@ -7,6 +7,7 @@
 //

 import Foundation
+import BitFoundation

 /// Represents a user-visible message in the BitChat system.
 /// Handles both broadcast messages and private encrypted messages,
@@ -338,7 +339,7 @@ extension BitchatMessage {
 extension Array where Element == BitchatMessage {
    /// Filters out empty ones and deduplicate by ID while preserving order (from oldest to newest)
    func cleanedAndDeduped() -> [Element] {
-        let arr = filter { $0.content.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty == false }
+        let arr = filter { $0.content.trimmed.isEmpty == false }
        guard arr.count > 1 else {
            return arr
        }
@@ -7,6 +7,7 @@
 //

 import Foundation
+import BitFoundation

 /// The core packet structure for all BitChat protocol messages.
 /// Encapsulates all data needed for routing through the mesh network,
@@ -22,8 +23,9 @@ struct BitchatPacket: Codable {
    var signature: Data?
    var ttl: UInt8
    var route: [Data]?
+    var isRSR: Bool
    
-    init(type: UInt8, senderID: Data, recipientID: Data?, timestamp: UInt64, payload: Data, signature: Data?, ttl: UInt8, version: UInt8 = 1, route: [Data]? = nil) {
+    init(type: UInt8, senderID: Data, recipientID: Data?, timestamp: UInt64, payload: Data, signature: Data?, ttl: UInt8, version: UInt8 = 1, route: [Data]? = nil, isRSR: Bool = false) {
        self.version = version
        self.type = type
        self.senderID = senderID
@@ -33,10 +35,11 @@ struct BitchatPacket: Codable {
        self.signature = signature
        self.ttl = ttl
        self.route = route
+        self.isRSR = isRSR
    }
    
    // Convenience initializer for new binary format
-    init(type: UInt8, ttl: UInt8, senderID: PeerID, payload: Data) {
+    init(type: UInt8, ttl: UInt8, senderID: PeerID, payload: Data, isRSR: Bool = false) {
        self.version = 1
        self.type = type
        // Convert hex string peer ID to binary data (8 bytes)
@@ -56,6 +59,7 @@ struct BitchatPacket: Codable {
        self.signature = nil
        self.ttl = ttl
        self.route = nil
+        self.isRSR = isRSR
    }
    
    var data: Data? {
@@ -85,7 +89,8 @@ struct BitchatPacket: Codable {
            signature: nil, // Remove signature for signing
            ttl: 0, // Use fixed TTL=0 for signing to ensure relay compatibility
            version: version,
-            route: route
+            route: route,
+            isRSR: false // RSR flag is mutable and not part of the signature
        )
        return BinaryProtocol.encode(unsignedPacket)
    }
@@ -1,5 +1,6 @@
 import Foundation
 import CoreBluetooth
+import BitFoundation

 /// Represents a peer in the BitChat network with all associated metadata
 struct BitchatPeer: Equatable {
@@ -7,6 +7,7 @@
 //

 import Foundation
+import BitFoundation

 struct ReadReceipt: Codable {
    let originalMessageID: String
@@ -9,12 +9,16 @@ struct RequestSyncPacket {
    let m: UInt32
    let data: Data
    let types: SyncTypeFlags?
+    let sinceTimestamp: UInt64?
+    let fragmentIdFilter: String?

-    init(p: Int, m: UInt32, data: Data, types: SyncTypeFlags? = nil) {
+    init(p: Int, m: UInt32, data: Data, types: SyncTypeFlags? = nil, sinceTimestamp: UInt64? = nil, fragmentIdFilter: String? = nil) {
        self.p = p
        self.m = m
        self.data = data
        self.types = types
+        self.sinceTimestamp = sinceTimestamp
+        self.fragmentIdFilter = fragmentIdFilter
    }

    func encode() -> Data {
@@ -36,15 +40,24 @@ struct RequestSyncPacket {
        if let typesData = types?.toData() {
            putTLV(0x04, typesData)
        }
+        if let ts = sinceTimestamp {
+            var tsBE = ts.bigEndian
+            putTLV(0x05, withUnsafeBytes(of: &tsBE) { Data($0) })
+        }
+        if let fid = fragmentIdFilter, let fidData = fid.data(using: .utf8) {
+            putTLV(0x06, fidData)
+        }
        return out
    }
-
+    
    static func decode(from data: Data, maxAcceptBytes: Int = 1024) -> RequestSyncPacket? {
        var off = 0
        var p: Int? = nil
        var m: UInt32? = nil
        var payload: Data? = nil
        var types: SyncTypeFlags? = nil
+        var sinceTimestamp: UInt64? = nil
+        var fragmentIdFilter: String? = nil

        while off + 3 <= data.count {
            let t = Int(data[off]); off += 1
@@ -68,12 +81,22 @@ struct RequestSyncPacket {
                if let decoded = SyncTypeFlags.decode(v) {
                    types = decoded
                }
+            case 0x05:
+                if v.count == 8 {
+                    var ts: UInt64 = 0
+                    for b in v { ts = (ts << 8) | UInt64(b) }
+                    sinceTimestamp = ts
+                }
+            case 0x06:
+                if let fid = String(data: v, encoding: .utf8) {
+                    fragmentIdFilter = fid
+                }
            default:
                break // forward compatible; ignore unknown TLVs
            }
        }

        guard let pp = p, let mm = m, let dd = payload, pp >= 1, mm > 0 else { return nil }
-        return RequestSyncPacket(p: pp, m: mm, data: dd, types: types)
+        return RequestSyncPacket(p: pp, m: mm, data: dd, types: types, sinceTimestamp: sinceTimestamp, fragmentIdFilter: fragmentIdFilter)
    }
 }
@@ -1,345 +0,0 @@
-import BitLogger
-import Foundation
-import Tor
-#if os(iOS)
-import UIKit
-#elseif os(macOS)
-import AppKit
-#endif
-
-/// Directory of online Nostr relays with approximate GPS locations, used for geohash routing.
-@MainActor
-final class GeoRelayDirectory {
-    struct Entry: Hashable {
-        let host: String
-        let lat: Double
-        let lon: Double
-    }
-
-    static let shared = GeoRelayDirectory()
-
-    private(set) var entries: [Entry] = []
-    private let cacheFileName = "georelays_cache.csv"
-    private let lastFetchKey = "georelay.lastFetchAt"
-    private let remoteURL = URL(string: "https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv")!
-    private let fetchInterval: TimeInterval = TransportConfig.geoRelayFetchIntervalSeconds
-
-    private var refreshTimer: Timer?
-    private var retryTask: Task<Void, Never>?
-    private var retryAttempt: Int = 0
-    private var isFetching: Bool = false
-    private var observers: [NSObjectProtocol] = []
-
-    private init() {
-        entries = loadLocalEntries()
-        registerObservers()
-        startRefreshTimer()
-        prefetchIfNeeded()
-    }
-
-    deinit {
-        observers.forEach { NotificationCenter.default.removeObserver($0) }
-        refreshTimer?.invalidate()
-        retryTask?.cancel()
-    }
-
-    /// Returns up to `count` relay URLs (wss://) closest to the geohash center.
-    func closestRelays(toGeohash geohash: String, count: Int = 5) -> [String] {
-        let center = Geohash.decodeCenter(geohash)
-        return closestRelays(toLat: center.lat, lon: center.lon, count: count)
-    }
-
-    /// Returns up to `count` relay URLs (wss://) closest to the given coordinate.
-    func closestRelays(toLat lat: Double, lon: Double, count: Int = 5) -> [String] {
-        guard !entries.isEmpty, count > 0 else { return [] }
-
-        if entries.count <= count {
-            return entries
-                .sorted { a, b in
-                    haversineKm(lat, lon, a.lat, a.lon) < haversineKm(lat, lon, b.lat, b.lon)
-                }
-                .map { "wss://\($0.host)" }
-        }
-
-        var best: [(entry: Entry, distance: Double)] = []
-        best.reserveCapacity(count)
-
-        for entry in entries {
-            let distance = haversineKm(lat, lon, entry.lat, entry.lon)
-            if best.count < count {
-                let idx = best.firstIndex { $0.distance > distance } ?? best.count
-                best.insert((entry, distance), at: idx)
-            } else if let worstDistance = best.last?.distance, distance < worstDistance {
-                let idx = best.firstIndex { $0.distance > distance } ?? best.count
-                best.insert((entry, distance), at: idx)
-                best.removeLast()
-            }
-        }
-
-        return best.map { "wss://\($0.entry.host)" }
-    }
-
-    // MARK: - Remote Fetch
-    func prefetchIfNeeded(force: Bool = false) {
-        guard !isFetching else { return }
-
-        let now = Date()
-        let last = UserDefaults.standard.object(forKey: lastFetchKey) as? Date ?? .distantPast
-
-        if !force {
-            guard now.timeIntervalSince(last) >= fetchInterval else { return }
-        } else if last != .distantPast,
-                  now.timeIntervalSince(last) < TransportConfig.geoRelayRetryInitialSeconds {
-            // Skip forced fetches if we just refreshed moments ago.
-            return
-        }
-
-        cancelRetry()
-        fetchRemote()
-    }
-
-    private func fetchRemote() {
-        guard !isFetching else { return }
-        isFetching = true
-
-        let request = URLRequest(
-            url: remoteURL,
-            cachePolicy: .reloadIgnoringLocalCacheData,
-            timeoutInterval: 15
-        )
-
-        Task.detached { [weak self] in
-            guard let self else { return }
-
-            let ready = await TorManager.shared.awaitReady()
-            if !ready {
-                await self.handleFetchFailure(.torNotReady)
-                return
-            }
-
-            do {
-                let (data, _) = try await TorURLSession.shared.session.data(for: request)
-                guard let text = String(data: data, encoding: .utf8) else {
-                    await self.handleFetchFailure(.invalidData)
-                    return
-                }
-
-                let parsed = GeoRelayDirectory.parseCSV(text)
-                guard !parsed.isEmpty else {
-                    await self.handleFetchFailure(.invalidData)
-                    return
-                }
-
-                await self.handleFetchSuccess(entries: parsed, csv: text)
-            } catch {
-                await self.handleFetchFailure(.network(error))
-            }
-        }
-    }
-
-    private enum FetchFailure {
-        case torNotReady
-        case invalidData
-        case network(Error)
-    }
-
-    @MainActor
-    private func handleFetchSuccess(entries parsed: [Entry], csv: String) {
-        entries = parsed
-        persistCache(csv)
-        UserDefaults.standard.set(Date(), forKey: lastFetchKey)
-        SecureLogger.info("GeoRelayDirectory: refreshed \(parsed.count) relays from remote", category: .session)
-        isFetching = false
-        retryAttempt = 0
-        cancelRetry()
-    }
-
-    @MainActor
-    private func handleFetchFailure(_ reason: FetchFailure) {
-        switch reason {
-        case .torNotReady:
-            SecureLogger.warning("GeoRelayDirectory: Tor not ready; scheduling retry", category: .session)
-        case .invalidData:
-            SecureLogger.warning("GeoRelayDirectory: remote fetch returned invalid data; scheduling retry", category: .session)
-        case .network(let error):
-            SecureLogger.warning("GeoRelayDirectory: remote fetch failed with error: \(error.localizedDescription)", category: .session)
-        }
-        isFetching = false
-        scheduleRetry()
-    }
-
-    @MainActor
-    private func scheduleRetry() {
-        retryAttempt = min(retryAttempt + 1, 10)
-        let base = TransportConfig.geoRelayRetryInitialSeconds
-        let maxDelay = TransportConfig.geoRelayRetryMaxSeconds
-        let multiplier = pow(2.0, Double(max(retryAttempt - 1, 0)))
-        let calculated = base * multiplier
-        let delay = min(maxDelay, max(base, calculated))
-
-        cancelRetry()
-        retryTask = Task { [weak self] in
-            let nanoseconds = UInt64(delay * 1_000_000_000)
-            try? await Task.sleep(nanoseconds: nanoseconds)
-            await MainActor.run {
-                self?.prefetchIfNeeded(force: true)
-            }
-        }
-    }
-
-    @MainActor
-    private func cancelRetry() {
-        retryTask?.cancel()
-        retryTask = nil
-    }
-
-    private func persistCache(_ text: String) {
-        guard let url = cacheURL() else { return }
-        do {
-            try text.data(using: .utf8)?.write(to: url, options: .atomic)
-        } catch {
-            SecureLogger.warning("GeoRelayDirectory: failed to write cache: \(error)", category: .session)
-        }
-    }
-
-    // MARK: - Loading
-    private func loadLocalEntries() -> [Entry] {
-        // Prefer cached file if present
-        if let cache = cacheURL(),
-           let data = try? Data(contentsOf: cache),
-           let text = String(data: data, encoding: .utf8) {
-            let arr = Self.parseCSV(text)
-            if !arr.isEmpty { return arr }
-        }
-
-        // Try bundled resource(s)
-        let bundleCandidates = [
-            Bundle.main.url(forResource: "nostr_relays", withExtension: "csv"),
-            Bundle.main.url(forResource: "online_relays_gps", withExtension: "csv"),
-            Bundle.main.url(forResource: "online_relays_gps", withExtension: "csv", subdirectory: "relays")
-        ].compactMap { $0 }
-
-        for url in bundleCandidates {
-            if let data = try? Data(contentsOf: url),
-               let text = String(data: data, encoding: .utf8) {
-                let arr = Self.parseCSV(text)
-                if !arr.isEmpty { return arr }
-            }
-        }
-
-        // Try filesystem path (development/test)
-        if let cwd = FileManager.default.currentDirectoryPath as String?,
-           let data = try? Data(contentsOf: URL(fileURLWithPath: cwd).appendingPathComponent("relays/online_relays_gps.csv")),
-           let text = String(data: data, encoding: .utf8) {
-            return Self.parseCSV(text)
-        }
-
-        SecureLogger.warning("GeoRelayDirectory: no local CSV found; entries empty", category: .session)
-        return []
-    }
-
-    nonisolated static func parseCSV(_ text: String) -> [Entry] {
-        var result: Set<Entry> = []
-        let lines = text.split(whereSeparator: { $0.isNewline })
-        for (idx, raw) in lines.enumerated() {
-            let line = raw.trimmingCharacters(in: .whitespacesAndNewlines)
-            if line.isEmpty { continue }
-            if idx == 0 && line.lowercased().contains("relay url") { continue }
-            let parts = line.split(separator: ",").map { String($0).trimmingCharacters(in: .whitespaces) }
-            guard parts.count >= 3 else { continue }
-            var host = parts[0]
-            host = host.replacingOccurrences(of: "https://", with: "")
-            host = host.replacingOccurrences(of: "http://", with: "")
-            host = host.replacingOccurrences(of: "wss://", with: "")
-            host = host.replacingOccurrences(of: "ws://", with: "")
-            host = host.trimmingCharacters(in: CharacterSet(charactersIn: "/"))
-            guard let lat = Double(parts[1]), let lon = Double(parts[2]) else { continue }
-            result.insert(Entry(host: host, lat: lat, lon: lon))
-        }
-        return Array(result)
-    }
-
-    private func cacheURL() -> URL? {
-        do {
-            let base = try FileManager.default.url(
-                for: .applicationSupportDirectory,
-                in: .userDomainMask,
-                appropriateFor: nil,
-                create: true
-            )
-            let dir = base.appendingPathComponent("bitchat", isDirectory: true)
-            try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
-            return dir.appendingPathComponent(cacheFileName)
-        } catch {
-            return nil
-        }
-    }
-
-    // MARK: - Observers & Timers
-    private func registerObservers() {
-        let center = NotificationCenter.default
-
-        let torReady = center.addObserver(
-            forName: .TorDidBecomeReady,
-            object: nil,
-            queue: .main
-        ) { [weak self] _ in
-            guard let self else { return }
-            Task { @MainActor in
-                self.prefetchIfNeeded(force: true)
-            }
-        }
-        observers.append(torReady)
-
-#if os(iOS)
-        let didBecomeActive = center.addObserver(
-            forName: UIApplication.didBecomeActiveNotification,
-            object: nil,
-            queue: .main
-        ) { [weak self] _ in
-            guard let self else { return }
-            Task { @MainActor in
-                self.prefetchIfNeeded()
-            }
-        }
-        observers.append(didBecomeActive)
-#elseif os(macOS)
-        let didBecomeActive = center.addObserver(
-            forName: NSApplication.didBecomeActiveNotification,
-            object: nil,
-            queue: .main
-        ) { [weak self] _ in
-            guard let self else { return }
-            Task { @MainActor in
-                self.prefetchIfNeeded()
-            }
-        }
-        observers.append(didBecomeActive)
-#endif
-    }
-
-    private func startRefreshTimer() {
-        refreshTimer?.invalidate()
-        let interval = TransportConfig.geoRelayRefreshCheckIntervalSeconds
-        guard interval > 0 else { return }
-
-        let timer = Timer.scheduledTimer(withTimeInterval: interval, repeats: true) { [weak self] _ in
-            guard let self else { return }
-            Task { @MainActor in
-                self.prefetchIfNeeded()
-            }
-        }
-        refreshTimer = timer
-        RunLoop.main.add(timer, forMode: .common)
-    }
-}
-
-// MARK: - Distance
-private func haversineKm(_ lat1: Double, _ lon1: Double, _ lat2: Double, _ lon2: Double) -> Double {
-    let r = 6371.0 // Earth radius in km
-    let dLat = (lat2 - lat1) * .pi / 180
-    let dLon = (lon2 - lon1) * .pi / 180
-    let a = sin(dLat/2) * sin(dLat/2) + cos(lat1 * .pi/180) * cos(lat2 * .pi/180) * sin(dLon/2) * sin(dLon/2)
-    let c = 2 * atan2(sqrt(a), sqrt(1 - a))
-    return r * c
-}
@@ -1,50 +0,0 @@
-import Foundation
-
-protocol KeychainHelperProtocol {
-    func save(key: String, data: Data, service: String, accessible: CFString?)
-    func load(key: String, service: String) -> Data?
-    func delete(key: String, service: String)
-}
-
-/// Keychain helper for secure storage
-struct KeychainHelper: KeychainHelperProtocol {
-    func save(key: String, data: Data, service: String, accessible: CFString? = nil) {
-        var query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service,
-            kSecAttrAccount as String: key,
-            kSecValueData as String: data
-        ]
-        if let accessible = accessible {
-            query[kSecAttrAccessible as String] = accessible
-        }
-        
-        SecItemDelete(query as CFDictionary)
-        SecItemAdd(query as CFDictionary, nil)
-    }
-    
-    func load(key: String, service: String) -> Data? {
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service,
-            kSecAttrAccount as String: key,
-            kSecReturnData as String: true
-        ]
-        
-        var result: AnyObject?
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-        
-        guard status == errSecSuccess else { return nil }
-        return result as? Data
-    }
-    
-    func delete(key: String, service: String) {
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: service,
-            kSecAttrAccount as String: key
-        ]
-        
-        SecItemDelete(query as CFDictionary)
-    }
-}
@@ -1,4 +1,5 @@
 import Foundation
+import BitFoundation

 // MARK: - BitChat-over-Nostr Adapter

@@ -0,0 +1,118 @@
+import Nostr
+import Combine
+import Foundation
+import Tor
+#if os(iOS)
+import UIKit
+#elseif os(macOS)
+import AppKit
+#endif
+
+// MARK: - GeoRelayDirectory Live Dependencies
+
+extension GeoRelayDirectoryDependencies {
+    @MainActor
+    static func live() -> Self {
+        #if os(iOS)
+        let activeNotificationName: Notification.Name? = UIApplication.didBecomeActiveNotification
+        #elseif os(macOS)
+        let activeNotificationName: Notification.Name? = NSApplication.didBecomeActiveNotification
+        #else
+        let activeNotificationName: Notification.Name? = nil
+        #endif
+
+        return Self(
+            userDefaults: .standard,
+            notificationCenter: .default,
+            now: Date.init,
+            remoteURL: URL(string: "https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv")!,
+            fetchInterval: TransportConfig.geoRelayFetchIntervalSeconds,
+            refreshCheckInterval: TransportConfig.geoRelayRefreshCheckIntervalSeconds,
+            retryInitialSeconds: TransportConfig.geoRelayRetryInitialSeconds,
+            retryMaxSeconds: TransportConfig.geoRelayRetryMaxSeconds,
+            awaitTorReady: { await TorManager.shared.awaitReady() },
+            makeFetchData: {
+                let session = TorURLSession.shared.session
+                return { request in
+                    let (data, _) = try await session.data(for: request)
+                    return data
+                }
+            },
+            readData: { try? Data(contentsOf: $0) },
+            writeData: { data, url in
+                try data.write(to: url, options: .atomic)
+            },
+            cacheURL: {
+                do {
+                    let base = try FileManager.default.url(
+                        for: .applicationSupportDirectory,
+                        in: .userDomainMask,
+                        appropriateFor: nil,
+                        create: true
+                    )
+                    let dir = base.appendingPathComponent("bitchat", isDirectory: true)
+                    try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+                    return dir.appendingPathComponent("georelays_cache.csv")
+                } catch {
+                    return nil
+                }
+            },
+            bundledCSVURLs: {
+                [
+                    Bundle.main.url(forResource: "nostr_relays", withExtension: "csv"),
+                    Bundle.main.url(forResource: "online_relays_gps", withExtension: "csv"),
+                    Bundle.main.url(forResource: "online_relays_gps", withExtension: "csv", subdirectory: "relays")
+                ].compactMap { $0 }
+            },
+            currentDirectoryPath: { FileManager.default.currentDirectoryPath },
+            retrySleep: { delay in
+                let nanoseconds = UInt64(delay * 1_000_000_000)
+                try? await Task.sleep(nanoseconds: nanoseconds)
+            },
+            torReadyNotificationName: .TorDidBecomeReady,
+            activeNotificationName: activeNotificationName,
+            autoStart: true
+        )
+    }
+}
+
+// MARK: - NostrRelayManager Live Dependencies
+
+extension NostrRelayManagerDependencies {
+    @MainActor
+    static func live() -> Self {
+        Self(
+            activationAllowed: { NetworkActivationService.shared.activationAllowed },
+            userTorEnabled: { NetworkActivationService.shared.userTorEnabled },
+            hasMutualFavorites: { !FavoritesPersistenceService.shared.mutualFavorites.isEmpty },
+            hasLocationPermission: { LocationChannelManager.shared.permissionState == .authorized },
+            mutualFavoritesPublisher: FavoritesPersistenceService.shared.$mutualFavorites.eraseToAnyPublisher(),
+            locationPermissionPublisher: LocationChannelManager.shared.$permissionState
+                .map { state -> LocationPermissionState in
+                    switch state {
+                    case .notDetermined:.notDetermined
+                    case .authorized:   .authorized
+                    case .denied:       .denied
+                    case .restricted:   .denied
+                    }
+                }
+                .eraseToAnyPublisher(),
+            torEnforced: { TorManager.shared.torEnforced },
+            torIsReady: { TorManager.shared.isReady },
+            torIsForeground: { TorManager.shared.isForeground() },
+            awaitTorReady: { completion in
+                Task.detached {
+                    let ready = await TorManager.shared.awaitReady()
+                    await MainActor.run {
+                        completion(ready)
+                    }
+                }
+            },
+            makeSession: { NostrRelayManager.makeURLSession(TorURLSession.shared.session) },
+            scheduleAfter: { delay, action in
+                DispatchQueue.main.asyncAfter(deadline: .now() + delay, execute: action)
+            },
+            now: Date.init
+        )
+    }
+}
@@ -6,40 +6,7 @@
 //

 import Foundation
-import CryptoKit
-
-// MARK: - Hex Encoding/Decoding
-
-extension Data {
-    func hexEncodedString() -> String {
-        if self.isEmpty {
-            return ""
-        }
-        return self.map { String(format: "%02x", $0) }.joined()
-    }
-
-    func sha256Hex() -> String {
-        let digest = SHA256.hash(data: self)
-        return digest.map { String(format: "%02x", $0) }.joined()
-    }
-    
-    init?(hexString: String) {
-        let len = hexString.count / 2
-        var data = Data(capacity: len)
-        var index = hexString.startIndex
-        
-        for _ in 0..<len {
-            let nextIndex = hexString.index(index, offsetBy: 2)
-            guard let byte = UInt8(String(hexString[index..<nextIndex]), radix: 16) else {
-                return nil
-            }
-            data.append(byte)
-            index = nextIndex
-        }
-        
-        self = data
-    }
-}
+import BitFoundation

 // MARK: - Binary Encoding Utilities

@@ -138,6 +138,7 @@ struct BinaryProtocol {
        static let hasSignature: UInt8 = 0x02
        static let isCompressed: UInt8 = 0x04
        static let hasRoute: UInt8 = 0x08
+        static let isRSR: UInt8 = 0x10
    }
    
    // Encode BitchatPacket to binary format
@@ -161,7 +162,9 @@ struct BinaryProtocol {
        }

        let lengthFieldBytes = lengthFieldSize(for: version)
-        let originalRoute = packet.route ?? []
+        
+        // Route is only supported for v2+ packets (per SOURCE_ROUTING.md spec)
+        let originalRoute = (version >= 2) ? (packet.route ?? []) : []
        if originalRoute.contains(where: { $0.isEmpty }) { return nil }
        let sanitizedRoute: [Data] = originalRoute.map { hop in
            if hop.count == senderIDSize { return hop }
@@ -175,13 +178,14 @@ struct BinaryProtocol {
        let hasRoute = !sanitizedRoute.isEmpty
        let routeLength = hasRoute ? 1 + sanitizedRoute.count * senderIDSize : 0
        let originalSizeFieldBytes = isCompressed ? lengthFieldBytes : 0
-        let payloadDataSize = routeLength + payload.count + originalSizeFieldBytes
+        // payloadLength in header is payload-only (does NOT include route bytes)
+        let payloadDataSize = payload.count + originalSizeFieldBytes

        if version == 1 && payloadDataSize > Int(UInt16.max) { return nil }
        if version == 2 && payloadDataSize > Int(UInt32.max) { return nil }

        guard let headerSize = headerSize(for: version) else { return nil }
-        let estimatedHeader = headerSize + senderIDSize + (packet.recipientID == nil ? 0 : recipientIDSize)
+        let estimatedHeader = headerSize + senderIDSize + (packet.recipientID == nil ? 0 : recipientIDSize) + routeLength
        let estimatedPayload = payloadDataSize
        let estimatedSignature = (packet.signature == nil ? 0 : signatureSize)
        var data = Data()
@@ -199,9 +203,11 @@ struct BinaryProtocol {
        if packet.recipientID != nil { flags |= Flags.hasRecipient }
        if packet.signature != nil { flags |= Flags.hasSignature }
        if isCompressed { flags |= Flags.isCompressed }
-        if hasRoute { flags |= Flags.hasRoute }
+        // HAS_ROUTE is only valid for v2+ packets
+        if hasRoute && version >= 2 { flags |= Flags.hasRoute }
+        if packet.isRSR { flags |= Flags.isRSR }
        data.append(flags)
-
+        
        if version == 2 {
            let length = UInt32(payloadDataSize)
            for shift in stride(from: 24, through: 0, by: -8) {
@@ -323,7 +329,10 @@ struct BinaryProtocol {
            let hasRecipient = (flags & Flags.hasRecipient) != 0
            let hasSignature = (flags & Flags.hasSignature) != 0
            let isCompressed = (flags & Flags.isCompressed) != 0
-
+            // HAS_ROUTE is only valid for v2+ packets; ignore the flag for v1
+            let hasRoute = (version >= 2) && (flags & Flags.hasRoute) != 0
+            let isRSR = (flags & Flags.isRSR) != 0
+            
            let payloadLength: Int
            if version == 2 {
                guard let len = read32() else { return nil }
@@ -334,6 +343,7 @@ struct BinaryProtocol {
            }

            guard payloadLength >= 0 else { return nil }
+            guard payloadLength <= FileTransferLimits.maxFramedFileBytes else { return nil }

            guard let senderID = readData(senderIDSize) else { return nil }

@@ -343,27 +353,24 @@ struct BinaryProtocol {
                if recipientID == nil { return nil }
            }

+            // Route (optional, v2+ only): route bytes are NOT included in payloadLength
            var route: [Data]? = nil
-            var remainingPayloadBytes = payloadLength
-
-            if (flags & Flags.hasRoute) != 0 {
-                guard remainingPayloadBytes >= 1, let routeCount = read8() else { return nil }
-                remainingPayloadBytes -= 1
+            if hasRoute {
+                guard let routeCount = read8() else { return nil }
                if routeCount > 0 {
                    var hops: [Data] = []
                    for _ in 0..<Int(routeCount) {
-                        guard remainingPayloadBytes >= senderIDSize,
-                              let hop = readData(senderIDSize) else { return nil }
-                        remainingPayloadBytes -= senderIDSize
+                        guard let hop = readData(senderIDSize) else { return nil }
                        hops.append(hop)
                    }
                    route = hops
                }
            }

+            // Payload: payloadLength is exactly the payload size (+ compression preamble if compressed)
            let payload: Data
            if isCompressed {
-                guard remainingPayloadBytes >= lengthFieldBytes else { return nil }
+                guard payloadLength >= lengthFieldBytes else { return nil }
                let originalSize: Int
                if version == 2 {
                    guard let rawSize = read32() else { return nil }
@@ -372,11 +379,9 @@ struct BinaryProtocol {
                    guard let rawSize = read16() else { return nil }
                    originalSize = Int(rawSize)
                }
-                remainingPayloadBytes -= lengthFieldBytes
                guard originalSize >= 0 && originalSize <= FileTransferLimits.maxFramedFileBytes else { return nil }
-                let compressedSize = remainingPayloadBytes
+                let compressedSize = payloadLength - lengthFieldBytes
                guard compressedSize > 0, let compressed = readData(compressedSize) else { return nil }
-                remainingPayloadBytes = 0

                let compressionRatio = Double(originalSize) / Double(compressedSize)
                guard compressionRatio <= 50_000.0 else {
@@ -388,9 +393,7 @@ struct BinaryProtocol {
                      decompressed.count == originalSize else { return nil }
                payload = decompressed
            } else {
-                guard remainingPayloadBytes >= 0,
-                      let rawPayload = readData(remainingPayloadBytes) else { return nil }
-                remainingPayloadBytes = 0
+                guard let rawPayload = readData(payloadLength) else { return nil }
                payload = rawPayload
            }

@@ -411,7 +414,8 @@ struct BinaryProtocol {
                signature: signature,
                ttl: ttl,
                version: version,
-                route: route
+                route: route,
+                isRSR: isRSR
            )
        }
    }
@@ -60,6 +60,7 @@

 import Foundation
 import CoreBluetooth
+import BitFoundation

 // MARK: - Message Types

@@ -191,5 +191,22 @@ enum MimeType: CaseIterable, Hashable {
 extension MimeType {
    enum Category: String {
        case audio, image, file
+
+        /// Ends with a space
+        var messagePrefix: String {
+            switch self {
+            case .audio: "[voice] "
+            case .image: "[image] "
+            case .file: "[file] "
+            }
+        }
+
+        var mediaDir: String {
+            switch self {
+            case .audio: "voicenotes"
+            case .image: "images"
+            case .file: "files"
+            }
+        }
    }
 }
@@ -6,7 +6,9 @@
 // This is free and unencumbered software released into the public domain.
 //

+import Nostr
 import Foundation
+import BitFoundation

 /// Result of command processing
 enum CommandResult {
@@ -15,15 +17,52 @@ enum CommandResult {
    case handled  // Command handled, no message needed
 }

+/// Simple struct for geo participant info used by CommandProcessor
+struct CommandGeoParticipant {
+    let id: String        // pubkey hex (lowercased)
+    let displayName: String
+}
+
+/// Protocol defining what CommandProcessor needs from its context.
+/// This breaks the circular dependency between CommandProcessor and ChatViewModel.
+@MainActor
+protocol CommandContextProvider: AnyObject {
+    // MARK: - State Properties
+    var nickname: String { get }
+    var selectedPrivateChatPeer: PeerID? { get }
+    var blockedUsers: Set<String> { get }
+    var privateChats: [PeerID: [BitchatMessage]] { get set }
+    var idBridge: NostrIdentityBridge { get }
+
+    // MARK: - Peer Lookup
+    func getPeerIDForNickname(_ nickname: String) -> PeerID?
+    func getVisibleGeoParticipants() -> [CommandGeoParticipant]
+    func nostrPubkeyForDisplayName(_ displayName: String) -> String?
+
+    // MARK: - Chat Actions
+    func startPrivateChat(with peerID: PeerID)
+    func sendPrivateMessage(_ content: String, to peerID: PeerID)
+    func clearCurrentPublicTimeline()
+    func sendPublicRaw(_ content: String)
+
+    // MARK: - System Messages
+    func addLocalPrivateSystemMessage(_ content: String, to peerID: PeerID)
+    func addPublicSystemMessage(_ content: String)
+
+    // MARK: - Favorites
+    func toggleFavorite(peerID: PeerID)
+    func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool)
+}
+
 /// Processes chat commands in a focused, efficient way
@MainActor
 final class CommandProcessor {
-    weak var chatViewModel: ChatViewModel?
+    weak var contextProvider: CommandContextProvider?
    weak var meshService: Transport?
    private let identityManager: SecureIdentityStateManagerProtocol
-    
-    init(chatViewModel: ChatViewModel? = nil, meshService: Transport? = nil, identityManager: SecureIdentityStateManagerProtocol) {
-        self.chatViewModel = chatViewModel
+
+    init(contextProvider: CommandContextProvider? = nil, meshService: Transport? = nil, identityManager: SecureIdentityStateManagerProtocol) {
+        self.contextProvider = contextProvider
        self.meshService = meshService
        self.identityManager = identityManager
    }
@@ -42,7 +81,7 @@ final class CommandProcessor {
            case .location: return true
            }
        }()
-        let inGeoDM = chatViewModel?.selectedPrivateChatPeer?.isGeoDM == true
+        let inGeoDM = contextProvider?.selectedPrivateChatPeer?.isGeoDM == true

        switch cmd {
        case "/m", "/msg":
@@ -81,15 +120,15 @@ final class CommandProcessor {
        let targetName = String(parts[0])
        let nickname = targetName.hasPrefix("@") ? String(targetName.dropFirst()) : targetName
        
-        guard let peerID = chatViewModel?.getPeerIDForNickname(nickname) else {
+        guard let peerID = contextProvider?.getPeerIDForNickname(nickname) else {
            return .error(message: "'\(nickname)' not found")
        }
-        
-        chatViewModel?.startPrivateChat(with: peerID)
-        
+
+        contextProvider?.startPrivateChat(with: peerID)
+
        if parts.count > 1 {
            let message = String(parts[1])
-            chatViewModel?.sendPrivateMessage(message, to: peerID)
+            contextProvider?.sendPrivateMessage(message, to: peerID)
        }
        
        return .success(message: "started private chat with \(nickname)")
@@ -100,9 +139,9 @@ final class CommandProcessor {
        switch LocationChannelManager.shared.selectedChannel {
        case .location(let ch):
            // Geohash context: show visible geohash participants (exclude self)
-            guard let vm = chatViewModel else { return .success(message: "nobody around") }
-            let myHex = (try? chatViewModel?.idBridge.deriveIdentity(forGeohash: ch.geohash))?.publicKeyHex.lowercased()
-            let people = vm.visibleGeohashPeople().filter { person in
+            guard let vm = contextProvider else { return .success(message: "nobody around") }
+            let myHex = (try? vm.idBridge.deriveIdentity(forGeohash: ch.geohash))?.publicKeyHex.lowercased()
+            let people = vm.getVisibleGeoParticipants().filter { person in
                if let me = myHex { return person.id.lowercased() != me }
                return true
            }
@@ -120,30 +159,30 @@ final class CommandProcessor {
    }
    
    private func handleClear() -> CommandResult {
-        if let peerID = chatViewModel?.selectedPrivateChatPeer {
-            chatViewModel?.privateChats[peerID]?.removeAll()
+        if let peerID = contextProvider?.selectedPrivateChatPeer {
+            contextProvider?.privateChats[peerID]?.removeAll()
        } else {
-            chatViewModel?.clearCurrentPublicTimeline()
+            contextProvider?.clearCurrentPublicTimeline()
        }
        return .handled
    }
    
    private func handleEmote(_ args: String, command: String, action: String, emoji: String, suffix: String = "") -> CommandResult {
-        let targetName = args.trimmingCharacters(in: .whitespaces)
+        let targetName = args.trimmed
        guard !targetName.isEmpty else {
            return .error(message: "usage: /\(command) <nickname>")
        }
        
        let nickname = targetName.hasPrefix("@") ? String(targetName.dropFirst()) : targetName
        
-        guard let targetPeerID = chatViewModel?.getPeerIDForNickname(nickname),
-              let myNickname = chatViewModel?.nickname else {
+        guard let targetPeerID = contextProvider?.getPeerIDForNickname(nickname),
+              let myNickname = contextProvider?.nickname else {
            return .error(message: "cannot \(command) \(nickname): not found")
        }
        
        let emoteContent = "* \(emoji) \(myNickname) \(action) \(nickname)\(suffix) *"
        
-        if chatViewModel?.selectedPrivateChatPeer != nil {
+        if contextProvider?.selectedPrivateChatPeer != nil {
            // In private chat
            if let peerNickname = meshService?.peerNickname(peerID: targetPeerID) {
                let personalMessage = "* \(emoji) \(myNickname) \(action) you\(suffix) *"
@@ -159,24 +198,24 @@ final class CommandProcessor {
                    }
                }()
                let localText = "\(emoji) you \(pastAction) \(nickname)\(suffix)"
-                chatViewModel?.addLocalPrivateSystemMessage(localText, to: targetPeerID)
+                contextProvider?.addLocalPrivateSystemMessage(localText, to: targetPeerID)
            }
        } else {
            // In public chat: send to active public channel (mesh or geohash)
-            chatViewModel?.sendPublicRaw(emoteContent)
+            contextProvider?.sendPublicRaw(emoteContent)
            let publicEcho = "\(emoji) \(myNickname) \(action) \(nickname)\(suffix)"
-            chatViewModel?.addPublicSystemMessage(publicEcho)
+            contextProvider?.addPublicSystemMessage(publicEcho)
        }
        
        return .handled
    }
    
    private func handleBlock(_ args: String) -> CommandResult {
-        let targetName = args.trimmingCharacters(in: .whitespaces)
+        let targetName = args.trimmed
        
        if targetName.isEmpty {
            // List blocked users (mesh) and geohash (Nostr) blocks
-            let meshBlocked = chatViewModel?.blockedUsers ?? []
+            let meshBlocked = contextProvider?.blockedUsers ?? []
            var blockedNicknames: [String] = []
            if let peers = meshService?.getPeerNicknames() {
                for (peerID, nickname) in peers {
@@ -190,8 +229,8 @@ final class CommandProcessor {
            // Geohash blocked names (prefer visible display names; fallback to #suffix)
            let geoBlocked = Array(identityManager.getBlockedNostrPubkeys())
            var geoNames: [String] = []
-            if let vm = chatViewModel {
-                let visible = vm.visibleGeohashPeople()
+            if let vm = contextProvider {
+                let visible = vm.getVisibleGeoParticipants()
                let visibleIndex = Dictionary(uniqueKeysWithValues: visible.map { ($0.id.lowercased(), $0.displayName) })
                for pk in geoBlocked {
                    if let name = visibleIndex[pk.lowercased()] {
@@ -210,7 +249,7 @@ final class CommandProcessor {
        
        let nickname = targetName.hasPrefix("@") ? String(targetName.dropFirst()) : targetName
        
-        if let peerID = chatViewModel?.getPeerIDForNickname(nickname),
+        if let peerID = contextProvider?.getPeerIDForNickname(nickname),
           let fingerprint = meshService?.getFingerprint(for: peerID) {
            if identityManager.isBlocked(fingerprint: fingerprint) {
                return .success(message: "\(nickname) is already blocked")
@@ -235,7 +274,7 @@ final class CommandProcessor {
            return .success(message: "blocked \(nickname). you will no longer receive messages from them")
        }
        // Mesh lookup failed; try geohash (Nostr) participant by display name
-        if let pub = chatViewModel?.nostrPubkeyForDisplayName(nickname) {
+        if let pub = contextProvider?.nostrPubkeyForDisplayName(nickname) {
            if identityManager.isNostrBlocked(pubkeyHexLowercased: pub) {
                return .success(message: "\(nickname) is already blocked")
            }
@@ -247,14 +286,14 @@ final class CommandProcessor {
    }
    
    private func handleUnblock(_ args: String) -> CommandResult {
-        let targetName = args.trimmingCharacters(in: .whitespaces)
+        let targetName = args.trimmed
        guard !targetName.isEmpty else {
            return .error(message: "usage: /unblock <nickname>")
        }
        
        let nickname = targetName.hasPrefix("@") ? String(targetName.dropFirst()) : targetName
        
-        if let peerID = chatViewModel?.getPeerIDForNickname(nickname),
+        if let peerID = contextProvider?.getPeerIDForNickname(nickname),
           let fingerprint = meshService?.getFingerprint(for: peerID) {
            if !identityManager.isBlocked(fingerprint: fingerprint) {
                return .success(message: "\(nickname) is not blocked")
@@ -263,7 +302,7 @@ final class CommandProcessor {
            return .success(message: "unblocked \(nickname)")
        }
        // Try geohash unblock
-        if let pub = chatViewModel?.nostrPubkeyForDisplayName(nickname) {
+        if let pub = contextProvider?.nostrPubkeyForDisplayName(nickname) {
            if !identityManager.isNostrBlocked(pubkeyHexLowercased: pub) {
                return .success(message: "\(nickname) is not blocked")
            }
@@ -274,14 +313,14 @@ final class CommandProcessor {
    }
    
    private func handleFavorite(_ args: String, add: Bool) -> CommandResult {
-        let targetName = args.trimmingCharacters(in: .whitespaces)
+        let targetName = args.trimmed
        guard !targetName.isEmpty else {
            return .error(message: "usage: /\(add ? "fav" : "unfav") <nickname>")
        }
        
        let nickname = targetName.hasPrefix("@") ? String(targetName.dropFirst()) : targetName
        
-        guard let peerID = chatViewModel?.getPeerIDForNickname(nickname),
+        guard let peerID = contextProvider?.getPeerIDForNickname(nickname),
              let noisePublicKey = Data(hexString: peerID.id) else {
            return .error(message: "can't find peer: \(nickname)")
        }
@@ -294,15 +333,15 @@ final class CommandProcessor {
                peerNickname: nickname
            )
            
-            chatViewModel?.toggleFavorite(peerID: peerID)
-            chatViewModel?.sendFavoriteNotification(to: peerID, isFavorite: true)
+            contextProvider?.toggleFavorite(peerID: peerID)
+            contextProvider?.sendFavoriteNotification(to: peerID, isFavorite: true)
            
            return .success(message: "added \(nickname) to favorites")
        } else {
            FavoritesPersistenceService.shared.removeFavorite(peerNoisePublicKey: noisePublicKey)
            
-            chatViewModel?.toggleFavorite(peerID: peerID)
-            chatViewModel?.sendFavoriteNotification(to: peerID, isFavorite: false)
+            contextProvider?.toggleFavorite(peerID: peerID)
+            contextProvider?.sendFavoriteNotification(to: peerID, isFavorite: false)
            
            return .success(message: "removed \(nickname) from favorites")
        }
@@ -1,4 +1,5 @@
 import BitLogger
+import BitFoundation
 import Foundation
 import Combine

@@ -26,17 +27,14 @@ final class FavoritesPersistenceService: ObservableObject {

    private static let storageKey = "chat.bitchat.favorites"
    private static let keychainService = "chat.bitchat.favorites"
-    private let keychain: KeychainHelperProtocol
+    private let keychain: KeychainManagerProtocol
    
    @Published private(set) var favorites: [Data: FavoriteRelationship] = [:] // Noise pubkey -> relationship
    @Published private(set) var mutualFavorites: Set<Data> = []
    
-    private let userDefaults = UserDefaults.standard
-    private var cancellables = Set<AnyCancellable>()
-    
    static let shared = FavoritesPersistenceService()
-    
-    init(keychain: KeychainHelperProtocol = KeychainHelper()) {
+
+    init(keychain: KeychainManagerProtocol = KeychainManager()) {
        self.keychain = keychain
        loadFavorites()
        
@@ -1,219 +0,0 @@
-import Foundation
-import Combine
-#if os(iOS) || os(macOS)
-import CoreLocation
-#endif
-
-/// Stores a user-maintained list of bookmarked geohash channels.
-/// - Persistence: UserDefaults (JSON string array)
-/// - Semantics: geohashes are normalized to lowercase base32 and de-duplicated
-final class GeohashBookmarksStore: ObservableObject {
-    static let shared = GeohashBookmarksStore()
-
-    @Published private(set) var bookmarks: [String] = []
-    @Published private(set) var bookmarkNames: [String: String] = [:] // geohash -> friendly name
-
-    private let storeKey = "locationChannel.bookmarks"
-    private let namesStoreKey = "locationChannel.bookmarkNames"
-    private var membership: Set<String> = []
-    #if os(iOS) || os(macOS)
-    private let geocoder = CLGeocoder()
-    private var resolving: Set<String> = []
-    #endif
-    
-    private let storage: UserDefaults
-
-    init(storage: UserDefaults = .standard) {
-        self.storage = storage
-        load()
-    }
-
-    // MARK: - Public API
-    func isBookmarked(_ geohash: String) -> Bool {
-        return membership.contains(Self.normalize(geohash))
-    }
-
-    func toggle(_ geohash: String) {
-        let gh = Self.normalize(geohash)
-        if membership.contains(gh) {
-            remove(gh)
-        } else {
-            add(gh)
-        }
-    }
-
-    func add(_ geohash: String) {
-        let gh = Self.normalize(geohash)
-        guard !gh.isEmpty else { return }
-        guard !membership.contains(gh) else { return }
-        bookmarks.insert(gh, at: 0)
-        membership.insert(gh)
-        persist()
-        // Resolve and persist a friendly name once when added
-        resolveNameIfNeeded(for: gh)
-    }
-
-    func remove(_ geohash: String) {
-        let gh = Self.normalize(geohash)
-        guard membership.contains(gh) else { return }
-        if let idx = bookmarks.firstIndex(of: gh) { bookmarks.remove(at: idx) }
-        membership.remove(gh)
-        // Clean up stored name to avoid stale cache growth
-        if bookmarkNames.removeValue(forKey: gh) != nil {
-            persistNames()
-        }
-        persist()
-    }
-
-    // MARK: - Persistence
-    private func load() {
-        guard let data = storage.data(forKey: storeKey) else { return }
-        if let arr = try? JSONDecoder().decode([String].self, from: data) {
-            // Sanitize, normalize, dedupe while preserving order (first occurrence wins)
-            var seen = Set<String>()
-            var list: [String] = []
-            for raw in arr {
-                let gh = Self.normalize(raw)
-                guard !gh.isEmpty else { continue }
-                if !seen.contains(gh) {
-                    seen.insert(gh)
-                    list.append(gh)
-                }
-            }
-            bookmarks = list
-            membership = seen
-        }
-        // Load any saved names
-        if let namesData = storage.data(forKey: namesStoreKey),
-           let dict = try? JSONDecoder().decode([String: String].self, from: namesData) {
-            bookmarkNames = dict
-        }
-    }
-
-    private func persist() {
-        if let data = try? JSONEncoder().encode(bookmarks) {
-            storage.set(data, forKey: storeKey)
-        }
-    }
-
-    private func persistNames() {
-        if let data = try? JSONEncoder().encode(bookmarkNames) {
-            storage.set(data, forKey: namesStoreKey)
-        }
-    }
-
-    // MARK: - Helpers
-    private static func normalize(_ s: String) -> String {
-        let allowed = Set("0123456789bcdefghjkmnpqrstuvwxyz")
-        return s
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-            .lowercased()
-            .replacingOccurrences(of: "#", with: "")
-            .filter { allowed.contains($0) }
-    }
-
-    // MARK: - Name Resolution
-    /// Attempt to resolve and persist a friendly place name for a bookmarked geohash.
-    func resolveNameIfNeeded(for geohash: String) {
-        let gh = Self.normalize(geohash)
-        guard !gh.isEmpty else { return }
-        if bookmarkNames[gh] != nil { return }
-        #if os(iOS) || os(macOS)
-        if resolving.contains(gh) { return }
-        resolving.insert(gh)
-        // For very coarse geohashes, sample multiple points to capture multiple admin areas
-        if gh.count <= 2 {
-            let b = Geohash.decodeBounds(gh)
-            let pts: [CLLocation] = [
-                CLLocation(latitude: (b.latMin + b.latMax) / 2, longitude: (b.lonMin + b.lonMax) / 2), // center
-                CLLocation(latitude: b.latMin, longitude: b.lonMin),
-                CLLocation(latitude: b.latMin, longitude: b.lonMax),
-                CLLocation(latitude: b.latMax, longitude: b.lonMin),
-                CLLocation(latitude: b.latMax, longitude: b.lonMax)
-            ]
-            resolveCompositeAdminName(geohash: gh, points: pts)
-        } else {
-            let center = Geohash.decodeCenter(gh)
-            let loc = CLLocation(latitude: center.lat, longitude: center.lon)
-            geocoder.reverseGeocodeLocation(loc) { [weak self] placemarks, _ in
-                guard let self = self else { return }
-                defer { self.resolving.remove(gh) }
-                if let pm = placemarks?.first {
-                    let name = Self.nameForGeohashLength(gh.count, from: pm)
-                    if let name = name, !name.isEmpty {
-                        DispatchQueue.main.async {
-                            self.bookmarkNames[gh] = name
-                            self.persistNames()
-                        }
-                    }
-                }
-            }
-        }
-        #endif
-    }
-
-    #if os(iOS) || os(macOS)
-    private func resolveCompositeAdminName(geohash gh: String, points: [CLLocation]) {
-        var uniqueAdmins = OrderedSet<String>()
-        var idx = 0
-        func step() {
-            if idx >= points.count {
-                // Compose up to 2 names joined by ' and '
-                let finalName: String? = {
-                    let names = uniqueAdmins.array
-                    if names.count >= 2 { return names[0] + " and " + names[1] }
-                    return names.first
-                }()
-                if let finalName = finalName, !finalName.isEmpty {
-                    DispatchQueue.main.async {
-                        self.bookmarkNames[gh] = finalName
-                        self.persistNames()
-                    }
-                }
-                self.resolving.remove(gh)
-                return
-            }
-            let loc = points[idx]
-            idx += 1
-            geocoder.reverseGeocodeLocation(loc) { [weak self] placemarks, _ in
-                guard self != nil else { return }
-                if let pm = placemarks?.first {
-                    if let admin = pm.administrativeArea, !admin.isEmpty {
-                        uniqueAdmins.insert(admin)
-                    } else if let country = pm.country, !country.isEmpty {
-                        uniqueAdmins.insert(country)
-                    }
-                }
-                // Proceed to next point
-                step()
-            }
-        }
-        step()
-    }
-
-    // Minimal ordered-set for stable joining
-    private struct OrderedSet<Element: Hashable> {
-        private var set: Set<Element> = []
-        private(set) var array: [Element] = []
-        mutating func insert(_ element: Element) {
-            if set.insert(element).inserted { array.append(element) }
-        }
-    }
-
-    private static func nameForGeohashLength(_ len: Int, from pm: CLPlacemark) -> String? {
-        switch len {
-        case 0...2:
-            // Prefer administrative area if available at this coarse level
-            return pm.administrativeArea ?? pm.country
-        case 3...4:
-            return pm.administrativeArea ?? pm.subAdministrativeArea ?? pm.country
-        case 5:
-            return pm.locality ?? pm.subAdministrativeArea ?? pm.administrativeArea
-        case 6...7:
-            return pm.subLocality ?? pm.locality ?? pm.administrativeArea
-        default:
-            return pm.subLocality ?? pm.locality ?? pm.administrativeArea ?? pm.country
-        }
-    }
-    #endif
-}
@@ -0,0 +1,162 @@
+//
+// GeohashParticipantTracker.swift
+// bitchat
+//
+// Tracks participants in geohash-based location channels.
+// This is free and unencumbered software released into the public domain.
+//
+
+import Foundation
+
+/// Represents a participant in a geohash channel
+public struct GeoPerson: Identifiable, Equatable, Sendable {
+    public let id: String        // pubkey hex (lowercased)
+    public let displayName: String
+    public let lastSeen: Date
+
+    public init(id: String, displayName: String, lastSeen: Date) {
+        self.id = id
+        self.displayName = displayName
+        self.lastSeen = lastSeen
+    }
+}
+
+/// Protocol for resolving display names and checking block status
+@MainActor
+public protocol GeohashParticipantContext: AnyObject {
+    /// Returns display name for a Nostr pubkey (e.g., "alice#a1b2" or "anon#c3d4")
+    func displayNameForPubkey(_ pubkeyHex: String) -> String
+    /// Returns true if the pubkey is blocked
+    func isBlocked(_ pubkeyHexLowercased: String) -> Bool
+}
+
+/// Tracks participants across multiple geohash channels
+@MainActor
+public final class GeohashParticipantTracker: ObservableObject {
+
+    /// Activity cutoff duration (defaults to 5 minutes)
+    public let activityCutoff: TimeInterval
+
+    /// Per-geohash participant map: [geohash: [pubkeyHex: lastSeen]]
+    private var participants: [String: [String: Date]] = [:]
+
+    /// Currently visible people for the active geohash
+    @Published public private(set) var visiblePeople: [GeoPerson] = []
+
+    /// The currently active geohash (if any)
+    private var activeGeohash: String?
+
+    /// Context for display name resolution and block checking
+    private weak var context: GeohashParticipantContext?
+
+    /// Timer for periodic refresh
+    private var refreshTimer: Timer?
+
+    public init(activityCutoff: TimeInterval = -300) { // default 5 minutes
+        self.activityCutoff = activityCutoff
+    }
+
+    /// Configure with a context provider
+    public func configure(context: GeohashParticipantContext) {
+        self.context = context
+    }
+
+    /// Set the currently active geohash
+    public func setActiveGeohash(_ geohash: String?) {
+        activeGeohash = geohash
+        if geohash == nil {
+            visiblePeople = []
+        } else {
+            refresh()
+        }
+    }
+
+    /// Record activity from a participant in the current active geohash
+    public func recordParticipant(pubkeyHex: String) {
+        guard let gh = activeGeohash else { return }
+        recordParticipant(pubkeyHex: pubkeyHex, geohash: gh)
+    }
+
+    /// Record activity from a participant in a specific geohash
+    public func recordParticipant(pubkeyHex: String, geohash: String) {
+        let key = pubkeyHex.lowercased()
+        var map = participants[geohash] ?? [:]
+        map[key] = Date()
+        participants[geohash] = map
+        
+        // Always notify observers that state has changed so counts in UI update
+        objectWillChange.send()
+
+        // Only refresh visible list if this geohash is currently active
+        if activeGeohash == geohash {
+            refresh()
+        }
+    }
+
+    /// Remove a participant from all geohashes (used when blocking)
+    public func removeParticipant(pubkeyHex: String) {
+        let key = pubkeyHex.lowercased()
+        for (gh, var map) in participants {
+            map.removeValue(forKey: key)
+            participants[gh] = map
+        }
+        refresh()
+    }
+
+    /// Get participant count for a specific geohash
+    public func participantCount(for geohash: String) -> Int {
+        let cutoff = Date().addingTimeInterval(activityCutoff)
+        let map = participants[geohash] ?? [:]
+        return map.values.filter { $0 >= cutoff }.count
+    }
+
+    /// Get the visible people list for the active geohash (read-only query)
+    public func getVisiblePeople() -> [GeoPerson] {
+        guard let gh = activeGeohash, let context = context else { return [] }
+        let cutoff = Date().addingTimeInterval(activityCutoff)
+        let map = (participants[gh] ?? [:])
+            .filter { $0.value >= cutoff }
+            .filter { !context.isBlocked($0.key) }
+
+        return map
+            .map { (pub, seen) in
+                GeoPerson(id: pub, displayName: context.displayNameForPubkey(pub), lastSeen: seen)
+            }
+            .sorted { $0.lastSeen > $1.lastSeen }
+    }
+
+    /// Refresh the visible people list
+    public func refresh() {
+        visiblePeople = getVisiblePeople()
+    }
+
+    /// Start the periodic refresh timer
+    public func startRefreshTimer(interval: TimeInterval = 30.0) {
+        stopRefreshTimer()
+        refreshTimer = Timer.scheduledTimer(withTimeInterval: interval, repeats: true) { [weak self] _ in
+            Task { @MainActor in
+                self?.refresh()
+            }
+        }
+    }
+
+    /// Stop the periodic refresh timer
+    public func stopRefreshTimer() {
+        refreshTimer?.invalidate()
+        refreshTimer = nil
+    }
+
+    /// Clear all participant data
+    public func clear() {
+        participants.removeAll()
+        visiblePeople = []
+    }
+
+    /// Clear participant data for a specific geohash
+    public func clear(geohash: String) {
+        participants.removeValue(forKey: geohash)
+        if activeGeohash == geohash {
+            visiblePeople = []
+        }
+    }
+}
@@ -0,0 +1,265 @@
+//
+// GeohashPresenceService.swift
+// bitchat
+//
+// Manages the broadcasting of ephemeral presence heartbeats (Kind 20001)
+// to geohash location channels.
+//
+// This is free and unencumbered software released into the public domain.
+//
+
+import Nostr
+import Foundation
+import Combine
+import BitLogger
+import Tor
+
+protocol GeohashPresenceTimerProtocol: AnyObject {
+    var isValid: Bool { get }
+    func invalidate()
+}
+
+private final class GeohashPresenceTimerAdapter: GeohashPresenceTimerProtocol {
+    private let base: Timer
+
+    init(base: Timer) {
+        self.base = base
+    }
+
+    var isValid: Bool { base.isValid }
+
+    func invalidate() {
+        base.invalidate()
+    }
+}
+
+/// Service that coordinates the broadcasting of presence heartbeats.
+///
+/// Behavior:
+/// - Monitors location changes via LocationStateManager
+/// - Broadcasts Kind 20001 events to low-precision geohash channels
+/// - Uses randomized timing (40-80s loop) and decorrelated bursts
+/// - Respects privacy by NOT broadcasting to Neighborhood/Block/Building levels
+@MainActor
+final class GeohashPresenceService: ObservableObject {
+    static let shared = GeohashPresenceService()
+
+    private var subscriptions = Set<AnyCancellable>()
+    private var heartbeatTimer: GeohashPresenceTimerProtocol?
+    private let availableChannelsProvider: () -> [GeohashChannel]
+    private let locationChanges: AnyPublisher<[GeohashChannel], Never>
+    private let torReadyPublisher: AnyPublisher<Void, Never>
+    private let torIsReady: () -> Bool
+    private let torIsForeground: () -> Bool
+    private let deriveIdentity: (String) throws -> NostrIdentity
+    private let relayLookup: (String, Int) -> [String]
+    private let relaySender: (NostrEvent, [String]) -> Void
+    private let sleeper: (UInt64) async -> Void
+    private let scheduleTimer: (TimeInterval, @escaping () -> Void) -> GeohashPresenceTimerProtocol
+    
+    // MARK: - Constants
+
+    // Loop interval range in seconds
+    private let loopMinInterval: TimeInterval
+    private let loopMaxInterval: TimeInterval
+    
+    // Per-broadcast decorrelation delay range in seconds
+    private let burstMinDelay: TimeInterval
+    private let burstMaxDelay: TimeInterval
+
+    // Privacy: Only broadcast to these levels
+    private let allowedPrecisions: Set<Int> = [
+        GeohashChannelLevel.region.precision,    // 2
+        GeohashChannelLevel.province.precision,  // 4
+        GeohashChannelLevel.city.precision       // 5
+    ]
+
+    private init() {
+        let idBridge = NostrIdentityBridge(keychain: KeychainManager())
+        self.availableChannelsProvider = { LocationStateManager.shared.availableChannels }
+        self.locationChanges = LocationStateManager.shared.$availableChannels.eraseToAnyPublisher()
+        self.torReadyPublisher = NotificationCenter.default.publisher(for: .TorDidBecomeReady)
+            .map { _ in () }
+            .eraseToAnyPublisher()
+        self.torIsReady = { TorManager.shared.isReady }
+        self.torIsForeground = { TorManager.shared.isForeground() }
+        self.deriveIdentity = { try idBridge.deriveIdentity(forGeohash: $0) }
+        self.relayLookup = { geohash, count in
+            GeoRelayDirectory.shared.closestRelays(toGeohash: geohash, count: count)
+        }
+        self.relaySender = { event, relays in
+            NostrRelayManager.shared.sendEvent(event, to: relays)
+        }
+        self.sleeper = { nanoseconds in
+            try? await Task.sleep(nanoseconds: nanoseconds)
+        }
+        self.scheduleTimer = { interval, action in
+            GeohashPresenceTimerAdapter(
+                base: Timer.scheduledTimer(withTimeInterval: interval, repeats: false) { _ in
+                    action()
+                }
+            )
+        }
+        self.loopMinInterval = 40.0
+        self.loopMaxInterval = 80.0
+        self.burstMinDelay = 2.0
+        self.burstMaxDelay = 5.0
+        setupObservers()
+    }
+
+    internal init(
+        availableChannelsProvider: @escaping () -> [GeohashChannel],
+        locationChanges: AnyPublisher<[GeohashChannel], Never>,
+        torReadyPublisher: AnyPublisher<Void, Never>,
+        torIsReady: @escaping () -> Bool,
+        torIsForeground: @escaping () -> Bool,
+        deriveIdentity: @escaping (String) throws -> NostrIdentity,
+        relayLookup: @escaping (String, Int) -> [String],
+        relaySender: @escaping (NostrEvent, [String]) -> Void,
+        sleeper: @escaping (UInt64) async -> Void = { nanoseconds in try? await Task.sleep(nanoseconds: nanoseconds) },
+        scheduleTimer: @escaping (TimeInterval, @escaping () -> Void) -> GeohashPresenceTimerProtocol = { interval, action in
+            GeohashPresenceTimerAdapter(
+                base: Timer.scheduledTimer(withTimeInterval: interval, repeats: false) { _ in
+                    action()
+                }
+            )
+        },
+        loopMinInterval: TimeInterval = 40.0,
+        loopMaxInterval: TimeInterval = 80.0,
+        burstMinDelay: TimeInterval = 2.0,
+        burstMaxDelay: TimeInterval = 5.0
+    ) {
+        self.availableChannelsProvider = availableChannelsProvider
+        self.locationChanges = locationChanges
+        self.torReadyPublisher = torReadyPublisher
+        self.torIsReady = torIsReady
+        self.torIsForeground = torIsForeground
+        self.deriveIdentity = deriveIdentity
+        self.relayLookup = relayLookup
+        self.relaySender = relaySender
+        self.sleeper = sleeper
+        self.scheduleTimer = scheduleTimer
+        self.loopMinInterval = loopMinInterval
+        self.loopMaxInterval = loopMaxInterval
+        self.burstMinDelay = burstMinDelay
+        self.burstMaxDelay = burstMaxDelay
+        setupObservers()
+    }
+    
+    /// Start the service (safe to call multiple times)
+    func start() {
+        SecureLogger.info("Presence: service starting...", category: .session)
+        scheduleNextHeartbeat()
+    }
+
+    private func setupObservers() {
+        // Monitor location channel changes
+        locationChanges
+            .dropFirst()
+            .sink { [weak self] _ in
+                self?.handleLocationChange()
+            }
+            .store(in: &subscriptions)
+
+        // Monitor Tor readiness to kick off heartbeat if it was stalled
+        torReadyPublisher
+            .sink { [weak self] _ in
+                self?.handleConnectivityChange()
+            }
+            .store(in: &subscriptions)
+    }
+
+    func handleLocationChange() {
+        // When location changes, we trigger an immediate (but slightly delayed) heartbeat
+        // to announce presence in the new zone, then reset the loop.
+        SecureLogger.debug("Presence: location changed, scheduling update", category: .session)
+        heartbeatTimer?.invalidate()
+        
+        // Small delay to allow location state to settle
+        heartbeatTimer = scheduleTimer(5.0) { [weak self] in
+            Task { @MainActor [weak self] in
+                self?.performHeartbeat()
+            }
+        }
+    }
+    
+    func handleConnectivityChange() {
+        SecureLogger.debug("Presence: connectivity restored, triggering heartbeat", category: .session)
+        // If we were waiting for network, do it now
+        if heartbeatTimer == nil || !heartbeatTimer!.isValid {
+            scheduleNextHeartbeat()
+        }
+    }
+
+    func scheduleNextHeartbeat() {
+        heartbeatTimer?.invalidate()
+        let interval = TimeInterval.random(in: loopMinInterval...loopMaxInterval)
+        heartbeatTimer = scheduleTimer(interval) { [weak self] in
+            Task { @MainActor [weak self] in
+                self?.performHeartbeat()
+            }
+        }
+    }
+
+    func performHeartbeat() {
+        // Always schedule next loop first ensures continuity even if this one fails/skips
+        defer { scheduleNextHeartbeat() }
+
+        // 1. Check preconditions
+        guard torIsReady() else {
+            SecureLogger.debug("Presence: skipping heartbeat (Tor not ready)", category: .session)
+            return
+        }
+        
+        // App must be active (or at least we shouldn't broadcast if in background, usually)
+        if !torIsForeground() {
+            return
+        }
+
+        // 2. Get channels
+        let channels = availableChannelsProvider()
+        guard !channels.isEmpty else { return }
+
+        // 3. Filter and broadcast
+        // We use Task + sleep for decorrelation to allow the main runloop to proceed
+        for channel in channels {
+            // Check privacy restriction
+            if !self.allowedPrecisions.contains(channel.geohash.count) {
+                continue
+            }
+            
+            // Launch independent task for each channel's delay
+            Task { @MainActor in
+                // Random delay for decorrelation
+                let delay = TimeInterval.random(in: self.burstMinDelay...self.burstMaxDelay)
+                let nanoseconds = UInt64(delay * 1_000_000_000)
+                await self.sleeper(nanoseconds)
+                
+                self.broadcastPresence(for: channel.geohash)
+            }
+        }
+    }
+
+    func broadcastPresence(for geohash: String) {
+        do {
+            guard let identity = try? deriveIdentity(geohash) else {
+                return
+            }
+            
+            let event = try NostrProtocol.createGeohashPresenceEvent(
+                geohash: geohash,
+                senderIdentity: identity
+            )
+            
+            // Send via RelayManager
+            let targetRelays = relayLookup(geohash, TransportConfig.nostrGeoRelayCount)
+            
+            if !targetRelays.isEmpty {
+                relaySender(event, targetRelays)
+                SecureLogger.debug("Presence: sent heartbeat for \(geohash) (pub=\(identity.publicKeyHex.prefix(6))...)", category: .session)
+            }
+        } catch {
+            SecureLogger.error("Presence: failed to create event for \(geohash): \(error)", category: .session)
+        }
+    }
+}
@@ -7,19 +7,76 @@
 //

 import BitLogger
+import protocol Nostr.NostrKeychainStoring
+import protocol Noise.SecureMemoryCleaner
 import Foundation
 import Security

-protocol KeychainManagerProtocol {
+// MARK: - Keychain Error Types
+// BCH-01-009: Proper error classification to distinguish expected states from critical failures
+
+/// Result of a keychain read operation with proper error classification
+enum KeychainReadResult {
+    case success(Data)
+    case itemNotFound        // Expected: key doesn't exist yet
+    case accessDenied        // Critical: app lacks keychain access
+    case deviceLocked        // Recoverable: device is locked
+    case authenticationFailed // Recoverable: biometric/passcode failed
+    case otherError(OSStatus) // Unexpected error
+
+    var isRecoverableError: Bool {
+        switch self {
+        case .deviceLocked, .authenticationFailed:
+            return true
+        default:
+            return false
+        }
+    }
+}
+
+/// Result of a keychain save operation with proper error classification
+enum KeychainSaveResult {
+    case success
+    case duplicateItem       // Can retry with update
+    case accessDenied        // Critical: app lacks keychain access
+    case deviceLocked        // Recoverable: device is locked
+    case storageFull         // Critical: no space available
+    case otherError(OSStatus)
+
+    var isRecoverableError: Bool {
+        switch self {
+        case .duplicateItem, .deviceLocked:
+            return true
+        default:
+            return false
+        }
+    }
+}
+
+protocol KeychainManagerProtocol: SecureMemoryCleaner, NostrKeychainStoring {
    func saveIdentityKey(_ keyData: Data, forKey key: String) -> Bool
    func getIdentityKey(forKey key: String) -> Data?
    func deleteIdentityKey(forKey key: String) -> Bool
    func deleteAllKeychainData() -> Bool
-    
+
    func secureClear(_ data: inout Data)
    func secureClear(_ string: inout String)
-    
+
    func verifyIdentityKeyExists() -> Bool
+
+    // BCH-01-009: Methods with proper error classification
+    /// Get identity key with detailed result for error handling
+    func getIdentityKeyWithResult(forKey key: String) -> KeychainReadResult
+    /// Save identity key with detailed result for error handling
+    func saveIdentityKeyWithResult(_ keyData: Data, forKey key: String) -> KeychainSaveResult
+
+    // MARK: - Generic Data Storage (consolidated from KeychainHelper)
+    /// Save data with a custom service name
+    func save(key: String, data: Data, service: String, accessible: CFString?)
+    /// Load data from a custom service
+    func load(key: String, service: String) -> Data?
+    /// Delete data from a custom service
+    func delete(key: String, service: String)
 }

 final class KeychainManager: KeychainManagerProtocol {
@@ -46,7 +103,181 @@ final class KeychainManager: KeychainManagerProtocol {
        SecureLogger.logKeyOperation(.delete, keyType: key, success: result)
        return result
    }
-    
+
+    // MARK: - BCH-01-009: Methods with Proper Error Classification
+
+    /// Get identity key with detailed result for proper error handling
+    /// Distinguishes between missing keys (expected) and critical failures
+    func getIdentityKeyWithResult(forKey key: String) -> KeychainReadResult {
+        let fullKey = "identity_\(key)"
+        return retrieveDataWithResult(forKey: fullKey)
+    }
+
+    /// Save identity key with detailed result and retry logic for transient errors
+    func saveIdentityKeyWithResult(_ keyData: Data, forKey key: String) -> KeychainSaveResult {
+        let fullKey = "identity_\(key)"
+        return saveDataWithResult(keyData, forKey: fullKey)
+    }
+
+    /// Internal method to save data with detailed result and retry for transient errors
+    private func saveDataWithResult(_ data: Data, forKey key: String, retryCount: Int = 2) -> KeychainSaveResult {
+        // Delete any existing item first to ensure clean state
+        _ = delete(forKey: key)
+
+        // Build base query
+        var base: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrAccount as String: key,
+            kSecValueData as String: data,
+            kSecAttrService as String: service,
+            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlocked,
+            kSecAttrLabel as String: "bitchat-\(key)"
+        ]
+        #if os(macOS)
+        base[kSecAttrSynchronizable as String] = false
+        #endif
+
+        func attempt(addAccessGroup: Bool) -> OSStatus {
+            var query = base
+            if addAccessGroup { query[kSecAttrAccessGroup as String] = appGroup }
+            return SecItemAdd(query as CFDictionary, nil)
+        }
+
+        #if os(iOS)
+        var status = attempt(addAccessGroup: true)
+        if status == -34018 { // Missing entitlement, retry without access group
+            status = attempt(addAccessGroup: false)
+        }
+        #else
+        let status = attempt(addAccessGroup: false)
+        #endif
+
+        // Classify the result
+        let result = classifySaveStatus(status)
+
+        // Log all outcomes consistently
+        switch result {
+        case .success:
+            SecureLogger.debug("Keychain save succeeded for key: \(key)", category: .keychain)
+        case .duplicateItem:
+            SecureLogger.warning("Keychain save found duplicate for key: \(key)", category: .keychain)
+        case .accessDenied:
+            SecureLogger.error(NSError(domain: "Keychain", code: Int(status)),
+                               context: "Keychain access denied for key: \(key)", category: .keychain)
+        case .deviceLocked:
+            SecureLogger.warning("Device locked during keychain save for key: \(key)", category: .keychain)
+        case .storageFull:
+            SecureLogger.error(NSError(domain: "Keychain", code: Int(status)),
+                               context: "Keychain storage full for key: \(key)", category: .keychain)
+        case .otherError(let code):
+            SecureLogger.error(NSError(domain: "Keychain", code: Int(code)),
+                               context: "Keychain save failed for key: \(key)", category: .keychain)
+        }
+
+        // Retry transient errors with exponential backoff
+        if result.isRecoverableError && retryCount > 0 {
+            let delayMs = UInt32((3 - retryCount) * 100) // 100ms, 200ms backoff
+            usleep(delayMs * 1000)
+            SecureLogger.debug("Retrying keychain save for key: \(key), attempts remaining: \(retryCount)", category: .keychain)
+            return saveDataWithResult(data, forKey: key, retryCount: retryCount - 1)
+        }
+
+        return result
+    }
+
+    /// Internal method to retrieve data with detailed result
+    private func retrieveDataWithResult(forKey key: String) -> KeychainReadResult {
+        let base: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrAccount as String: key,
+            kSecAttrService as String: service,
+            kSecReturnData as String: true,
+            kSecMatchLimit as String: kSecMatchLimitOne
+        ]
+
+        var result: AnyObject?
+        func attempt(withAccessGroup: Bool) -> OSStatus {
+            var q = base
+            if withAccessGroup { q[kSecAttrAccessGroup as String] = appGroup }
+            return SecItemCopyMatching(q as CFDictionary, &result)
+        }
+
+        #if os(iOS)
+        var status = attempt(withAccessGroup: true)
+        if status == -34018 { status = attempt(withAccessGroup: false) }
+        #else
+        let status = attempt(withAccessGroup: false)
+        #endif
+
+        // Classify the result
+        let readResult = classifyReadStatus(status, data: result as? Data)
+
+        // Log all outcomes consistently
+        switch readResult {
+        case .success:
+            SecureLogger.debug("Keychain read succeeded for key: \(key)", category: .keychain)
+        case .itemNotFound:
+            // Expected case - no logging needed for missing keys
+            break
+        case .accessDenied:
+            SecureLogger.error(NSError(domain: "Keychain", code: Int(status)),
+                               context: "Keychain access denied for key: \(key)", category: .keychain)
+        case .deviceLocked:
+            SecureLogger.warning("Device locked during keychain read for key: \(key)", category: .keychain)
+        case .authenticationFailed:
+            SecureLogger.warning("Authentication failed for keychain read of key: \(key)", category: .keychain)
+        case .otherError(let code):
+            SecureLogger.error(NSError(domain: "Keychain", code: Int(code)),
+                               context: "Keychain read failed for key: \(key)", category: .keychain)
+        }
+
+        return readResult
+    }
+
+    /// Classify keychain read status into meaningful categories
+    private func classifyReadStatus(_ status: OSStatus, data: Data?) -> KeychainReadResult {
+        switch status {
+        case errSecSuccess:
+            if let data = data {
+                return .success(data)
+            }
+            return .otherError(status)
+        case errSecItemNotFound:
+            return .itemNotFound
+        case errSecInteractionNotAllowed:
+            // Device is locked or in a state that doesn't allow keychain access
+            return .deviceLocked
+        case errSecAuthFailed:
+            return .authenticationFailed
+        case -34018: // errSecMissingEntitlement
+            return .accessDenied
+        case errSecNotAvailable:
+            return .accessDenied
+        default:
+            return .otherError(status)
+        }
+    }
+
+    /// Classify keychain save status into meaningful categories
+    private func classifySaveStatus(_ status: OSStatus) -> KeychainSaveResult {
+        switch status {
+        case errSecSuccess:
+            return .success
+        case errSecDuplicateItem:
+            return .duplicateItem
+        case errSecInteractionNotAllowed:
+            return .deviceLocked
+        case -34018: // errSecMissingEntitlement
+            return .accessDenied
+        case errSecNotAvailable:
+            return .accessDenied
+        case errSecDiskFull:
+            return .storageFull
+        default:
+            return .otherError(status)
+        }
+    }
+
    // MARK: - Generic Operations
    
    private func save(_ value: String, forKey key: String) -> Bool {
@@ -309,9 +540,54 @@ final class KeychainManager: KeychainManagerProtocol {
    }
    
    // MARK: - Debug
-    
+
    func verifyIdentityKeyExists() -> Bool {
        let key = "identity_noiseStaticKey"
        return retrieveData(forKey: key) != nil
    }
+
+    // MARK: - Generic Data Storage (consolidated from KeychainHelper)
+
+    /// Save data with a custom service name
+    func save(key: String, data: Data, service customService: String, accessible: CFString?) {
+        var query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: customService,
+            kSecAttrAccount as String: key,
+            kSecValueData as String: data
+        ]
+        if let accessible = accessible {
+            query[kSecAttrAccessible as String] = accessible
+        }
+
+        SecItemDelete(query as CFDictionary)
+        SecItemAdd(query as CFDictionary, nil)
+    }
+
+    /// Load data from a custom service
+    func load(key: String, service customService: String) -> Data? {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: customService,
+            kSecAttrAccount as String: key,
+            kSecReturnData as String: true
+        ]
+
+        var result: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+
+        guard status == errSecSuccess else { return nil }
+        return result as? Data
+    }
+
+    /// Delete data from a custom service
+    func delete(key: String, service customService: String) {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: customService,
+            kSecAttrAccount as String: key
+        ]
+
+        SecItemDelete(query as CFDictionary)
+    }
 }
@@ -1,306 +0,0 @@
-import BitLogger
-import Foundation
-import Combine
-
-#if os(iOS) || os(macOS)
-import CoreLocation
-
-/// Manages location permissions, one-shot location retrieval, and computing geohash channels.
-/// Not main-actor isolated to satisfy CLLocationManagerDelegate in Swift 6; state updates hop to MainActor.
-final class LocationChannelManager: NSObject, CLLocationManagerDelegate, ObservableObject {
-    static let shared = LocationChannelManager()
-
-    enum PermissionState: Equatable {
-        case notDetermined
-        case denied
-        case restricted
-        case authorized
-    }
-
-    private let cl = CLLocationManager()
-    private let geocoder = CLGeocoder()
-    private var lastLocation: CLLocation?
-    private var refreshTimer: Timer?
-    private let userDefaultsKey = "locationChannel.selected"
-    private let teleportedStoreKey = "locationChannel.teleportedSet"
-    private var isGeocoding: Bool = false
-
-    // Published state for UI bindings
-    @Published private(set) var permissionState: PermissionState = .notDetermined
-    @Published private(set) var availableChannels: [GeohashChannel] = []
-    @Published private(set) var selectedChannel: ChannelID = .mesh
-    // True when the current location channel was selected via manual teleport
-    @Published var teleported: Bool = false
-    @Published private(set) var locationNames: [GeohashChannelLevel: String] = [:]
-
-    // Persisted set of geohashes that were selected via teleport
-    private var teleportedSet: Set<String> = []
-
-    private override init() {
-        super.init()
-        cl.delegate = self
-        cl.desiredAccuracy = kCLLocationAccuracyHundredMeters
-        cl.distanceFilter = TransportConfig.locationDistanceFilterMeters // meters; we're not tracking continuously
-        // Load selection
-        if let data = UserDefaults.standard.data(forKey: userDefaultsKey),
-           let channel = try? JSONDecoder().decode(ChannelID.self, from: data) {
-            selectedChannel = channel
-        }
-        // Load persisted teleported set
-        if let data = UserDefaults.standard.data(forKey: teleportedStoreKey),
-           let arr = try? JSONDecoder().decode([String].self, from: data) {
-            teleportedSet = Set(arr)
-        }
-        // Do not eagerly mark teleported on startup; wait for location to compute regional set.
-        // This avoids showing teleported for in-region channels during cold start.
-        let status: CLAuthorizationStatus
-        if #available(iOS 14.0, macOS 11.0, *) {
-            status = cl.authorizationStatus
-        } else {
-            status = CLLocationManager.authorizationStatus()
-        }
-        updatePermissionState(from: status)
-        // If we don't have location authorization at startup, fall back to persisted teleport state
-        switch status {
-        case .authorizedAlways, .authorizedWhenInUse, .authorized:
-            break // will compute from location
-        case .notDetermined, .restricted, .denied:
-            fallthrough
-        @unknown default:
-            if case .location(let ch) = selectedChannel {
-                teleported = teleportedSet.contains(ch.geohash)
-            }
-        }
-    }
-
-    // MARK: - Public API
-    func enableLocationChannels() {
-        let status: CLAuthorizationStatus
-        if #available(iOS 14.0, macOS 11.0, *) {
-            status = cl.authorizationStatus
-        } else {
-            status = CLLocationManager.authorizationStatus()
-        }
-        switch status {
-        case .notDetermined:
-            cl.requestWhenInUseAuthorization()
-        case .restricted:
-            Task { @MainActor in self.permissionState = .restricted }
-        case .denied:
-            Task { @MainActor in self.permissionState = .denied }
-        case .authorizedAlways, .authorizedWhenInUse, .authorized:
-            Task { @MainActor in self.permissionState = .authorized }
-            requestOneShotLocation()
-        @unknown default:
-            Task { @MainActor in self.permissionState = .restricted }
-        }
-    }
-
-    func refreshChannels() {
-        if permissionState == .authorized {
-            requestOneShotLocation()
-        }
-    }
-
-    /// Begin continuous, distance-filtered updates while the channel sheet is visible.
-    /// Uses a 21m filter (configurable) to only refresh on meaningful movement.
-    func beginLiveRefresh(interval: TimeInterval = TransportConfig.locationLiveRefreshInterval) {
-        guard permissionState == .authorized else { return }
-        // Stop any previous polling timer
-        refreshTimer?.invalidate()
-        refreshTimer = nil
-        // Tighten accuracy and distance filter for live view
-        cl.desiredAccuracy = kCLLocationAccuracyNearestTenMeters
-        cl.distanceFilter = TransportConfig.locationDistanceFilterLiveMeters
-        // Start continuous updates
-        cl.startUpdatingLocation()
-        // Request an immediate fix to populate UI without waiting for movement
-        requestOneShotLocation()
-    }
-
-    /// Stop continuous refreshes when selector UI is dismissed.
-    func endLiveRefresh() {
-        refreshTimer?.invalidate()
-        refreshTimer = nil
-        cl.stopUpdatingLocation()
-        // Restore more relaxed defaults for background/idle state
-        cl.desiredAccuracy = kCLLocationAccuracyHundredMeters
-        cl.distanceFilter = TransportConfig.locationDistanceFilterMeters
-    }
-
-    func select(_ channel: ChannelID) {
-        Task { @MainActor in
-            self.selectedChannel = channel
-            if let data = try? JSONEncoder().encode(channel) {
-                UserDefaults.standard.set(data, forKey: self.userDefaultsKey)
-            }
-            // Update teleported flag based on persisted state for immediate UI behavior
-            switch channel {
-            case .mesh:
-                self.teleported = false
-            case .location(let ch):
-                // If this geohash is in our current regional set, do NOT mark teleported.
-                let inRegional = self.availableChannels.contains { $0.geohash == ch.geohash }
-                if inRegional {
-                    self.teleported = false
-                    // Clear persisted teleport for this geohash to keep future selections clean
-                    if self.teleportedSet.contains(ch.geohash) {
-                        self.teleportedSet.remove(ch.geohash)
-                        if let data = try? JSONEncoder().encode(Array(self.teleportedSet)) {
-                            UserDefaults.standard.set(data, forKey: self.teleportedStoreKey)
-                        }
-                    }
-                } else {
-                    // Fall back to persisted mark (set by deep link or manual teleport)
-                    self.teleported = self.teleportedSet.contains(ch.geohash)
-                }
-            }
-        }
-    }
-
-    // Mark or unmark a geohash as teleported in persistence and update current flag if relevant
-    func markTeleported(for geohash: String, _ flag: Bool) {
-        if flag { teleportedSet.insert(geohash) } else { teleportedSet.remove(geohash) }
-        if let data = try? JSONEncoder().encode(Array(teleportedSet)) {
-            UserDefaults.standard.set(data, forKey: teleportedStoreKey)
-        }
-        if case .location(let ch) = selectedChannel, ch.geohash == geohash {
-            Task { @MainActor in self.teleported = flag }
-        }
-    }
-
-    // MARK: - CoreLocation
-    private func requestOneShotLocation() {
-        cl.requestLocation()
-    }
-
-    // iOS < 14
-    func locationManager(_ manager: CLLocationManager, didChangeAuthorization status: CLAuthorizationStatus) {
-        updatePermissionState(from: status)
-        if case .authorized = permissionState {
-            requestOneShotLocation()
-        }
-    }
-
-    // iOS 14+ / macOS 11+
-    @available(iOS 14.0, macOS 11.0, *)
-    func locationManagerDidChangeAuthorization(_ manager: CLLocationManager) {
-        updatePermissionState(from: manager.authorizationStatus)
-        if case .authorized = permissionState {
-            requestOneShotLocation()
-        }
-    }
-
-    func locationManager(_ manager: CLLocationManager, didUpdateLocations locations: [CLLocation]) {
-        guard let loc = locations.last else { return }
-        lastLocation = loc
-        computeChannels(from: loc.coordinate)
-        reverseGeocodeIfNeeded(location: loc)
-    }
-
-    func locationManager(_ manager: CLLocationManager, didFailWithError error: Error) {
-        // Surface as denied/restricted if relevant; otherwise keep previous state
-        SecureLogger.error("LocationChannelManager: location error: \(error.localizedDescription)", category: .session)
-    }
-
-    // MARK: - Helpers
-    private func updatePermissionState(from status: CLAuthorizationStatus) {
-        let newState: PermissionState
-        switch status {
-        case .notDetermined: newState = .notDetermined
-        case .restricted: newState = .restricted
-        case .denied: newState = .denied
-        case .authorizedAlways, .authorizedWhenInUse, .authorized: newState = .authorized
-        @unknown default: newState = .restricted
-        }
-        Task { @MainActor in self.permissionState = newState }
-    }
-
-    private func computeChannels(from coord: CLLocationCoordinate2D) {
-        let levels = GeohashChannelLevel.allCases
-        var result: [GeohashChannel] = []
-        for level in levels {
-            let gh = Geohash.encode(latitude: coord.latitude, longitude: coord.longitude, precision: level.precision)
-            result.append(GeohashChannel(level: level, geohash: gh))
-        }
-        Task { @MainActor in
-            self.availableChannels = result
-            // Recompute teleported status based on whether the selected geohash is in our regional set
-            switch self.selectedChannel {
-            case .mesh:
-                self.teleported = false
-            case .location(let ch):
-                // Membership check using freshly computed regional channels; avoids precision/rename drift
-                let inRegional = result.contains { $0.geohash == ch.geohash }
-                if inRegional {
-                    self.teleported = false
-                    // Clear persisted teleport flag if present
-                    if self.teleportedSet.contains(ch.geohash) {
-                        self.teleportedSet.remove(ch.geohash)
-                        if let data = try? JSONEncoder().encode(Array(self.teleportedSet)) {
-                            UserDefaults.standard.set(data, forKey: self.teleportedStoreKey)
-                        }
-                    }
-                } else {
-                    self.teleported = true
-                }
-            }
-        }
-    }
-
-    private func reverseGeocodeIfNeeded(location: CLLocation) {
-        // Always cancel previous to keep latest fresh while user moves
-        geocoder.cancelGeocode()
-        isGeocoding = true
-        geocoder.reverseGeocodeLocation(location) { [weak self] placemarks, error in
-            guard let self = self else { return }
-            self.isGeocoding = false
-            if let pm = placemarks?.first {
-                let names = self.namesByLevel(from: pm)
-                Task { @MainActor in self.locationNames = names }
-            }
-        }
-    }
-
-    private func namesByLevel(from pm: CLPlacemark) -> [GeohashChannelLevel: String] {
-        var dict: [GeohashChannelLevel: String] = [:]
-        // Region (country)
-        if let country = pm.country, !country.isEmpty {
-            dict[.region] = country
-        }
-        // Province (state/province or county)
-        if let admin = pm.administrativeArea, !admin.isEmpty {
-            dict[.province] = admin
-        } else if let subAdmin = pm.subAdministrativeArea, !subAdmin.isEmpty {
-            dict[.province] = subAdmin
-        }
-        // City (locality)
-        if let locality = pm.locality, !locality.isEmpty {
-            dict[.city] = locality
-        } else if let subAdmin = pm.subAdministrativeArea, !subAdmin.isEmpty {
-            dict[.city] = subAdmin
-        } else if let admin = pm.administrativeArea, !admin.isEmpty {
-            dict[.city] = admin
-        }
-        // Neighborhood
-        if let subLocality = pm.subLocality, !subLocality.isEmpty {
-            dict[.neighborhood] = subLocality
-        } else if let locality = pm.locality, !locality.isEmpty {
-            dict[.neighborhood] = locality
-        }
-        // Block: reuse neighborhood/locality granularity
-        if let subLocality = pm.subLocality, !subLocality.isEmpty {
-            dict[.block] = subLocality
-        } else if let locality = pm.locality, !locality.isEmpty {
-            dict[.block] = locality
-        }
-        // Building: prefer place name/street/venue when available
-        if let name = pm.name, !name.isEmpty {
-            dict[.building] = name
-        } else if let thoroughfare = pm.thoroughfare, !thoroughfare.isEmpty {
-            dict[.building] = thoroughfare
-        }
-        return dict
-    }
-}
-#endif
@@ -1,4 +1,5 @@
 import BitLogger
+import Nostr
 import Foundation

 /// Dependencies for location notes, allowing tests to stub relay/identity behavior.
@@ -15,7 +16,7 @@ struct LocationNotesDependencies {
    var deriveIdentity: (_ geohash: String) throws -> NostrIdentity
    var now: () -> Date
    
-    private static let idBridge = NostrIdentityBridge()
+    private static let idBridge = NostrIdentityBridge(keychain: KeychainManager())

    static let live = LocationNotesDependencies(
        relayLookup: { geohash, count in
@@ -63,7 +64,7 @@ final class LocationNotesManager: ObservableObject {

        var displayName: String {
            let suffix = String(pubkey.suffix(4))
-            if let nick = nickname, !nick.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
+            if let nick = nickname?.trimmedOrNilIfEmpty {
                return "\(nick)#\(suffix)"
            }
            return "anon#\(suffix)"
@@ -199,8 +200,7 @@ final class LocationNotesManager: ObservableObject {

    /// Send a location note for the current geohash using the per-geohash identity.
    func send(content: String, nickname: String) {
-        let trimmed = content.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !trimmed.isEmpty else { return }
+        guard let trimmed = content.trimmedOrNilIfEmpty else { return }
        let relays = dependencies.relayLookup(geohash, TransportConfig.nostrGeoRelayCount)
        guard !relays.isEmpty else {
            state = .noRelays
@@ -0,0 +1,630 @@
+import BitLogger
+import Foundation
+import Combine
+
+#if os(iOS) || os(macOS)
+import CoreLocation
+
+protocol LocationStateManaging: AnyObject {
+    var delegate: CLLocationManagerDelegate? { get set }
+    var desiredAccuracy: CLLocationAccuracy { get set }
+    var distanceFilter: CLLocationDistance { get set }
+    var authorizationStatus: CLAuthorizationStatus { get }
+    func requestWhenInUseAuthorization()
+    func requestLocation()
+    func startUpdatingLocation()
+    func stopUpdatingLocation()
+}
+
+protocol LocationStateGeocoding: AnyObject {
+    func cancelGeocode()
+    func reverseGeocodeLocation(
+        _ location: CLLocation,
+        completionHandler: @escaping ([CLPlacemark]?, Error?) -> Void
+    )
+}
+
+private final class CLLocationManagerAdapter: NSObject, LocationStateManaging {
+    private let base = CLLocationManager()
+
+    var delegate: CLLocationManagerDelegate? {
+        get { base.delegate }
+        set { base.delegate = newValue }
+    }
+
+    var desiredAccuracy: CLLocationAccuracy {
+        get { base.desiredAccuracy }
+        set { base.desiredAccuracy = newValue }
+    }
+
+    var distanceFilter: CLLocationDistance {
+        get { base.distanceFilter }
+        set { base.distanceFilter = newValue }
+    }
+
+    var authorizationStatus: CLAuthorizationStatus {
+        base.authorizationStatus
+    }
+
+    func requestWhenInUseAuthorization() {
+        base.requestWhenInUseAuthorization()
+    }
+
+    func requestLocation() {
+        base.requestLocation()
+    }
+
+    func startUpdatingLocation() {
+        base.startUpdatingLocation()
+    }
+
+    func stopUpdatingLocation() {
+        base.stopUpdatingLocation()
+    }
+}
+
+private final class CLGeocoderAdapter: LocationStateGeocoding {
+    private let base = CLGeocoder()
+
+    func cancelGeocode() {
+        base.cancelGeocode()
+    }
+
+    func reverseGeocodeLocation(
+        _ location: CLLocation,
+        completionHandler: @escaping ([CLPlacemark]?, Error?) -> Void
+    ) {
+        base.reverseGeocodeLocation(location, completionHandler: completionHandler)
+    }
+}
+
+/// Unified manager for location-based channel state including:
+/// - CoreLocation permissions and one-shot location retrieval
+/// - Geohash channel computation from coordinates
+/// - Channel selection and teleport state
+/// - Bookmark persistence and friendly name resolution
+///
+/// Consolidates LocationChannelManager + GeohashBookmarksStore into a single source of truth.
+final class LocationStateManager: NSObject, CLLocationManagerDelegate, ObservableObject {
+    static let shared = LocationStateManager()
+
+    // MARK: - Permission State
+
+    enum PermissionState: Equatable {
+        case notDetermined
+        case denied
+        case restricted
+        case authorized
+    }
+
+    // MARK: - Private Properties (CoreLocation)
+
+    private let cl: LocationStateManaging
+    private let geocoder: LocationStateGeocoding
+    private var lastLocation: CLLocation?
+    private var refreshTimer: Timer?
+    private var isGeocoding: Bool = false
+
+    // MARK: - Persistence Keys
+
+    private let selectedChannelKey = "locationChannel.selected"
+    private let teleportedStoreKey = "locationChannel.teleportedSet"
+    private let bookmarksKey = "locationChannel.bookmarks"
+    private let bookmarkNamesKey = "locationChannel.bookmarkNames"
+
+    // MARK: - Published State (Channel)
+
+    @Published private(set) var permissionState: PermissionState = .notDetermined
+    @Published private(set) var availableChannels: [GeohashChannel] = []
+    @Published private(set) var selectedChannel: ChannelID = .mesh
+    @Published var teleported: Bool = false
+    @Published private(set) var locationNames: [GeohashChannelLevel: String] = [:]
+
+    // MARK: - Published State (Bookmarks)
+
+    @Published private(set) var bookmarks: [String] = []
+    @Published private(set) var bookmarkNames: [String: String] = [:]
+
+    // MARK: - Private State
+
+    private var teleportedSet: Set<String> = []
+    private var bookmarkMembership: Set<String> = []
+    private var resolvingNames: Set<String> = []
+    private let storage: UserDefaults
+
+    /// Returns true if running in test environment
+    private static var isRunningTests: Bool {
+        let env = ProcessInfo.processInfo.environment
+        return NSClassFromString("XCTestCase") != nil ||
+               env["XCTestConfigurationFilePath"] != nil ||
+               env["XCTestBundlePath"] != nil ||
+               env["GITHUB_ACTIONS"] != nil ||
+               env["CI"] != nil
+    }
+
+    // MARK: - Initialization
+
+    private override init() {
+        self.storage = .standard
+        self.cl = CLLocationManagerAdapter()
+        self.geocoder = CLGeocoderAdapter()
+        super.init()
+
+        // Skip CoreLocation setup in test environments
+        guard !Self.isRunningTests else {
+            loadPersistedState()
+            return
+        }
+
+        cl.delegate = self
+        cl.desiredAccuracy = kCLLocationAccuracyHundredMeters
+        cl.distanceFilter = TransportConfig.locationDistanceFilterMeters
+
+        loadPersistedState()
+        initializePermissionState()
+    }
+
+    /// Internal initializer for testing with custom storage
+    init(storage: UserDefaults) {
+        self.storage = storage
+        self.cl = CLLocationManagerAdapter()
+        self.geocoder = CLGeocoderAdapter()
+        super.init()
+        loadPersistedState()
+    }
+
+    internal init(
+        storage: UserDefaults,
+        locationManager: LocationStateManaging,
+        geocoder: LocationStateGeocoding,
+        shouldInitializeCoreLocation: Bool
+    ) {
+        self.storage = storage
+        self.cl = locationManager
+        self.geocoder = geocoder
+        super.init()
+        loadPersistedState()
+        guard shouldInitializeCoreLocation else { return }
+        cl.delegate = self
+        cl.desiredAccuracy = kCLLocationAccuracyHundredMeters
+        cl.distanceFilter = TransportConfig.locationDistanceFilterMeters
+        initializePermissionState()
+    }
+
+    private func loadPersistedState() {
+        // Load selected channel
+        if let data = storage.data(forKey: selectedChannelKey),
+           let channel = try? JSONDecoder().decode(ChannelID.self, from: data) {
+            selectedChannel = channel
+        }
+
+        // Load teleported set
+        if let data = storage.data(forKey: teleportedStoreKey),
+           let arr = try? JSONDecoder().decode([String].self, from: data) {
+            teleportedSet = Set(arr)
+        }
+
+        // Load bookmarks
+        if let data = storage.data(forKey: bookmarksKey),
+           let arr = try? JSONDecoder().decode([String].self, from: data) {
+            var seen = Set<String>()
+            var list: [String] = []
+            for raw in arr {
+                let gh = Self.normalizeGeohash(raw)
+                guard !gh.isEmpty, !seen.contains(gh) else { continue }
+                seen.insert(gh)
+                list.append(gh)
+            }
+            bookmarks = list
+            bookmarkMembership = seen
+        }
+
+        // Load bookmark names
+        if let data = storage.data(forKey: bookmarkNamesKey),
+           let dict = try? JSONDecoder().decode([String: String].self, from: data) {
+            bookmarkNames = dict
+        }
+    }
+
+    private func initializePermissionState() {
+        let status = cl.authorizationStatus
+        updatePermissionState(from: status)
+
+        // Fall back to persisted teleport state if no location authorization
+        switch status {
+        case .authorizedAlways, .authorizedWhenInUse, .authorized:
+            break
+        case .notDetermined, .restricted, .denied:
+            fallthrough
+        @unknown default:
+            if case .location(let ch) = selectedChannel {
+                teleported = teleportedSet.contains(ch.geohash)
+            }
+        }
+    }
+
+    // MARK: - Public API (Permissions & Location)
+
+    func enableLocationChannels() {
+        let status = cl.authorizationStatus
+        switch status {
+        case .notDetermined:
+            cl.requestWhenInUseAuthorization()
+        case .restricted:
+            Task { @MainActor in self.permissionState = .restricted }
+        case .denied:
+            Task { @MainActor in self.permissionState = .denied }
+        case .authorizedAlways, .authorizedWhenInUse, .authorized:
+            Task { @MainActor in self.permissionState = .authorized }
+            requestOneShotLocation()
+        @unknown default:
+            Task { @MainActor in self.permissionState = .restricted }
+        }
+    }
+
+    func refreshChannels() {
+        if permissionState == .authorized {
+            requestOneShotLocation()
+        }
+    }
+
+    func beginLiveRefresh(interval: TimeInterval = TransportConfig.locationLiveRefreshInterval) {
+        guard permissionState == .authorized else { return }
+        refreshTimer?.invalidate()
+        refreshTimer = nil
+        cl.desiredAccuracy = kCLLocationAccuracyNearestTenMeters
+        cl.distanceFilter = TransportConfig.locationDistanceFilterLiveMeters
+        cl.startUpdatingLocation()
+        requestOneShotLocation()
+    }
+
+    func endLiveRefresh() {
+        refreshTimer?.invalidate()
+        refreshTimer = nil
+        cl.stopUpdatingLocation()
+        cl.desiredAccuracy = kCLLocationAccuracyHundredMeters
+        cl.distanceFilter = TransportConfig.locationDistanceFilterMeters
+    }
+
+    // MARK: - Public API (Channel Selection)
+
+    func select(_ channel: ChannelID) {
+        Task { @MainActor in
+            self.selectedChannel = channel
+            if let data = try? JSONEncoder().encode(channel) {
+                self.storage.set(data, forKey: self.selectedChannelKey)
+            }
+
+            switch channel {
+            case .mesh:
+                self.teleported = false
+            case .location(let ch):
+                let inRegional = self.availableChannels.contains { $0.geohash == ch.geohash }
+                if inRegional {
+                    self.teleported = false
+                    if self.teleportedSet.contains(ch.geohash) {
+                        self.teleportedSet.remove(ch.geohash)
+                        self.persistTeleportedSet()
+                    }
+                } else {
+                    self.teleported = self.teleportedSet.contains(ch.geohash)
+                }
+            }
+        }
+    }
+
+    func markTeleported(for geohash: String, _ flag: Bool) {
+        if flag {
+            teleportedSet.insert(geohash)
+        } else {
+            teleportedSet.remove(geohash)
+        }
+        persistTeleportedSet()
+        if case .location(let ch) = selectedChannel, ch.geohash == geohash {
+            Task { @MainActor in self.teleported = flag }
+        }
+    }
+
+    // MARK: - Public API (Bookmarks)
+
+    func isBookmarked(_ geohash: String) -> Bool {
+        bookmarkMembership.contains(Self.normalizeGeohash(geohash))
+    }
+
+    func toggleBookmark(_ geohash: String) {
+        let gh = Self.normalizeGeohash(geohash)
+        if bookmarkMembership.contains(gh) {
+            removeBookmark(gh)
+        } else {
+            addBookmark(gh)
+        }
+    }
+
+    func addBookmark(_ geohash: String) {
+        let gh = Self.normalizeGeohash(geohash)
+        guard !gh.isEmpty, !bookmarkMembership.contains(gh) else { return }
+        bookmarks.insert(gh, at: 0)
+        bookmarkMembership.insert(gh)
+        persistBookmarks()
+        resolveBookmarkNameIfNeeded(for: gh)
+    }
+
+    func removeBookmark(_ geohash: String) {
+        let gh = Self.normalizeGeohash(geohash)
+        guard bookmarkMembership.contains(gh) else { return }
+        if let idx = bookmarks.firstIndex(of: gh) {
+            bookmarks.remove(at: idx)
+        }
+        bookmarkMembership.remove(gh)
+        if bookmarkNames.removeValue(forKey: gh) != nil {
+            persistBookmarkNames()
+        }
+        persistBookmarks()
+    }
+
+    // MARK: - CLLocationManagerDelegate
+
+    private func requestOneShotLocation() {
+        cl.requestLocation()
+    }
+
+    func locationManager(_ manager: CLLocationManager, didChangeAuthorization status: CLAuthorizationStatus) {
+        updatePermissionState(from: status)
+        if case .authorized = permissionState {
+            requestOneShotLocation()
+        }
+    }
+
+    @available(iOS 14.0, macOS 11.0, *)
+    func locationManagerDidChangeAuthorization(_ manager: CLLocationManager) {
+        updatePermissionState(from: manager.authorizationStatus)
+        if case .authorized = permissionState {
+            requestOneShotLocation()
+        }
+    }
+
+    func locationManager(_ manager: CLLocationManager, didUpdateLocations locations: [CLLocation]) {
+        guard let loc = locations.last else { return }
+        lastLocation = loc
+        computeChannels(from: loc.coordinate)
+        reverseGeocodeLocation(loc)
+    }
+
+    func locationManager(_ manager: CLLocationManager, didFailWithError error: Error) {
+        SecureLogger.error("LocationStateManager: location error: \(error.localizedDescription)", category: .session)
+    }
+
+    // MARK: - Private Helpers (Permission)
+
+    private func updatePermissionState(from status: CLAuthorizationStatus) {
+        let newState: PermissionState
+        switch status {
+        case .notDetermined: newState = .notDetermined
+        case .restricted: newState = .restricted
+        case .denied: newState = .denied
+        case .authorizedAlways, .authorizedWhenInUse, .authorized: newState = .authorized
+        @unknown default: newState = .restricted
+        }
+        Task { @MainActor in self.permissionState = newState }
+    }
+
+    // MARK: - Private Helpers (Channel Computation)
+
+    private func computeChannels(from coord: CLLocationCoordinate2D) {
+        let levels = GeohashChannelLevel.allCases
+        var result: [GeohashChannel] = []
+        for level in levels {
+            let gh = Geohash.encode(latitude: coord.latitude, longitude: coord.longitude, precision: level.precision)
+            result.append(GeohashChannel(level: level, geohash: gh))
+        }
+        Task { @MainActor in
+            self.availableChannels = result
+            switch self.selectedChannel {
+            case .mesh:
+                self.teleported = false
+            case .location(let ch):
+                let inRegional = result.contains { $0.geohash == ch.geohash }
+                if inRegional {
+                    self.teleported = false
+                    if self.teleportedSet.contains(ch.geohash) {
+                        self.teleportedSet.remove(ch.geohash)
+                        self.persistTeleportedSet()
+                    }
+                } else {
+                    self.teleported = true
+                }
+            }
+        }
+    }
+
+    // MARK: - Private Helpers (Geocoding)
+
+    private func reverseGeocodeLocation(_ location: CLLocation) {
+        geocoder.cancelGeocode()
+        isGeocoding = true
+        geocoder.reverseGeocodeLocation(location) { [weak self] placemarks, _ in
+            guard let self = self else { return }
+            self.isGeocoding = false
+            if let pm = placemarks?.first {
+                let names = self.locationNamesByLevel(from: pm)
+                Task { @MainActor in self.locationNames = names }
+            }
+        }
+    }
+
+    private func locationNamesByLevel(from pm: CLPlacemark) -> [GeohashChannelLevel: String] {
+        var dict: [GeohashChannelLevel: String] = [:]
+        if let country = pm.country, !country.isEmpty {
+            dict[.region] = country
+        }
+        if let admin = pm.administrativeArea, !admin.isEmpty {
+            dict[.province] = admin
+        } else if let subAdmin = pm.subAdministrativeArea, !subAdmin.isEmpty {
+            dict[.province] = subAdmin
+        }
+        if let locality = pm.locality, !locality.isEmpty {
+            dict[.city] = locality
+        } else if let subAdmin = pm.subAdministrativeArea, !subAdmin.isEmpty {
+            dict[.city] = subAdmin
+        } else if let admin = pm.administrativeArea, !admin.isEmpty {
+            dict[.city] = admin
+        }
+        if let subLocality = pm.subLocality, !subLocality.isEmpty {
+            dict[.neighborhood] = subLocality
+        } else if let locality = pm.locality, !locality.isEmpty {
+            dict[.neighborhood] = locality
+        }
+        if let subLocality = pm.subLocality, !subLocality.isEmpty {
+            dict[.block] = subLocality
+        } else if let locality = pm.locality, !locality.isEmpty {
+            dict[.block] = locality
+        }
+        if let name = pm.name, !name.isEmpty {
+            dict[.building] = name
+        } else if let thoroughfare = pm.thoroughfare, !thoroughfare.isEmpty {
+            dict[.building] = thoroughfare
+        }
+        return dict
+    }
+
+    func resolveBookmarkNameIfNeeded(for geohash: String) {
+        let gh = Self.normalizeGeohash(geohash)
+        guard !gh.isEmpty, bookmarkNames[gh] == nil, !resolvingNames.contains(gh) else { return }
+        resolvingNames.insert(gh)
+
+        if gh.count <= 2 {
+            let b = Geohash.decodeBounds(gh)
+            let pts: [CLLocation] = [
+                CLLocation(latitude: (b.latMin + b.latMax) / 2, longitude: (b.lonMin + b.lonMax) / 2),
+                CLLocation(latitude: b.latMin, longitude: b.lonMin),
+                CLLocation(latitude: b.latMin, longitude: b.lonMax),
+                CLLocation(latitude: b.latMax, longitude: b.lonMin),
+                CLLocation(latitude: b.latMax, longitude: b.lonMax)
+            ]
+            resolveCompositeAdminName(geohash: gh, points: pts)
+        } else {
+            let center = Geohash.decodeCenter(gh)
+            let loc = CLLocation(latitude: center.lat, longitude: center.lon)
+            geocoder.reverseGeocodeLocation(loc) { [weak self] placemarks, _ in
+                guard let self = self else { return }
+                defer { self.resolvingNames.remove(gh) }
+                if let pm = placemarks?.first,
+                   let name = Self.nameForGeohashLength(gh.count, from: pm),
+                   !name.isEmpty {
+                    DispatchQueue.main.async {
+                        self.bookmarkNames[gh] = name
+                        self.persistBookmarkNames()
+                    }
+                }
+            }
+        }
+    }
+
+    private func resolveCompositeAdminName(geohash gh: String, points: [CLLocation]) {
+        var uniqueAdmins: [String] = []
+        var seenAdmins = Set<String>()
+        var idx = 0
+
+        func step() {
+            if idx >= points.count {
+                let finalName: String? = {
+                    if uniqueAdmins.count >= 2 { return uniqueAdmins[0] + " and " + uniqueAdmins[1] }
+                    return uniqueAdmins.first
+                }()
+                if let finalName = finalName, !finalName.isEmpty {
+                    DispatchQueue.main.async {
+                        self.bookmarkNames[gh] = finalName
+                        self.persistBookmarkNames()
+                    }
+                }
+                self.resolvingNames.remove(gh)
+                return
+            }
+            let loc = points[idx]
+            idx += 1
+            geocoder.reverseGeocodeLocation(loc) { [weak self] placemarks, _ in
+                guard self != nil else { return }
+                if let pm = placemarks?.first {
+                    if let admin = pm.administrativeArea, !admin.isEmpty, !seenAdmins.contains(admin) {
+                        seenAdmins.insert(admin)
+                        uniqueAdmins.append(admin)
+                    } else if let country = pm.country, !country.isEmpty, !seenAdmins.contains(country) {
+                        seenAdmins.insert(country)
+                        uniqueAdmins.append(country)
+                    }
+                }
+                step()
+            }
+        }
+        step()
+    }
+
+    private static func nameForGeohashLength(_ len: Int, from pm: CLPlacemark) -> String? {
+        switch len {
+        case 0...2:
+            return pm.administrativeArea ?? pm.country
+        case 3...4:
+            return pm.administrativeArea ?? pm.subAdministrativeArea ?? pm.country
+        case 5:
+            return pm.locality ?? pm.subAdministrativeArea ?? pm.administrativeArea
+        case 6...7:
+            return pm.subLocality ?? pm.locality ?? pm.administrativeArea
+        default:
+            return pm.subLocality ?? pm.locality ?? pm.administrativeArea ?? pm.country
+        }
+    }
+
+    // MARK: - Private Helpers (Persistence)
+
+    private func persistTeleportedSet() {
+        if let data = try? JSONEncoder().encode(Array(teleportedSet)) {
+            storage.set(data, forKey: teleportedStoreKey)
+        }
+    }
+
+    private func persistBookmarks() {
+        if let data = try? JSONEncoder().encode(bookmarks) {
+            storage.set(data, forKey: bookmarksKey)
+        }
+    }
+
+    private func persistBookmarkNames() {
+        if let data = try? JSONEncoder().encode(bookmarkNames) {
+            storage.set(data, forKey: bookmarkNamesKey)
+        }
+    }
+
+    private static func normalizeGeohash(_ s: String) -> String {
+        let allowed = Set("0123456789bcdefghjkmnpqrstuvwxyz")
+        return s
+            .trimmed
+            .lowercased()
+            .replacingOccurrences(of: "#", with: "")
+            .filter { allowed.contains($0) }
+    }
+}
+
+// MARK: - Backward Compatibility Typealiases
+
+typealias LocationChannelManager = LocationStateManager
+typealias GeohashBookmarksStore = LocationStateManager
+
+// MARK: - Backward Compatibility Extensions
+
+extension LocationStateManager {
+    /// Backward compatibility: toggle bookmark (was GeohashBookmarksStore.toggle)
+    func toggle(_ geohash: String) {
+        toggleBookmark(geohash)
+    }
+
+    /// Backward compatibility: add bookmark (was GeohashBookmarksStore.add)
+    func add(_ geohash: String) {
+        addBookmark(geohash)
+    }
+
+    /// Backward compatibility: remove bookmark (was GeohashBookmarksStore.remove)
+    func remove(_ geohash: String) {
+        removeBookmark(geohash)
+    }
+}
+#endif
@@ -6,104 +6,114 @@ final class MeshTopologyTracker {

    private let queue = DispatchQueue(label: "mesh.topology", attributes: .concurrent)
    private let hopSize = 8
-    private var adjacency: [RoutingID: Set<RoutingID>] = [:]
+    // Directed claims: Key claims to see Value (neighbors)
+    private var claims: [RoutingID: Set<RoutingID>] = [:]
+    // Last time we received an update from a node
+    private var lastSeen: [RoutingID: Date] = [:]
+
+    // Maximum age for topology claims to be considered fresh for routing
+    // Routes computed using stale topology can fail when the network has changed
+    private static let routeFreshnessThreshold: TimeInterval = 60 // 60 seconds

    func reset() {
        queue.sync(flags: .barrier) {
-            self.adjacency.removeAll()
+            self.claims.removeAll()
+            self.lastSeen.removeAll()
        }
    }

-    func recordDirectLink(between a: Data?, and b: Data?) {
-        guard let left = sanitize(a), let right = sanitize(b), left != right else { return }
+    /// Update the topology with a node's self-reported neighbor list
+    func updateNeighbors(for sourceData: Data?, neighbors: [Data]) {
+        guard let source = sanitize(sourceData) else { return }
+        // Sanitize neighbors and exclude self-loops
+        let validNeighbors = Set(neighbors.compactMap { sanitize($0) }).subtracting([source])
+        
        queue.sync(flags: .barrier) {
-            var setA = self.adjacency[left] ?? []
-            setA.insert(right)
-            self.adjacency[left] = setA
-
-            var setB = self.adjacency[right] ?? []
-            setB.insert(left)
-            self.adjacency[right] = setB
-        }
-    }
-
-    func removeDirectLink(between a: Data?, and b: Data?) {
-        guard let left = sanitize(a), let right = sanitize(b), left != right else { return }
-        queue.sync(flags: .barrier) {
-            if var setA = self.adjacency[left] {
-                setA.remove(right)
-                self.adjacency[left] = setA.isEmpty ? nil : setA
-            }
-            if var setB = self.adjacency[right] {
-                setB.remove(left)
-                self.adjacency[right] = setB.isEmpty ? nil : setB
-            }
+            self.claims[source] = validNeighbors
+            self.lastSeen[source] = Date()
        }
    }

    func removePeer(_ data: Data?) {
        guard let peer = sanitize(data) else { return }
        queue.sync(flags: .barrier) {
-            guard let neighbors = self.adjacency.removeValue(forKey: peer) else { return }
-            for neighbor in neighbors {
-                if var set = self.adjacency[neighbor] {
-                    set.remove(peer)
-                    self.adjacency[neighbor] = set.isEmpty ? nil : set
-                }
-            }
+            self.claims.removeValue(forKey: peer)
+            self.lastSeen.removeValue(forKey: peer)
        }
    }
-
-    func recordRoute(_ hops: [Data]) {
-        let sanitized = hops.compactMap { sanitize($0) }
-        guard sanitized.count >= 2 else { return }
+    
+    /// Prune nodes that haven't updated their topology in `age` seconds
+    func prune(olderThan age: TimeInterval) {
+        let deadline = Date().addingTimeInterval(-age)
        queue.sync(flags: .barrier) {
-            for idx in 0..<(sanitized.count - 1) {
-                let left = sanitized[idx]
-                let right = sanitized[idx + 1]
-                guard left != right else { continue }
-
-                var setA = self.adjacency[left] ?? []
-                setA.insert(right)
-                self.adjacency[left] = setA
-
-                var setB = self.adjacency[right] ?? []
-                setB.insert(left)
-                self.adjacency[right] = setB
+            let stale = self.lastSeen.filter { $0.value < deadline }
+            for (peer, _) in stale {
+                self.claims.removeValue(forKey: peer)
+                self.lastSeen.removeValue(forKey: peer)
            }
        }
    }

-    func computeRoute(from start: Data?, to goal: Data?, maxHops: Int = 255) -> [Data]? {
+    func computeRoute(from start: Data?, to goal: Data?, maxHops: Int = 10) -> [Data]? {
        guard let source = sanitize(start), let target = sanitize(goal) else { return nil }
-        if source == target { return [source] }
+        if source == target { return [] } // Direct connection, no intermediate hops

-        let graph = queue.sync { adjacency }
-        guard graph[source] != nil, graph[target] != nil else { return nil }
+        return queue.sync {
+            let now = Date()
+            let freshnessDeadline = now.addingTimeInterval(-Self.routeFreshnessThreshold)

-        var visited: Set<RoutingID> = [source]
-        var queuePaths: [[RoutingID]] = [[source]]
-        var index = 0
+            // BFS
+            var visited: Set<RoutingID> = [source]
+            // Queue stores paths: [Start, Hop1, Hop2, ..., Current]
+            var queuePaths: [[RoutingID]] = [[source]]

-        while index < queuePaths.count {
-            let path = queuePaths[index]
-            index += 1
-            guard path.count <= maxHops else { continue }
-            guard let last = path.last, let neighbors = graph[last] else { continue }
+            while !queuePaths.isEmpty {
+                let path = queuePaths.removeFirst()
+                // Limit path length (path contains source + maxHops + target) -> maxHops intermediate
+                // If maxHops = 10, max edges = 11, max nodes = 12.
+                if path.count > maxHops + 1 { continue }

-            for neighbor in neighbors {
-                if visited.contains(neighbor) { continue }
-                var nextPath = path
-                nextPath.append(neighbor)
-                if neighbor == target { return nextPath }
-                if nextPath.count <= maxHops {
+                guard let last = path.last else { continue }
+
+                // Get neighbors that 'last' claims to see
+                guard let neighbors = claims[last] else { continue }
+
+                // Check if 'last' node's topology info is fresh
+                guard let lastSeenTime = lastSeen[last], lastSeenTime > freshnessDeadline else {
+                    continue // Skip stale nodes
+                }
+
+                for neighbor in neighbors {
+                    if visited.contains(neighbor) { continue }
+
+                    // CONFIRMED EDGE CHECK:
+                    // 'last' claims 'neighbor' (checked above)
+                    // Does 'neighbor' claim 'last'?
+                    guard let neighborClaims = claims[neighbor],
+                          neighborClaims.contains(last) else {
+                        continue
+                    }
+
+                    // Check if 'neighbor' node's topology info is fresh
+                    guard let neighborSeenTime = lastSeen[neighbor], neighborSeenTime > freshnessDeadline else {
+                        continue // Skip edges to stale nodes
+                    }
+
+                    var nextPath = path
+                    nextPath.append(neighbor)
+
+                    if neighbor == target {
+                        // Return only intermediate hops
+                        // Path: [Source, I1, I2, Target] -> [I1, I2]
+                        return Array(nextPath.dropFirst().dropLast())
+                    }
+
+                    visited.insert(neighbor)
                    queuePaths.append(nextPath)
                }
-                visited.insert(neighbor)
            }
+            return nil
        }
-
-        return nil
    }

    // MARK: - Helpers
@@ -0,0 +1,278 @@
+//
+// MessageDeduplicationService.swift
+// bitchat
+//
+// Handles message deduplication using LRU caches.
+// This is free and unencumbered software released into the public domain.
+//
+
+import Foundation
+
+// MARK: - LRU Deduplication Cache
+
+/// Generic LRU (Least Recently Used) cache for deduplication.
+/// Uses an efficient O(1) lookup with periodic compaction.
+/// Thread-safe via @MainActor - all callers are already on main actor.
+@MainActor
+final class LRUDeduplicationCache<Value> {
+    private var map: [String: Value] = [:]
+    private var order: [String] = []
+    private var head: Int = 0
+    private let capacity: Int
+
+    /// Creates a new LRU cache with the specified capacity.
+    /// - Parameter capacity: Maximum number of entries before eviction
+    init(capacity: Int) {
+        precondition(capacity > 0, "LRU cache capacity must be positive")
+        self.capacity = capacity
+    }
+
+    /// Number of active entries in the cache
+    var count: Int {
+        order.count - head
+    }
+
+    /// Checks if a key exists in the cache
+    func contains(_ key: String) -> Bool {
+        map[key] != nil
+    }
+
+    /// Gets the value for a key, or nil if not present
+    func value(for key: String) -> Value? {
+        map[key]
+    }
+
+    /// Records a key-value pair, updating if exists or inserting if new
+    func record(_ key: String, value: Value) {
+        if map[key] == nil {
+            order.append(key)
+        }
+        map[key] = value
+        trimIfNeeded()
+    }
+
+    /// Removes a specific key from the cache
+    func remove(_ key: String) {
+        map.removeValue(forKey: key)
+        // Note: key remains in order array but will be skipped during eviction
+    }
+
+    /// Clears all entries from the cache
+    func clear() {
+        map.removeAll()
+        order.removeAll()
+        head = 0
+    }
+
+    // MARK: - Private
+
+    private func trimIfNeeded() {
+        let activeCount = order.count - head
+        guard activeCount > capacity else { return }
+
+        let overflow = activeCount - capacity
+        for _ in 0..<overflow {
+            guard let victim = popOldest() else { break }
+            map.removeValue(forKey: victim)
+        }
+    }
+
+    private func popOldest() -> String? {
+        // Skip keys that were already removed from map
+        while head < order.count {
+            let key = order[head]
+            head += 1
+
+            // Periodically compact the backing storage
+            if head >= 32 && head * 2 >= order.count {
+                order.removeFirst(head)
+                head = 0
+            }
+
+            // Only return if key is still in map
+            if map[key] != nil {
+                return key
+            }
+        }
+        return nil
+    }
+}
+
+// MARK: - Content Normalizer
+
+/// Normalizes message content for near-duplicate detection.
+enum ContentNormalizer {
+
+    /// Regex to simplify HTTP URLs by stripping query strings and fragments
+    private static let simplifyHTTPURL: NSRegularExpression = {
+        try! NSRegularExpression(
+            pattern: "https?://[^\\s?#]+(?:[?#][^\\s]*)?",
+            options: [.caseInsensitive]
+        )
+    }()
+
+    /// Normalizes content for deduplication comparison.
+    /// - Parameters:
+    ///   - content: The raw message content
+    ///   - prefixLength: Maximum characters to consider (default from TransportConfig)
+    /// - Returns: A hash-based key for comparison
+    static func normalizedKey(
+        _ content: String,
+        prefixLength: Int = TransportConfig.contentKeyPrefixLength
+    ) -> String {
+        // Lowercase for case-insensitive comparison
+        let lowered = content.lowercased()
+        let ns = lowered as NSString
+        let range = NSRange(location: 0, length: ns.length)
+
+        // Simplify URLs by stripping query/fragment
+        var simplified = ""
+        var last = 0
+        for match in simplifyHTTPURL.matches(in: lowered, options: [], range: range) {
+            if match.range.location > last {
+                simplified += ns.substring(with: NSRange(location: last, length: match.range.location - last))
+            }
+            let url = ns.substring(with: match.range)
+            if let queryIndex = url.firstIndex(where: { $0 == "?" || $0 == "#" }) {
+                simplified += String(url[..<queryIndex])
+            } else {
+                simplified += url
+            }
+            last = match.range.location + match.range.length
+        }
+        if last < ns.length {
+            simplified += ns.substring(with: NSRange(location: last, length: ns.length - last))
+        }
+
+        // Trim and collapse whitespace
+        let trimmed = simplified.trimmed
+        let collapsed = trimmed.replacingOccurrences(of: "\\s+", with: " ", options: .regularExpression)
+
+        // Take prefix and hash
+        let prefix = String(collapsed.prefix(prefixLength))
+        let hash = prefix.djb2()
+        return String(format: "h:%016llx", hash)
+    }
+}
+
+// MARK: - Message Deduplication Service
+
+/// Service that manages message deduplication using LRU caches.
+/// Provides separate caches for content-based dedup and Nostr event ID dedup.
+/// Thread-safe via @MainActor - all callers are already on main actor.
+@MainActor
+final class MessageDeduplicationService {
+
+    /// Cache for content-based near-duplicate detection
+    private let contentCache: LRUDeduplicationCache<Date>
+
+    /// Cache for Nostr event ID deduplication
+    private let nostrEventCache: LRUDeduplicationCache<Bool>
+
+    /// Cache for Nostr ACK deduplication (messageId:ackType:senderPubkey format)
+    private let nostrAckCache: LRUDeduplicationCache<Bool>
+
+    /// Creates a new deduplication service with specified capacities.
+    /// - Parameters:
+    ///   - contentCapacity: Max entries for content cache
+    ///   - nostrEventCapacity: Max entries for Nostr event cache
+    init(
+        contentCapacity: Int = TransportConfig.contentLRUCap,
+        nostrEventCapacity: Int = TransportConfig.uiProcessedNostrEventsCap
+    ) {
+        self.contentCache = LRUDeduplicationCache(capacity: contentCapacity)
+        self.nostrEventCache = LRUDeduplicationCache(capacity: nostrEventCapacity)
+        self.nostrAckCache = LRUDeduplicationCache(capacity: nostrEventCapacity)
+    }
+
+    // MARK: - Content Deduplication
+
+    /// Records content with its timestamp for near-duplicate detection.
+    /// - Parameters:
+    ///   - content: The message content
+    ///   - timestamp: When the content was received
+    func recordContent(_ content: String, timestamp: Date) {
+        let key = ContentNormalizer.normalizedKey(content)
+        contentCache.record(key, value: timestamp)
+    }
+
+    /// Records a pre-normalized content key with its timestamp.
+    /// - Parameters:
+    ///   - key: The normalized content key
+    ///   - timestamp: When the content was received
+    func recordContentKey(_ key: String, timestamp: Date) {
+        contentCache.record(key, value: timestamp)
+    }
+
+    /// Gets the timestamp for previously seen content.
+    /// - Parameter content: The message content
+    /// - Returns: The timestamp when first seen, or nil if not seen
+    func contentTimestamp(for content: String) -> Date? {
+        let key = ContentNormalizer.normalizedKey(content)
+        return contentCache.value(for: key)
+    }
+
+    /// Gets the timestamp for a pre-normalized content key.
+    /// - Parameter key: The normalized content key
+    /// - Returns: The timestamp when first seen, or nil if not seen
+    func contentTimestamp(forKey key: String) -> Date? {
+        contentCache.value(for: key)
+    }
+
+    /// Normalizes content to a deduplication key.
+    /// - Parameter content: The raw content
+    /// - Returns: A normalized hash key
+    func normalizedContentKey(_ content: String) -> String {
+        ContentNormalizer.normalizedKey(content)
+    }
+
+    // MARK: - Nostr Event Deduplication
+
+    /// Checks if a Nostr event has already been processed.
+    /// - Parameter eventId: The event ID
+    /// - Returns: true if already processed
+    func hasProcessedNostrEvent(_ eventId: String) -> Bool {
+        nostrEventCache.contains(eventId)
+    }
+
+    /// Records a Nostr event as processed.
+    /// - Parameter eventId: The event ID
+    func recordNostrEvent(_ eventId: String) {
+        nostrEventCache.record(eventId, value: true)
+    }
+
+    // MARK: - Nostr ACK Deduplication
+
+    /// Checks if a Nostr ACK has already been processed.
+    /// - Parameter ackKey: The ACK key in format "messageId:ackType:senderPubkey"
+    /// - Returns: true if already processed
+    func hasProcessedNostrAck(_ ackKey: String) -> Bool {
+        nostrAckCache.contains(ackKey)
+    }
+
+    /// Records a Nostr ACK as processed.
+    /// - Parameter ackKey: The ACK key in format "messageId:ackType:senderPubkey"
+    func recordNostrAck(_ ackKey: String) {
+        nostrAckCache.record(ackKey, value: true)
+    }
+
+    /// Creates an ACK key from components.
+    static func ackKey(messageId: String, ackType: String, senderPubkey: String) -> String {
+        "\(messageId):\(ackType):\(senderPubkey)"
+    }
+
+    // MARK: - Clear
+
+    /// Clears all caches
+    func clearAll() {
+        contentCache.clear()
+        nostrEventCache.clear()
+        nostrAckCache.clear()
+    }
+
+    /// Clears only the Nostr caches (events and ACKs)
+    func clearNostrCaches() {
+        nostrEventCache.clear()
+        nostrAckCache.clear()
+    }
+}
@@ -0,0 +1,472 @@
+//
+// MessageFormattingEngine.swift
+// bitchat
+//
+// Handles message text formatting, including mentions, hashtags, URLs, and tokens.
+// This is free and unencumbered software released into the public domain.
+//
+
+import BitFoundation
+import Foundation
+import SwiftUI
+
+// MARK: - Formatting Context Protocol
+
+/// Protocol defining the context needed for message formatting.
+/// Implemented by ChatViewModel to provide runtime state.
+@MainActor
+protocol MessageFormattingContext: AnyObject {
+    /// The user's current nickname
+    var nickname: String { get }
+
+    /// Determines if a message was sent by the current user
+    func isSelfMessage(_ message: BitchatMessage) -> Bool
+
+    /// Gets the color for a message's sender
+    func senderColor(for message: BitchatMessage, isDark: Bool) -> Color
+
+    /// Resolves a peer ID to a clickable URL
+    func peerURL(for peerID: PeerID) -> URL?
+}
+
+// MARK: - Formatting Engine
+
+/// Handles rich text formatting for chat messages.
+/// Extracts mentions, hashtags, URLs, Lightning invoices, and Cashu tokens.
+final class MessageFormattingEngine {
+
+    // MARK: - Precompiled Regexes
+
+    /// Precompiled regex patterns for message content parsing
+    enum Patterns {
+        static let hashtag: NSRegularExpression = {
+            try! NSRegularExpression(pattern: "#([a-zA-Z0-9_]+)", options: [])
+        }()
+
+        static let mention: NSRegularExpression = {
+            try! NSRegularExpression(pattern: "@([\\p{L}0-9_]+(?:#[a-fA-F0-9]{4})?)", options: [])
+        }()
+
+        static let cashu: NSRegularExpression = {
+            try! NSRegularExpression(pattern: "\\bcashu[AB][A-Za-z0-9._-]{40,}\\b", options: [])
+        }()
+
+        static let bolt11: NSRegularExpression = {
+            try! NSRegularExpression(pattern: "(?i)\\bln(bc|tb|bcrt)[0-9][a-z0-9]{50,}\\b", options: [])
+        }()
+
+        static let lnurl: NSRegularExpression = {
+            try! NSRegularExpression(pattern: "(?i)\\blnurl1[a-z0-9]{20,}\\b", options: [])
+        }()
+
+        static let lightningScheme: NSRegularExpression = {
+            try! NSRegularExpression(pattern: "(?i)\\blightning:[^\\s]+", options: [])
+        }()
+
+        static let linkDetector: NSDataDetector? = {
+            try? NSDataDetector(types: NSTextCheckingResult.CheckingType.link.rawValue)
+        }()
+
+        static let quickCashuPresence: NSRegularExpression = {
+            try! NSRegularExpression(pattern: "\\bcashu[AB][A-Za-z0-9._-]{40,}\\b", options: [])
+        }()
+
+        static let simplifyHTTPURL: NSRegularExpression = {
+            try! NSRegularExpression(pattern: "https?://[^\\s?#]+(?:[?#][^\\s]*)?", options: [.caseInsensitive])
+        }()
+    }
+
+    // MARK: - Match Types
+
+    /// Types of matches found in message content
+    enum MatchType: String {
+        case hashtag
+        case mention
+        case url
+        case cashu
+        case lightning
+        case bolt11
+        case lnurl
+    }
+
+    /// A match found in message content
+    struct ContentMatch {
+        let range: NSRange
+        let type: MatchType
+    }
+
+    // MARK: - Public API
+
+    /// Formats a message with rich text styling
+    @MainActor
+    static func formatMessage(
+        _ message: BitchatMessage,
+        context: MessageFormattingContext,
+        colorScheme: ColorScheme
+    ) -> AttributedString {
+        let isDark = colorScheme == .dark
+        let isSelf = context.isSelfMessage(message)
+
+        // Check cache first
+        if let cached = message.getCachedFormattedText(isDark: isDark, isSelf: isSelf) {
+            return cached
+        }
+
+        var result = AttributedString()
+        let baseColor: Color = isSelf ? .orange : context.senderColor(for: message, isDark: isDark)
+
+        // Format system messages differently
+        if message.sender == "system" {
+            result = formatSystemMessage(message, isDark: isDark)
+        } else {
+            // Format sender header
+            result = formatSenderHeader(
+                message: message,
+                baseColor: baseColor,
+                isSelf: isSelf,
+                context: context
+            )
+
+            // Format content
+            let contentResult = formatContent(
+                message.content,
+                baseColor: baseColor,
+                isSelf: isSelf,
+                isMentioned: message.mentions?.contains(context.nickname) ?? false
+            )
+            result.append(contentResult)
+
+            // Add timestamp
+            result.append(formatTimestamp(message.formattedTimestamp))
+        }
+
+        // Cache the result
+        message.setCachedFormattedText(result, isDark: isDark, isSelf: isSelf)
+
+        return result
+    }
+
+    /// Formats just the message header (sender portion)
+    @MainActor
+    static func formatHeader(
+        _ message: BitchatMessage,
+        context: MessageFormattingContext,
+        colorScheme: ColorScheme
+    ) -> AttributedString {
+        let isDark = colorScheme == .dark
+        let isSelf = context.isSelfMessage(message)
+        let baseColor: Color = isSelf ? .orange : context.senderColor(for: message, isDark: isDark)
+
+        if message.sender == "system" {
+            var style = AttributeContainer()
+            style.foregroundColor = baseColor
+            style.font = .bitchatSystem(size: 14, weight: .medium, design: .monospaced)
+            return AttributedString(message.sender).mergingAttributes(style)
+        }
+
+        return formatSenderHeader(
+            message: message,
+            baseColor: baseColor,
+            isSelf: isSelf,
+            context: context
+        )
+    }
+
+    /// Extracts mentions from message content
+    static func extractMentions(from content: String) -> [String] {
+        let nsContent = content as NSString
+        let range = NSRange(location: 0, length: nsContent.length)
+        let matches = Patterns.mention.matches(in: content, options: [], range: range)
+
+        return matches.compactMap { match -> String? in
+            guard match.numberOfRanges > 1 else { return nil }
+            let captureRange = match.range(at: 1)
+            guard let swiftRange = Range(captureRange, in: content) else { return nil }
+            return String(content[swiftRange])
+        }
+    }
+
+    /// Checks if content contains a Cashu token
+    static func containsCashuToken(_ content: String) -> Bool {
+        let nsContent = content as NSString
+        let range = NSRange(location: 0, length: nsContent.length)
+        return Patterns.quickCashuPresence.numberOfMatches(in: content, options: [], range: range) > 0
+    }
+
+    // MARK: - Private Helpers
+
+    private static func formatSystemMessage(_ message: BitchatMessage, isDark: Bool) -> AttributedString {
+        var result = AttributedString()
+
+        let content = AttributedString("* \(message.content) *")
+        var contentStyle = AttributeContainer()
+        contentStyle.foregroundColor = Color.gray
+        contentStyle.font = .bitchatSystem(size: 12, design: .monospaced).italic()
+        result.append(content.mergingAttributes(contentStyle))
+
+        // Add timestamp
+        let timestamp = AttributedString(" [\(message.formattedTimestamp)]")
+        var timestampStyle = AttributeContainer()
+        timestampStyle.foregroundColor = Color.gray.opacity(0.5)
+        timestampStyle.font = .bitchatSystem(size: 10, design: .monospaced)
+        result.append(timestamp.mergingAttributes(timestampStyle))
+
+        return result
+    }
+
+    @MainActor
+    private static func formatSenderHeader(
+        message: BitchatMessage,
+        baseColor: Color,
+        isSelf: Bool,
+        context: MessageFormattingContext
+    ) -> AttributedString {
+        var result = AttributedString()
+
+        let (baseName, suffix) = message.sender.splitSuffix()
+        var senderStyle = AttributeContainer()
+        senderStyle.foregroundColor = baseColor
+        let fontWeight: Font.Weight = isSelf ? .bold : .medium
+        senderStyle.font = .bitchatSystem(size: 14, weight: fontWeight, design: .monospaced)
+
+        // Make sender clickable
+        if let spid = message.senderPeerID, let url = context.peerURL(for: spid) {
+            senderStyle.link = url
+        }
+
+        // Build: "<@baseName#suffix> "
+        result.append(AttributedString("<@").mergingAttributes(senderStyle))
+        result.append(AttributedString(baseName).mergingAttributes(senderStyle))
+
+        if !suffix.isEmpty {
+            var suffixStyle = senderStyle
+            suffixStyle.foregroundColor = baseColor.opacity(0.6)
+            result.append(AttributedString(suffix).mergingAttributes(suffixStyle))
+        }
+
+        result.append(AttributedString("> ").mergingAttributes(senderStyle))
+
+        return result
+    }
+
+    private static func formatContent(
+        _ content: String,
+        baseColor: Color,
+        isSelf: Bool,
+        isMentioned: Bool
+    ) -> AttributedString {
+        // For very long content without special tokens, use plain formatting
+        let containsCashu = containsCashuToken(content)
+        if (content.count > 4000 || content.hasVeryLongToken(threshold: 1024)) && !containsCashu {
+            return formatPlainContent(content, baseColor: baseColor, isSelf: isSelf)
+        }
+
+        // Find all matches
+        let matches = findAllMatches(in: content)
+
+        // Build formatted content
+        var result = AttributedString()
+        var lastEnd = content.startIndex
+
+        for match in matches {
+            guard let swiftRange = Range(match.range, in: content) else { continue }
+
+            // Add text before match
+            if lastEnd < swiftRange.lowerBound {
+                let beforeText = String(content[lastEnd..<swiftRange.lowerBound])
+                result.append(formatPlainText(beforeText, baseColor: baseColor, isSelf: isSelf, isMentioned: isMentioned))
+            }
+
+            // Add styled match
+            let matchText = String(content[swiftRange])
+            result.append(formatMatch(matchText, type: match.type, baseColor: baseColor, isSelf: isSelf))
+
+            lastEnd = swiftRange.upperBound
+        }
+
+        // Add remaining text
+        if lastEnd < content.endIndex {
+            let remainingText = String(content[lastEnd...])
+            result.append(formatPlainText(remainingText, baseColor: baseColor, isSelf: isSelf, isMentioned: isMentioned))
+        }
+
+        return result
+    }
+
+    private static func findAllMatches(in content: String) -> [ContentMatch] {
+        let nsContent = content as NSString
+        let nsLen = nsContent.length
+        let fullRange = NSRange(location: 0, length: nsLen)
+
+        // Quick hints to avoid unnecessary regex work
+        let hasMentions = content.contains("@")
+        let hasHashtags = content.contains("#")
+        let hasURLs = content.contains("://") || content.contains("www.") || content.contains("http")
+        let hasLightning = content.lowercased().contains("ln") || content.lowercased().contains("lightning:")
+        let hasCashu = content.lowercased().contains("cashu")
+
+        // Collect matches
+        let mentionMatches = hasMentions ? Patterns.mention.matches(in: content, options: [], range: fullRange) : []
+        let hashtagMatches = hasHashtags ? Patterns.hashtag.matches(in: content, options: [], range: fullRange) : []
+        let urlMatches = hasURLs ? (Patterns.linkDetector?.matches(in: content, options: [], range: fullRange) ?? []) : []
+        let cashuMatches = hasCashu ? Patterns.cashu.matches(in: content, options: [], range: fullRange) : []
+        let lightningMatches = hasLightning ? Patterns.lightningScheme.matches(in: content, options: [], range: fullRange) : []
+        let bolt11Matches = hasLightning ? Patterns.bolt11.matches(in: content, options: [], range: fullRange) : []
+        let lnurlMatches = hasLightning ? Patterns.lnurl.matches(in: content, options: [], range: fullRange) : []
+
+        // Build mention ranges for overlap checking
+        let mentionRanges = mentionMatches.map { $0.range(at: 0) }
+
+        func overlapsMention(_ r: NSRange) -> Bool {
+            mentionRanges.contains { NSIntersectionRange(r, $0).length > 0 }
+        }
+
+        func isStandaloneHashtag(_ r: NSRange) -> Bool {
+            guard let swiftRange = Range(r, in: content) else { return false }
+            if swiftRange.lowerBound == content.startIndex { return true }
+            let prev = content.index(before: swiftRange.lowerBound)
+            return content[prev].isWhitespace || content[prev].isNewline
+        }
+
+        func attachedToMention(_ r: NSRange) -> Bool {
+            guard let swiftRange = Range(r, in: content), swiftRange.lowerBound > content.startIndex else { return false }
+            var i = content.index(before: swiftRange.lowerBound)
+            while true {
+                let ch = content[i]
+                if ch.isWhitespace || ch.isNewline { break }
+                if ch == "@" { return true }
+                if i == content.startIndex { break }
+                i = content.index(before: i)
+            }
+            return false
+        }
+
+        var allMatches: [ContentMatch] = []
+
+        // Add hashtags (excluding those attached to mentions)
+        for match in hashtagMatches {
+            let range = match.range(at: 0)
+            if !overlapsMention(range) && !attachedToMention(range) && isStandaloneHashtag(range) {
+                allMatches.append(ContentMatch(range: range, type: .hashtag))
+            }
+        }
+
+        // Add mentions
+        for match in mentionMatches {
+            allMatches.append(ContentMatch(range: match.range(at: 0), type: .mention))
+        }
+
+        // Add URLs
+        for match in urlMatches where !overlapsMention(match.range) {
+            allMatches.append(ContentMatch(range: match.range, type: .url))
+        }
+
+        // Add Cashu tokens
+        for match in cashuMatches where !overlapsMention(match.range(at: 0)) {
+            allMatches.append(ContentMatch(range: match.range(at: 0), type: .cashu))
+        }
+
+        // Add Lightning scheme URLs
+        for match in lightningMatches where !overlapsMention(match.range(at: 0)) {
+            allMatches.append(ContentMatch(range: match.range(at: 0), type: .lightning))
+        }
+
+        // Add bolt11/lnurl (avoiding overlaps with lightning scheme and URLs)
+        let occupied = urlMatches.map { $0.range } + lightningMatches.map { $0.range(at: 0) }
+        func overlapsOccupied(_ r: NSRange) -> Bool {
+            occupied.contains { NSIntersectionRange(r, $0).length > 0 }
+        }
+
+        for match in bolt11Matches where !overlapsMention(match.range(at: 0)) && !overlapsOccupied(match.range(at: 0)) {
+            allMatches.append(ContentMatch(range: match.range(at: 0), type: .bolt11))
+        }
+
+        for match in lnurlMatches where !overlapsMention(match.range(at: 0)) && !overlapsOccupied(match.range(at: 0)) {
+            allMatches.append(ContentMatch(range: match.range(at: 0), type: .lnurl))
+        }
+
+        // Sort by position
+        return allMatches.sorted { $0.range.location < $1.range.location }
+    }
+
+    private static func formatPlainContent(_ content: String, baseColor: Color, isSelf: Bool) -> AttributedString {
+        var style = AttributeContainer()
+        style.foregroundColor = baseColor
+        style.font = isSelf
+            ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+            : .bitchatSystem(size: 14, design: .monospaced)
+        return AttributedString(content).mergingAttributes(style)
+    }
+
+    private static func formatPlainText(_ text: String, baseColor: Color, isSelf: Bool, isMentioned: Bool) -> AttributedString {
+        guard !text.isEmpty else { return AttributedString() }
+
+        var style = AttributeContainer()
+        style.foregroundColor = baseColor
+        style.font = isSelf
+            ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+            : .bitchatSystem(size: 14, design: .monospaced)
+
+        if isMentioned {
+            style.font = style.font?.bold()
+        }
+
+        return AttributedString(text).mergingAttributes(style)
+    }
+
+    private static func formatMatch(_ text: String, type: MatchType, baseColor: Color, isSelf: Bool) -> AttributedString {
+        var style = AttributeContainer()
+
+        switch type {
+        case .mention:
+            // Split optional '#abcd' suffix
+            let (baseName, suffix) = text.splitSuffix()
+            var result = AttributedString()
+
+            var mentionStyle = AttributeContainer()
+            mentionStyle.foregroundColor = .blue
+            mentionStyle.font = .bitchatSystem(size: 14, weight: .semibold, design: .monospaced)
+            result.append(AttributedString(baseName).mergingAttributes(mentionStyle))
+
+            if !suffix.isEmpty {
+                var suffixStyle = mentionStyle
+                suffixStyle.foregroundColor = Color.gray.opacity(0.7)
+                result.append(AttributedString(suffix).mergingAttributes(suffixStyle))
+            }
+
+            return result
+
+        case .hashtag:
+            style.foregroundColor = .purple
+            style.font = .bitchatSystem(size: 14, weight: .medium, design: .monospaced)
+
+        case .url:
+            style.foregroundColor = .blue
+            style.font = .bitchatSystem(size: 14, design: .monospaced)
+            style.underlineStyle = .single
+            if let url = URL(string: text) {
+                style.link = url
+            }
+
+        case .cashu:
+            style.foregroundColor = .green
+            style.font = .bitchatSystem(size: 14, weight: .medium, design: .monospaced)
+            style.backgroundColor = Color.green.opacity(0.1)
+
+        case .lightning, .bolt11, .lnurl:
+            style.foregroundColor = .yellow
+            style.font = .bitchatSystem(size: 14, weight: .medium, design: .monospaced)
+            style.backgroundColor = Color.yellow.opacity(0.1)
+        }
+
+        return AttributedString(text).mergingAttributes(style)
+    }
+
+    private static func formatTimestamp(_ timestamp: String) -> AttributedString {
+        let text = AttributedString(" [\(timestamp)]")
+        var style = AttributeContainer()
+        style.foregroundColor = Color.gray.opacity(0.5)
+        style.font = .bitchatSystem(size: 10, design: .monospaced)
+        return text.mergingAttributes(style)
+    }
+}
@@ -1,17 +1,28 @@
 import BitLogger
+import BitFoundation
 import Foundation

-/// Routes messages between BLE and Nostr transports
+/// Routes messages using available transports (Mesh, Nostr, etc.)
@MainActor
 final class MessageRouter {
-    private let mesh: Transport
-    private let nostr: NostrTransport
-    private var outbox: [PeerID: [(content: String, nickname: String, messageID: String)]] = [:] // peerID -> queued messages
+    private let transports: [Transport]

-    init(mesh: Transport, nostr: NostrTransport) {
-        self.mesh = mesh
-        self.nostr = nostr
-        self.nostr.senderPeerID = mesh.myPeerID
+    // Outbox entry with timestamp for TTL-based eviction
+    private struct QueuedMessage {
+        let content: String
+        let nickname: String
+        let messageID: String
+        let timestamp: Date
+    }
+
+    private var outbox: [PeerID: [QueuedMessage]] = [:]
+
+    // Outbox limits to prevent unbounded memory growth
+    private static let maxMessagesPerPeer = 100
+    private static let messageTTLSeconds: TimeInterval = 24 * 60 * 60 // 24 hours
+
+    init(transports: [Transport]) {
+        self.transports = transports

        // Observe favorites changes to learn Nostr mapping and flush queued messages
        NotificationCenter.default.addObserver(
@@ -37,89 +48,87 @@ final class MessageRouter {
        }
    }

+    // MARK: - Transport Selection
+
+    private func reachableTransport(for peerID: PeerID) -> Transport? {
+        transports.first { $0.isPeerReachable(peerID) }
+    }
+
+    private func connectedTransport(for peerID: PeerID) -> Transport? {
+        transports.first { $0.isPeerConnected(peerID) }
+    }
+
+    // MARK: - Message Sending
+
    func sendPrivate(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
-        let reachableMesh = mesh.isPeerReachable(peerID)
-        if reachableMesh {
-            SecureLogger.debug("Routing PM via mesh (reachable) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-            // BLEService will initiate a handshake if needed and queue the message
-            mesh.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
-        } else if canSendViaNostr(peerID: peerID) {
-            SecureLogger.debug("Routing PM via Nostr to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-            nostr.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
+        if let transport = reachableTransport(for: peerID) {
+            SecureLogger.debug("Routing PM via \(type(of: transport)) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
+            transport.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
        } else {
-            // Queue for later (when mesh connects or Nostr mapping appears)
+            // Queue for later with timestamp for TTL tracking
            if outbox[peerID] == nil { outbox[peerID] = [] }
-            outbox[peerID]?.append((content, recipientNickname, messageID))
-            SecureLogger.debug("Queued PM for \(peerID.id.prefix(8))… (no mesh, no Nostr mapping) id=\(messageID.prefix(8))…", category: .session)
+
+            let message = QueuedMessage(content: content, nickname: recipientNickname, messageID: messageID, timestamp: Date())
+            outbox[peerID]?.append(message)
+
+            // Enforce per-peer size limit with FIFO eviction
+            if let count = outbox[peerID]?.count, count > Self.maxMessagesPerPeer {
+                let evicted = outbox[peerID]?.removeFirst()
+                SecureLogger.warning("📤 Outbox overflow for \(peerID.id.prefix(8))… - evicted oldest message: \(evicted?.messageID.prefix(8) ?? "?")…", category: .session)
+            }
+
+            SecureLogger.debug("Queued PM for \(peerID.id.prefix(8))… (no reachable transport) id=\(messageID.prefix(8))… queue=\(outbox[peerID]?.count ?? 0)", category: .session)
        }
    }

    func sendReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
-        // Prefer mesh for reachable peers; BLE will queue if handshake is needed
-        if mesh.isPeerReachable(peerID) {
-            SecureLogger.debug("Routing READ ack via mesh (reachable) to \(peerID.id.prefix(8))… id=\(receipt.originalMessageID.prefix(8))…", category: .session)
-            mesh.sendReadReceipt(receipt, to: peerID)
-        } else {
-            SecureLogger.debug("Routing READ ack via Nostr to \(peerID.id.prefix(8))… id=\(receipt.originalMessageID.prefix(8))…", category: .session)
-            nostr.sendReadReceipt(receipt, to: peerID)
+        if let transport = reachableTransport(for: peerID) {
+            SecureLogger.debug("Routing READ ack via \(type(of: transport)) to \(peerID.id.prefix(8))… id=\(receipt.originalMessageID.prefix(8))…", category: .session)
+            transport.sendReadReceipt(receipt, to: peerID)
+        } else if !transports.isEmpty {
+            SecureLogger.debug("No reachable transport for READ ack to \(peerID.id.prefix(8))…", category: .session)
        }
    }

    func sendDeliveryAck(_ messageID: String, to peerID: PeerID) {
-        if mesh.isPeerReachable(peerID) {
-            SecureLogger.debug("Routing DELIVERED ack via mesh (reachable) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-            mesh.sendDeliveryAck(for: messageID, to: peerID)
-        } else {
-            nostr.sendDeliveryAck(for: messageID, to: peerID)
+        if let transport = reachableTransport(for: peerID) {
+            SecureLogger.debug("Routing DELIVERED ack via \(type(of: transport)) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
+            transport.sendDeliveryAck(for: messageID, to: peerID)
        }
    }

    func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool) {
-        // Route via mesh when connected; else use Nostr
-        if mesh.isPeerConnected(peerID) {
-            mesh.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
-        } else {
-            nostr.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
+        if let transport = connectedTransport(for: peerID) {
+            transport.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
+        } else if let transport = reachableTransport(for: peerID) {
+            transport.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
        }
    }

    // MARK: - Outbox Management
-    private func canSendViaNostr(peerID: PeerID) -> Bool {
-        // Two forms are supported:
-        // - 64-hex Noise public key (32 bytes)
-        // - 16-hex short peer ID (derived from Noise pubkey)
-        if let noiseKey = peerID.noiseKey {
-            if let fav = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey),
-               fav.peerNostrPublicKey != nil {
-                return true
-            }
-        } else if peerID.isShort {
-            if let fav = FavoritesPersistenceService.shared.getFavoriteStatus(forPeerID: peerID),
-               fav.peerNostrPublicKey != nil {
-                return true
-            }
-        }
-        return false
-    }

    func flushOutbox(for peerID: PeerID) {
        guard let queued = outbox[peerID], !queued.isEmpty else { return }
        SecureLogger.debug("Flushing outbox for \(peerID.id.prefix(8))… count=\(queued.count)", category: .session)
-        var remaining: [(content: String, nickname: String, messageID: String)] = []
-        // Prefer mesh if connected; else try Nostr if mapping exists
-        for (content, nickname, messageID) in queued {
-            if mesh.isPeerReachable(peerID) {
-                SecureLogger.debug("Outbox -> mesh for \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-                mesh.sendPrivateMessage(content, to: peerID, recipientNickname: nickname, messageID: messageID)
-            } else if canSendViaNostr(peerID: peerID) {
-                SecureLogger.debug("Outbox -> Nostr for \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-                nostr.sendPrivateMessage(content, to: peerID, recipientNickname: nickname, messageID: messageID)
+
+        let now = Date()
+        var remaining: [QueuedMessage] = []
+
+        for message in queued {
+            // Skip expired messages (TTL exceeded)
+            if now.timeIntervalSince(message.timestamp) > Self.messageTTLSeconds {
+                SecureLogger.debug("⏰ Expired queued message for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))… (age: \(Int(now.timeIntervalSince(message.timestamp)))s)", category: .session)
+                continue
+            }
+
+            if let transport = reachableTransport(for: peerID) {
+                SecureLogger.debug("Outbox -> \(type(of: transport)) for \(peerID.id.prefix(8))… id=\(message.messageID.prefix(8))…", category: .session)
+                transport.sendPrivateMessage(message.content, to: peerID, recipientNickname: message.nickname, messageID: message.messageID)
            } else {
-                // Keep unsent items queued
-                remaining.append((content, nickname, messageID))
+                remaining.append(message)
            }
        }
-        // Persist only items we could not send
+
        if remaining.isEmpty {
            outbox.removeValue(forKey: peerID)
        } else {
@@ -130,4 +139,15 @@ final class MessageRouter {
    func flushAllOutbox() {
        for key in Array(outbox.keys) { flushOutbox(for: key) }
    }
+
+    /// Periodically clean up expired messages from all outboxes
+    func cleanupExpiredMessages() {
+        let now = Date()
+        for peerID in Array(outbox.keys) {
+            outbox[peerID]?.removeAll { now.timeIntervalSince($0.timestamp) > Self.messageTTLSeconds }
+            if outbox[peerID]?.isEmpty == true {
+                outbox.removeValue(forKey: peerID)
+            }
+        }
+    }
 }
@@ -1,8 +1,30 @@
+import Nostr
 import Foundation
 import BitLogger
 import Combine
 import Tor

+@MainActor
+protocol NetworkActivationTorControlling: AnyObject {
+    func setAutoStartAllowed(_ allowed: Bool)
+    func startIfNeeded()
+    func shutdownCompletely()
+}
+
+@MainActor
+protocol NetworkActivationRelayControlling: AnyObject {
+    func connect()
+    func disconnect()
+}
+
+protocol NetworkActivationProxyControlling: AnyObject {
+    func setProxyMode(useTor: Bool)
+}
+
+extension TorManager: NetworkActivationTorControlling {}
+extension NostrRelayManager: NetworkActivationRelayControlling {}
+extension TorURLSession: NetworkActivationProxyControlling {}
+
 /// Coordinates when the app is allowed to start Tor and connect to Nostr relays.
 /// Policy: permit start when either location permissions are authorized OR
 /// there exists at least one mutual favorite. Otherwise, do not start.
@@ -17,14 +39,55 @@ final class NetworkActivationService: ObservableObject {
    private var started = false
    private let torPreferenceKey = "networkActivationService.userTorEnabled"
    private var torAutoStartDesired: Bool = false
+    private let storage: UserDefaults
+    private let locationPermissionPublisher: AnyPublisher<LocationChannelManager.PermissionState, Never>
+    private let mutualFavoritesPublisher: AnyPublisher<Set<Data>, Never>
+    private let permissionProvider: () -> LocationChannelManager.PermissionState
+    private let mutualFavoritesProvider: () -> Set<Data>
+    private let torController: NetworkActivationTorControlling
+    private let relayController: NetworkActivationRelayControlling
+    private let proxyController: NetworkActivationProxyControlling
+    private let notificationCenter: NotificationCenter

-    private init() {}
+    private init() {
+        storage = .standard
+        locationPermissionPublisher = LocationChannelManager.shared.$permissionState.eraseToAnyPublisher()
+        mutualFavoritesPublisher = FavoritesPersistenceService.shared.$mutualFavorites.eraseToAnyPublisher()
+        permissionProvider = { LocationChannelManager.shared.permissionState }
+        mutualFavoritesProvider = { FavoritesPersistenceService.shared.mutualFavorites }
+        torController = TorManager.shared
+        relayController = NostrRelayManager.shared
+        proxyController = TorURLSession.shared
+        notificationCenter = .default
+    }
+
+    internal init(
+        storage: UserDefaults,
+        locationPermissionPublisher: AnyPublisher<LocationChannelManager.PermissionState, Never>,
+        mutualFavoritesPublisher: AnyPublisher<Set<Data>, Never>,
+        permissionProvider: @escaping () -> LocationChannelManager.PermissionState,
+        mutualFavoritesProvider: @escaping () -> Set<Data>,
+        torController: NetworkActivationTorControlling,
+        relayController: NetworkActivationRelayControlling,
+        proxyController: NetworkActivationProxyControlling,
+        notificationCenter: NotificationCenter = .default
+    ) {
+        self.storage = storage
+        self.locationPermissionPublisher = locationPermissionPublisher
+        self.mutualFavoritesPublisher = mutualFavoritesPublisher
+        self.permissionProvider = permissionProvider
+        self.mutualFavoritesProvider = mutualFavoritesProvider
+        self.torController = torController
+        self.relayController = relayController
+        self.proxyController = proxyController
+        self.notificationCenter = notificationCenter
+    }

    func start() {
        guard !started else { return }
        started = true

-        if let stored = UserDefaults.standard.object(forKey: torPreferenceKey) as? Bool {
+        if let stored = storage.object(forKey: torPreferenceKey) as? Bool {
            userTorEnabled = stored
        } else {
            userTorEnabled = true
@@ -34,16 +97,16 @@ final class NetworkActivationService: ObservableObject {
        let allowed = basePolicyAllowed()
        activationAllowed = allowed
        torAutoStartDesired = allowed && userTorEnabled
-        TorManager.shared.setAutoStartAllowed(torAutoStartDesired)
+        torController.setAutoStartAllowed(torAutoStartDesired)
        applyTorState(torDesired: torAutoStartDesired)
        if allowed {
-            NostrRelayManager.shared.connect()
+            relayController.connect()
        } else {
-            NostrRelayManager.shared.disconnect()
+            relayController.disconnect()
        }

        // React to location permission changes
-        LocationChannelManager.shared.$permissionState
+        locationPermissionPublisher
            .receive(on: DispatchQueue.main)
            .sink { [weak self] _ in
                self?.reevaluate()
@@ -51,7 +114,7 @@ final class NetworkActivationService: ObservableObject {
            .store(in: &cancellables)

        // React to mutual favorites changes
-        FavoritesPersistenceService.shared.$mutualFavorites
+        mutualFavoritesPublisher
            .receive(on: DispatchQueue.main)
            .sink { [weak self] _ in
                self?.reevaluate()
@@ -62,8 +125,8 @@ final class NetworkActivationService: ObservableObject {
    func setUserTorEnabled(_ enabled: Bool) {
        guard enabled != userTorEnabled else { return }
        userTorEnabled = enabled
-        UserDefaults.standard.set(enabled, forKey: torPreferenceKey)
-        NotificationCenter.default.post(
+        storage.set(enabled, forKey: torPreferenceKey)
+        notificationCenter.post(
            name: .TorUserPreferenceChanged,
            object: nil,
            userInfo: ["enabled": enabled]
@@ -82,33 +145,33 @@ final class NetworkActivationService: ObservableObject {
        }
        if statusChanged || torChanged {
            torAutoStartDesired = torDesired
-            TorManager.shared.setAutoStartAllowed(torDesired)
+            torController.setAutoStartAllowed(torDesired)
            applyTorState(torDesired: torDesired)
        }

        if allowed {
            if torChanged {
                // Reset relay sockets when switching transport path (Tor ↔︎ direct)
-                NostrRelayManager.shared.disconnect()
+                relayController.disconnect()
            }
-            NostrRelayManager.shared.connect()
+            relayController.connect()
        } else if statusChanged {
-            NostrRelayManager.shared.disconnect()
+            relayController.disconnect()
        }
    }

    private func basePolicyAllowed() -> Bool {
-        let permOK = LocationChannelManager.shared.permissionState == .authorized
-        let hasMutual = !FavoritesPersistenceService.shared.mutualFavorites.isEmpty
+        let permOK = permissionProvider() == .authorized
+        let hasMutual = !mutualFavoritesProvider().isEmpty
        return permOK || hasMutual
    }

    private func applyTorState(torDesired: Bool) {
-        TorURLSession.shared.setProxyMode(useTor: torDesired)
+        proxyController.setProxyMode(useTor: torDesired)
        if torDesired {
-            TorManager.shared.startIfNeeded()
+            torController.startIfNeeded()
        } else {
-            TorManager.shared.shutdownCompletely()
+            torController.shutdownCompletely()
        }
    }
 }
@@ -83,6 +83,8 @@
 ///

 import BitLogger
+import BitFoundation
+import Noise
 import Foundation
 import CryptoKit

@@ -199,64 +201,153 @@ final class NoiseEncryptionService {
    
    init(keychain: KeychainManagerProtocol) {
        self.keychain = keychain
-        
-        // Load or create static identity key (ONLY from keychain)
+
+        // BCH-01-009: Load or create static identity key with proper error handling
        let loadedKey: Curve25519.KeyAgreement.PrivateKey
-        
-        // Try to load from keychain
-        if let identityData = keychain.getIdentityKey(forKey: "noiseStaticKey"),
-           let key = try? Curve25519.KeyAgreement.PrivateKey(rawRepresentation: identityData) {
-            loadedKey = key
-            SecureLogger.logKeyOperation(.load, keyType: "noiseStaticKey", success: true)
-        }
-        // If no identity exists, create new one
-        else {
+
+        // Try to load from keychain with proper error classification
+        let noiseKeyResult = keychain.getIdentityKeyWithResult(forKey: "noiseStaticKey")
+
+        switch noiseKeyResult {
+        case .success(let identityData):
+            if let key = try? Curve25519.KeyAgreement.PrivateKey(rawRepresentation: identityData) {
+                loadedKey = key
+                SecureLogger.logKeyOperation(.load, keyType: "noiseStaticKey", success: true)
+            } else {
+                // Data corrupted, regenerate
+                SecureLogger.warning("Noise static key data corrupted, regenerating", category: .keychain)
+                loadedKey = Self.generateAndSaveNoiseKey(keychain: keychain)
+            }
+
+        case .itemNotFound:
+            // Expected case: no key exists yet, create new one
+            loadedKey = Self.generateAndSaveNoiseKey(keychain: keychain)
+
+        case .accessDenied:
+            // Critical error - log but proceed with ephemeral key (will be lost on restart)
+            SecureLogger.error(NSError(domain: "Keychain", code: -1),
+                               context: "Keychain access denied - using ephemeral identity", category: .keychain)
+            loadedKey = Curve25519.KeyAgreement.PrivateKey()
+
+        case .deviceLocked, .authenticationFailed:
+            // Recoverable error - use ephemeral key and warn
+            SecureLogger.warning("Device locked or auth failed - using ephemeral identity until unlocked", category: .keychain)
+            loadedKey = Curve25519.KeyAgreement.PrivateKey()
+
+        case .otherError(let status):
+            // Unexpected error - log and use ephemeral key
+            SecureLogger.error(NSError(domain: "Keychain", code: Int(status)),
+                               context: "Unexpected keychain error - using ephemeral identity", category: .keychain)
            loadedKey = Curve25519.KeyAgreement.PrivateKey()
-            let keyData = loadedKey.rawRepresentation
-            
-            // Save to keychain
-            let saved = keychain.saveIdentityKey(keyData, forKey: "noiseStaticKey")
-            SecureLogger.logKeyOperation(.create, keyType: "noiseStaticKey", success: saved)
        }
-        
+
        // Now assign the final value
        self.staticIdentityKey = loadedKey
        self.staticIdentityPublicKey = staticIdentityKey.publicKey
-        
-        // Load or create signing key pair
+
+        // BCH-01-009: Load or create signing key pair with proper error handling
        let loadedSigningKey: Curve25519.Signing.PrivateKey
-        
-        // Try to load from keychain
-        if let signingData = keychain.getIdentityKey(forKey: "ed25519SigningKey"),
-           let key = try? Curve25519.Signing.PrivateKey(rawRepresentation: signingData) {
-            loadedSigningKey = key
-            SecureLogger.logKeyOperation(.load, keyType: "ed25519SigningKey", success: true)
-        }
-        // If no signing key exists, create new one
-        else {
+
+        let signingKeyResult = keychain.getIdentityKeyWithResult(forKey: "ed25519SigningKey")
+
+        switch signingKeyResult {
+        case .success(let signingData):
+            if let key = try? Curve25519.Signing.PrivateKey(rawRepresentation: signingData) {
+                loadedSigningKey = key
+                SecureLogger.logKeyOperation(.load, keyType: "ed25519SigningKey", success: true)
+            } else {
+                // Data corrupted, regenerate
+                SecureLogger.warning("Ed25519 signing key data corrupted, regenerating", category: .keychain)
+                loadedSigningKey = Self.generateAndSaveSigningKey(keychain: keychain)
+            }
+
+        case .itemNotFound:
+            // Expected case: no key exists yet, create new one
+            loadedSigningKey = Self.generateAndSaveSigningKey(keychain: keychain)
+
+        case .accessDenied:
+            // Critical error - log but proceed with ephemeral key
+            SecureLogger.error(NSError(domain: "Keychain", code: -1),
+                               context: "Keychain access denied - using ephemeral signing key", category: .keychain)
+            loadedSigningKey = Curve25519.Signing.PrivateKey()
+
+        case .deviceLocked, .authenticationFailed:
+            // Recoverable error - use ephemeral key and warn
+            SecureLogger.warning("Device locked or auth failed - using ephemeral signing key until unlocked", category: .keychain)
+            loadedSigningKey = Curve25519.Signing.PrivateKey()
+
+        case .otherError(let status):
+            // Unexpected error - log and use ephemeral key
+            SecureLogger.error(NSError(domain: "Keychain", code: Int(status)),
+                               context: "Unexpected keychain error - using ephemeral signing key", category: .keychain)
            loadedSigningKey = Curve25519.Signing.PrivateKey()
-            let keyData = loadedSigningKey.rawRepresentation
-            
-            // Save to keychain
-            let saved = keychain.saveIdentityKey(keyData, forKey: "ed25519SigningKey")
-            SecureLogger.logKeyOperation(.create, keyType: "ed25519SigningKey", success: saved)
        }
-        
+
        // Now assign the signing keys
        self.signingKey = loadedSigningKey
        self.signingPublicKey = signingKey.publicKey
-        
+
        // Initialize session manager
        self.sessionManager = NoiseSessionManager(localStaticKey: staticIdentityKey, keychain: keychain)
-        
+
        // Set up session callbacks
        sessionManager.onSessionEstablished = { [weak self] peerID, remoteStaticKey in
            self?.handleSessionEstablished(peerID: peerID, remoteStaticKey: remoteStaticKey)
        }
-        
+
        // Start session maintenance timer
        startRekeyTimer()
    }
+
+    // MARK: - BCH-01-009: Key Generation Helpers with Save Verification
+
+    /// Generate and save a new Noise static key, verifying the save succeeds
+    private static func generateAndSaveNoiseKey(keychain: KeychainManagerProtocol) -> Curve25519.KeyAgreement.PrivateKey {
+        let newKey = Curve25519.KeyAgreement.PrivateKey()
+        let keyData = newKey.rawRepresentation
+
+        // Save to keychain and verify success
+        let saveResult = keychain.saveIdentityKeyWithResult(keyData, forKey: "noiseStaticKey")
+
+        switch saveResult {
+        case .success:
+            SecureLogger.logKeyOperation(.create, keyType: "noiseStaticKey", success: true)
+        case .duplicateItem:
+            // This shouldn't happen since we just tried to load, but handle it
+            SecureLogger.warning("Noise key already exists (race condition?)", category: .keychain)
+        default:
+            // Save failed - log but continue with the key (it will be ephemeral)
+            SecureLogger.error(NSError(domain: "Keychain", code: -1),
+                               context: "Failed to persist noise static key - identity will be lost on restart",
+                               category: .keychain)
+        }
+
+        return newKey
+    }
+
+    /// Generate and save a new Ed25519 signing key, verifying the save succeeds
+    private static func generateAndSaveSigningKey(keychain: KeychainManagerProtocol) -> Curve25519.Signing.PrivateKey {
+        let newKey = Curve25519.Signing.PrivateKey()
+        let keyData = newKey.rawRepresentation
+
+        // Save to keychain and verify success
+        let saveResult = keychain.saveIdentityKeyWithResult(keyData, forKey: "ed25519SigningKey")
+
+        switch saveResult {
+        case .success:
+            SecureLogger.logKeyOperation(.create, keyType: "ed25519SigningKey", success: true)
+        case .duplicateItem:
+            // This shouldn't happen since we just tried to load, but handle it
+            SecureLogger.warning("Signing key already exists (race condition?)", category: .keychain)
+        default:
+            // Save failed - log but continue with the key (it will be ephemeral)
+            SecureLogger.error(NSError(domain: "Keychain", code: -1),
+                               context: "Failed to persist signing key - identity will be lost on restart",
+                               category: .keychain)
+        }
+
+        return newKey
+    }
    
    // MARK: - Public Interface
    
@@ -527,6 +618,17 @@ final class NoiseEncryptionService {
        }
        rateLimiter.resetAll()
    }
+
+    /// Clear session for a specific peer (e.g., on decryption failure to allow re-handshake)
+    func clearSession(for peerID: PeerID) {
+        sessionManager.removeSession(for: peerID)
+        serviceQueue.sync(flags: .barrier) {
+            if let fingerprint = peerFingerprints.removeValue(forKey: peerID) {
+                fingerprintToPeerID.removeValue(forKey: fingerprint)
+            }
+        }
+        SecureLogger.debug("🔓 Cleared Noise session for \(peerID)", category: .session)
+    }
    
    // MARK: - Private Helpers
    
@@ -1,9 +1,37 @@
 import BitLogger
+import BitFoundation
+import Nostr
 import Foundation
 import Combine

 // Minimal Nostr transport conforming to Transport for offline sending
-final class NostrTransport: Transport {
+final class NostrTransport: Transport, @unchecked Sendable {
+    struct Dependencies {
+        let notificationCenter: NotificationCenter
+        let loadFavorites: @MainActor () -> [Data: FavoritesPersistenceService.FavoriteRelationship]
+        let favoriteStatusForNoiseKey: @MainActor (Data) -> FavoritesPersistenceService.FavoriteRelationship?
+        let favoriteStatusForPeerID: @MainActor (PeerID) -> FavoritesPersistenceService.FavoriteRelationship?
+        let currentIdentity: @MainActor () throws -> NostrIdentity?
+        let registerPendingGiftWrap: @MainActor (String) -> Void
+        let sendEvent: @MainActor (NostrEvent) -> Void
+        let scheduleAfter: @Sendable (TimeInterval, @escaping @Sendable () -> Void) -> Void
+
+        static func live(idBridge: NostrIdentityBridge) -> Dependencies {
+            Dependencies(
+                notificationCenter: .default,
+                loadFavorites: { FavoritesPersistenceService.shared.favorites },
+                favoriteStatusForNoiseKey: { FavoritesPersistenceService.shared.getFavoriteStatus(for: $0) },
+                favoriteStatusForPeerID: { FavoritesPersistenceService.shared.getFavoriteStatus(forPeerID: $0) },
+                currentIdentity: { try idBridge.getCurrentNostrIdentity() },
+                registerPendingGiftWrap: { NostrRelayManager.registerPendingGiftWrap(id: $0) },
+                sendEvent: { NostrRelayManager.shared.sendEvent($0) },
+                scheduleAfter: { delay, action in
+                    DispatchQueue.main.asyncAfter(deadline: .now() + delay, execute: action)
+                }
+            )
+        }
+    }
+
    // Provide BLE short peer ID for BitChat embedding
    var senderPeerID = PeerID(str: "")

@@ -17,10 +45,63 @@ final class NostrTransport: Transport {
    private let readAckInterval: TimeInterval = TransportConfig.nostrReadAckInterval
    private let keychain: KeychainManagerProtocol
    private let idBridge: NostrIdentityBridge
+    private let dependencies: Dependencies
+    private var favoriteStatusObserver: NSObjectProtocol?

-    init(keychain: KeychainManagerProtocol, idBridge: NostrIdentityBridge) {
+    // Reachability Cache (thread-safe)
+    private var reachablePeers: Set<PeerID> = []
+    private let queue = DispatchQueue(label: "nostr.transport.state", attributes: .concurrent)
+
+    @MainActor
+    init(
+        keychain: KeychainManagerProtocol,
+        idBridge: NostrIdentityBridge,
+        dependencies: Dependencies? = nil
+    ) {
        self.keychain = keychain
        self.idBridge = idBridge
+        self.dependencies = dependencies ?? .live(idBridge: idBridge)
+        
+        setupObservers()
+        
+        // Synchronously warm the cache to avoid startup race
+        let favorites = self.dependencies.loadFavorites()
+        let reachable = favorites.values
+            .filter { $0.peerNostrPublicKey != nil }
+            .map { PeerID(publicKey: $0.peerNoisePublicKey) }
+            
+        queue.sync(flags: .barrier) {
+            self.reachablePeers = Set(reachable)
+        }
+    }
+
+    deinit {
+        if let favoriteStatusObserver {
+            dependencies.notificationCenter.removeObserver(favoriteStatusObserver)
+        }
+    }
+
+    private func setupObservers() {
+        favoriteStatusObserver = dependencies.notificationCenter.addObserver(
+            forName: .favoriteStatusChanged,
+            object: nil,
+            queue: nil
+        ) { [weak self] _ in
+            self?.refreshReachablePeers()
+        }
+    }
+
+    private func refreshReachablePeers() {
+        Task { @MainActor in
+            let favorites = dependencies.loadFavorites()
+            let reachable = favorites.values
+                .filter { $0.peerNostrPublicKey != nil }
+                .map { PeerID(publicKey: $0.peerNoisePublicKey) }
+            
+            self.queue.async(flags: .barrier) { [weak self] in
+                self?.reachablePeers = Set(reachable)
+            }
+        }
    }

    // MARK: - Transport Protocol Conformance
@@ -42,7 +123,19 @@ final class NostrTransport: Transport {
    func emergencyDisconnectAll() { /* no-op */ }

    func isPeerConnected(_ peerID: PeerID) -> Bool { false }
-    func isPeerReachable(_ peerID: PeerID) -> Bool { false }
+    
+    func isPeerReachable(_ peerID: PeerID) -> Bool {
+        queue.sync {
+            // Check if exact match
+            if reachablePeers.contains(peerID) { return true }
+            // Check for short ID match
+            if peerID.isShort {
+                return reachablePeers.contains(where: { $0.toShort() == peerID })
+            }
+            return false
+        }
+    }
+    
    func peerNickname(peerID: PeerID) -> String? { nil }
    func getPeerNicknames() -> [PeerID : String] { [:] }

@@ -66,89 +159,54 @@ final class NostrTransport: Transport {

    func sendPrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
        Task { @MainActor in
-            guard let recipientNpub = resolveRecipientNpub(for: peerID) else { return }
-            guard let senderIdentity = try? idBridge.getCurrentNostrIdentity() else { return }
-            SecureLogger.debug("NostrTransport: preparing PM to \(recipientNpub.prefix(16))… for peerID \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-            // Convert recipient npub -> hex (x-only)
-            let recipientHex: String
-            do {
-                let (hrp, data) = try Bech32.decode(recipientNpub)
-                guard hrp == "npub" else {
-                    SecureLogger.error("NostrTransport: recipient key not npub (hrp=\(hrp))", category: .session)
-                    return
-                }
-                recipientHex = data.hexEncodedString()
-            } catch {
-                SecureLogger.error("NostrTransport: failed to decode npub -> hex: \(error)", category: .session)
-                return
-            }
+            guard let recipientNpub = resolveRecipientNpub(for: peerID),
+                  let recipientHex = npubToHex(recipientNpub),
+                  let senderIdentity = try? dependencies.currentIdentity() else { return }
+            SecureLogger.debug("NostrTransport: preparing PM to \(recipientNpub.prefix(16))… id=\(messageID.prefix(8))…", category: .session)
            guard let embedded = NostrEmbeddedBitChat.encodePMForNostr(content: content, messageID: messageID, recipientPeerID: peerID, senderPeerID: senderPeerID) else {
                SecureLogger.error("NostrTransport: failed to embed PM packet", category: .session)
                return
            }
-            guard let event = try? NostrProtocol.createPrivateMessage(content: embedded, recipientPubkey: recipientHex, senderIdentity: senderIdentity) else {
-                SecureLogger.error("NostrTransport: failed to build Nostr event for PM", category: .session)
-                return
-            }
-            SecureLogger.debug("NostrTransport: sending PM giftWrap id=\(event.id.prefix(16))…", category: .session)
-            NostrRelayManager.shared.sendEvent(event)
+            sendWrappedMessage(content: embedded, recipientHex: recipientHex, senderIdentity: senderIdentity)
        }
    }

    func sendReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
        // Enqueue and process with throttling to avoid relay rate limits
-        readQueue.append(QueuedRead(receipt: receipt, peerID: peerID))
-        processReadQueueIfNeeded()
+        // Use barrier to synchronize access to readQueue
+        queue.async(flags: .barrier) { [weak self] in
+            self?.readQueue.append(QueuedRead(receipt: receipt, peerID: peerID))
+            self?.processReadQueueIfNeeded()
+        }
    }

    func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool) {
        Task { @MainActor in
-            guard let recipientNpub = resolveRecipientNpub(for: peerID) else { return }
-            guard let senderIdentity = try? idBridge.getCurrentNostrIdentity() else { return }
+            guard let recipientNpub = resolveRecipientNpub(for: peerID),
+                  let recipientHex = npubToHex(recipientNpub),
+                  let senderIdentity = try? dependencies.currentIdentity() else { return }
            let content = isFavorite ? "[FAVORITED]:\(senderIdentity.npub)" : "[UNFAVORITED]:\(senderIdentity.npub)"
            SecureLogger.debug("NostrTransport: preparing FAVORITE(\(isFavorite)) to \(recipientNpub.prefix(16))…", category: .session)
-            // Convert recipient npub -> hex
-            let recipientHex: String
-            do {
-                let (hrp, data) = try Bech32.decode(recipientNpub)
-                guard hrp == "npub" else { return }
-                recipientHex = data.hexEncodedString()
-            } catch { return }
            guard let embedded = NostrEmbeddedBitChat.encodePMForNostr(content: content, messageID: UUID().uuidString, recipientPeerID: peerID, senderPeerID: senderPeerID) else {
                SecureLogger.error("NostrTransport: failed to embed favorite notification", category: .session)
                return
            }
-            guard let event = try? NostrProtocol.createPrivateMessage(content: embedded, recipientPubkey: recipientHex, senderIdentity: senderIdentity) else {
-                SecureLogger.error("NostrTransport: failed to build Nostr event for favorite notification", category: .session)
-                return
-            }
-            SecureLogger.debug("NostrTransport: sending favorite giftWrap id=\(event.id.prefix(16))…", category: .session)
-            NostrRelayManager.shared.sendEvent(event)
+            sendWrappedMessage(content: embedded, recipientHex: recipientHex, senderIdentity: senderIdentity)
        }
    }

    func sendBroadcastAnnounce() { /* no-op for Nostr */ }
    func sendDeliveryAck(for messageID: String, to peerID: PeerID) {
        Task { @MainActor in
-            guard let recipientNpub = resolveRecipientNpub(for: peerID) else { return }
-            guard let senderIdentity = try? idBridge.getCurrentNostrIdentity() else { return }
-            SecureLogger.debug("NostrTransport: preparing DELIVERED ack for id=\(messageID.prefix(8))… to \(recipientNpub.prefix(16))…", category: .session)
-            let recipientHex: String
-            do {
-                let (hrp, data) = try Bech32.decode(recipientNpub)
-                guard hrp == "npub" else { return }
-                recipientHex = data.hexEncodedString()
-            } catch { return }
+            guard let recipientNpub = resolveRecipientNpub(for: peerID),
+                  let recipientHex = npubToHex(recipientNpub),
+                  let senderIdentity = try? dependencies.currentIdentity() else { return }
+            SecureLogger.debug("NostrTransport: preparing DELIVERED ack id=\(messageID.prefix(8))…", category: .session)
            guard let ack = NostrEmbeddedBitChat.encodeAckForNostr(type: .delivered, messageID: messageID, recipientPeerID: peerID, senderPeerID: senderPeerID) else {
                SecureLogger.error("NostrTransport: failed to embed DELIVERED ack", category: .session)
                return
            }
-            guard let event = try? NostrProtocol.createPrivateMessage(content: ack, recipientPubkey: recipientHex, senderIdentity: senderIdentity) else {
-                SecureLogger.error("NostrTransport: failed to build Nostr event for DELIVERED ack", category: .session)
-                return
-            }
-            SecureLogger.debug("NostrTransport: sending DELIVERED ack giftWrap id=\(event.id.prefix(16))…", category: .session)
-            NostrRelayManager.shared.sendEvent(event)
+            sendWrappedMessage(content: ack, recipientHex: recipientHex, senderIdentity: senderIdentity)
        }
    }
 }
@@ -160,21 +218,17 @@ extension NostrTransport {
    // MARK: Geohash ACK helpers
    func sendDeliveryAckGeohash(for messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity) {
        Task { @MainActor in
-            SecureLogger.debug("GeoDM: send DELIVERED -> recip=\(recipientHex.prefix(8))… mid=\(messageID.prefix(8))… from=\(identity.publicKeyHex.prefix(8))…", category: .session)
+            SecureLogger.debug("GeoDM: send DELIVERED mid=\(messageID.prefix(8))…", category: .session)
            guard let embedded = NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(type: .delivered, messageID: messageID, senderPeerID: senderPeerID) else { return }
-            guard let event = try? NostrProtocol.createPrivateMessage(content: embedded, recipientPubkey: recipientHex, senderIdentity: identity) else { return }
-            NostrRelayManager.registerPendingGiftWrap(id: event.id)
-            NostrRelayManager.shared.sendEvent(event)
+            sendWrappedMessage(content: embedded, recipientHex: recipientHex, senderIdentity: identity, registerPending: true)
        }
    }

    func sendReadReceiptGeohash(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity) {
        Task { @MainActor in
-            SecureLogger.debug("GeoDM: send READ -> recip=\(recipientHex.prefix(8))… mid=\(messageID.prefix(8))… from=\(identity.publicKeyHex.prefix(8))…", category: .session)
+            SecureLogger.debug("GeoDM: send READ mid=\(messageID.prefix(8))…", category: .session)
            guard let embedded = NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(type: .readReceipt, messageID: messageID, senderPeerID: senderPeerID) else { return }
-            guard let event = try? NostrProtocol.createPrivateMessage(content: embedded, recipientPubkey: recipientHex, senderIdentity: identity) else { return }
-            NostrRelayManager.registerPendingGiftWrap(id: event.id)
-            NostrRelayManager.shared.sendEvent(event)
+            sendWrappedMessage(content: embedded, recipientHex: recipientHex, senderIdentity: identity, registerPending: true)
        }
    }

@@ -182,19 +236,12 @@ extension NostrTransport {
    func sendPrivateMessageGeohash(content: String, toRecipientHex recipientHex: String, from identity: NostrIdentity, messageID: String) {
        Task { @MainActor in
            guard !recipientHex.isEmpty else { return }
-            SecureLogger.debug("GeoDM: send PM -> recip=\(recipientHex.prefix(8))… mid=\(messageID.prefix(8))… from=\(identity.publicKeyHex.prefix(8))…", category: .session)
-            // Build embedded BitChat packet without recipient peer ID
+            SecureLogger.debug("GeoDM: send PM mid=\(messageID.prefix(8))…", category: .session)
            guard let embedded = NostrEmbeddedBitChat.encodePMForNostrNoRecipient(content: content, messageID: messageID, senderPeerID: senderPeerID) else {
                SecureLogger.error("NostrTransport: failed to embed geohash PM packet", category: .session)
                return
            }
-            guard let event = try? NostrProtocol.createPrivateMessage(content: embedded, recipientPubkey: recipientHex, senderIdentity: identity) else {
-                SecureLogger.error("NostrTransport: failed to build Nostr event for geohash PM", category: .session)
-                return
-            }
-            SecureLogger.debug("NostrTransport: sending geohash PM giftWrap id=\(event.id.prefix(16))…", category: .session)
-            NostrRelayManager.registerPendingGiftWrap(id: event.id)
-            NostrRelayManager.shared.sendEvent(event)
+            sendWrappedMessage(content: embedded, recipientHex: recipientHex, senderIdentity: identity, registerPending: true)
        }
    }
 }
@@ -202,58 +249,75 @@ extension NostrTransport {
 // MARK: - Private Helpers

 extension NostrTransport {
+    /// Converts npub bech32 string to hex pubkey
+    @MainActor
+    private func npubToHex(_ npub: String) -> String? {
+        do {
+            let (hrp, data) = try Bech32.decode(npub)
+            guard hrp == "npub" else { return nil }
+            return data.hexEncodedString()
+        } catch {
+            SecureLogger.error("NostrTransport: failed to decode npub -> hex: \(error)", category: .session)
+            return nil
+        }
+    }
+
+    /// Creates and sends a gift-wrapped private message event
+    @MainActor
+    private func sendWrappedMessage(content: String, recipientHex: String, senderIdentity: NostrIdentity, registerPending: Bool = false) {
+        guard let event = try? NostrProtocol.createPrivateMessage(content: content, recipientPubkey: recipientHex, senderIdentity: senderIdentity) else {
+            SecureLogger.error("NostrTransport: failed to build Nostr event", category: .session)
+            return
+        }
+        if registerPending {
+            dependencies.registerPendingGiftWrap(event.id)
+        }
+        dependencies.sendEvent(event)
+    }
+
+    /// Must be called within a barrier on `queue`
    private func processReadQueueIfNeeded() {
        guard !isSendingReadAcks else { return }
        guard !readQueue.isEmpty else { return }
        isSendingReadAcks = true
-        sendNextReadAck()
+        let item = readQueue.removeFirst()
+        sendReadAckItem(item)
    }

-    private func sendNextReadAck() {
-        guard !readQueue.isEmpty else { isSendingReadAcks = false; return }
-        let item = readQueue.removeFirst()
+    /// Sends a single read ack item (called after extraction from queue within barrier)
+    private func sendReadAckItem(_ item: QueuedRead) {
        Task { @MainActor in
-            guard let recipientNpub = resolveRecipientNpub(for: item.peerID) else { scheduleNextReadAck(); return }
-            guard let senderIdentity = try? idBridge.getCurrentNostrIdentity() else { scheduleNextReadAck(); return }
-            SecureLogger.debug("NostrTransport: preparing READ ack for id=\(item.receipt.originalMessageID.prefix(8))… to \(recipientNpub.prefix(16))…", category: .session)
-            // Convert recipient npub -> hex
-            let recipientHex: String
-            do {
-                let (hrp, data) = try Bech32.decode(recipientNpub)
-                guard hrp == "npub" else { scheduleNextReadAck(); return }
-                recipientHex = data.hexEncodedString()
-            } catch { scheduleNextReadAck(); return }
+            defer { scheduleNextReadAck() }
+            guard let recipientNpub = resolveRecipientNpub(for: item.peerID),
+                  let recipientHex = npubToHex(recipientNpub),
+                  let senderIdentity = try? dependencies.currentIdentity() else { return }
+            SecureLogger.debug("NostrTransport: preparing READ ack id=\(item.receipt.originalMessageID.prefix(8))…", category: .session)
            guard let ack = NostrEmbeddedBitChat.encodeAckForNostr(type: .readReceipt, messageID: item.receipt.originalMessageID, recipientPeerID: item.peerID, senderPeerID: senderPeerID) else {
                SecureLogger.error("NostrTransport: failed to embed READ ack", category: .session)
-                scheduleNextReadAck(); return
+                return
            }
-            guard let event = try? NostrProtocol.createPrivateMessage(content: ack, recipientPubkey: recipientHex, senderIdentity: senderIdentity) else {
-                SecureLogger.error("NostrTransport: failed to build Nostr event for READ ack", category: .session)
-                scheduleNextReadAck(); return
-            }
-            SecureLogger.debug("NostrTransport: sending READ ack giftWrap id=\(event.id.prefix(16))…", category: .session)
-            NostrRelayManager.shared.sendEvent(event)
-            scheduleNextReadAck()
+            sendWrappedMessage(content: ack, recipientHex: recipientHex, senderIdentity: senderIdentity)
        }
    }

    private func scheduleNextReadAck() {
-        DispatchQueue.main.asyncAfter(deadline: .now() + readAckInterval) { [weak self] in
-            guard let self = self else { return }
-            self.isSendingReadAcks = false
-            self.processReadQueueIfNeeded()
+        dependencies.scheduleAfter(readAckInterval) { [weak self] in
+            self?.queue.async(flags: .barrier) { [weak self] in
+                self?.isSendingReadAcks = false
+                self?.processReadQueueIfNeeded()
+            }
        }
    }

    @MainActor
    private func resolveRecipientNpub(for peerID: PeerID) -> String? {
        if let noiseKey = Data(hexString: peerID.id),
-           let fav = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey),
+           let fav = dependencies.favoriteStatusForNoiseKey(noiseKey),
           let npub = fav.peerNostrPublicKey {
            return npub
        }
        if peerID.id.count == 16,
-           let fav = FavoritesPersistenceService.shared.getFavoriteStatus(forPeerID: peerID),
+           let fav = dependencies.favoriteStatusForPeerID(peerID),
           let npub = fav.peerNostrPublicKey {
            return npub
        }
@@ -6,6 +6,7 @@
 // For more information, see <https://unlicense.org>
 //

+import BitFoundation
 import Foundation
 import UserNotifications
 #if os(iOS)
@@ -14,13 +15,103 @@ import UIKit
 import AppKit
 #endif

+protocol NotificationAuthorizing {
+    func requestAuthorization(
+        options: UNAuthorizationOptions,
+        completionHandler: @escaping (Bool, Error?) -> Void
+    )
+}
+
+protocol NotificationRequestDelivering {
+    func add(_ request: UNNotificationRequest)
+}
+
+private final class NotificationCenterAuthorizerAdapter: NotificationAuthorizing {
+    private let center: UNUserNotificationCenter
+
+    init(center: UNUserNotificationCenter) {
+        self.center = center
+    }
+
+    func requestAuthorization(
+        options: UNAuthorizationOptions,
+        completionHandler: @escaping (Bool, Error?) -> Void
+    ) {
+        center.requestAuthorization(options: options, completionHandler: completionHandler)
+    }
+}
+
+private final class NotificationCenterRequestDelivererAdapter: NotificationRequestDelivering {
+    private let center: UNUserNotificationCenter
+
+    init(center: UNUserNotificationCenter) {
+        self.center = center
+    }
+
+    func add(_ request: UNNotificationRequest) {
+        Task {
+            try? await center.add(request)
+        }
+    }
+}
+
+private struct NoopNotificationAuthorizer: NotificationAuthorizing {
+    func requestAuthorization(
+        options: UNAuthorizationOptions,
+        completionHandler: @escaping (Bool, Error?) -> Void
+    ) {
+        completionHandler(false, nil)
+    }
+}
+
+private struct NoopNotificationRequestDeliverer: NotificationRequestDelivering {
+    func add(_ request: UNNotificationRequest) {}
+}
+
 final class NotificationService {
    static let shared = NotificationService()
-    
-    private init() {}
-    
+
+    private let isRunningTestsProvider: () -> Bool
+    private let authorizer: NotificationAuthorizing
+    private let requestDeliverer: NotificationRequestDelivering
+
+    /// Returns true if running in test environment (XCTest, Swift Testing, or CI)
+    private var isRunningTests: Bool {
+        isRunningTestsProvider()
+    }
+
+    private init() {
+        self.isRunningTestsProvider = {
+            let env = ProcessInfo.processInfo.environment
+            return NSClassFromString("XCTestCase") != nil ||
+                   env["XCTestConfigurationFilePath"] != nil ||
+                   env["XCTestBundlePath"] != nil ||
+                   env["GITHUB_ACTIONS"] != nil ||
+                   env["CI"] != nil
+        }
+        if isRunningTestsProvider() {
+            self.authorizer = NoopNotificationAuthorizer()
+            self.requestDeliverer = NoopNotificationRequestDeliverer()
+        } else {
+            let center = UNUserNotificationCenter.current()
+            self.authorizer = NotificationCenterAuthorizerAdapter(center: center)
+            self.requestDeliverer = NotificationCenterRequestDelivererAdapter(center: center)
+        }
+    }
+
+    internal init(
+        isRunningTestsProvider: @escaping () -> Bool,
+        authorizer: NotificationAuthorizing,
+        requestDeliverer: NotificationRequestDelivering
+    ) {
+        self.isRunningTestsProvider = isRunningTestsProvider
+        self.authorizer = authorizer
+        self.requestDeliverer = requestDeliverer
+    }
+
    func requestAuthorization() {
-        UNUserNotificationCenter.current().requestAuthorization(options: [.alert, .sound, .badge]) { granted, error in
+        guard !isRunningTests else { return }
+        authorizer.requestAuthorization(options: [.alert, .sound, .badge]) { granted, error in
            if granted {
                // Permission granted
            } else {
@@ -36,6 +127,7 @@ final class NotificationService {
        userInfo: [String: Any]? = nil,
        interruptionLevel: UNNotificationInterruptionLevel = .active
    ) {
+        guard !isRunningTests else { return }
        let content = UNMutableNotificationContent()
        content.title = title
        content.body = body
@@ -52,7 +144,7 @@ final class NotificationService {
            trigger: nil // Deliver immediately
        )

-        UNUserNotificationCenter.current().add(request)
+        requestDeliverer.add(request)
    }
    
    func sendMentionNotification(from sender: String, message: String) {
@@ -84,7 +176,8 @@ final class NotificationService {
    func sendNetworkAvailableNotification(peerCount: Int) {
        let title = "👥 bitchatters nearby!"
        let body = peerCount == 1 ? "1 person around" : "\(peerCount) people around"
-        let identifier = "network-available-\(Date().timeIntervalSince1970)"
+        // Fixed identifier so iOS updates the existing notification instead of creating new ones
+        let identifier = "network-available"

        sendLocalNotification(
            title: title,
@@ -62,6 +62,7 @@ struct NotificationStreamAssembler {
            let hasRecipient = (flags & BinaryProtocol.Flags.hasRecipient) != 0
            let hasSignature = (flags & BinaryProtocol.Flags.hasSignature) != 0
            let isCompressed = (flags & BinaryProtocol.Flags.isCompressed) != 0
+            let hasRoute = (version >= 2) && (flags & BinaryProtocol.Flags.hasRoute) != 0

            let lengthOffset = 12
            let payloadLength: Int
@@ -80,6 +81,15 @@ struct NotificationStreamAssembler {
            var frameLength = framePrefix + payloadLength
            if hasRecipient { frameLength += BinaryProtocol.recipientIDSize }
            if hasSignature { frameLength += BinaryProtocol.signatureSize }
+            
+            if hasRoute {
+                let routeCountOffset = framePrefix + (hasRecipient ? BinaryProtocol.recipientIDSize : 0)
+                let routeCountIndex = buffer.startIndex + routeCountOffset
+                guard buffer.count > routeCountOffset else { break }
+                let routeCount = Int(buffer[routeCountIndex])
+                frameLength += 1 + (routeCount * BinaryProtocol.senderIDSize)
+            }
+            
            if isCompressed {
                let rawLengthFieldBytes = (version == 2) ? 4 : 2
                if payloadLength < rawLengthFieldBytes {
@@ -7,6 +7,7 @@
 //

 import BitLogger
+import BitFoundation
 import Foundation
 import SwiftUI

@@ -15,20 +16,174 @@ final class PrivateChatManager: ObservableObject {
    @Published var privateChats: [PeerID: [BitchatMessage]] = [:]
    @Published var selectedPeer: PeerID? = nil
    @Published var unreadMessages: Set<PeerID> = []
-    
+
    private var selectedPeerFingerprint: String? = nil
    var sentReadReceipts: Set<String> = []  // Made accessible for ChatViewModel
-    
+
    weak var meshService: Transport?
    // Route acks/receipts via MessageRouter (chooses mesh or Nostr)
    weak var messageRouter: MessageRouter?
-    
+    // Peer service for looking up peer info during consolidation
+    weak var unifiedPeerService: UnifiedPeerService?
+
    init(meshService: Transport? = nil) {
        self.meshService = meshService
    }

    // Cap for messages stored per private chat
    private let privateChatCap = TransportConfig.privateChatCap
+
+    // MARK: - Message Consolidation
+
+    /// Consolidates messages from different peer ID representations into a single chat.
+    /// This ensures messages from stable Noise keys and temporary Nostr peer IDs are merged.
+    /// - Parameters:
+    ///   - peerID: The target peer ID to consolidate messages into
+    ///   - peerNickname: The peer's display name (lowercased for matching)
+    ///   - persistedReadReceipts: The persisted read receipts set from ChatViewModel (UserDefaults-backed)
+    /// - Returns: True if any unread messages were found during consolidation
+    @MainActor
+    func consolidateMessages(for peerID: PeerID, peerNickname: String, persistedReadReceipts: Set<String>) -> Bool {
+        guard let meshService = meshService else { return false }
+        var hasUnreadMessages = false
+
+        // 1. Consolidate from stable Noise key (64-char hex)
+        if let peer = unifiedPeerService?.getPeer(by: peerID) {
+            let noiseKeyHex = PeerID(hexData: peer.noisePublicKey)
+
+            if noiseKeyHex != peerID, let nostrMessages = privateChats[noiseKeyHex], !nostrMessages.isEmpty {
+                if privateChats[peerID] == nil {
+                    privateChats[peerID] = []
+                }
+
+                let existingMessageIds = Set(privateChats[peerID]?.map { $0.id } ?? [])
+                for message in nostrMessages {
+                    if !existingMessageIds.contains(message.id) {
+                        // Update senderPeerID for correct read receipts
+                        let updatedMessage = BitchatMessage(
+                            id: message.id,
+                            sender: message.sender,
+                            content: message.content,
+                            timestamp: message.timestamp,
+                            isRelay: message.isRelay,
+                            originalSender: message.originalSender,
+                            isPrivate: message.isPrivate,
+                            recipientNickname: message.recipientNickname,
+                            senderPeerID: message.senderPeerID == meshService.myPeerID ? meshService.myPeerID : peerID,
+                            mentions: message.mentions,
+                            deliveryStatus: message.deliveryStatus
+                        )
+                        privateChats[peerID]?.append(updatedMessage)
+
+                        // Check for recent unread messages (< 60s, not sent by us, not already read)
+                        // Use persistedReadReceipts to correctly identify already-read messages after app restart
+                        if message.senderPeerID != meshService.myPeerID {
+                            let messageAge = Date().timeIntervalSince(message.timestamp)
+                            if messageAge < 60 && !persistedReadReceipts.contains(message.id) {
+                                hasUnreadMessages = true
+                            }
+                        }
+                    }
+                }
+
+                privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
+
+                if hasUnreadMessages {
+                    unreadMessages.insert(peerID)
+                } else if unreadMessages.contains(noiseKeyHex) {
+                    unreadMessages.remove(noiseKeyHex)
+                }
+
+                privateChats.removeValue(forKey: noiseKeyHex)
+            }
+        }
+
+        // 2. Consolidate from temporary Nostr peer IDs (nostr_* prefixed)
+        let normalizedNickname = peerNickname.lowercased()
+        var tempPeerIDsToConsolidate: [PeerID] = []
+
+        for (storedPeerID, messages) in privateChats {
+            if storedPeerID.isGeoDM && storedPeerID != peerID {
+                let nicknamesMatch = messages.allSatisfy { $0.sender.lowercased() == normalizedNickname }
+                if nicknamesMatch && !messages.isEmpty {
+                    tempPeerIDsToConsolidate.append(storedPeerID)
+                }
+            }
+        }
+
+        if !tempPeerIDsToConsolidate.isEmpty {
+            if privateChats[peerID] == nil {
+                privateChats[peerID] = []
+            }
+
+            let existingMessageIds = Set(privateChats[peerID]?.map { $0.id } ?? [])
+            var consolidatedCount = 0
+            var hadUnreadTemp = false
+
+            for tempPeerID in tempPeerIDsToConsolidate {
+                if unreadMessages.contains(tempPeerID) {
+                    hadUnreadTemp = true
+                }
+
+                if let tempMessages = privateChats[tempPeerID] {
+                    for message in tempMessages {
+                        if !existingMessageIds.contains(message.id) {
+                            let updatedMessage = BitchatMessage(
+                                id: message.id,
+                                sender: message.sender,
+                                content: message.content,
+                                timestamp: message.timestamp,
+                                isRelay: message.isRelay,
+                                originalSender: message.originalSender,
+                                isPrivate: message.isPrivate,
+                                recipientNickname: message.recipientNickname,
+                                senderPeerID: peerID,
+                                mentions: message.mentions,
+                                deliveryStatus: message.deliveryStatus
+                            )
+                            privateChats[peerID]?.append(updatedMessage)
+                            consolidatedCount += 1
+                        }
+                    }
+                    privateChats.removeValue(forKey: tempPeerID)
+                    unreadMessages.remove(tempPeerID)
+                }
+            }
+
+            if hadUnreadTemp {
+                unreadMessages.insert(peerID)
+                hasUnreadMessages = true
+                SecureLogger.debug("📬 Transferred unread status from temp peer IDs to \(peerID)", category: .session)
+            }
+
+            if consolidatedCount > 0 {
+                privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
+                SecureLogger.info("📥 Consolidated \(consolidatedCount) Nostr messages from temporary peer IDs to \(peerNickname)", category: .session)
+            }
+        }
+
+        return hasUnreadMessages
+    }
+
+    /// Syncs the read receipt tracking between manager and view model for sent messages
+    @MainActor
+    func syncReadReceiptsForSentMessages(peerID: PeerID, nickname: String, externalReceipts: inout Set<String>) {
+        guard let messages = privateChats[peerID] else { return }
+
+        for message in messages {
+            if message.sender == nickname {
+                if let status = message.deliveryStatus {
+                    switch status {
+                    case .read, .delivered:
+                        externalReceipts.insert(message.id)
+                        sentReadReceipts.insert(message.id)
+                    case .failed, .partiallyDelivered, .sending, .sent:
+                        break
+                    }
+                }
+            }
+        }
+    }
    
    /// Start a private chat with a peer
    func startChat(with peerID: PeerID) {
@@ -1,3 +1,4 @@
+import BitFoundation
 import Foundation
 import Combine

@@ -58,6 +59,10 @@ protocol Transport: AnyObject {
    // QR verification (optional for transports)
    func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data)
    func sendVerifyResponse(to peerID: PeerID, noiseKeyHex: String, nonceA: Data)
+
+    // Pending file management (BCH-01-002: files held in memory until user accepts)
+    func acceptPendingFile(id: String) -> URL?
+    func declinePendingFile(id: String)
 }

 extension Transport {
@@ -70,6 +75,9 @@ extension Transport {
    func sendMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date) {
        sendMessage(content, mentions: mentions)
    }
+
+    func acceptPendingFile(id: String) -> URL? { nil }
+    func declinePendingFile(id: String) {}
 }

 protocol TransportPeerEventsDelegate: AnyObject {
@@ -21,6 +21,7 @@ enum TransportConfig {

    // Timers
    static let networkResetGraceSeconds: TimeInterval = 600 // 10 minutes
+    static let networkNotificationCooldownSeconds: TimeInterval = 300 // 5 minutes
    static let basePublicFlushInterval: TimeInterval = 0.08  // ~12.5 fps batching

    // BLE duty/announce/connect
@@ -96,11 +97,12 @@ enum TransportConfig {
    // Keep scanning fully ON when we saw traffic very recently
    static let bleRecentTrafficForceScanSeconds: TimeInterval = 10.0
    static let bleThreadSleepWriteShortDelaySeconds: TimeInterval = 0.05
-    static let bleExpectedWritePerFragmentMs: Int = 8
-    static let bleExpectedWriteMaxMs: Int = 2000
-    // Faster fragment pacing; use slightly tighter spacing for directed trains
-    static let bleFragmentSpacingMs: Int = 5
-    static let bleFragmentSpacingDirectedMs: Int = 4
+    static let bleExpectedWritePerFragmentMs: Int = 20
+    static let bleExpectedWriteMaxMs: Int = 5000
+    // Fragment pacing: Conservative spacing to prevent BLE buffer overflow
+    // Aggressive pacing causes packet loss; needs 25-30ms between fragments for reliable delivery
+    static let bleFragmentSpacingMs: Int = 30
+    static let bleFragmentSpacingDirectedMs: Int = 25
    static let bleAnnounceIntervalSeconds: TimeInterval = 4.0
    static let bleDutyOnDurationDense: TimeInterval = 3.0
    static let bleDutyOffDurationDense: TimeInterval = 15.0
@@ -162,6 +164,14 @@ enum TransportConfig {
    static let blePostAnnounceDelaySeconds: TimeInterval = 0.4
    static let bleForceAnnounceMinIntervalSeconds: TimeInterval = 0.15

+    // BCH-01-004: Rate-limiting for subscription-triggered announces
+    // Prevents rapid enumeration attacks by rate-limiting announce responses
+    static let bleSubscriptionRateLimitMinSeconds: TimeInterval = 2.0       // Minimum interval between announces per central
+    static let bleSubscriptionRateLimitBackoffFactor: Double = 2.0          // Exponential backoff multiplier
+    static let bleSubscriptionRateLimitMaxBackoffSeconds: TimeInterval = 30.0  // Maximum backoff period
+    static let bleSubscriptionRateLimitWindowSeconds: TimeInterval = 60.0   // Window for tracking subscription attempts
+    static let bleSubscriptionRateLimitMaxAttempts: Int = 5                 // Max attempts before extended cooldown
+
    // Store-and-forward for directed packets at relays
    static let bleDirectedSpoolWindowSeconds: TimeInterval = 15.0

@@ -203,4 +213,18 @@ enum TransportConfig {
    static let uiShareExtensionDismissDelaySeconds: TimeInterval = 2.0
    static let uiShareAcceptWindowSeconds: TimeInterval = 30.0
    static let uiMigrationCutoffSeconds: TimeInterval = 24 * 60 * 60
+
+    // Gossip Sync Configuration
+    static let syncSeenCapacity: Int = 1000
+    static let syncGCSMaxBytes: Int = 400
+    static let syncGCSTargetFpr: Double = 0.01
+    static let syncMaxMessageAgeSeconds: TimeInterval = 900
+    static let syncMaintenanceIntervalSeconds: TimeInterval = 30.0
+    static let syncStalePeerCleanupIntervalSeconds: TimeInterval = 60.0
+    static let syncStalePeerTimeoutSeconds: TimeInterval = 60.0
+    static let syncFragmentCapacity: Int = 600
+    static let syncFileTransferCapacity: Int = 200
+    static let syncFragmentIntervalSeconds: TimeInterval = 30.0
+    static let syncFileTransferIntervalSeconds: TimeInterval = 60.0
+    static let syncMessageIntervalSeconds: TimeInterval = 15.0
 }
@@ -7,6 +7,8 @@
 //

 import BitLogger
+import BitFoundation
+import Nostr
 import Foundation
 import Combine
 import SwiftUI
@@ -1,4 +1,6 @@
 import Foundation
+import BitLogger
+import BitFoundation

 // Gossip-based sync manager using on-demand GCS filters
 final class GossipSyncManager {
@@ -6,6 +8,7 @@ final class GossipSyncManager {
        func sendPacket(_ packet: BitchatPacket)
        func sendPacket(to peerID: PeerID, packet: BitchatPacket)
        func signPacketForBroadcast(_ packet: BitchatPacket) -> BitchatPacket
+        func getConnectedPeers() -> [PeerID]
    }

    private struct PacketStore {
@@ -74,6 +77,7 @@ final class GossipSyncManager {

    private let myPeerID: PeerID
    private let config: Config
+    private let requestSyncManager: RequestSyncManager
    weak var delegate: Delegate?

    // Storage: broadcast packets by type, and latest announce per sender
@@ -88,9 +92,10 @@ final class GossipSyncManager {
    private var lastStalePeerCleanup: Date = .distantPast
    private var syncSchedules: [SyncSchedule] = []

-    init(myPeerID: PeerID, config: Config = Config()) {
+    init(myPeerID: PeerID, config: Config = Config(), requestSyncManager: RequestSyncManager) {
        self.myPeerID = myPeerID
        self.config = config
+        self.requestSyncManager = requestSyncManager
        var schedules: [SyncSchedule] = []
        if config.seenCapacity > 0 && config.messageSyncIntervalSeconds > 0 {
            schedules.append(SyncSchedule(types: .publicMessages, interval: config.messageSyncIntervalSeconds, lastSent: .distantPast))
@@ -202,6 +207,19 @@ final class GossipSyncManager {
        }
    }

+    private func sendPeriodicSync(for types: SyncTypeFlags) {
+        // Unicast sync to connected peers to allow RSR attribution
+        if let connectedPeers = delegate?.getConnectedPeers(), !connectedPeers.isEmpty {
+            SecureLogger.debug("Sending periodic sync to \(connectedPeers.count) connected peers", category: .sync)
+            for peerID in connectedPeers {
+                sendRequestSync(to: peerID, types: types)
+            }
+        } else {
+            // Fallback to broadcast (discovery phase)
+            sendRequestSync(for: types)
+        }
+    }
+
    private func sendRequestSync(for types: SyncTypeFlags) {
        let payload = buildGcsPayload(for: types)
        let pkt = BitchatPacket(
@@ -218,6 +236,9 @@ final class GossipSyncManager {
    }

    private func sendRequestSync(to peerID: PeerID, types: SyncTypeFlags) {
+        // Register the request for RSR validation
+        requestSyncManager.registerRequest(to: peerID)
+        
        let payload = buildGcsPayload(for: types)
        var recipient = Data()
        var temp = peerID.id
@@ -262,6 +283,7 @@ final class GossipSyncManager {
                if !mightContain(idBytes) {
                    var toSend = pkt
                    toSend.ttl = 0
+                    toSend.isRSR = true // Mark as solicited response
                    delegate?.sendPacket(to: peerID, packet: toSend)
                }
            }
@@ -274,6 +296,7 @@ final class GossipSyncManager {
                if !mightContain(idBytes) {
                    var toSend = pkt
                    toSend.ttl = 0
+                    toSend.isRSR = true // Mark as solicited response
                    delegate?.sendPacket(to: peerID, packet: toSend)
                }
            }
@@ -286,6 +309,7 @@ final class GossipSyncManager {
                if !mightContain(idBytes) {
                    var toSend = pkt
                    toSend.ttl = 0
+                    toSend.isRSR = true // Mark as solicited response
                    delegate?.sendPacket(to: peerID, packet: toSend)
                }
            }
@@ -298,6 +322,7 @@ final class GossipSyncManager {
                if !mightContain(idBytes) {
                    var toSend = pkt
                    toSend.ttl = 0
+                    toSend.isRSR = true // Mark as solicited response
                    delegate?.sendPacket(to: peerID, packet: toSend)
                }
            }
@@ -366,11 +391,13 @@ final class GossipSyncManager {
    private func performPeriodicMaintenance(now: Date = Date()) {
        cleanupExpiredMessages()
        cleanupStaleAnnouncementsIfNeeded(now: now)
+        requestSyncManager.cleanup() // Cleanup expired sync requests
+        
        for index in syncSchedules.indices {
            guard syncSchedules[index].interval > 0 else { continue }
            if syncSchedules[index].lastSent == .distantPast || now.timeIntervalSince(syncSchedules[index].lastSent) >= syncSchedules[index].interval {
                syncSchedules[index].lastSent = now
-                sendRequestSync(for: syncSchedules[index].types)
+                sendPeriodicSync(for: syncSchedules[index].types)
            }
        }
    }
@@ -0,0 +1,86 @@
+//
+// RequestSyncManager.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import Foundation
+import BitLogger
+import BitFoundation
+
+/// Manages outgoing sync requests and validates incoming responses.
+///
+/// Allows attributing RSR (Request-Sync Response) packets to specific peers
+/// that we have actively requested sync from.
+final class RequestSyncManager {
+    
+    private let queue = DispatchQueue(label: "request.sync.manager", attributes: .concurrent)
+    private var pendingRequests: [PeerID: TimeInterval] = [:]
+    private let responseWindow: TimeInterval
+    private let now: () -> TimeInterval
+    
+    init(
+        responseWindow: TimeInterval = 30.0,
+        now: @escaping () -> TimeInterval = { Date().timeIntervalSince1970 }
+    ) {
+        self.responseWindow = responseWindow
+        self.now = now
+    }
+    
+    /// Register that we are sending a sync request to a peer.
+    /// - Parameter peerID: The peer we are requesting sync from
+    func registerRequest(to peerID: PeerID) {
+        let now = self.now()
+        queue.async(flags: .barrier) {
+            SecureLogger.debug("Registering sync request to \(peerID.id.prefix(8))…", category: .sync)
+            self.pendingRequests[peerID] = now
+        }
+    }
+    
+    /// Check if a packet from a peer is a valid response to a sync request.
+    ///
+    /// - Parameters:
+    ///   - peerID: The sender of the packet
+    ///   - isRSR: Whether the packet is marked as a Request-Sync Response
+    /// - Returns: true if we have a pending request for this peer and the window is open
+    func isValidResponse(from peerID: PeerID, isRSR: Bool) -> Bool {
+        guard isRSR else { return false }
+        
+        return queue.sync {
+            guard let requestTime = pendingRequests[peerID] else {
+                SecureLogger.warning("Received unsolicited RSR packet from \(peerID.id.prefix(8))…", category: .security)
+                return false
+            }
+            
+            let now = self.now()
+            if now - requestTime > responseWindow {
+                SecureLogger.warning("Received RSR packet from \(peerID.id.prefix(8))… outside of response window", category: .security)
+                // We don't remove here because we might receive multiple packets for one request
+                return false
+            }
+            
+            return true
+        }
+    }
+    
+    /// Periodic cleanup of expired requests
+    func cleanup() {
+        let now = self.now()
+        queue.async(flags: .barrier) {
+            let originalCount = self.pendingRequests.count
+            self.pendingRequests = self.pendingRequests.filter { _, timestamp in
+                now - timestamp <= self.responseWindow
+            }
+            let removed = originalCount - self.pendingRequests.count
+            if removed > 0 {
+                SecureLogger.debug("Cleaned up \(removed) expired sync requests", category: .sync)
+            }
+        }
+    }
+
+    var debugPendingRequestCount: Int {
+        queue.sync { pendingRequests.count }
+    }
+}
@@ -1,22 +0,0 @@
-//
-//  Data+SHA256.swift
-//  bitchat
-//
-//  Created by Islam on 26/09/2025.
-//
-
-import struct Foundation.Data
-import struct CryptoKit.SHA256
-
-extension Data {
-    /// Returns the hex representation of SHA256 hash
-    func sha256Fingerprint() -> String {
-        // Implementation matches existing fingerprint generation in NoiseEncryptionService
-        sha256Hash().hexEncodedString()
-    }
-    
-    /// Returns the SHA256 hash wrapped in Data
-    func sha256Hash() -> Data {
-        Data(SHA256.hash(data: self))
-    }
-}
@@ -21,9 +21,7 @@ struct InputValidator {
    /// Rejects strings containing control characters to prevent potential security issues
    /// and UI rendering problems. This strict approach ensures data integrity at input time.
    static func validateUserString(_ string: String, maxLength: Int) -> String? {
-        let trimmed = string.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !trimmed.isEmpty else { return nil }
-        guard trimmed.count <= maxLength else { return nil }
+        guard let trimmed = string.trimmedOrNilIfEmpty, trimmed.count <= maxLength else { return nil }

        // Reject control characters outright instead of rewriting the string.
        // This prevents injection attacks and ensures consistent UI rendering.
@@ -52,11 +50,13 @@ struct InputValidator {
    // MessageType/NoisePayloadType enums; keeping validator free of stale lists.

    /// Validates timestamp is reasonable (not too far in past or future)
+    /// BCH-01-011: Reduced from ±1 hour to ±5 minutes to limit replay attack window
    static func validateTimestamp(_ timestamp: Date) -> Bool {
        let now = Date()
-        let oneHourAgo = now.addingTimeInterval(-3600)
-        let oneHourFromNow = now.addingTimeInterval(3600)
-        return timestamp >= oneHourAgo && timestamp <= oneHourFromNow
+        // 5 minutes = 300 seconds (industry standard for replay protection)
+        let fiveMinutesAgo = now.addingTimeInterval(-300)
+        let fiveMinutesFromNow = now.addingTimeInterval(300)
+        return timestamp >= fiveMinutesAgo && timestamp <= fiveMinutesFromNow
    }

 }
@@ -2,66 +2,112 @@ import Foundation

 // MARK: - Message Deduplicator (shared)

+/// Thread-safe deduplicator with LRU eviction and time-based expiry.
+/// Used for both message ID deduplication (network layer) and content key deduplication (UI layer).
 final class MessageDeduplicator {
-    private struct Entry {
-        let messageID: String
+    private struct Entry: Equatable {
+        let id: String
        let timestamp: Date
    }

    private var entries: [Entry] = []
    private var head: Int = 0
-    private var lookup = Set<String>()
+    private var lookup: [String: Date] = [:]  // id -> timestamp for O(1) lookup
    private let lock = NSLock()
-    private let maxAge: TimeInterval = TransportConfig.messageDedupMaxAgeSeconds  // 5 minutes
-    private let maxCount = TransportConfig.messageDedupMaxCount
+    private let maxAge: TimeInterval
+    private let maxCount: Int

-    /// Check if message is duplicate and add if not
-    func isDuplicate(_ messageID: String) -> Bool {
+    /// Initialize with default config from TransportConfig
+    convenience init() {
+        self.init(
+            maxAge: TransportConfig.messageDedupMaxAgeSeconds,
+            maxCount: TransportConfig.messageDedupMaxCount
+        )
+    }
+
+    /// Initialize with custom config for content deduplication
+    init(maxAge: TimeInterval, maxCount: Int) {
+        self.maxAge = maxAge
+        self.maxCount = maxCount
+    }
+
+    /// Check if message is duplicate and add if not.
+    /// - Parameter id: The message identifier to check.
+    /// - Returns: `true` if the message was already seen, `false` otherwise.
+    func isDuplicate(_ id: String) -> Bool {
        lock.lock()
        defer { lock.unlock() }

-        cleanupOldEntries()
+        let now = Date()
+        cleanupOldEntries(before: now.addingTimeInterval(-maxAge))

-        if lookup.contains(messageID) {
+        if lookup[id] != nil {
            return true
        }

-        entries.append(Entry(messageID: messageID, timestamp: Date()))
-        lookup.insert(messageID)
-
-        // Soft-cap and advance head by a chunk to avoid O(n) shifting
-        if (entries.count - head) > maxCount {
-            let removeCount = min(100, entries.count - head)
-            for i in head..<(head + removeCount) {
-                lookup.remove(entries[i].messageID)
-            }
-            head += removeCount
-            // Periodically compact to reclaim memory
-            if head > entries.count / 2 {
-                entries.removeFirst(head)
-                head = 0
-            }
-        }
+        entries.append(Entry(id: id, timestamp: now))
+        lookup[id] = now
+        trimIfNeeded()

        return false
    }

-    /// Add an ID without checking (for announce-back tracking)
-    func markProcessed(_ messageID: String) {
+    /// Record an ID with a specific timestamp (for content key tracking)
+    func record(_ id: String, timestamp: Date) {
        lock.lock()
        defer { lock.unlock() }

-        if !lookup.contains(messageID) {
-            entries.append(Entry(messageID: messageID, timestamp: Date()))
-            lookup.insert(messageID)
+        if lookup[id] == nil {
+            entries.append(Entry(id: id, timestamp: timestamp))
+        }
+        lookup[id] = timestamp
+        trimIfNeeded()
+    }
+
+    /// Add an ID without checking (for announce-back tracking)
+    func markProcessed(_ id: String) {
+        lock.lock()
+        defer { lock.unlock() }
+
+        if lookup[id] == nil {
+            let now = Date()
+            entries.append(Entry(id: id, timestamp: now))
+            lookup[id] = now
        }
    }

    /// Check if ID exists without adding
-    func contains(_ messageID: String) -> Bool {
+    func contains(_ id: String) -> Bool {
        lock.lock()
        defer { lock.unlock() }
-        return lookup.contains(messageID)
+        return lookup[id] != nil
+    }
+
+    /// Get timestamp for an ID (for content deduplication time-window checks)
+    func timestampFor(_ id: String) -> Date? {
+        lock.lock()
+        defer { lock.unlock() }
+        return lookup[id]
+    }
+
+    private func trimIfNeeded() {
+        let activeCount = entries.count - head
+        guard activeCount > maxCount else { return }
+
+        // Remove down to 75% of maxCount for better amortization
+        let targetCount = (maxCount * 3) / 4
+        let removeCount = activeCount - targetCount
+
+        for i in head..<(head + removeCount) {
+            lookup.removeValue(forKey: entries[i].id)
+        }
+        head += removeCount
+
+        // Compact when head exceeds half the array to reclaim memory
+        if head > entries.count / 2 {
+            entries.removeFirst(head)
+            head = 0
+        }
    }

    /// Clear all entries
@@ -74,24 +120,25 @@ final class MessageDeduplicator {
        lookup.removeAll()
    }

-    /// Periodic cleanup
+    /// Periodic cleanup of expired entries and memory optimization.
    func cleanup() {
        lock.lock()
        defer { lock.unlock() }

-        cleanupOldEntries()
+        cleanupOldEntries(before: Date().addingTimeInterval(-maxAge))

-        if entries.capacity > maxCount * 2 {
+        // Shrink capacity if significantly oversized
+        if entries.capacity > maxCount * 2 && entries.count < maxCount {
            entries.reserveCapacity(maxCount)
        }
    }

-    private func cleanupOldEntries() {
-        let cutoff = Date().addingTimeInterval(-maxAge)
+    private func cleanupOldEntries(before cutoff: Date) {
        while head < entries.count, entries[head].timestamp < cutoff {
-            lookup.remove(entries[head].messageID)
+            lookup.removeValue(forKey: entries[head].id)
            head += 1
        }
+        // Compact when head exceeds half the array
        if head > 0 && head > entries.count / 2 {
            entries.removeFirst(head)
            head = 0
@@ -1,4 +1,5 @@
 import Foundation
+import BitFoundation

 /// Resolves a stable display name for peers, adding a short suffix when collisions exist.
 struct PeerDisplayNameResolver {
@@ -0,0 +1,44 @@
+//
+// SystemSettings.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+#if os(iOS)
+import UIKit
+#elseif os(macOS)
+import AppKit
+#endif
+
+enum SystemSettings {
+    case bluetooth
+    case location
+    case microphone
+
+    #if os(macOS)
+    private static let baseURL = "x-apple.systempreferences:com.apple.preference.security"
+
+    private var macPrivacyAnchor: String {
+        switch self {
+        case .bluetooth: "Privacy_Bluetooth"
+        case .location: "Privacy_LocationServices"
+        case .microphone: "Privacy_Microphone"
+        }
+    }
+    #endif
+
+    func open() {
+        #if os(iOS)
+        if let url = URL(string: UIApplication.openSettingsURLString) {
+            UIApplication.shared.open(url)
+        }
+        #elseif os(macOS)
+        let urlString = "\(Self.baseURL)?\(macPrivacyAnchor)"
+        if let url = URL(string: urlString) {
+            NSWorkspace.shared.open(url)
+        }
+        #endif
+    }
+}
@@ -0,0 +1,851 @@
+//
+// ChatViewModel+Nostr.swift
+// bitchat
+//
+// Geohash and Nostr logic for ChatViewModel
+//
+
+import Nostr
+import Foundation
+import Combine
+import BitLogger
+import BitFoundation
+import SwiftUI
+import Tor
+
+extension ChatViewModel {
+
+    // MARK: - Geohash Subscription
+
+    // Resubscribe to the active geohash channel without clearing timeline
+    @MainActor
+    func resubscribeCurrentGeohash() {
+        guard case .location(let ch) = activeChannel else { return }
+        guard let subID = geoSubscriptionID else {
+            // No existing subscription; set it up
+            switchLocationChannel(to: activeChannel)
+            return
+        }
+        // Ensure participant decay timer is running
+        participantTracker.startRefreshTimer()
+        // Unsubscribe + resubscribe
+        NostrRelayManager.shared.unsubscribe(id: subID)
+        let filter = NostrFilter.geohashEphemeral(
+            ch.geohash,
+            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds),
+            limit: TransportConfig.nostrGeohashInitialLimit
+        )
+        let subRelays = GeoRelayDirectory.shared.closestRelays(
+            toGeohash: ch.geohash,
+            count: TransportConfig.nostrGeoRelayCount
+        )
+        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
+            self?.subscribeNostrEvent(event)
+        }
+        // Resubscribe geohash DMs for this identity
+        if let dmSub = geoDmSubscriptionID {
+            NostrRelayManager.shared.unsubscribe(id: dmSub); geoDmSubscriptionID = nil
+        }
+        
+        if let id = try? idBridge.deriveIdentity(forGeohash: ch.geohash) {
+            let dmSub = "geo-dm-\(ch.geohash)"
+            geoDmSubscriptionID = dmSub
+            let dmFilter = NostrFilter.giftWrapsFor(pubkey: id.publicKeyHex, since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds))
+            NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
+                self?.subscribeGiftWrap(giftWrap, id: id)
+            }
+        }
+    }
+    
+    func subscribeNostrEvent(_ event: NostrEvent) {
+        guard event.isValidSignature() else { return }
+        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue || 
+               event.kind == NostrProtocol.EventKind.geohashPresence.rawValue),
+              !deduplicationService.hasProcessedNostrEvent(event.id)
+        else {
+            return
+        }
+
+        deduplicationService.recordNostrEvent(event.id)
+        
+        if let gh = currentGeohash,
+           let myGeoIdentity = try? idBridge.deriveIdentity(forGeohash: gh),
+           myGeoIdentity.publicKeyHex.lowercased() == event.pubkey.lowercased() {
+            // Skip very recent self-echo from relay, but allow older events (e.g., after app restart)
+            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+            if Date().timeIntervalSince(eventTime) < 15 {
+                return
+            }
+        }
+        
+        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
+            let nick = nickTag[1].trimmed
+            geoNicknames[event.pubkey.lowercased()] = nick
+        }
+        
+        // Store mapping for geohash sender IDs used in messages (ensures consistent colors)
+        nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
+        nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
+
+        // Update participants last-seen for this pubkey
+        participantTracker.recordParticipant(pubkeyHex: event.pubkey)
+        
+        // If presence heartbeat (Kind 20001), stop here - no content to display
+        if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
+            return
+        }
+        
+        // Track teleported tag (only our format ["t","teleport"]) for icon state
+        let hasTeleportTag = event.tags.contains(where: { tag in
+            tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
+        })
+        
+        if hasTeleportTag {
+            let key = event.pubkey.lowercased()
+            // Do not mark our own key from historical events; rely on manager.teleported for self
+            let isSelf: Bool = {
+                if let gh = currentGeohash, let my = try? idBridge.deriveIdentity(forGeohash: gh) {
+                    return my.publicKeyHex.lowercased() == key
+                }
+                return false
+            }()
+            if !isSelf {
+                Task { @MainActor in
+                    teleportedGeo = teleportedGeo.union([key])
+                }
+            }
+        }
+        
+        let senderName = displayNameForNostrPubkey(event.pubkey)
+        let content = event.content.trimmed
+
+        // Clamp future timestamps to now to avoid future-dated messages skewing order
+        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+        let timestamp = min(rawTs, Date())
+        let mentions = parseMentions(from: content)
+        let msg = BitchatMessage(
+            id: event.id,
+            sender: senderName,
+            content: content,
+            timestamp: timestamp,
+            isRelay: false,
+            senderPeerID: PeerID(nostr: event.pubkey),
+            mentions: mentions.isEmpty ? nil : mentions
+        )
+        Task { @MainActor in
+            // BCH-01-012: Check blocking before any notifications
+            // handlePublicMessage has its own blocking check but returns silently,
+            // so we must also guard checkForMentions to prevent notification bypass
+            let isBlocked = identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased())
+
+            handlePublicMessage(msg)
+
+            // Only check mentions and send haptic if sender is not blocked
+            if !isBlocked {
+                checkForMentions(msg)
+                sendHapticFeedback(for: msg)
+            }
+        }
+    }
+
+    func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
+        guard giftWrap.isValidSignature() else { return }
+        guard !deduplicationService.hasProcessedNostrEvent(giftWrap.id) else { return }
+        deduplicationService.recordNostrEvent(giftWrap.id)
+        
+        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(giftWrap: giftWrap, recipientIdentity: id),
+              let packet = Self.decodeEmbeddedBitChatPacket(from: content),
+              packet.type == MessageType.noiseEncrypted.rawValue,
+              let noisePayload = NoisePayload.decode(packet.payload)
+        else {
+            return
+        }
+        
+        let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
+        let convKey = PeerID(nostr_: senderPubkey)
+        nostrKeyMapping[convKey] = senderPubkey
+        
+        switch noisePayload.type {
+        case .privateMessage:
+            handlePrivateMessage(noisePayload, senderPubkey: senderPubkey, convKey: convKey, id: id, messageTimestamp: messageTimestamp)
+        case .delivered:
+            handleDelivered(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
+        case .readReceipt:
+            handleReadReceipt(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
+        case .verifyChallenge, .verifyResponse:
+            // QR verification payloads over Nostr are not supported; ignore in geohash DMs
+            break
+        }
+    }
+
+    // MARK: - Geohash Channel Handling
+
+    @MainActor
+    func switchLocationChannel(to channel: ChannelID) {
+        // Reset pending public batches to avoid cross-channel bleed
+        publicMessagePipeline.reset()
+        
+        activeChannel = channel
+        publicMessagePipeline.updateActiveChannel(channel)
+        
+        // Reset deduplication set and optionally hydrate timeline for mesh
+        deduplicationService.clearNostrCaches()
+        switch channel {
+        case .mesh:
+            refreshVisibleMessages(from: .mesh)
+            // Debug: log if any empty messages are present
+            let emptyMesh = messages.filter { $0.content.trimmed.isEmpty }.count
+            if emptyMesh > 0 {
+                SecureLogger.debug("RenderGuard: mesh timeline contains \(emptyMesh) empty messages", category: .session)
+            }
+            participantTracker.stopRefreshTimer()
+            participantTracker.setActiveGeohash(nil)
+            teleportedGeo.removeAll()
+        case .location:
+            refreshVisibleMessages(from: channel)
+        }
+        // If switching to a location channel, flush any pending geohash-only system messages
+        if case .location = channel {
+            for content in timelineStore.drainPendingGeohashSystemMessages() {
+                addPublicSystemMessage(content)
+            }
+        }
+        // Unsubscribe previous
+        if let sub = geoSubscriptionID {
+            NostrRelayManager.shared.unsubscribe(id: sub)
+            geoSubscriptionID = nil
+        }
+        if let dmSub = geoDmSubscriptionID {
+            NostrRelayManager.shared.unsubscribe(id: dmSub)
+            geoDmSubscriptionID = nil
+        }
+        currentGeohash = nil
+        participantTracker.setActiveGeohash(nil)
+        // Reset nickname cache for geochat participants
+        geoNicknames.removeAll()
+
+        guard case .location(let ch) = channel else { return }
+        currentGeohash = ch.geohash
+        participantTracker.setActiveGeohash(ch.geohash)
+        
+        // Ensure self appears immediately in the people list; mark teleported state only when truly teleported
+        if let id = try? idBridge.deriveIdentity(forGeohash: ch.geohash) {
+            participantTracker.recordParticipant(pubkeyHex: id.publicKeyHex)
+            let hasRegional = !LocationChannelManager.shared.availableChannels.isEmpty
+            let inRegional = LocationChannelManager.shared.availableChannels.contains { $0.geohash == ch.geohash }
+            let key = id.publicKeyHex.lowercased()
+            if LocationChannelManager.shared.teleported && hasRegional && !inRegional {
+                teleportedGeo = teleportedGeo.union([key])
+                SecureLogger.info("GeoTeleport: channel switch mark self teleported key=\(key.prefix(8))… total=\(teleportedGeo.count)", category: .session)
+            } else {
+                teleportedGeo.remove(key)
+            }
+        }
+        
+        let subID = "geo-\(ch.geohash)"
+        geoSubscriptionID = subID
+        participantTracker.startRefreshTimer()
+        let ts = Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds)
+        let filter = NostrFilter.geohashEphemeral(ch.geohash, since: ts, limit: TransportConfig.nostrGeohashInitialLimit)
+        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: ch.geohash, count: 5)
+        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
+            self?.handleNostrEvent(event)
+        }
+
+        subscribeToGeoChat(ch)
+    }
+    
+    func handleNostrEvent(_ event: NostrEvent) {
+        guard event.isValidSignature() else { return }
+        // Only handle ephemeral kind 20000 or presence kind 20001 with matching tag
+        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue ||
+               event.kind == NostrProtocol.EventKind.geohashPresence.rawValue) else { return }
+        
+        // Deduplicate
+        if deduplicationService.hasProcessedNostrEvent(event.id) { return }
+        deduplicationService.recordNostrEvent(event.id)
+        
+        // Log incoming tags for diagnostics
+        let tagSummary = event.tags.map { "[" + $0.joined(separator: ",") + "]" }.joined(separator: ",")
+        SecureLogger.debug("GeoTeleport: recv pub=\(event.pubkey.prefix(8))… tags=\(tagSummary)", category: .session)
+        
+        // If this pubkey is blocked, skip mapping, participants, and timeline
+        if identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
+            return
+        }
+        
+        // Track teleport tag for participants – only our format ["t", "teleport"]
+        let hasTeleportTag: Bool = event.tags.contains { tag in
+            tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
+        }
+        
+        let isSelf: Bool = {
+            if let gh = currentGeohash, let my = try? idBridge.deriveIdentity(forGeohash: gh) {
+                return my.publicKeyHex.lowercased() == event.pubkey.lowercased()
+            }
+            return false
+        }()
+
+        if hasTeleportTag {
+            // Avoid marking our own key from historical events; rely on manager.teleported for self
+            if !isSelf {
+                let key = event.pubkey.lowercased()
+                Task { @MainActor in
+                    teleportedGeo = teleportedGeo.union([key])
+                    SecureLogger.info("GeoTeleport: mark peer teleported key=\(key.prefix(8))… total=\(teleportedGeo.count)", category: .session)
+                }
+            }
+        }
+        
+        // Update participants last-seen for this pubkey
+        participantTracker.recordParticipant(pubkeyHex: event.pubkey)
+
+        // Skip only very recent self-echo from relay; include older self events for hydration
+        if isSelf {
+            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+            if Date().timeIntervalSince(eventTime) < 15 {
+                return
+            }
+        }
+        
+        // Cache nickname from tag if present
+        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
+            geoNicknames[event.pubkey.lowercased()] = nickTag[1].trimmed
+        }
+        
+        // Store mapping for geohash DM initiation
+        nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
+        nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
+        
+        // If presence heartbeat (Kind 20001), stop here - no content to display
+        if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
+            return
+        }
+        
+        let senderName = displayNameForNostrPubkey(event.pubkey)
+        let content = event.content
+        
+        // If this is a teleport presence event (no content), don't add to timeline
+        if let teleTag = event.tags.first(where: { $0.first == "t" }),
+           teleTag.count >= 2,
+           teleTag[1] == "teleport",
+           content.trimmed.isEmpty {
+            return
+        }
+        
+        // Clamp future timestamps
+        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+        let mentions = parseMentions(from: content)
+        let msg = BitchatMessage(
+            id: event.id,
+            sender: senderName,
+            content: content,
+            timestamp: min(rawTs, Date()),
+            isRelay: false,
+            senderPeerID: PeerID(nostr: event.pubkey),
+            mentions: mentions.isEmpty ? nil : mentions
+        )
+        
+        Task { @MainActor in
+            handlePublicMessage(msg)
+            checkForMentions(msg)
+            sendHapticFeedback(for: msg)
+        }
+    }
+    
+    @MainActor
+    func subscribeToGeoChat(_ ch: GeohashChannel) {
+        guard let id = try? idBridge.deriveIdentity(forGeohash: ch.geohash) else { return }
+        
+        let dmSub = "geo-dm-\(ch.geohash)"
+        geoDmSubscriptionID = dmSub
+        // pared back logging: subscribe debug only
+        // Log GeoDM subscribe only when Tor is ready to avoid early noise
+        if TorManager.shared.isReady {
+            SecureLogger.debug("GeoDM: subscribing DMs pub=\(id.publicKeyHex.prefix(8))… sub=\(dmSub)", category: .session)
+        }
+        let dmFilter = NostrFilter.giftWrapsFor(pubkey: id.publicKeyHex, since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds))
+        NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
+            self?.handleGiftWrap(giftWrap, id: id)
+        }
+    }
+    
+    func handleGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
+        guard giftWrap.isValidSignature() else { return }
+        if deduplicationService.hasProcessedNostrEvent(giftWrap.id) {
+            return
+        }
+        deduplicationService.recordNostrEvent(giftWrap.id)
+        
+        // Decrypt with per-geohash identity
+        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(giftWrap: giftWrap, recipientIdentity: id) else {
+            SecureLogger.warning("GeoDM: failed decrypt giftWrap id=\(giftWrap.id.prefix(8))…", category: .session)
+            return
+        }
+        
+        SecureLogger.debug("GeoDM: decrypted gift-wrap id=\(giftWrap.id.prefix(16))... from=\(senderPubkey.prefix(8))...", category: .session)
+        
+        guard let packet = Self.decodeEmbeddedBitChatPacket(from: content),
+              packet.type == MessageType.noiseEncrypted.rawValue,
+              let payload = NoisePayload.decode(packet.payload)
+        else {
+            return
+        }
+        
+        let convKey = PeerID(nostr_: senderPubkey)
+        nostrKeyMapping[convKey] = senderPubkey
+        
+        switch payload.type {
+        case .privateMessage:
+            let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
+            handlePrivateMessage(payload, senderPubkey: senderPubkey, convKey: convKey, id: id, messageTimestamp: messageTimestamp)
+        case .delivered:
+            handleDelivered(payload, senderPubkey: senderPubkey, convKey: convKey)
+        case .readReceipt:
+            handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: convKey)
+        
+        // Explicitly list other cases so we get compile-time check if a new case is added in the future
+        case .verifyChallenge, .verifyResponse:
+            break
+        }
+    }
+
+    @MainActor
+    func sendGeohash(context: GeoOutgoingContext) {
+        let ch = context.channel
+        let event = context.event
+        let identity = context.identity
+
+        let targetRelays = GeoRelayDirectory.shared.closestRelays(
+            toGeohash: ch.geohash,
+            count: TransportConfig.nostrGeoRelayCount
+        )
+
+        if targetRelays.isEmpty {
+            SecureLogger.warning("Geo: no geohash relays available for \(ch.geohash); not sending", category: .session)
+        } else {
+            NostrRelayManager.shared.sendEvent(event, to: targetRelays)
+        }
+
+        // Track ourselves as active participant
+        participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
+        nostrKeyMapping[PeerID(nostr: identity.publicKeyHex)] = identity.publicKeyHex
+        SecureLogger.debug("GeoTeleport: sent geo message pub=\(identity.publicKeyHex.prefix(8))… teleported=\(context.teleported)", category: .session)
+
+        // If we tagged this as teleported, also mark our pubkey in teleportedGeo for UI
+        // Only when not in our regional set (and regional list is known)
+        let hasRegional = !LocationChannelManager.shared.availableChannels.isEmpty
+        let inRegional = LocationChannelManager.shared.availableChannels.contains { $0.geohash == ch.geohash }
+
+        if context.teleported && hasRegional && !inRegional {
+            let key = identity.publicKeyHex.lowercased()
+            teleportedGeo = teleportedGeo.union([key])
+            SecureLogger.info("GeoTeleport: mark self teleported key=\(key.prefix(8))… total=\(teleportedGeo.count)", category: .session)
+        }
+
+        deduplicationService.recordNostrEvent(event.id)
+    }
+
+    // MARK: - Sampling
+
+    /// Begin sampling multiple geohashes (used by channel sheet) without changing active channel.
+    @MainActor
+    func beginGeohashSampling(for geohashes: [String]) {
+        // Disable sampling when app is backgrounded (Tor is stopped there)
+        if !TorManager.shared.isForeground() {
+            endGeohashSampling()
+            return
+        }
+        // Determine which to add and which to remove
+        let desired = Set(geohashes)
+        let current = Set(geoSamplingSubs.values)
+        let toAdd = desired.subtracting(current)
+        let toRemove = current.subtracting(desired)
+
+        for (subID, gh) in geoSamplingSubs where toRemove.contains(gh) {
+            NostrRelayManager.shared.unsubscribe(id: subID)
+            geoSamplingSubs.removeValue(forKey: subID)
+        }
+
+        for gh in toAdd {
+            subscribe(gh)
+        }
+    }
+    
+    @MainActor
+    func subscribe(_ gh: String) {
+        let subID = "geo-sample-\(gh)"
+        geoSamplingSubs[subID] = gh
+        let filter = NostrFilter.geohashEphemeral(
+            gh,
+            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashSampleLookbackSeconds),
+            limit: TransportConfig.nostrGeohashSampleLimit
+        )
+        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: gh, count: 5)
+        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
+            self?.subscribeNostrEvent(event, gh: gh)
+        }
+    }
+    
+    func subscribeNostrEvent(_ event: NostrEvent, gh: String) {
+        guard event.isValidSignature() else { return }
+        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue ||
+               event.kind == NostrProtocol.EventKind.geohashPresence.rawValue) else { return }
+
+        // Compute current participant count (5-minute window) BEFORE updating with this event
+        let existingCount = participantTracker.participantCount(for: gh)
+
+        // Update participants for this specific geohash
+        participantTracker.recordParticipant(pubkeyHex: event.pubkey, geohash: gh)
+        
+        // Notify only on rising-edge: previously zero people, now someone sends a chat
+        guard let content = event.content.trimmedOrNilIfEmpty else { return }
+
+        // Respect geohash blocks
+        if identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased()) { return }
+        
+        // Skip self identity for this geohash
+        if let my = try? idBridge.deriveIdentity(forGeohash: gh), my.publicKeyHex.lowercased() == event.pubkey.lowercased() { return }
+        
+        // Only trigger when there were zero participants in this geohash recently
+        guard existingCount == 0 else { return }
+        
+        // Avoid notifications for old sampled events when launching or (re)subscribing
+        let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+        if Date().timeIntervalSince(eventTime) > 30 { return }
+        
+        // Foreground-only notifications: app must be active, and not already viewing this geohash
+        #if os(iOS)
+        guard UIApplication.shared.applicationState == .active else { return }
+        if case .location(let ch) = activeChannel, ch.geohash == gh { return }
+        #elseif os(macOS)
+        guard NSApplication.shared.isActive else { return }
+        if case .location(let ch) = activeChannel, ch.geohash == gh { return }
+        #endif
+        
+        cooldownPerGeohash(gh, content: content, event: event)
+    }
+    
+    func cooldownPerGeohash(_ gh: String, content: String, event: NostrEvent) {
+        let now = Date()
+        let last = lastGeoNotificationAt[gh] ?? .distantPast
+        if now.timeIntervalSince(last) < TransportConfig.uiGeoNotifyCooldownSeconds { return }
+        
+        // Compose a short preview
+        let preview: String = {
+            let maxLen = TransportConfig.uiGeoNotifySnippetMaxLen
+            if content.count <= maxLen { return content }
+            let idx = content.index(content.startIndex, offsetBy: maxLen)
+            return String(content[..<idx]) + "…"
+        }()
+
+        Task { @MainActor in
+            lastGeoNotificationAt[gh] = now
+            // Pre-populate the target geohash timeline so the triggering message appears when user opens it
+            let senderSuffix = String(event.pubkey.suffix(4))
+            let nick = geoNicknames[event.pubkey.lowercased()]
+            let senderName = (nick?.isEmpty == false ? nick! : "anon") + "#" + senderSuffix
+            
+            // Clamp future timestamps
+            let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+            let ts = min(rawTs, Date())
+            let mentions = self.parseMentions(from: content)
+            let msg = BitchatMessage(
+                id: event.id,
+                sender: senderName,
+                content: content,
+                timestamp: ts,
+                isRelay: false,
+                senderPeerID: PeerID(nostr: event.pubkey),
+                mentions: mentions.isEmpty ? nil : mentions
+            )
+            if timelineStore.appendIfAbsent(msg, toGeohash: gh) {
+                NotificationService.shared.sendGeohashActivityNotification(geohash: gh, bodyPreview: preview)
+            }
+        }
+    }
+
+    /// Stop sampling all extra geohashes.
+    @MainActor
+    func endGeohashSampling() {
+        for subID in geoSamplingSubs.keys { NostrRelayManager.shared.unsubscribe(id: subID) }
+        geoSamplingSubs.removeAll()
+    }
+
+    // MARK: - Nostr DM Handling
+
+    func setupNostrMessageHandling() {
+        guard let currentIdentity = try? idBridge.getCurrentNostrIdentity() else {
+            SecureLogger.warning("⚠️ No Nostr identity available for message handling", category: .session)
+            return
+        }
+        
+        SecureLogger.debug("🔑 Setting up Nostr subscription for pubkey: \(currentIdentity.publicKeyHex.prefix(16))...", category: .session)
+        
+        // Subscribe to Nostr messages
+        let filter = NostrFilter.giftWrapsFor(
+            pubkey: currentIdentity.publicKeyHex,
+            since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)  // Last 24 hours
+        )
+        
+        nostrRelayManager?.subscribe(filter: filter, id: "chat-messages") { [weak self] event in
+            self?.handleNostrMessage(event)
+        }
+    }
+    
+    func handleNostrMessage(_ giftWrap: NostrEvent) {
+        // Deduplicate messages by ID
+        if deduplicationService.hasProcessedNostrEvent(giftWrap.id) { return }
+        deduplicationService.recordNostrEvent(giftWrap.id)
+        
+        // Ensure we're on a background queue for decryption
+        Task.detached(priority: .userInitiated) { [weak self] in
+            await self?.processNostrMessage(giftWrap)
+        }
+    }
+    
+    func processNostrMessage(_ giftWrap: NostrEvent) async {
+        guard giftWrap.isValidSignature() else { return }
+        guard let currentIdentity = try? idBridge.getCurrentNostrIdentity() else { return }
+        
+        do {
+            let (content, senderPubkey, rumorTimestamp) = try NostrProtocol.decryptPrivateMessage(
+                giftWrap: giftWrap,
+                recipientIdentity: currentIdentity
+            )
+            
+            // Handle verification payloads first
+            if content.hasPrefix("verify:") {
+                // Ignore verification payloads arriving via Nostr path for now
+                // Verification should ideally happen over mesh for security binding
+                return
+            }
+            
+            // Check if it's a BitChat packet embedded in the content (bitchat1:...)
+            if content.hasPrefix("bitchat1:") {
+                guard let packet = Self.decodeEmbeddedBitChatPacket(from: content) else {
+                    SecureLogger.error("Failed to decode embedded BitChat packet from Nostr DM", category: .session)
+                    return
+                }
+                
+                // Map sender by Nostr pubkey to Noise key when possible
+                let actualSenderNoiseKey = findNoiseKey(for: senderPubkey)
+                
+                // Stable target ID if we know Noise key; otherwise temporary Nostr-based peer
+                let targetPeerID = PeerID(str: actualSenderNoiseKey?.hexEncodedString()) ?? PeerID(nostr_: senderPubkey)
+                
+                if packet.type == MessageType.noiseEncrypted.rawValue,
+                   let payload = NoisePayload.decode(packet.payload) {
+                    let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTimestamp))
+                    // Store Nostr mapping
+                    await MainActor.run {
+                        nostrKeyMapping[targetPeerID] = senderPubkey
+                        
+                        // Handle packet types
+                        switch payload.type {
+                        case .privateMessage:
+                            handlePrivateMessage(payload, senderPubkey: senderPubkey, convKey: targetPeerID, id: currentIdentity, messageTimestamp: messageTimestamp)
+                        case .delivered:
+                            handleDelivered(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
+                        case .readReceipt:
+                            handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
+                        case .verifyChallenge, .verifyResponse:
+                            break
+                        }
+                    }
+                }
+            } else {
+                SecureLogger.debug("Ignoring non-embedded Nostr DM content", category: .session)
+            }
+        } catch {
+            SecureLogger.error("Failed to decrypt Nostr message: \(error)", category: .session)
+        }
+    }
+
+    func findNoiseKey(for nostrPubkey: String) -> Data? {
+        // Check favorites for this Nostr key
+        let favorites = FavoritesPersistenceService.shared.favorites.values
+        var npubToMatch = nostrPubkey
+        
+        // Convert hex to npub if needed for comparison
+        if !nostrPubkey.hasPrefix("npub") {
+            if let pubkeyData = Data(hexString: nostrPubkey),
+               let encoded = try? Bech32.encode(hrp: "npub", data: pubkeyData) {
+                npubToMatch = encoded
+            } else {
+                SecureLogger.warning("⚠️ Invalid hex public key format or encoding failed: \(nostrPubkey.prefix(16))...", category: .session)
+            }
+        }
+        
+        for relationship in favorites {
+            // Search through favorites for matching Nostr pubkey
+            if let storedNostrKey = relationship.peerNostrPublicKey {
+                // Compare against stored key (could be hex or npub)
+                if storedNostrKey == npubToMatch {
+                    // SecureLogger.debug("✅ Found Noise key for Nostr sender (npub match)", category: .session)
+                    return relationship.peerNoisePublicKey
+                }
+                
+                // Also try comparing raw hex if stored key is hex
+                if !storedNostrKey.hasPrefix("npub") && storedNostrKey == nostrPubkey {
+                    SecureLogger.debug("✅ Found Noise key for Nostr sender (hex match)", category: .session)
+                    return relationship.peerNoisePublicKey
+                }
+            }
+        }
+        
+        SecureLogger.debug("⚠️ No matching Noise key found for Nostr pubkey: \(nostrPubkey.prefix(16))... (tried npub: \(npubToMatch.prefix(16))...)", category: .session)
+        return nil
+    }
+
+    func sendDeliveryAckViaNostrEmbedded(_ message: BitchatMessage, wasReadBefore: Bool, senderPubkey: String, key: Data?) {
+        // If we have a Noise key, try to route securely if possible, otherwise fallback to direct
+        if let _ = key {
+             // Ideally we would use MessageRouter here, but for simplicity in this direct callback:
+             // check if we have an identity
+             if let id = try? idBridge.getCurrentNostrIdentity() {
+                 let nt = NostrTransport(keychain: keychain, idBridge: idBridge)
+                 nt.senderPeerID = meshService.myPeerID
+                 nt.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: id)
+             }
+        } else if let id = try? idBridge.getCurrentNostrIdentity() {
+            // Fallback: no Noise mapping yet — send directly to sender's Nostr pubkey
+            let nt = NostrTransport(keychain: keychain, idBridge: idBridge)
+            nt.senderPeerID = meshService.myPeerID
+            nt.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: id)
+            SecureLogger.debug("Sent DELIVERED ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…", category: .session)
+        }
+        
+        // Same for READ receipt if viewing
+        if !wasReadBefore && selectedPrivateChatPeer == message.senderPeerID {
+             if let _ = key {
+                 if let id = try? idBridge.getCurrentNostrIdentity() {
+                     let nt = NostrTransport(keychain: keychain, idBridge: idBridge)
+                     nt.senderPeerID = meshService.myPeerID
+                     nt.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: id)
+                 }
+             } else if let id = try? idBridge.getCurrentNostrIdentity() {
+                 let nt = NostrTransport(keychain: keychain, idBridge: idBridge)
+                 nt.senderPeerID = meshService.myPeerID
+                 nt.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: id)
+                 SecureLogger.debug("Viewing chat; sent READ ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…", category: .session)
+             }
+        }
+    }
+
+    func handleFavoriteNotification(content: String, from nostrPubkey: String) {
+        // Try to find Noise key associated with this Nostr pubkey
+        guard let senderNoiseKey = findNoiseKey(for: nostrPubkey) else { return }
+        
+        let isFavorite = content.contains("FAVORITE:TRUE")
+        let senderNickname = content.components(separatedBy: "|").last ?? "Unknown"
+        
+        // Update favorite status
+        if isFavorite {
+            FavoritesPersistenceService.shared.addFavorite(
+                peerNoisePublicKey: senderNoiseKey,
+                peerNostrPublicKey: nostrPubkey,
+                peerNickname: senderNickname
+            )
+        } else {
+            // Only remove if we don't have it set locally
+            // Logic handled by persistence service usually, here we just update remote state
+            // Actually for now we just process the notification
+        }
+        
+        // Extract Nostr public key if included
+        var extractedNostrPubkey: String? = nil
+        if let range = content.range(of: "NPUB:") {
+            let suffix = content[range.upperBound...]
+            let parts = suffix.components(separatedBy: "|")
+            if let key = parts.first {
+                extractedNostrPubkey = String(key)
+            }
+        } else if content.contains(":") {
+             // Fallback: simple format FAVORITE:TRUE:npub...
+             let parts = content.components(separatedBy: ":")
+             if parts.count >= 3 {
+                 extractedNostrPubkey = String(parts[2])
+             }
+        }
+        
+        SecureLogger.info("📝 Received favorite notification from \(senderNickname): \(isFavorite)", category: .session)
+        
+        // If they favorited us and provided their Nostr key, ensure it's stored
+        if isFavorite && extractedNostrPubkey != nil {
+            SecureLogger.info("💾 Storing Nostr key association for \(senderNickname): \(extractedNostrPubkey!.prefix(16))...", category: .session)
+             FavoritesPersistenceService.shared.addFavorite(
+                peerNoisePublicKey: senderNoiseKey,
+                peerNostrPublicKey: extractedNostrPubkey,
+                peerNickname: senderNickname
+            )
+        }
+        
+        // Show notification
+        NotificationService.shared.sendLocalNotification(
+            title: isFavorite ? "New Favorite" : "Favorite Removed",
+            body: "\(senderNickname) \(isFavorite ? "favorited" : "unfavorited") you",
+            identifier: "fav-\(UUID().uuidString)"
+        )
+    }
+
+    func sendFavoriteNotificationViaNostr(noisePublicKey: Data, isFavorite: Bool) {
+        // Find peer Nostr key
+        guard let relationship = FavoritesPersistenceService.shared.getFavoriteStatus(for: noisePublicKey),
+              relationship.peerNostrPublicKey != nil else {
+            SecureLogger.warning("⚠️ Cannot send favorite notification - no Nostr key for peer", category: .session)
+            return
+        }
+        
+        let peerID = PeerID(hexData: noisePublicKey)
+        
+        // Route via message router
+        messageRouter.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
+    }
+
+    private static func decodeEmbeddedBitChatPacket(from content: String) -> BitchatPacket? {
+        guard content.hasPrefix("bitchat1:") else { return nil }
+        let encoded = String(content.dropFirst("bitchat1:".count))
+        let maxBytes = FileTransferLimits.maxFramedFileBytes
+        // Base64url length upper bound for maxBytes (padded length; unpadded is <= this).
+        let maxEncoded = ((maxBytes + 2) / 3) * 4
+        guard encoded.count <= maxEncoded else { return nil }
+        guard let packetData = Self.base64URLDecode(encoded),
+              packetData.count <= maxBytes
+        else { return nil }
+        return BitchatPacket.from(packetData)
+    }
+
+    // MARK: - Geohash Nickname Resolution (for /block in geohash)
+
+    func nostrPubkeyForDisplayName(_ name: String) -> String? {
+        // Look up current visible geohash participants for an exact displayName match
+        for p in visibleGeohashPeople() {
+            if p.displayName == name {
+                return p.id
+            }
+        }
+        // Also check nickname cache directly
+        for (pub, nick) in geoNicknames {
+            if nick == name { return pub }
+        }
+        return nil
+    }
+    
+    func startGeohashDM(withPubkeyHex hex: String) {
+        let convKey = PeerID(nostr_: hex)
+        nostrKeyMapping[convKey] = hex
+        startPrivateChat(with: convKey)
+    }
+    
+    func fullNostrHex(forSenderPeerID senderID: PeerID) -> String? {
+        return nostrKeyMapping[senderID]
+    }
+    
+    func geohashDisplayName(for convKey: PeerID) -> String {
+        guard let full = nostrKeyMapping[convKey] else {
+            return convKey.bare
+        }
+        return displayNameForNostrPubkey(full)
+    }
+}
@@ -0,0 +1,64 @@
+//
+// ChatViewModel+Tor.swift
+// bitchat
+//
+// Tor lifecycle handling for ChatViewModel
+//
+
+import Foundation
+import Combine
+import Tor
+
+extension ChatViewModel {
+    
+    // MARK: - Tor notifications
+    
+    @objc func handleTorWillStart() {
+        Task { @MainActor in
+            if !self.torStatusAnnounced && TorManager.shared.torEnforced {
+                self.torStatusAnnounced = true
+                // Post only in geohash channels (queue if not active)
+                self.addGeohashOnlySystemMessage(
+                    String(localized: "system.tor.starting", comment: "System message when Tor is starting")
+                )
+            }
+        }
+    }
+
+    @objc func handleTorWillRestart() {
+        Task { @MainActor in
+            self.torRestartPending = true
+            // Post only in geohash channels (queue if not active)
+            self.addGeohashOnlySystemMessage(
+                String(localized: "system.tor.restarting", comment: "System message when Tor is restarting")
+            )
+        }
+    }
+
+    @objc func handleTorDidBecomeReady() {
+        Task { @MainActor in
+            // Only announce "restarted" if we actually restarted this session
+            if self.torRestartPending {
+                // Post only in geohash channels (queue if not active)
+                self.addGeohashOnlySystemMessage(
+                    String(localized: "system.tor.restarted", comment: "System message when Tor has restarted")
+                )
+                self.torRestartPending = false
+            } else if TorManager.shared.torEnforced && !self.torInitialReadyAnnounced {
+                // Initial start completed
+                self.addGeohashOnlySystemMessage(
+                    String(localized: "system.tor.started", comment: "System message when Tor has started")
+                )
+                self.torInitialReadyAnnounced = true
+            }
+        }
+    }
+
+    @objc func handleTorPreferenceChanged(_ notification: Notification) {
+        Task { @MainActor in
+            self.torStatusAnnounced = false
+            self.torInitialReadyAnnounced = false
+            self.torRestartPending = false
+        }
+    }
+}
@@ -0,0 +1,9 @@
+# ChatViewModel Extensions
+
+This directory contains extensions to `ChatViewModel` to modularize its functionality.
+
+- `ChatViewModel+Tor.swift`: Handles Tor lifecycle events and notifications.
+- `ChatViewModel+PrivateChat.swift`: Manages private chat logic, media transfers (images, voice notes), and file handling.
+- `ChatViewModel+Nostr.swift`: Contains all logic related to Nostr integration, Geohash channels, and Nostr identity management.
+
+The main `ChatViewModel.swift` retains core state, initialization, and coordination logic.
@@ -0,0 +1,142 @@
+//
+// VoiceRecordingViewModel.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import BitLogger
+import Foundation
+
+@MainActor
+final class VoiceRecordingViewModel: ObservableObject {
+    enum State: Equatable {
+        case idle
+        case requestingPermission
+        case permissionDenied
+        case preparing
+        case recording(startDate: Date)
+        case error(message: String)
+
+        var isActive: Bool {
+            switch self {
+            case .preparing, .recording: true
+            case .idle, .requestingPermission, .permissionDenied, .error: false
+            }
+        }
+
+        var alertMessage: String {
+            switch self {
+            case .error(let message): message
+            case .permissionDenied: "Microphone access is required to record voice notes."
+            case .idle, .requestingPermission, .preparing, .recording: ""
+            }
+        }
+
+        fileprivate func duration(for date: Date) -> TimeInterval {
+            switch self {
+            case .idle, .requestingPermission, .preparing, .permissionDenied, .error: 0
+            case .recording(let startDate): date.timeIntervalSince(startDate)
+            }
+        }
+    }
+
+    var showAlert: Bool {
+        get {
+            switch state {
+            case .permissionDenied, .error:   true
+            case .idle, .requestingPermission, .preparing, .recording: false
+            }
+        }
+        set {
+            if !newValue { state = .idle }
+        }
+    }
+
+    @Published private(set) var state = State.idle
+
+    func formattedDuration(for date: Date) -> String {
+        let clamped = max(0, state.duration(for: date))
+        let totalMilliseconds = Int(clamped * 1000)
+        let minutes = totalMilliseconds / 60_000
+        let seconds = (totalMilliseconds % 60_000) / 1_000
+        let centiseconds = (totalMilliseconds % 1_000) / 10
+        return String(format: "%02d:%02d.%02d", minutes, seconds, centiseconds)
+    }
+
+    func start(shouldShow: Bool) {
+        guard shouldShow, state == .idle else { return }
+        state = .requestingPermission
+        Task {
+            let granted = await VoiceRecorder.shared.requestPermission()
+            guard state == .requestingPermission else { return }
+            guard granted else {
+                state = .permissionDenied
+                return
+            }
+            state = .preparing
+            do {
+                try await VoiceRecorder.shared.startRecording()
+                guard state == .preparing else {
+                    cancel()
+                    return
+                }
+                state = .recording(startDate: Date())
+            } catch {
+                SecureLogger.error("Voice recording failed to start: \(error)", category: .session)
+                await VoiceRecorder.shared.cancelRecording()
+                guard state == .preparing else { return }
+                state = .error(message: "Could not start recording.")
+            }
+        }
+    }
+
+    func finish(completion: ((URL) -> Void)?) {
+        let previousState = state
+
+        switch previousState {
+        case .permissionDenied, .error:
+            return
+        case .idle, .requestingPermission, .preparing, .recording:
+            break
+        }
+
+        state = .idle
+
+        guard case .recording(let startDate) = previousState, let completion else {
+            Task { await VoiceRecorder.shared.cancelRecording() }
+            return
+        }
+
+        Task {
+            let finalDuration = Date().timeIntervalSince(startDate)
+            if let url = await VoiceRecorder.shared.stopRecording(),
+               isValidRecording(at: url, duration: finalDuration) {
+                completion(url)
+            } else {
+                guard state == .idle else { return }
+                state = .error(
+                    message: finalDuration < VoiceRecorder.minRecordingDuration
+                    ? "Recording is too short."
+                    : "Recording failed to save."
+                )
+            }
+        }
+    }
+
+    func cancel() {
+        finish(completion: nil)
+    }
+
+    private func isValidRecording(at url: URL, duration: TimeInterval) -> Bool {
+        if let attributes = try? FileManager.default.attributesOfItem(atPath: url.path),
+           let fileSize = attributes[.size] as? NSNumber,
+           fileSize.intValue > 0,
+           duration >= VoiceRecorder.minRecordingDuration {
+            return true
+        }
+        try? FileManager.default.removeItem(at: url)
+        return false
+    }
+}
@@ -86,10 +86,6 @@ struct AppInfoView: View {
            ]
        }

-        enum Warning {
-            static let title: LocalizedStringKey = "app_info.warning.title"
-            static let message: LocalizedStringKey = "app_info.warning.message"
-        }
    }
    
    var body: some View {
@@ -192,24 +188,6 @@ struct AppInfoView: View {

                FeatureRow(info: Strings.Privacy.panic)
            }
-
-            // Warning
-            VStack(alignment: .leading, spacing: 6) {
-                SectionHeader(Strings.Warning.title)
-                    .foregroundColor(Color.red)
-                
-                Text(Strings.Warning.message)
-                    .font(.bitchatSystem(size: 14, design: .monospaced))
-                    .foregroundColor(Color.red)
-                    .fixedSize(horizontal: false, vertical: true)
-            }
-            .padding(.top, 6)
-            .padding(.bottom, 16)
-            .padding(.horizontal)
-            .background(Color.red.opacity(0.1))
-            .cornerRadius(8)
-            
-            .padding(.top)
        }
        .padding()
    }
@@ -5,6 +5,7 @@
 //  Created by Islam on 29/10/2025.
 //

+import Nostr
 import SwiftUI

 struct CommandSuggestionsView: View {
@@ -76,7 +77,7 @@ struct CommandSuggestionsView: View {
    let keychain = KeychainManager()
    let viewModel = ChatViewModel(
        keychain: keychain,
-        idBridge: NostrIdentityBridge(),
+        idBridge: NostrIdentityBridge(keychain: keychain),
        identityManager: SecureIdentityStateManager(keychain)
    )
    
@@ -15,10 +15,22 @@ struct PaymentChipView: View {
    enum PaymentType {
        case cashu(String)
        case lightning(String)
-        
+
+        private static let cashuAllowedCharacters = CharacterSet.alphanumerics.union(CharacterSet(charactersIn: "-_"))
+
+        private static func cashuURL(from link: String) -> URL? {
+            if let url = URL(string: link), url.scheme != nil {
+                return url
+            }
+            let enc = link.addingPercentEncoding(withAllowedCharacters: cashuAllowedCharacters) ?? link
+            return URL(string: "cashu:\(enc)")
+        }
+
        var url: URL? {
            switch self {
-            case .cashu(let link), .lightning(let link):
+            case .cashu(let link):
+                return Self.cashuURL(from: link)
+            case .lightning(let link):
                return URL(string: link)
            }
        }
@@ -6,6 +6,7 @@
 // For more information, see <https://unlicense.org>
 //

+import Nostr
 import SwiftUI

 struct TextMessageView: View {
@@ -13,7 +14,7 @@ struct TextMessageView: View {
    @EnvironmentObject private var viewModel: ChatViewModel
    
    let message: BitchatMessage
-    @Binding var expandedMessageIDs: Set<String>
+    @State private var expandedMessageIDs: Set<String> = []
    
    var body: some View {
        VStack(alignment: .leading, spacing: 0) {
@@ -66,14 +67,12 @@ struct TextMessageView: View {
    }
 }

-@available(macOS 14, iOS 17, *)
 #Preview {
-    @Previewable @State var ids: Set<String> = []
    let keychain = PreviewKeychainManager()
    
    Group {
        List {
-            TextMessageView(message: .preview, expandedMessageIDs: $ids)
+            TextMessageView(message: .preview)
                .listRowSeparator(.hidden)
                .listRowInsets(EdgeInsets())
                .listRowBackground(EmptyView())
@@ -81,7 +80,7 @@ struct TextMessageView: View {
        .environment(\.colorScheme, .light)
        
        List {
-            TextMessageView(message: .preview, expandedMessageIDs: $ids)
+            TextMessageView(message: .preview)
                .listRowSeparator(.hidden)
                .listRowInsets(EdgeInsets())
                .listRowBackground(EmptyView())
@@ -91,7 +90,7 @@ struct TextMessageView: View {
    .environmentObject(
        ChatViewModel(
            keychain: keychain,
-            idBridge: NostrIdentityBridge(),
+            idBridge: NostrIdentityBridge(keychain: keychain),
            identityManager: SecureIdentityStateManager(keychain)
        )
    )
@@ -7,6 +7,7 @@
 //

 import SwiftUI
+import BitFoundation

 struct FingerprintView: View {
    @ObservedObject var viewModel: ChatViewModel
@@ -0,0 +1,79 @@
+//
+// ImagePickerView.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+#if os(iOS)
+
+import SwiftUI
+
+/// Camera or Photo Library
+struct ImagePickerView: UIViewControllerRepresentable {
+    let sourceType: UIImagePickerController.SourceType
+    let completion: (UIImage?) -> Void
+
+    func makeUIViewController(context: Context) -> UIImagePickerController {
+        let picker = UIImagePickerController()
+        picker.sourceType = sourceType
+        picker.delegate = context.coordinator
+        picker.allowsEditing = false
+
+        // Use standard full screen - iOS handles safe areas automatically
+        picker.modalPresentationStyle = .fullScreen
+
+        // Force dark mode to make safe area bars black instead of white
+        picker.overrideUserInterfaceStyle = .dark
+
+        return picker
+    }
+
+    func updateUIViewController(_ uiViewController: UIImagePickerController, context: Context) {}
+
+    func makeCoordinator() -> Coordinator {
+        Coordinator(completion: completion)
+    }
+
+    class Coordinator: NSObject, UIImagePickerControllerDelegate, UINavigationControllerDelegate {
+        let completion: (UIImage?) -> Void
+
+        init(completion: @escaping (UIImage?) -> Void) {
+            self.completion = completion
+        }
+
+        func imagePickerController(_ picker: UIImagePickerController, didFinishPickingMediaWithInfo info: [UIImagePickerController.InfoKey: Any]) {
+            let image = info[.originalImage] as? UIImage
+            completion(image)
+        }
+
+        func imagePickerControllerDidCancel(_ picker: UIImagePickerController) {
+            completion(nil)
+        }
+    }
+}
+
+@available(iOS 17, *)
+#Preview {
+    @Previewable @State var isPresented = true
+    @Previewable @State var selectedImage: UIImage?
+    VStack {
+        if let selectedImage {
+            Image(uiImage: selectedImage)
+                .resizable()
+                .scaledToFit()
+        } else {
+            Text("No image selected")
+        }
+        Button("Show") { isPresented = true }
+    }
+    .sheet(isPresented: $isPresented) {
+        ImagePickerView(sourceType: .photoLibrary) { image in
+            selectedImage = image
+            isPresented = false
+        }
+    }
+}
+
+#endif
@@ -0,0 +1,147 @@
+//
+// ImagePreviewView.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import SwiftUI
+#if os(macOS)
+import BitLogger
+#endif
+
+struct ImagePreviewView: View {
+    let url: URL
+
+    @Environment(\.dismiss) private var dismiss
+    #if os(iOS)
+    @State private var showExporter = false
+    @State private var platformImage: UIImage?
+    #else
+    @State private var platformImage: NSImage?
+    #endif
+
+    var body: some View {
+        ZStack {
+            Color.black.ignoresSafeArea()
+            VStack {
+                Spacer()
+                if let image = platformImage {
+                    #if os(iOS)
+                    Image(uiImage: image)
+                        .resizable()
+                        .aspectRatio(contentMode: .fit)
+                        .padding()
+                    #else
+                    Image(nsImage: image)
+                        .resizable()
+                        .aspectRatio(contentMode: .fit)
+                        .padding()
+                    #endif
+                } else {
+                    ProgressView()
+                        .progressViewStyle(.circular)
+                        .tint(.white)
+                }
+                Spacer()
+                HStack {
+                    Button(action: { dismiss() }) {
+                        Text("close", comment: "Button to dismiss fullscreen media viewer")
+                            .font(.bitchatSystem(size: 15, weight: .semibold))
+                            .foregroundColor(.white)
+                            .padding(.horizontal, 16)
+                            .padding(.vertical, 8)
+                            .background(RoundedRectangle(cornerRadius: 12).stroke(Color.white.opacity(0.5), lineWidth: 1))
+                    }
+                    Spacer()
+                    Button(action: saveCopy) {
+                        Text("save", comment: "Button to save media to device")
+                            .font(.bitchatSystem(size: 15, weight: .semibold))
+                            .foregroundColor(.white)
+                            .padding(.horizontal, 16)
+                            .padding(.vertical, 8)
+                            .background(RoundedRectangle(cornerRadius: 12).fill(Color.blue.opacity(0.6)))
+                    }
+                }
+                .padding([.horizontal, .bottom], 24)
+            }
+        }
+        .onAppear(perform: loadImage)
+        #if os(iOS)
+        .sheet(isPresented: $showExporter) {
+            FileExportWrapper(url: url)
+        }
+        #endif
+    }
+
+    private func loadImage() {
+        DispatchQueue.global(qos: .userInitiated).async {
+            #if os(iOS)
+            guard let image = UIImage(contentsOfFile: url.path) else { return }
+            #else
+            guard let image = NSImage(contentsOf: url) else { return }
+            #endif
+            DispatchQueue.main.async {
+                self.platformImage = image
+            }
+        }
+    }
+
+    private func saveCopy() {
+        #if os(iOS)
+        showExporter = true
+        #else
+        Task { @MainActor in
+            let panel = NSSavePanel()
+            panel.canCreateDirectories = true
+            panel.nameFieldStringValue = url.lastPathComponent
+            panel.prompt = "save"
+            if panel.runModal() == .OK, let destination = panel.url {
+                do {
+                    if FileManager.default.fileExists(atPath: destination.path) {
+                        try FileManager.default.removeItem(at: destination)
+                    }
+                    try FileManager.default.copyItem(at: url, to: destination)
+                } catch {
+                    SecureLogger.error("Failed to save image preview copy: \(error)", category: .session)
+                }
+            }
+        }
+        #endif
+    }
+
+    #if os(iOS)
+    private struct FileExportWrapper: UIViewControllerRepresentable {
+        let url: URL
+
+        func makeUIViewController(context: Context) -> UIDocumentPickerViewController {
+            let controller = UIDocumentPickerViewController(forExporting: [url])
+            controller.shouldShowFileExtensions = true
+            return controller
+        }
+
+        func updateUIViewController(_ uiViewController: UIDocumentPickerViewController, context: Context) {}
+    }
+    #endif
+}
+
+#Preview {
+    let tempURL = FileManager.default.temporaryDirectory.appendingPathComponent("dummy.jpg")
+    if !FileManager.default.fileExists(atPath: tempURL.path(percentEncoded: false)) {
+        #if os(iOS)
+        let image = UIImage(named: "dummy")
+        let data = image?.jpegData(compressionQuality: 0.8)
+        let _ = try? data?.write(to: tempURL)
+        #elseif os(macOS)
+        let image = NSImage(named: "dummy")
+        var rect = NSRect(origin: .zero, size: image?.size ?? .zero)
+        if let cgImage = image?.cgImage(forProposedRect: &rect, context: nil, hints: nil) {
+            let rep = NSBitmapImageRep(cgImage: cgImage)
+            let jpegData = rep.representation(using: .jpeg, properties: [.compressionFactor: 0.8])
+            let _ = try? jpegData?.write(to: tempURL)
+        }
+        #endif
+    }
+    ImagePreviewView(url: tempURL)
+}
@@ -0,0 +1,71 @@
+//
+// MacImagePickerView.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+#if os(macOS)
+
+import SwiftUI
+
+struct MacImagePickerView: View {
+    let completion: (URL?) -> Void
+    @Environment(\.dismiss) private var dismiss
+
+    var body: some View {
+        VStack(spacing: 16) {
+            Text("Choose an image")
+                .font(.headline)
+
+            Button("Select Image") {
+                let panel = NSOpenPanel()
+                panel.allowsMultipleSelection = false
+                panel.canChooseDirectories = false
+                panel.canChooseFiles = true
+                panel.allowedContentTypes = [.image, .png, .jpeg, .heic]
+                panel.message = "Choose an image to send"
+
+                if panel.runModal() == .OK {
+                    completion(panel.url)
+                } else {
+                    dismiss()
+                }
+            }
+            .buttonStyle(.borderedProminent)
+
+            Button("Cancel") {
+                completion(nil)
+            }
+            .buttonStyle(.bordered)
+        }
+        .padding(40)
+        .frame(minWidth: 300, minHeight: 150)
+    }
+}
+
+@available(OSX 14, *)
+#Preview {
+    @Previewable @State var isPresented = true
+    @Previewable @State var selectedImage: NSImage?
+
+    VStack {
+        if let selectedImage {
+            Image(nsImage: selectedImage)
+                .resizable()
+                .scaledToFit()
+        } else {
+            Text("No image selected")
+        }
+        Button("Show") { isPresented = true }
+    }
+    .sheet(isPresented: $isPresented) {
+        MacImagePickerView { url in
+            selectedImage = url.map(NSImage.init)
+            isPresented = false
+        }
+    }
+}
+
+#endif
@@ -40,10 +40,31 @@ struct LocationChannelsSheet: View {
        }

        static func levelTitle(for level: GeohashChannelLevel, count: Int) -> String {
+            // High-precision uncertainty: if count is 0 for high-precision levels,
+            // show "?" because presence broadcasting is disabled for privacy.
+            let isHighPrecision = (level == .neighborhood || level == .block || level == .building)
+            if isHighPrecision && count == 0 {
+                return String(
+                    format: String(localized: "location_channels.row_title_unknown", defaultValue: "%@ [? people]"),
+                    locale: .current,
+                    level.displayName
+                )
+            }
            return rowTitle(label: level.displayName, count: count)
        }

        static func bookmarkTitle(geohash: String, count: Int) -> String {
+            // Check precision for bookmarks too
+            let len = geohash.count
+            // Neighborhood=6, Block=7, Building=8+
+            let isHighPrecision = (len >= 6)
+            if isHighPrecision && count == 0 {
+                return String(
+                    format: String(localized: "location_channels.row_title_unknown", defaultValue: "%@ [? people]"),
+                    locale: .current,
+                    "#\(geohash)"
+                )
+            }
            return rowTitle(label: "#\(geohash)", count: count)
        }

@@ -104,7 +125,7 @@ struct LocationChannelsSheet: View {
                            Text(Strings.permissionDenied)
                                .font(.bitchatSystem(size: 12, design: .monospaced))
                                .foregroundColor(.secondary)
-                            Button(Strings.openSettings) { openSystemLocationSettings() }
+                            Button(Strings.openSettings, action: SystemSettings.location.open)
                            .buttonStyle(.plain)
                        }
                    case LocationChannelManager.PermissionState.authorized:
@@ -225,9 +246,7 @@ struct LocationChannelsSheet: View {
                    sectionDivider
                    torToggleSection
                        .padding(.top, 12)
-                    Button(action: {
-                        openSystemLocationSettings()
-                    }) {
+                    Button(action: SystemSettings.location.open) {
                        Text(Strings.removeAccess)
                            .font(.bitchatSystem(size: 12, design: .monospaced))
                            .foregroundColor(Color(red: 0.75, green: 0.1, blue: 0.1))
@@ -283,7 +302,7 @@ struct LocationChannelsSheet: View {
                        }
                    }
                let normalized = customGeohash
-                    .trimmingCharacters(in: .whitespacesAndNewlines)
+                    .trimmed
                    .lowercased()
                    .replacingOccurrences(of: "#", with: "")
                let isValid = validateGeohash(normalized)
@@ -357,7 +376,7 @@ struct LocationChannelsSheet: View {
                        isPresented = false
                    }
                    .padding(.vertical, 6)
-                    .onAppear { bookmarks.resolveNameIfNeeded(for: gh) }
+                    .onAppear { bookmarks.resolveBookmarkNameIfNeeded(for: gh) }

                    if index < entries.count - 1 {
                        sectionDivider
@@ -430,7 +449,7 @@ struct LocationChannelsSheet: View {
    // Split a title like "#mesh [3 people]" into base and suffix "[3 people]"
    private func splitTitleAndCount(_ s: String) -> (base: String, countSuffix: String?) {
        guard let idx = s.lastIndex(of: "[") else { return (s, nil) }
-        let prefix = String(s[..<idx]).trimmingCharacters(in: .whitespaces)
+        let prefix = String(s[..<idx]).trimmed
        let suffix = String(s[idx...])
        return (prefix, suffix)
    }
@@ -601,18 +620,3 @@ extension LocationChannelsSheet {
        }
    }
 }
-
-// MARK: - Open Settings helper
-private func openSystemLocationSettings() {
-    #if os(iOS)
-    if let url = URL(string: UIApplication.openSettingsURLString) {
-        UIApplication.shared.open(url)
-    }
-    #else
-    if let url = URL(string: "x-apple.systempreferences:com.apple.preference.security?Privacy_LocationServices") {
-        NSWorkspace.shared.open(url)
-    } else if let url = URL(string: "x-apple.systempreferences:com.apple.preference.security") {
-        NSWorkspace.shared.open(url)
-    }
-    #endif
-}
@@ -12,11 +12,15 @@ struct LocationNotesView: View {
    @Environment(\.dismiss) private var dismiss
    @State private var draft: String = ""

-    init(geohash: String, onNotesCountChanged: ((Int) -> Void)? = nil) {
+    init(
+        geohash: String,
+        onNotesCountChanged: ((Int) -> Void)? = nil,
+        manager: LocationNotesManager? = nil
+    ) {
        let gh = geohash.lowercased()
        self.geohash = gh
        self.onNotesCountChanged = onNotesCountChanged
-        _manager = StateObject(wrappedValue: LocationNotesManager(geohash: gh))
+        _manager = StateObject(wrappedValue: manager ?? LocationNotesManager(geohash: gh))
    }

    private var backgroundColor: Color { colorScheme == .dark ? .black : .white }
@@ -260,14 +264,13 @@ struct LocationNotesView: View {
    }

    private func send() {
-        let content = draft.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !content.isEmpty else { return }
+        guard let content = draft.trimmedOrNilIfEmpty else { return }
        manager.send(content: content, nickname: viewModel.nickname)
        draft = ""
    }

    private var sendButtonEnabled: Bool {
-        !draft.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty && manager.state != .noRelays
+        !draft.trimmed.isEmpty && manager.state != .noRelays
    }

    // MARK: - Timestamp Formatting
@@ -0,0 +1,87 @@
+//
+//  MediaMessageView.swift
+//  bitchat
+//
+//  Created by Islam on 30/03/2026.
+//
+
+import SwiftUI
+
+struct MediaMessageView: View {
+    @Environment(\.colorScheme) private var colorScheme
+
+    @EnvironmentObject var viewModel: ChatViewModel
+    let message: BitchatMessage
+    let media: BitchatMessage.Media
+
+    @Binding var imagePreviewURL: URL?
+
+    var body: some View {
+        let state = mediaSendState(for: message)
+        let isFromMe = message.sender == viewModel.nickname || message.senderPeerID == viewModel.meshService.myPeerID
+        let cancelAction: (() -> Void)? = state.canCancel ? { viewModel.cancelMediaSend(messageID: message.id) } : nil
+
+        VStack(alignment: .leading, spacing: 2) {
+            HStack(alignment: .center, spacing: 4) {
+                Text(viewModel.formatMessageHeader(message, colorScheme: colorScheme))
+                    .fixedSize(horizontal: false, vertical: true)
+                    .frame(maxWidth: .infinity, alignment: .leading)
+                if message.isPrivate && message.sender == viewModel.nickname,
+                   let status = message.deliveryStatus {
+                    DeliveryStatusView(status: status)
+                        .padding(.leading, 4)
+                }
+            }
+
+            Group {
+                switch media {
+                case .voice(let url):
+                    VoiceNoteView(
+                        url: url,
+                        isSending: state.isSending,
+                        sendProgress: state.progress,
+                        onCancel: cancelAction
+                    )
+                case .image(let url):
+                    BlockRevealImageView(
+                        url: url,
+                        revealProgress: state.progress,
+                        isSending: state.isSending,
+                        onCancel: cancelAction,
+                        initiallyBlurred: !isFromMe,
+                        onOpen: {
+                            if !state.isSending {
+                                imagePreviewURL = url
+                            }
+                        },
+                        onDelete: !isFromMe ? { viewModel.deleteMediaMessage(messageID: message.id) } : nil
+                    )
+                    .frame(maxWidth: 280)
+                }
+            }
+        }
+        .padding(.vertical, 4)
+    }
+
+    private func mediaSendState(for message: BitchatMessage) -> (isSending: Bool, progress: Double?, canCancel: Bool) {
+        var isSending = false
+        var progress: Double?
+        if let status = message.deliveryStatus {
+            switch status {
+            case .sending:
+                isSending = true
+                progress = 0
+            case .partiallyDelivered(let reached, let total):
+                if total > 0 {
+                    isSending = true
+                    progress = Double(reached) / Double(total)
+                }
+            case .sent, .read, .delivered, .failed:
+                break
+            }
+        }
+        let canCancel = isSending && message.sender == viewModel.nickname
+        let clamped = progress.map { max(0, min(1, $0)) }
+        return (isSending, isSending ? clamped : nil, canCancel)
+    }
+}
@@ -34,24 +34,10 @@ struct VoiceNoteView: View {
        colorScheme == .dark ? Color.green.opacity(0.3) : Color.green.opacity(0.2)
    }

-    private var durationText: String {
-        let duration = playback.duration
-        guard duration.isFinite, duration > 0 else { return "--:--" }
-        let minutes = Int(duration) / 60
-        let seconds = Int(duration) % 60
-        return String(format: "%02d:%02d", minutes, seconds)
-    }
-
-    private var currentText: String {
-        let current = playback.currentTime
-        guard current.isFinite, current > 0 else { return "00:00" }
-        let minutes = Int(current) / 60
-        let seconds = Int(current) % 60
-        return String(format: "%02d:%02d", minutes, seconds)
-    }
-
    private var playbackLabel: String {
-        playback.isPlaying ? currentText + "/" + durationText : durationText
+        guard playback.duration.isFinite else { return "--:--" }
+        let seconds = playback.isPlaying ? playback.remainingSeconds : playback.roundedDuration
+        return String(format: "%02d:%02d", seconds / 60, seconds % 60)
    }

    var body: some View {
@@ -1,4 +1,5 @@
 import SwiftUI
+import BitFoundation

 struct MeshPeerList: View {
    @ObservedObject var viewModel: ChatViewModel
@@ -0,0 +1,449 @@
+//
+//  MessageListView.swift
+//  bitchat
+//
+//  Created by Islam on 30/03/2026.
+//
+
+import BitFoundation
+import SwiftUI
+
+private struct MessageDisplayItem: Identifiable {
+    let id: String
+    let message: BitchatMessage
+}
+
+struct MessageListView: View {
+    @EnvironmentObject private var viewModel: ChatViewModel
+    @ObservedObject private var locationManager = LocationChannelManager.shared
+
+    @Environment(\.colorScheme) private var colorScheme
+
+    let privatePeer: PeerID?
+    @Binding var isAtBottom: Bool
+    @Binding var messageText: String
+    @Binding var selectedMessageSender: String?
+    @Binding var selectedMessageSenderID: PeerID?
+    @Binding var imagePreviewURL: URL?
+    @Binding var windowCountPublic: Int
+    @Binding var windowCountPrivate: [PeerID: Int]
+    @Binding var showSidebar: Bool
+
+    var isTextFieldFocused: FocusState<Bool>.Binding
+
+    @State private var showMessageActions = false
+    @State private var lastScrollTime: Date = .distantPast
+    @State private var scrollThrottleTimer: Timer?
+
+    var body: some View {
+        let currentWindowCount: Int = {
+            if let peer = privatePeer {
+                return windowCountPrivate[peer] ?? TransportConfig.uiWindowInitialCountPrivate
+            }
+            return windowCountPublic
+        }()
+
+        let messages = viewModel.getMessages(for: privatePeer)
+        let windowedMessages = Array(messages.suffix(currentWindowCount))
+
+        let contextKey: String = {
+            if let peer = privatePeer {
+                "dm:\(peer)"
+            } else {
+                locationManager.selectedChannel.contextKey
+            }
+        }()
+
+        let messageItems: [MessageDisplayItem] = windowedMessages.compactMap { message in
+            guard !message.content.trimmed.isEmpty else { return nil }
+            return MessageDisplayItem(id: "\(contextKey)|\(message.id)", message: message)
+        }
+
+        ScrollViewReader { proxy in
+            ScrollView {
+                LazyVStack(alignment: .leading, spacing: 0) {
+                    ForEach(messageItems) { item in
+                        let message = item.message
+                        messageRow(for: message)
+                            .onAppear {
+                                if message.id == windowedMessages.last?.id {
+                                    isAtBottom = true
+                                }
+                                if message.id == windowedMessages.first?.id,
+                                   messages.count > windowedMessages.count {
+                                    expandWindow(
+                                        ifNeededFor: message,
+                                        allMessages: messages,
+                                        privatePeer: privatePeer,
+                                        proxy: proxy
+                                    )
+                                }
+                            }
+                            .onDisappear {
+                                if message.id == windowedMessages.last?.id {
+                                    isAtBottom = false
+                                }
+                            }
+                            .contentShape(Rectangle())
+                            .onTapGesture {
+                                if message.sender != "system" {
+                                    messageText = "@\(message.sender) "
+                                    isTextFieldFocused.wrappedValue = true
+                                }
+                            }
+                            .contextMenu {
+                                Button("content.message.copy") {
+                                    #if os(iOS)
+                                    UIPasteboard.general.string = message.content
+                                    #else
+                                    let pb = NSPasteboard.general
+                                    pb.clearContents()
+                                    pb.setString(message.content, forType: .string)
+                                    #endif
+                                }
+                            }
+                            .padding(.horizontal, 12)
+                            .padding(.vertical, 1)
+                    }
+                }
+                .transaction { tx in if viewModel.isBatchingPublic { tx.disablesAnimations = true } }
+                .padding(.vertical, 2)
+            }
+            .onOpenURL(perform: handleOpenURL)
+            .onTapGesture(count: 3) {
+                viewModel.sendMessage("/clear")
+            }
+            .onAppear {
+                scrollToBottom(on: proxy)
+            }
+            .onChange(of: privatePeer) { _ in
+                scrollToBottom(on: proxy)
+            }
+            .onChange(of: viewModel.messages.count) { _ in
+                onMessagesChange(proxy: proxy)
+            }
+            .onChange(of: viewModel.privateChats) { _ in
+                onPrivateChatsChange(proxy: proxy)
+            }
+            .onChange(of: locationManager.selectedChannel) { newChannel in
+                onSelectedChannelChange(newChannel, proxy: proxy)
+            }
+            .confirmationDialog(
+                selectedMessageSender.map { "@\($0)" } ?? String(localized: "content.actions.title", comment: "Fallback title for the message action sheet"),
+                isPresented: $showMessageActions,
+                titleVisibility: .visible
+            ) {
+                Button("content.actions.mention") {
+                    if let sender = selectedMessageSender {
+                        // Pre-fill the input with an @mention and focus the field
+                        messageText = "@\(sender) "
+                        isTextFieldFocused.wrappedValue = true
+                    }
+                }
+
+                Button("content.actions.direct_message") {
+                    if let peerID = selectedMessageSenderID {
+                        if peerID.isGeoChat {
+                            if let full = viewModel.fullNostrHex(forSenderPeerID: peerID) {
+                                viewModel.startGeohashDM(withPubkeyHex: full)
+                            }
+                        } else {
+                            viewModel.startPrivateChat(with: peerID)
+                        }
+                        withAnimation(.easeInOut(duration: TransportConfig.uiAnimationMediumSeconds)) {
+                            showSidebar = true
+                        }
+                    }
+                }
+
+                Button("content.actions.hug") {
+                    if let sender = selectedMessageSender {
+                        viewModel.sendMessage("/hug @\(sender)")
+                    }
+                }
+
+                Button("content.actions.slap") {
+                    if let sender = selectedMessageSender {
+                        viewModel.sendMessage("/slap @\(sender)")
+                    }
+                }
+
+                Button("content.actions.block", role: .destructive) {
+                    // Prefer direct geohash block when we have a Nostr sender ID
+                    if let peerID = selectedMessageSenderID, peerID.isGeoChat,
+                       let full = viewModel.fullNostrHex(forSenderPeerID: peerID),
+                       let sender = selectedMessageSender {
+                        viewModel.blockGeohashUser(pubkeyHexLowercased: full, displayName: sender)
+                    } else if let sender = selectedMessageSender {
+                        viewModel.sendMessage("/block \(sender)")
+                    }
+                }
+
+                Button("common.cancel", role: .cancel) {}
+            }
+            .onAppear {
+                // Also check when view appears
+                if let peerID = privatePeer {
+                    // Try multiple times to ensure read receipts are sent
+                    viewModel.markPrivateMessagesAsRead(from: peerID)
+
+                    DispatchQueue.main.asyncAfter(deadline: .now() + TransportConfig.uiReadReceiptRetryShortSeconds) {
+                        viewModel.markPrivateMessagesAsRead(from: peerID)
+                    }
+
+                    DispatchQueue.main.asyncAfter(deadline: .now() + TransportConfig.uiReadReceiptRetryLongSeconds) {
+                        viewModel.markPrivateMessagesAsRead(from: peerID)
+                    }
+                }
+            }
+            .onDisappear {
+                scrollThrottleTimer?.invalidate()
+            }
+        }
+        .environment(\.openURL, OpenURLAction { url in
+            // Intercept custom cashu: links created in attributed text
+            if let scheme = url.scheme?.lowercased(), scheme == "cashu" || scheme == "lightning" {
+                #if os(iOS)
+                UIApplication.shared.open(url)
+                return .handled
+                #else
+                // On non-iOS platforms, let the system handle or ignore
+                return .systemAction
+                #endif
+            }
+            return .systemAction
+        })
+    }
+}
+
+private extension MessageListView {
+    @ViewBuilder
+    func messageRow(for message: BitchatMessage) -> some View {
+        Group {
+            if message.sender == "system" {
+                systemMessageRow(message)
+            } else if let media = message.mediaAttachment(for: viewModel.nickname) {
+                MediaMessageView(message: message, media: media, imagePreviewURL: $imagePreviewURL)
+            } else {
+                TextMessageView(message: message)
+            }
+        }
+    }
+
+    @ViewBuilder
+    func systemMessageRow(_ message: BitchatMessage) -> some View {
+        Text(viewModel.formatMessageAsText(message, colorScheme: colorScheme))
+            .fixedSize(horizontal: false, vertical: true)
+            .frame(maxWidth: .infinity, alignment: .leading)
+    }
+
+    func expandWindow(ifNeededFor message: BitchatMessage,
+                      allMessages: [BitchatMessage],
+                      privatePeer: PeerID?,
+                      proxy: ScrollViewProxy) {
+        let step = TransportConfig.uiWindowStepCount
+        let contextKey: String = {
+            if let peer = privatePeer {
+                "dm:\(peer)"
+            } else {
+                locationManager.selectedChannel.contextKey
+            }
+        }()
+        let preserveID = "\(contextKey)|\(message.id)"
+
+        if let peer = privatePeer {
+            let current = windowCountPrivate[peer] ?? TransportConfig.uiWindowInitialCountPrivate
+            let newCount = min(allMessages.count, current + step)
+            guard newCount != current else { return }
+            windowCountPrivate[peer] = newCount
+            DispatchQueue.main.async {
+                proxy.scrollTo(preserveID, anchor: .top)
+            }
+        } else {
+            let current = windowCountPublic
+            let newCount = min(allMessages.count, current + step)
+            guard newCount != current else { return }
+            windowCountPublic = newCount
+            DispatchQueue.main.async {
+                proxy.scrollTo(preserveID, anchor: .top)
+            }
+        }
+    }
+
+    func handleOpenURL(_ url: URL) {
+        guard url.scheme == "bitchat" else { return }
+        switch url.host {
+        case "user":
+            let id = url.path.trimmingCharacters(in: CharacterSet(charactersIn: "/"))
+            let peerID = PeerID(str: id.removingPercentEncoding ?? id)
+            selectedMessageSenderID = peerID
+
+            if peerID.isGeoDM || peerID.isGeoChat {
+                selectedMessageSender = viewModel.geohashDisplayName(for: peerID)
+            } else if let name = viewModel.meshService.peerNickname(peerID: peerID) {
+                selectedMessageSender = name
+            } else {
+                selectedMessageSender = viewModel.messages.last(where: { $0.senderPeerID == peerID && $0.sender != "system" })?.sender
+            }
+
+            if viewModel.isSelfSender(peerID: peerID, displayName: selectedMessageSender) {
+                selectedMessageSender = nil
+                selectedMessageSenderID = nil
+            } else {
+                showMessageActions = true
+            }
+
+        case "geohash":
+            let gh = url.path.trimmingCharacters(in: CharacterSet(charactersIn: "/")).lowercased()
+            let allowed = Set("0123456789bcdefghjkmnpqrstuvwxyz")
+            guard (2...12).contains(gh.count), gh.allSatisfy({ allowed.contains($0) }) else { return }
+
+            func levelForLength(_ len: Int) -> GeohashChannelLevel {
+                switch len {
+                case 0...2: return .region
+                case 3...4: return .province
+                case 5: return .city
+                case 6: return .neighborhood
+                case 7: return .block
+                default: return .block
+                }
+            }
+
+            let level = levelForLength(gh.count)
+            let channel = GeohashChannel(level: level, geohash: gh)
+
+            let inRegional = LocationChannelManager.shared.availableChannels.contains { $0.geohash == gh }
+            if !inRegional && !LocationChannelManager.shared.availableChannels.isEmpty {
+                LocationChannelManager.shared.markTeleported(for: gh, true)
+            }
+            LocationChannelManager.shared.select(ChannelID.location(channel))
+
+        default:
+            return
+        }
+    }
+
+    func scrollToBottom(on proxy: ScrollViewProxy) {
+        isAtBottom = true
+        if let targetPeerID {
+            proxy.scrollTo(targetPeerID, anchor: .bottom)
+        }
+        DispatchQueue.main.asyncAfter(deadline: .now() + 0.05) {
+            if let secondTarget = self.targetPeerID {
+                proxy.scrollTo(secondTarget, anchor: .bottom)
+            }
+        }
+    }
+
+    var targetPeerID: String? {
+        if let peer = privatePeer,
+           let last = viewModel.getPrivateChatMessages(for: peer).suffix(300).last?.id {
+            return "dm:\(peer)|\(last)"
+        }
+        if let last = viewModel.messages.suffix(300).last?.id {
+            return "\(locationManager.selectedChannel.contextKey)|\(last)"
+        }
+        return nil
+    }
+
+    func onMessagesChange(proxy: ScrollViewProxy) {
+        guard privatePeer == nil, let lastMsg = viewModel.messages.last else { return }
+
+        // If the newest message is from me, always scroll to bottom
+        let isFromSelf = (lastMsg.sender == viewModel.nickname) || lastMsg.sender.hasPrefix(viewModel.nickname + "#")
+        if !isFromSelf && !isAtBottom { // Only autoscroll when user is at/near bottom
+            return
+        } else { // Ensure we consider ourselves at bottom for subsequent messages
+            isAtBottom = true
+        }
+
+        func scrollIfNeeded(date: Date) {
+            lastScrollTime = date
+            let contextKey = locationManager.selectedChannel.contextKey
+            if let target = viewModel.messages.suffix(windowCountPublic).last.map({ "\(contextKey)|\($0.id)" }) {
+                proxy.scrollTo(target, anchor: .bottom)
+            }
+        }
+
+        // Throttle scroll animations to prevent excessive UI updates
+        let now = Date()
+        if now.timeIntervalSince(lastScrollTime) > TransportConfig.uiScrollThrottleSeconds {
+            // Immediate scroll if enough time has passed
+            scrollIfNeeded(date: now)
+        } else {
+            // Schedule a delayed scroll
+            scrollThrottleTimer?.invalidate()
+            scrollThrottleTimer = Timer.scheduledTimer(withTimeInterval: TransportConfig.uiScrollThrottleSeconds, repeats: false) { _ in
+                Task { @MainActor in
+                    scrollIfNeeded(date: Date())
+                }
+            }
+        }
+    }
+
+    func onPrivateChatsChange(proxy: ScrollViewProxy) {
+        guard let peerID = privatePeer, let messages = viewModel.privateChats[peerID], let lastMsg = messages.last else {
+            return
+        }
+
+        // If the newest private message is from me, always scroll
+        let isFromSelf = (lastMsg.sender == viewModel.nickname) || lastMsg.sender.hasPrefix(viewModel.nickname + "#")
+        if !isFromSelf && !isAtBottom { // Only autoscroll when user is at/near bottom
+            return
+        } else {
+            isAtBottom = true
+        }
+
+        func scrollIfNeeded(date: Date) {
+            lastScrollTime = date
+            let contextKey = "dm:\(peerID)"
+            let count = windowCountPrivate[peerID] ?? 300
+            if let target = messages.suffix(count).last.map({ "\(contextKey)|\($0.id)" }){
+                proxy.scrollTo(target, anchor: .bottom)
+            }
+        }
+
+        // Same throttling for private chats
+        let now = Date()
+        if now.timeIntervalSince(lastScrollTime) > TransportConfig.uiScrollThrottleSeconds {
+            scrollIfNeeded(date: now)
+        } else {
+            scrollThrottleTimer?.invalidate()
+            scrollThrottleTimer = Timer.scheduledTimer(withTimeInterval: TransportConfig.uiScrollThrottleSeconds, repeats: false) { _ in
+                Task { @MainActor in
+                    scrollIfNeeded(date: Date())
+                }
+            }
+        }
+    }
+
+    func onSelectedChannelChange(_ channel: ChannelID, proxy: ScrollViewProxy) {
+        // When switching to a new geohash channel, scroll to the bottom
+        guard privatePeer == nil else { return }
+        switch channel {
+        case .mesh:
+            break
+        case .location(let ch):
+            // Reset window size
+            isAtBottom = true
+            windowCountPublic = TransportConfig.uiWindowInitialCountPublic
+            let contextKey = "geo:\(ch.geohash)"
+            if let target = viewModel.messages.suffix(windowCountPublic).last?.id.map({ "\(contextKey)|\($0)" }) {
+                proxy.scrollTo(target, anchor: .bottom)
+            }
+        }
+    }
+}
+
+private extension ChannelID {
+    var contextKey: String {
+        switch self {
+        case .mesh:             "mesh"
+        case .location(let ch): "geo:\(ch.geohash)"
+        }
+    }
+}
+
+//#Preview {
+//    MessageListView()
+//}
@@ -5,21 +5,6 @@

 import Foundation

-private enum RegexCache {
-    static let cashu: NSRegularExpression = {
-        try! NSRegularExpression(pattern: "\\bcashu[AB][A-Za-z0-9._-]{40,}\\b", options: [])
-    }()
-    static let lightningScheme: NSRegularExpression = {
-        try! NSRegularExpression(pattern: "(?i)\\blightning:[^\\s]+", options: [])
-    }()
-    static let bolt11: NSRegularExpression = {
-        try! NSRegularExpression(pattern: "(?i)\\bln(bc|tb|bcrt)[0-9][a-z0-9]{50,}\\b", options: [])
-    }()
-    static let lnurl: NSRegularExpression = {
-        try! NSRegularExpression(pattern: "(?i)\\blnurl1[a-z0-9]{20,}\\b", options: [])
-    }()
-}
-
 extension String {
    // Detect if there is an extremely long token (no whitespace/newlines) that could break layout
    func hasVeryLongToken(threshold: Int) -> Bool {
@@ -38,7 +23,7 @@ extension String {

    // Extract up to `max` Cashu tokens (cashuA/cashuB). Allow dot '.' and shorter lengths.
    func extractCashuLinks(max: Int = 3) -> [String] {
-        let regex = RegexCache.cashu
+        let regex = MessageFormattingEngine.Patterns.cashu
        let ns = self as NSString
        let range = NSRange(location: 0, length: ns.length)
        var found: [String] = []
@@ -59,19 +44,19 @@ extension String {
        let ns = self as NSString
        let full = NSRange(location: 0, length: ns.length)
        // lightning: scheme
-        for m in RegexCache.lightningScheme.matches(in: self, range: full) {
+        for m in MessageFormattingEngine.Patterns.lightningScheme.matches(in: self, range: full) {
            let s = ns.substring(with: m.range(at: 0))
            results.append(s)
            if results.count >= max { return results }
        }
        // BOLT11
-        for m in RegexCache.bolt11.matches(in: self, range: full) {
+        for m in MessageFormattingEngine.Patterns.bolt11.matches(in: self, range: full) {
            let s = ns.substring(with: m.range(at: 0))
            results.append("lightning:\(s)")
            if results.count >= max { return results }
        }
        // LNURL bech32
-        for m in RegexCache.lnurl.matches(in: self, range: full) {
+        for m in MessageFormattingEngine.Patterns.lnurl.matches(in: self, range: full) {
            let s = ns.substring(with: m.range(at: 0))
            results.append("lightning:\(s)")
            if results.count >= max { return results }
@@ -1,3 +1,4 @@
+import Nostr
 import SwiftUI
 import CoreImage
 import CoreImage.CIFilterBuiltins
@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
@@ -0,0 +1,21 @@
+{
+  "images" : [
+    {
+      "filename" : "dummy.jpg",
+      "idiom" : "universal",
+      "scale" : "1x"
+    },
+    {
+      "idiom" : "universal",
+      "scale" : "2x"
+    },
+    {
+      "idiom" : "universal",
+      "scale" : "3x"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
@@ -10,32 +10,64 @@ import Foundation

 final class PreviewKeychainManager: KeychainManagerProtocol {
    private var storage: [String: Data] = [:]
+    private var serviceStorage: [String: [String: Data]] = [:]
    init() {}
-    
+
    func saveIdentityKey(_ keyData: Data, forKey key: String) -> Bool {
        storage[key] = keyData
        return true
    }
-    
+
    func getIdentityKey(forKey key: String) -> Data? {
        storage[key]
    }
-    
+
    func deleteIdentityKey(forKey key: String) -> Bool {
        storage.removeValue(forKey: key)
        return true
    }
-    
+
    func deleteAllKeychainData() -> Bool {
        storage.removeAll()
+        serviceStorage.removeAll()
        return true
    }
-    
+
    func secureClear(_ data: inout Data) {}
-    
+
    func secureClear(_ string: inout String) {}
-    
+
    func verifyIdentityKeyExists() -> Bool {
        storage["identity_noiseStaticKey"] != nil
    }
+
+    // BCH-01-009: New methods with proper error classification
+    func getIdentityKeyWithResult(forKey key: String) -> KeychainReadResult {
+        if let data = storage[key] {
+            return .success(data)
+        }
+        return .itemNotFound
+    }
+
+    func saveIdentityKeyWithResult(_ keyData: Data, forKey key: String) -> KeychainSaveResult {
+        storage[key] = keyData
+        return .success
+    }
+
+    // MARK: - Generic Data Storage (consolidated from KeychainHelper)
+
+    func save(key: String, data: Data, service: String, accessible: CFString?) {
+        if serviceStorage[service] == nil {
+            serviceStorage[service] = [:]
+        }
+        serviceStorage[service]?[key] = data
+    }
+
+    func load(key: String, service: String) -> Data? {
+        serviceStorage[service]?[key]
+    }
+
+    func delete(key: String, service: String) {
+        serviceStorage[service]?.removeValue(forKey: key)
+    }
 }
@@ -6,7 +6,7 @@
 	<true/>
 	<key>com.apple.security.application-groups</key>
 	<array>
-		<string>group.chat.bitchat</string>
+		<string>$(APP_GROUP_ID)</string>
 	</array>
 	<key>com.apple.security.device.bluetooth</key>
 	<true/>
@@ -6,7 +6,7 @@
 	<true/>
 	<key>com.apple.security.application-groups</key>
 	<array>
-		<string>group.chat.bitchat</string>
+		<string>$(APP_GROUP_ID)</string>
 	</array>
 	<key>com.apple.security.device.bluetooth</key>
 	<true/>
@@ -2,6 +2,8 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>AppGroupID</key>
+	<string>$(APP_GROUP_ID)</string>
 	<key>CFBundleDevelopmentRegion</key>
 	<string>$(DEVELOPMENT_LANGUAGE)</string>
 	<key>CFBundleDisplayName</key>
@@ -13,7 +13,7 @@ import UniformTypeIdentifiers
 /// Avoids deprecated Social framework and SLComposeServiceViewController.
 final class ShareViewController: UIViewController {
    // Bundle.main.bundleIdentifier would get the extension's bundleID
-    private static let groupID = "group.chat.bitchat"
+    private static let groupID = Bundle.main.object(forInfoDictionaryKey: "AppGroupID") as? String ?? "group.chat.bitchat"

    private enum Strings {
        static let nothingToShare = String(localized: "share.status.nothing_to_share", comment: "Shown when the share extension receives no content")
@@ -6,7 +6,7 @@
 	<true/>
 	<key>com.apple.security.application-groups</key>
 	<array>
-		<string>group.chat.bitchat</string>
+		<string>$(APP_GROUP_ID)</string>
 	</array>
 </dict>
 </plist>
@@ -0,0 +1,155 @@
+//
+// BLEServiceCoreTests.swift
+// bitchatTests
+//
+// Focused BLEService tests for packet handling behavior.
+//
+
+import Testing
+import Nostr
+import Foundation
+import CoreBluetooth
+import BitFoundation
+@testable import bitchat
+
+struct BLEServiceCoreTests {
+
+    @Test
+    func duplicatePacket_isDeduped() async {
+        let ble = makeService()
+        let delegate = PublicCaptureDelegate()
+        ble.delegate = delegate
+
+        let sender = PeerID(str: "1122334455667788")
+        let timestamp = UInt64(Date().timeIntervalSince1970 * 1000)
+        let packet = makePublicPacket(content: "Hello", sender: sender, timestamp: timestamp)
+
+        ble._test_handlePacket(packet, fromPeerID: sender)
+        let receivedFirst = await TestHelpers.waitUntil(
+            { delegate.publicMessagesSnapshot().count == 1 },
+            timeout: TestConstants.defaultTimeout
+        )
+        #expect(receivedFirst)
+
+        ble._test_handlePacket(packet, fromPeerID: sender)
+        let receivedDuplicate = await TestHelpers.waitUntil(
+            { delegate.publicMessagesSnapshot().count > 1 },
+            timeout: TestConstants.shortTimeout
+        )
+        #expect(!receivedDuplicate)
+
+        let messages = delegate.publicMessagesSnapshot()
+        #expect(messages.count == 1)
+        #expect(messages.first?.content == "Hello")
+    }
+
+    @Test
+    func staleBroadcast_isIgnored() async {
+        let ble = makeService()
+        let delegate = PublicCaptureDelegate()
+        ble.delegate = delegate
+
+        let sender = PeerID(str: "A1B2C3D4E5F60708")
+        let oldTimestamp = UInt64(Date().addingTimeInterval(-901).timeIntervalSince1970 * 1000)
+        let packet = makePublicPacket(content: "Old", sender: sender, timestamp: oldTimestamp)
+
+        ble._test_handlePacket(packet, fromPeerID: sender)
+
+        let didReceive = await TestHelpers.waitUntil({ !delegate.publicMessagesSnapshot().isEmpty }, timeout: 0.3)
+        #expect(!didReceive)
+        #expect(delegate.publicMessagesSnapshot().isEmpty)
+    }
+
+    @Test
+    func announceSenderMismatch_isRejected() async throws {
+        let ble = makeService()
+
+        let signer = NoiseEncryptionService(keychain: MockKeychain())
+        let announcement = AnnouncementPacket(
+            nickname: "Spoof",
+            noisePublicKey: signer.getStaticPublicKeyData(),
+            signingPublicKey: signer.getSigningPublicKeyData(),
+            directNeighbors: nil
+        )
+        let payload = try #require(announcement.encode(), "Failed to encode announcement")
+
+        let derivedPeerID = PeerID(publicKey: announcement.noisePublicKey)
+        let wrongFirst = derivedPeerID.bare.first == "0" ? "1" : "0"
+        let wrongBare = String(wrongFirst) + String(derivedPeerID.bare.dropFirst())
+        let wrongPeerID = PeerID(str: wrongBare)
+        let packet = BitchatPacket(
+            type: MessageType.announce.rawValue,
+            senderID: Data(hexString: wrongPeerID.id) ?? Data(),
+            recipientID: nil,
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
+            payload: payload,
+            signature: nil,
+            ttl: 7
+        )
+        let signed = try #require(signer.signPacket(packet), "Failed to sign announce packet")
+
+        ble._test_handlePacket(signed, fromPeerID: wrongPeerID, preseedPeer: false)
+
+        _ = await TestHelpers.waitUntil({ !ble.currentPeerSnapshots().isEmpty }, timeout: 0.3)
+        #expect(ble.currentPeerSnapshots().isEmpty)
+    }
+}
+
+private func makeService() -> BLEService {
+    let keychain = MockKeychain()
+    let identityManager = MockIdentityManager(keychain)
+    let idBridge = NostrIdentityBridge(keychain: MockKeychainHelper())
+    return BLEService(
+        keychain: keychain,
+        idBridge: idBridge,
+        identityManager: identityManager,
+        initializeBluetoothManagers: false
+    )
+}
+
+private func makePublicPacket(content: String, sender: PeerID, timestamp: UInt64) -> BitchatPacket {
+    BitchatPacket(
+        type: MessageType.message.rawValue,
+        senderID: Data(hexString: sender.id) ?? Data(),
+        recipientID: nil,
+        timestamp: timestamp,
+        payload: Data(content.utf8),
+        signature: nil,
+        ttl: 3
+    )
+}
+
+private final class PublicCaptureDelegate: BitchatDelegate {
+    private let lock = NSLock()
+    private(set) var publicMessages: [BitchatMessage] = []
+
+    func didReceivePublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date, messageID: String?) {
+        let message = BitchatMessage(
+            id: messageID,
+            sender: nickname,
+            content: content,
+            timestamp: timestamp,
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: false,
+            recipientNickname: nil,
+            senderPeerID: peerID,
+            mentions: nil
+        )
+        lock.lock()
+        publicMessages.append(message)
+        lock.unlock()
+    }
+
+    func didReceiveMessage(_ message: BitchatMessage) {}
+    func didConnectToPeer(_ peerID: PeerID) {}
+    func didDisconnectFromPeer(_ peerID: PeerID) {}
+    func didUpdatePeerList(_ peers: [PeerID]) {}
+    func didUpdateBluetoothState(_ state: CBManagerState) {}
+
+    func publicMessagesSnapshot() -> [BitchatMessage] {
+        lock.lock()
+        defer { lock.unlock() }
+        return publicMessages
+    }
+}
@@ -8,6 +8,7 @@

 import Testing
 import CoreBluetooth
+import BitFoundation
@testable import bitchat

 struct BLEServiceTests {
@@ -73,7 +74,7 @@ struct BLEServiceTests {
            service.sendMessage("Hello, world!")
            
            // Allow async processing
-            try await sleep(0.5)
+            try await sleep(1.0)
        }
        #expect(service.sentMessages.count == 1)
    }
@@ -97,7 +98,7 @@ struct BLEServiceTests {
            )
            
            // Allow async processing
-            try await sleep(0.5)
+            try await sleep(1.0)
        }
        #expect(service.sentMessages.count == 1)
    }
@@ -113,7 +114,7 @@ struct BLEServiceTests {
            service.sendMessage("@alice @bob check this out", mentions: ["alice", "bob"])
            
            // Allow async processing
-            try await sleep(0.5)
+            try await sleep(1.0)
        }
    }
    
@@ -146,7 +147,7 @@ struct BLEServiceTests {
            service.simulateIncomingMessage(incomingMessage)
            
            // Allow async processing
-            try await sleep(0.5)
+            try await sleep(1.0)
        }
    }
    
@@ -189,7 +190,7 @@ struct BLEServiceTests {
            service.simulateIncomingPacket(packet)
            
            // Allow async processing
-            try await sleep(0.5)
+            try await sleep(1.0)
        }
    }
    
@@ -231,7 +232,7 @@ struct BLEServiceTests {
            service.sendMessage("Test delivery")
            
            // Allow async processing
-            try await sleep(0.5)
+            try await sleep(1.0)
        }
    }
    
@@ -273,7 +274,7 @@ struct BLEServiceTests {
            service.simulateIncomingPacket(packet)
            
            // Allow async processing
-            try await sleep(0.5)
+            try await sleep(1.0)
        }
    }
 }
@@ -0,0 +1,84 @@
+import Foundation
+import Testing
+import BitFoundation
+@testable import bitchat
+
+@Suite("BitchatPeer Tests")
+struct BitchatPeerTests {
+    typealias FavoriteRelationship = FavoritesPersistenceService.FavoriteRelationship
+
+    @Test("Connection state prioritizes bluetooth, mesh, nostr, then offline")
+    func connectionStatePriorityIsCorrect() {
+        let peerID = PeerID(str: "0123456789abcdef")
+        let noiseKey = Data((0..<32).map(UInt8.init))
+        let mutual = makeRelationship(isFavorite: true, theyFavoritedUs: true)
+
+        let bluetooth = BitchatPeer(peerID: peerID, noisePublicKey: noiseKey, nickname: "A", isConnected: true, isReachable: true)
+        let mesh = BitchatPeer(peerID: peerID, noisePublicKey: noiseKey, nickname: "A", isConnected: false, isReachable: true)
+        var nostr = BitchatPeer(peerID: peerID, noisePublicKey: noiseKey, nickname: "A", isConnected: false, isReachable: false)
+        nostr.favoriteStatus = mutual
+        let offline = BitchatPeer(peerID: peerID, noisePublicKey: noiseKey, nickname: "A", isConnected: false, isReachable: false)
+
+        #expect(bluetooth.connectionState == .bluetoothConnected)
+        #expect(mesh.connectionState == .meshReachable)
+        #expect(nostr.connectionState == .nostrAvailable)
+        #expect(offline.connectionState == .offline)
+    }
+
+    @Test("Display name falls back to peer prefix and offline icon reflects inbound favorite")
+    func displayNameAndOfflineIconUseDerivedState() {
+        let peerID = PeerID(str: "fedcba9876543210")
+        let noiseKey = Data((32..<64).map(UInt8.init))
+        var peer = BitchatPeer(peerID: peerID, noisePublicKey: noiseKey, nickname: "", isConnected: false, isReachable: false)
+        peer.favoriteStatus = makeRelationship(isFavorite: false, theyFavoritedUs: true)
+
+        #expect(peer.displayName == String(peerID.id.prefix(8)))
+        #expect(peer.statusIcon == "🌙")
+    }
+
+    @Test("Mutual offline peers show Nostr icon")
+    func mutualFavoriteOfflinePeerShowsNostrIcon() {
+        let peerID = PeerID(str: "0011223344556677")
+        let noiseKey = Data((64..<96).map(UInt8.init))
+        var peer = BitchatPeer(peerID: peerID, noisePublicKey: noiseKey, nickname: "Peer", isConnected: false, isReachable: false)
+        peer.favoriteStatus = makeRelationship(isFavorite: true, theyFavoritedUs: true)
+
+        #expect(peer.statusIcon == "🌐")
+        #expect(peer.isFavorite)
+        #expect(peer.isMutualFavorite)
+        #expect(peer.theyFavoritedUs)
+    }
+
+    @Test("Equality is based only on peer ID")
+    func equalityUsesPeerIDOnly() {
+        let peerID = PeerID(str: "8899aabbccddeeff")
+        let first = BitchatPeer(
+            peerID: peerID,
+            noisePublicKey: Data(repeating: 1, count: 32),
+            nickname: "First",
+            isConnected: false,
+            isReachable: false
+        )
+        let second = BitchatPeer(
+            peerID: peerID,
+            noisePublicKey: Data(repeating: 2, count: 32),
+            nickname: "Second",
+            isConnected: true,
+            isReachable: true
+        )
+
+        #expect(first == second)
+    }
+
+    private func makeRelationship(isFavorite: Bool, theyFavoritedUs: Bool) -> FavoriteRelationship {
+        FavoriteRelationship(
+            peerNoisePublicKey: Data(repeating: 7, count: 32),
+            peerNostrPublicKey: "npub1example",
+            peerNickname: "Peer",
+            isFavorite: isFavorite,
+            theyFavoritedUs: theyFavoritedUs,
+            favoritedAt: Date(timeIntervalSince1970: 1),
+            lastUpdated: Date(timeIntervalSince1970: 2)
+        )
+    }
+}
@@ -0,0 +1,230 @@
+//
+// ChatViewModelDeliveryStatusTests.swift
+// bitchatTests
+//
+// Tests for ChatViewModel delivery status state machine.
+//
+
+import Testing
+import Nostr
+import Foundation
+import BitFoundation
+@testable import bitchat
+
+// MARK: - Test Helpers
+
+@MainActor
+private func makeTestableViewModel() -> (viewModel: ChatViewModel, transport: MockTransport) {
+    let keychain = MockKeychain()
+    let keychainHelper = MockKeychainHelper()
+    let idBridge = NostrIdentityBridge(keychain: keychainHelper)
+    let identityManager = MockIdentityManager(keychain)
+    let transport = MockTransport()
+
+    let viewModel = ChatViewModel(
+        keychain: keychain,
+        idBridge: idBridge,
+        identityManager: identityManager,
+        transport: transport
+    )
+
+    return (viewModel, transport)
+}
+
+// MARK: - Delivery Status Tests
+
+struct ChatViewModelDeliveryStatusTests {
+
+    // MARK: - Status Transition Tests
+
+    @Test @MainActor
+    func deliveryStatus_noDowngrade_readToDelivered() async {
+        let (viewModel, transport) = makeTestableViewModel()
+        let peerID = PeerID(str: "0102030405060708")
+        let messageID = "test-msg-1"
+
+        // Setup: create a message with .read status
+        let message = BitchatMessage(
+            id: messageID,
+            sender: viewModel.nickname,
+            content: "Test message",
+            timestamp: Date(),
+            isRelay: false,
+            isPrivate: true,
+            recipientNickname: "Peer",
+            senderPeerID: transport.myPeerID,
+            deliveryStatus: .read(by: "Peer", at: Date())
+        )
+        viewModel.privateChats[peerID] = [message]
+
+        // Action: try to downgrade to .delivered
+        viewModel.didUpdateMessageDeliveryStatus(messageID, status: .delivered(to: "Peer", at: Date()))
+
+        // Assert: status should remain .read (no downgrade)
+        let currentStatus = viewModel.privateChats[peerID]?.first?.deliveryStatus
+        #expect({
+            if case .read = currentStatus { return true }
+            return false
+        }())
+    }
+
+    @Test @MainActor
+    func deliveryStatus_upgrade_sentToDelivered() async {
+        let (viewModel, transport) = makeTestableViewModel()
+        let peerID = PeerID(str: "0102030405060708")
+        let messageID = "test-msg-2"
+
+        // Setup: create a message with .sent status
+        let message = BitchatMessage(
+            id: messageID,
+            sender: viewModel.nickname,
+            content: "Test message",
+            timestamp: Date(),
+            isRelay: false,
+            isPrivate: true,
+            recipientNickname: "Peer",
+            senderPeerID: transport.myPeerID,
+            deliveryStatus: .sent
+        )
+        viewModel.privateChats[peerID] = [message]
+
+        // Action: upgrade to .delivered
+        viewModel.didUpdateMessageDeliveryStatus(messageID, status: .delivered(to: "Peer", at: Date()))
+
+        // Assert: status should be .delivered
+        let currentStatus = viewModel.privateChats[peerID]?.first?.deliveryStatus
+        #expect({
+            if case .delivered = currentStatus { return true }
+            return false
+        }())
+    }
+
+    @Test @MainActor
+    func deliveryStatus_upgrade_deliveredToRead() async {
+        let (viewModel, transport) = makeTestableViewModel()
+        let peerID = PeerID(str: "0102030405060708")
+        let messageID = "test-msg-3"
+
+        // Setup: create a message with .delivered status
+        let message = BitchatMessage(
+            id: messageID,
+            sender: viewModel.nickname,
+            content: "Test message",
+            timestamp: Date(),
+            isRelay: false,
+            isPrivate: true,
+            recipientNickname: "Peer",
+            senderPeerID: transport.myPeerID,
+            deliveryStatus: .delivered(to: "Peer", at: Date().addingTimeInterval(-60))
+        )
+        viewModel.privateChats[peerID] = [message]
+
+        // Action: upgrade to .read
+        viewModel.didUpdateMessageDeliveryStatus(messageID, status: .read(by: "Peer", at: Date()))
+
+        // Assert: status should be .read
+        let currentStatus = viewModel.privateChats[peerID]?.first?.deliveryStatus
+        #expect({
+            if case .read = currentStatus { return true }
+            return false
+        }())
+    }
+
+    // MARK: - Read Receipt Handling
+
+    @Test @MainActor
+    func didReceiveReadReceipt_updatesMessageStatus() async {
+        let (viewModel, transport) = makeTestableViewModel()
+        let peerID = PeerID(str: "0102030405060708")
+        let messageID = "test-msg-4"
+
+        // Setup: create a message with .sent status
+        let message = BitchatMessage(
+            id: messageID,
+            sender: viewModel.nickname,
+            content: "Test message",
+            timestamp: Date(),
+            isRelay: false,
+            isPrivate: true,
+            recipientNickname: "Peer",
+            senderPeerID: transport.myPeerID,
+            deliveryStatus: .sent
+        )
+        viewModel.privateChats[peerID] = [message]
+
+        // Action: receive read receipt
+        let receipt = ReadReceipt(
+            originalMessageID: messageID,
+            readerID: peerID,
+            readerNickname: "Peer"
+        )
+        viewModel.didReceiveReadReceipt(receipt)
+
+        // Assert: status should be .read
+        let currentStatus = viewModel.privateChats[peerID]?.first?.deliveryStatus
+        #expect({
+            if case .read = currentStatus { return true }
+            return false
+        }())
+    }
+
+    // MARK: - Public Timeline Status Tests
+
+    @Test @MainActor
+    func deliveryStatus_publicTimeline_updatesCorrectly() async {
+        let (viewModel, _) = makeTestableViewModel()
+        let messageID = "public-msg-1"
+
+        // Setup: add a message to public timeline with .sending status
+        let message = BitchatMessage(
+            id: messageID,
+            sender: viewModel.nickname,
+            content: "Public message",
+            timestamp: Date(),
+            isRelay: false,
+            isPrivate: false,
+            deliveryStatus: .sending
+        )
+        viewModel.messages.append(message)
+
+        // Action: update to .sent
+        viewModel.didUpdateMessageDeliveryStatus(messageID, status: .sent)
+
+        // Assert
+        let updatedMessage = viewModel.messages.first(where: { $0.id == messageID })
+        #expect({
+            if case .sent = updatedMessage?.deliveryStatus { return true }
+            return false
+        }())
+    }
+
+    // MARK: - Status Rank Tests (for deduplication)
+
+    @Test @MainActor
+    func statusRank_orderingIsCorrect() async {
+        // This tests the implicit ordering used in refreshVisibleMessages
+        // failed < sending < sent < partiallyDelivered < delivered < read
+
+        let statuses: [DeliveryStatus] = [
+            .failed(reason: "test"),
+            .sending,
+            .sent,
+            .partiallyDelivered(reached: 1, total: 3),
+            .delivered(to: "B", at: Date()),
+            .read(by: "C", at: Date())
+        ]
+
+        // Verify each status has a logical progression
+        // This is more of a documentation test to ensure the ranking logic is understood
+        for (index, status) in statuses.enumerated() {
+            switch status {
+            case .failed: #expect(index == 0)
+            case .sending: #expect(index == 1)
+            case .sent: #expect(index == 2)
+            case .partiallyDelivered: #expect(index == 3)
+            case .delivered: #expect(index == 4)
+            case .read: #expect(index == 5)
+            }
+        }
+    }
+}
@@ -0,0 +1,150 @@
+//
+// ChatViewModelRefactoringTests.swift
+// bitchatTests
+//
+// Pinning tests to characterize ChatViewModel behavior before refactoring.
+// These tests act as a safety net to ensure we don't break existing functionality.
+//
+
+import Testing
+import Nostr
+import Foundation
+import BitFoundation
+@testable import bitchat
+
+struct ChatViewModelRefactoringTests {
+
+    // Helper to setup the environment
+    @MainActor
+    private func makePinnedViewModel() -> (viewModel: ChatViewModel, transport: MockTransport, identity: MockIdentityManager) {
+        let keychain = MockKeychain()
+        let keychainHelper = MockKeychainHelper()
+        let idBridge = NostrIdentityBridge(keychain: keychainHelper)
+        let identityManager = MockIdentityManager(keychain)
+        let transport = MockTransport()
+
+        let viewModel = ChatViewModel(
+            keychain: keychain,
+            idBridge: idBridge,
+            identityManager: identityManager,
+            transport: transport
+        )
+
+        return (viewModel, transport, identityManager)
+    }
+
+    // MARK: - Command Processor Integration "Pinning"
+    
+    @Test @MainActor
+    func command_msg_routesToTransport() async throws {
+        let (viewModel, transport, _) = makePinnedViewModel()
+        
+        // Setup: Use simulateConnect so ChatViewModel and UnifiedPeerService are notified
+        let peerID = PeerID(str: "0000000000000001")
+        transport.simulateConnect(peerID, nickname: "alice")
+
+        let didResolve = await TestHelpers.waitUntil({ viewModel.getPeerIDForNickname("alice") != nil },
+                                                     timeout: TestConstants.shortTimeout)
+        #expect(didResolve)
+        
+        // Action: User types /msg command
+        viewModel.sendMessage("/msg @alice Hello Private World")
+
+        let didSend = await TestHelpers.waitUntil({ transport.sentPrivateMessages.count == 1 },
+                                                  timeout: TestConstants.shortTimeout)
+        #expect(didSend)
+        
+        // Assert:
+        // 1. Should NOT go to public transport
+        #expect(transport.sentMessages.isEmpty, "Command should not be sent as public message")
+        
+        // 2. Should go to private transport logic
+        #expect(transport.sentPrivateMessages.count == 1)
+        #expect(transport.sentPrivateMessages.first?.content == "Hello Private World")
+        #expect(transport.sentPrivateMessages.first?.peerID == peerID)
+    }
+
+    @Test @MainActor
+    func command_block_updatesIdentity() async throws {
+        let (viewModel, transport, identity) = makePinnedViewModel()
+        
+        // Setup: Use simulateConnect
+        let peerID = PeerID(str: "0000000000000002")
+        // Mock the fingerprint so the block command finds it
+        transport.peerFingerprints[peerID] = "fingerprint_123"
+        transport.simulateConnect(peerID, nickname: "troll")
+
+        let didResolve = await TestHelpers.waitUntil({ viewModel.getPeerIDForNickname("troll") != nil },
+                                                     timeout: TestConstants.shortTimeout)
+        #expect(didResolve)
+        
+        // Action
+        viewModel.sendMessage("/block @troll")
+        
+        // Assert
+        // Verify identity manager was called to block "fingerprint_123"
+        let didBlock = await TestHelpers.waitUntil({ identity.isBlocked(fingerprint: "fingerprint_123") },
+                                                   timeout: TestConstants.shortTimeout)
+        #expect(didBlock)
+    }
+
+    // MARK: - Message Routing Logic
+
+    @Test @MainActor
+    func routing_incomingPrivateMessage_addsToPrivateChats() async {
+        let (viewModel, _, _) = makePinnedViewModel()
+        let senderID = PeerID(str: "sender_1")
+
+        // Setup
+        let message = BitchatMessage(
+            id: "msg_1",
+            sender: "bob",
+            content: "Secret",
+            timestamp: Date(),
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: true,
+            recipientNickname: "me",
+            senderPeerID: senderID,
+            mentions: nil
+        )
+
+        // Action: Simulate incoming private message
+        viewModel.didReceiveMessage(message)
+
+        // Wait for async processing with proper timeout
+        let found = await TestHelpers.waitUntil(
+            { viewModel.privateChats[senderID]?.first?.content == "Secret" },
+            timeout: TestConstants.defaultTimeout
+        )
+
+        // Assert
+        #expect(found)
+    }
+
+    @Test @MainActor
+    func routing_incomingPublicMessage_addsToPublicTimeline() async {
+        let (viewModel, _, _) = makePinnedViewModel()
+        let senderID = PeerID(str: "sender_2")
+
+        // Action
+        viewModel.didReceivePublicMessage(
+            from: senderID,
+            nickname: "charlie",
+            content: "Public Hi",
+            timestamp: Date(),
+            messageID: "msg_2"
+        )
+
+        // Wait for async processing with proper timeout
+        let found = await TestHelpers.waitUntil(
+            {
+                viewModel.timelineStore.messages(for: .mesh).contains(where: { $0.content == "Public Hi" })
+            },
+            timeout: TestConstants.defaultTimeout
+        )
+
+        // Assert
+        #expect(found)
+    }
+}
@@ -0,0 +1,519 @@
+//
+// ChatViewModelTests.swift
+// bitchatTests
+//
+// Tests for ChatViewModel using MockTransport for isolation.
+// This is free and unencumbered software released into the public domain.
+//
+
+import Testing
+import Nostr
+import Foundation
+import BitFoundation
+@testable import bitchat
+
+// MARK: - Test Helpers
+
+/// Creates a ChatViewModel with mock dependencies for testing
+@MainActor
+private func makeTestableViewModel() -> (viewModel: ChatViewModel, transport: MockTransport) {
+    let keychain = MockKeychain()
+    let keychainHelper = MockKeychainHelper()
+    let idBridge = NostrIdentityBridge(keychain: keychainHelper)
+    let identityManager = MockIdentityManager(keychain)
+    let transport = MockTransport()
+
+    let viewModel = ChatViewModel(
+        keychain: keychain,
+        idBridge: idBridge,
+        identityManager: identityManager,
+        transport: transport
+    )
+
+    return (viewModel, transport)
+}
+
+// MARK: - Initialization Tests
+
+struct ChatViewModelInitializationTests {
+
+    @Test @MainActor
+    func initialization_setsDelegate() async {
+        let (viewModel, transport) = makeTestableViewModel()
+
+        // The viewModel should set itself as the transport delegate
+        #expect(transport.delegate === viewModel)
+    }
+
+    @Test @MainActor
+    func initialization_startsServices() async {
+        let (_, transport) = makeTestableViewModel()
+
+        // Services should be started during init
+        #expect(transport.startServicesCallCount == 1)
+    }
+
+    @Test @MainActor
+    func initialization_hasEmptyMessageList() async {
+        let (viewModel, _) = makeTestableViewModel()
+
+        // Initial messages may include system messages, but should be limited
+        #expect(viewModel.messages.count < 10)
+    }
+
+    @Test @MainActor
+    func initialization_setsNickname() async {
+        let (_, transport) = makeTestableViewModel()
+
+        // Nickname should be set during init
+        #expect(!transport.myNickname.isEmpty)
+    }
+}
+
+// MARK: - Message Sending Tests
+
+struct ChatViewModelSendingTests {
+
+    @Test @MainActor
+    func sendMessage_delegatesToTransport() async {
+        let (viewModel, transport) = makeTestableViewModel()
+
+        viewModel.sendMessage("Hello World")
+
+        #expect(transport.sentMessages.count == 1)
+        #expect(transport.sentMessages.first?.content == "Hello World")
+    }
+
+    @Test @MainActor
+    func sendMessage_emptyContent_ignored() async {
+        let (viewModel, transport) = makeTestableViewModel()
+
+        viewModel.sendMessage("")
+        viewModel.sendMessage("   ")
+        viewModel.sendMessage("\n\t")
+
+        #expect(transport.sentMessages.isEmpty)
+    }
+
+    @Test @MainActor
+    func sendMessage_withMentions_sendsContent() async {
+        let (viewModel, transport) = makeTestableViewModel()
+
+        viewModel.sendMessage("Hello @alice")
+
+        #expect(transport.sentMessages.count == 1)
+        #expect(transport.sentMessages.first?.content == "Hello @alice")
+    }
+
+    @Test @MainActor
+    func sendMessage_command_notSentToTransport() async {
+        let (viewModel, transport) = makeTestableViewModel()
+
+        viewModel.sendMessage("/help")
+
+        // Commands are processed locally, not sent to transport
+        #expect(transport.sentMessages.isEmpty)
+    }
+}
+
+// MARK: - Command Handling Tests
+
+struct ChatViewModelCommandTests {
+
+    @Test @MainActor
+    func sendMessage_commandsNotSentToTransport() async {
+        let (viewModel, transport) = makeTestableViewModel()
+        let commands = ["/nick bob", "/who", "/help", "/clear"]
+
+        for command in commands {
+            transport.resetRecordings()
+            viewModel.sendMessage(command)
+            try? await Task.sleep(nanoseconds: 100_000_000)
+
+            #expect(transport.sentMessages.isEmpty)
+            #expect(transport.sentPrivateMessages.isEmpty)
+        }
+    }
+}
+
+// MARK: - Timeline Cap Tests
+
+struct ChatViewModelTimelineCapTests {
+
+    @Test @MainActor
+    func sendMessage_trimsTimelineToCap() async {
+        let (viewModel, _) = makeTestableViewModel()
+        let total = TransportConfig.meshTimelineCap + 5
+
+        for i in 0..<total {
+            viewModel.sendMessage("cap-msg-\(i)")
+        }
+
+        #expect(viewModel.messages.count == TransportConfig.meshTimelineCap)
+        #expect(viewModel.messages.last?.content == "cap-msg-\(total - 1)")
+    }
+}
+
+// MARK: - Message Receiving Tests
+
+struct ChatViewModelReceivingTests {
+
+    @Test @MainActor
+    func didReceiveMessage_callsDelegate() async {
+        let (_, transport) = makeTestableViewModel()
+
+        let message = BitchatMessage(
+            id: "msg-001",
+            sender: "Alice",
+            content: "Hello from Alice",
+            timestamp: Date(),
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: false,
+            recipientNickname: nil,
+            senderPeerID: PeerID(str: "PEER001"),
+            mentions: nil
+        )
+
+        transport.simulateIncomingMessage(message)
+
+        // Give time for Task and pipeline processing
+        try? await Task.sleep(nanoseconds: 200_000_000)
+
+        // Message may or may not appear due to rate limiting/pipeline batching
+        // The important thing is no crash and delegate was called
+        #expect(transport.delegate != nil)
+    }
+
+    @Test @MainActor
+    func didReceivePublicMessage_addsToTimeline() async {
+        let (viewModel, transport) = makeTestableViewModel()
+
+        transport.simulateIncomingPublicMessage(
+            from: PeerID(str: "PEER002"),
+            nickname: "Bob",
+            content: "Public hello from Bob",
+            timestamp: Date(),
+            messageID: "pub-001"
+        )
+
+        let found = await TestHelpers.waitUntil({
+            viewModel.timelineStore.messages(for: .mesh).contains { $0.content == "Public hello from Bob" }
+        }, timeout: TestConstants.defaultTimeout)
+
+        #expect(found)
+    }
+}
+
+// MARK: - Rate Limiting Tests
+
+struct ChatViewModelRateLimitingTests {
+
+    @Test @MainActor
+    func handlePublicMessage_rateLimitsBurstBySender() async {
+        let (viewModel, _) = makeTestableViewModel()
+        let senderID = PeerID(str: "1122334455667788")
+        let now = Date()
+
+        for i in 0..<6 {
+            let message = BitchatMessage(
+                id: "rate-\(i)",
+                sender: "Spammer",
+                content: "rate-msg-\(i)",
+                timestamp: now,
+                isRelay: false,
+                originalSender: nil,
+                isPrivate: false,
+                recipientNickname: nil,
+                senderPeerID: senderID,
+                mentions: nil
+            )
+            viewModel.handlePublicMessage(message)
+        }
+
+        viewModel.publicMessagePipeline.flushIfNeeded()
+
+        let burstMessages = viewModel.messages.filter { $0.content.hasPrefix("rate-msg-") }
+        #expect(burstMessages.count == 5)
+        #expect(!burstMessages.contains { $0.content == "rate-msg-5" })
+    }
+}
+
+// MARK: - Peer Connection Tests
+
+struct ChatViewModelPeerTests {
+
+    @Test @MainActor
+    func didConnectToPeer_notifiesDelegate() async {
+        let (_, transport) = makeTestableViewModel()
+        let peerID = PeerID(str: "NEWPEER")
+
+        transport.simulateConnect(peerID, nickname: "NewUser")
+
+        #expect(transport.connectedPeers.contains(peerID))
+    }
+
+    @Test @MainActor
+    func didDisconnectFromPeer_notifiesDelegate() async {
+        let (_, transport) = makeTestableViewModel()
+        let peerID = PeerID(str: "OLDPEER")
+
+        transport.simulateConnect(peerID, nickname: "OldUser")
+        transport.simulateDisconnect(peerID)
+
+        #expect(!transport.connectedPeers.contains(peerID))
+    }
+
+    @Test @MainActor
+    func isPeerConnected_delegatesToTransport() async {
+        let (_, transport) = makeTestableViewModel()
+        let peerID = PeerID(str: "TESTPEER")
+
+        // Not connected initially
+        #expect(!transport.isPeerConnected(peerID))
+
+        transport.connectedPeers.insert(peerID)
+
+        #expect(transport.isPeerConnected(peerID))
+    }
+}
+
+// MARK: - Deduplication Integration Tests
+//
+// Note: Detailed deduplication logic is tested in MessageDeduplicationServiceTests.
+// These tests verify that ChatViewModel has a deduplication service configured.
+
+struct ChatViewModelDeduplicationTests {
+
+    @Test @MainActor
+    func deduplicationService_isConfigured() async {
+        let (viewModel, _) = makeTestableViewModel()
+
+        // Verify the deduplication service is available and functional
+        // by checking that we can record and query content
+        let testContent = "Test dedup content \(UUID().uuidString)"
+        let testDate = Date()
+
+        viewModel.deduplicationService.recordContent(testContent, timestamp: testDate)
+
+        let retrieved = viewModel.deduplicationService.contentTimestamp(for: testContent)
+        #expect(retrieved == testDate)
+    }
+
+    @Test @MainActor
+    func deduplicationService_normalizedKey_consistent() async {
+        let (viewModel, _) = makeTestableViewModel()
+
+        let content = "Hello World"
+        let key1 = viewModel.deduplicationService.normalizedContentKey(content)
+        let key2 = viewModel.deduplicationService.normalizedContentKey(content)
+
+        #expect(key1 == key2)
+    }
+}
+
+// MARK: - Private Chat Tests
+
+struct ChatViewModelPrivateChatTests {
+
+    @Test @MainActor
+    func sendPrivateMessage_delegatesToTransport() async {
+        let (viewModel, transport) = makeTestableViewModel()
+        let recipientID = PeerID(str: "RECIPIENT")
+
+        // Set up connected peer for routing
+        transport.connectedPeers.insert(recipientID)
+        transport.peerNicknames[recipientID] = "Recipient"
+
+        viewModel.sendPrivateMessage("Secret message", to: recipientID)
+
+        // The message routing depends on connection state and other factors
+        // At minimum, it should not crash
+        #expect(true) // If we get here without crash, the test passes
+    }
+}
+
+// MARK: - Private Chat Selection Tests
+
+struct ChatViewModelPrivateChatSelectionTests {
+
+    @Test @MainActor
+    func openMostRelevantPrivateChat_prefersUnreadMostRecent() async {
+        let (viewModel, _) = makeTestableViewModel()
+        let peerA = PeerID(str: "PEER_A")
+        let peerB = PeerID(str: "PEER_B")
+
+        let older = Date().addingTimeInterval(-120)
+        let newer = Date().addingTimeInterval(-30)
+
+        viewModel.privateChats = [
+            peerA: [
+                BitchatMessage(
+                    id: "a-1",
+                    sender: "A",
+                    content: "Old",
+                    timestamp: older,
+                    isRelay: false,
+                    isPrivate: true,
+                    recipientNickname: "Me",
+                    senderPeerID: peerA
+                )
+            ],
+            peerB: [
+                BitchatMessage(
+                    id: "b-1",
+                    sender: "B",
+                    content: "New",
+                    timestamp: newer,
+                    isRelay: false,
+                    isPrivate: true,
+                    recipientNickname: "Me",
+                    senderPeerID: peerB
+                )
+            ]
+        ]
+        viewModel.unreadPrivateMessages = [peerA, peerB]
+
+        viewModel.openMostRelevantPrivateChat()
+
+        #expect(viewModel.selectedPrivateChatPeer == peerB)
+    }
+
+    @Test @MainActor
+    func openMostRelevantPrivateChat_fallsBackToMostRecentChat() async {
+        let (viewModel, _) = makeTestableViewModel()
+        let peerA = PeerID(str: "PEER_A")
+        let peerB = PeerID(str: "PEER_B")
+
+        let older = Date().addingTimeInterval(-200)
+        let newer = Date().addingTimeInterval(-20)
+
+        viewModel.privateChats = [
+            peerA: [
+                BitchatMessage(
+                    id: "a-1",
+                    sender: "A",
+                    content: "Old",
+                    timestamp: older,
+                    isRelay: false,
+                    isPrivate: true,
+                    recipientNickname: "Me",
+                    senderPeerID: peerA
+                )
+            ],
+            peerB: [
+                BitchatMessage(
+                    id: "b-1",
+                    sender: "B",
+                    content: "New",
+                    timestamp: newer,
+                    isRelay: false,
+                    isPrivate: true,
+                    recipientNickname: "Me",
+                    senderPeerID: peerB
+                )
+            ]
+        ]
+
+        viewModel.openMostRelevantPrivateChat()
+
+        #expect(viewModel.selectedPrivateChatPeer == peerB)
+    }
+}
+
+// MARK: - Bluetooth State Tests
+
+struct ChatViewModelBluetoothTests {
+
+    @Test @MainActor
+    func didUpdateBluetoothState_poweredOn_noAlert() async {
+        let (viewModel, transport) = makeTestableViewModel()
+
+        transport.simulateBluetoothStateChange(.poweredOn)
+
+        // Give time for async processing
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        #expect(!viewModel.showBluetoothAlert)
+    }
+
+    @Test @MainActor
+    func didUpdateBluetoothState_poweredOff_showsAlert() async {
+        let (viewModel, transport) = makeTestableViewModel()
+
+        transport.simulateBluetoothStateChange(.poweredOff)
+
+        // Give time for async processing
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        #expect(viewModel.showBluetoothAlert)
+    }
+
+    @Test @MainActor
+    func didUpdateBluetoothState_unauthorized_showsAlert() async {
+        let (viewModel, transport) = makeTestableViewModel()
+
+        transport.simulateBluetoothStateChange(.unauthorized)
+
+        // Give time for async processing
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        #expect(viewModel.showBluetoothAlert)
+    }
+}
+
+// MARK: - Panic Clear Tests
+
+struct ChatViewModelPanicTests {
+
+    @Test @MainActor
+    func panicClearAllData_delegatesToTransport() async {
+        let (viewModel, transport) = makeTestableViewModel()
+
+        // Set up some state
+        transport.connectedPeers.insert(PeerID(str: "PEER1"))
+        viewModel.messages = [
+            BitchatMessage(
+                id: "panic-1",
+                sender: "Tester",
+                content: "Before",
+                timestamp: Date(),
+                isRelay: false
+            )
+        ]
+        viewModel.privateChats[PeerID(str: "PEER1")] = [
+            BitchatMessage(
+                id: "pm-1",
+                sender: "Peer",
+                content: "Secret",
+                timestamp: Date(),
+                isRelay: false,
+                isPrivate: true,
+                recipientNickname: "Me",
+                senderPeerID: PeerID(str: "PEER1")
+            )
+        ]
+        viewModel.unreadPrivateMessages.insert(PeerID(str: "PEER1"))
+
+        viewModel.panicClearAllData()
+
+        // After panic, emergency disconnect should be called
+        #expect(transport.emergencyDisconnectCallCount == 1)
+        #expect(viewModel.messages.isEmpty)
+        #expect(viewModel.privateChats.isEmpty)
+        #expect(viewModel.unreadPrivateMessages.isEmpty)
+        #expect(viewModel.selectedPrivateChatPeer == nil)
+    }
+}
+
+// MARK: - Service Lifecycle Tests
+
+struct ChatViewModelLifecycleTests {
+
+    @Test @MainActor
+    func startServices_calledOnInit() async {
+        let (_, transport) = makeTestableViewModel()
+
+        #expect(transport.startServicesCallCount == 1)
+    }
+}
@@ -0,0 +1,179 @@
+//
+// ChatViewModelTorTests.swift
+// bitchatTests
+//
+// Tests for ChatViewModel+Tor.swift Tor lifecycle notification handlers.
+//
+
+import Testing
+import Nostr
+import Foundation
+@testable import bitchat
+
+// MARK: - Test Helpers
+
+@MainActor
+private func makeTestableViewModel() -> (viewModel: ChatViewModel, transport: MockTransport) {
+    let keychain = MockKeychain()
+    let keychainHelper = MockKeychainHelper()
+    let idBridge = NostrIdentityBridge(keychain: keychainHelper)
+    let identityManager = MockIdentityManager(keychain)
+    let transport = MockTransport()
+
+    let viewModel = ChatViewModel(
+        keychain: keychain,
+        idBridge: idBridge,
+        identityManager: identityManager,
+        transport: transport
+    )
+
+    return (viewModel, transport)
+}
+
+// MARK: - Tor Notification Handler Tests
+
+struct ChatViewModelTorTests {
+
+    // MARK: - handleTorWillStart Tests
+
+    @Test @MainActor
+    func handleTorWillStart_whenEnforced_setsAnnouncedFlag() async {
+        let (viewModel, _) = makeTestableViewModel()
+
+        // Precondition: flag should start false
+        #expect(!viewModel.torStatusAnnounced)
+
+        // Action: simulate Tor starting notification
+        viewModel.handleTorWillStart()
+
+        // Wait for Task to complete
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        // Assert: flag should be set (torEnforced is true in tests)
+        #expect(viewModel.torStatusAnnounced)
+    }
+
+    @Test @MainActor
+    func handleTorWillStart_whenAlreadyAnnounced_doesNotDuplicate() async {
+        let (viewModel, _) = makeTestableViewModel()
+
+        // Setup: pre-set the flag
+        viewModel.torStatusAnnounced = true
+
+        // Switch to a geohash channel so messages would be visible
+        viewModel.switchLocationChannel(to: .location(GeohashChannel(level: .city, geohash: "u4pruydq")))
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        let initialMessageCount = viewModel.messages.count
+
+        // Action: call handler again
+        viewModel.handleTorWillStart()
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        // Assert: no new message added (flag was already true)
+        #expect(viewModel.messages.count == initialMessageCount)
+    }
+
+    // MARK: - handleTorWillRestart Tests
+
+    @Test @MainActor
+    func handleTorWillRestart_setsPendingFlag() async {
+        let (viewModel, _) = makeTestableViewModel()
+
+        // Precondition
+        #expect(!viewModel.torRestartPending)
+
+        // Action
+        viewModel.handleTorWillRestart()
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        // Assert
+        #expect(viewModel.torRestartPending)
+    }
+
+    @Test @MainActor
+    func handleTorWillRestart_setsFlag_regardlessOfChannel() async {
+        let (viewModel, _) = makeTestableViewModel()
+
+        // Action: call handler (works regardless of channel)
+        viewModel.handleTorWillRestart()
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        // Assert: flag should be set
+        #expect(viewModel.torRestartPending)
+    }
+
+    // MARK: - handleTorDidBecomeReady Tests
+
+    @Test @MainActor
+    func handleTorDidBecomeReady_afterRestart_clearsPendingFlag() async {
+        let (viewModel, _) = makeTestableViewModel()
+
+        // Setup: simulate restart pending state
+        viewModel.torRestartPending = true
+
+        // Action
+        viewModel.handleTorDidBecomeReady()
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        // Assert: should clear pending flag
+        #expect(!viewModel.torRestartPending)
+    }
+
+    @Test @MainActor
+    func handleTorDidBecomeReady_initialStart_setsAnnouncedFlag() async {
+        let (viewModel, _) = makeTestableViewModel()
+
+        // Setup: not restarting, but initial ready not announced yet
+        viewModel.torRestartPending = false
+        viewModel.torInitialReadyAnnounced = false
+
+        // Action
+        viewModel.handleTorDidBecomeReady()
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        // Assert: should set flag (torEnforced is true in tests)
+        #expect(viewModel.torInitialReadyAnnounced)
+    }
+
+    @Test @MainActor
+    func handleTorDidBecomeReady_alreadyAnnounced_noDuplicate() async {
+        let (viewModel, _) = makeTestableViewModel()
+
+        // Setup: already announced initial ready
+        viewModel.torRestartPending = false
+        viewModel.torInitialReadyAnnounced = true
+        viewModel.switchLocationChannel(to: .location(GeohashChannel(level: .city, geohash: "u4pruydq")))
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        let initialMessageCount = viewModel.messages.count
+
+        // Action
+        viewModel.handleTorDidBecomeReady()
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        // Assert: no new message
+        #expect(viewModel.messages.count == initialMessageCount)
+    }
+
+    // MARK: - handleTorPreferenceChanged Tests
+
+    @Test @MainActor
+    func handleTorPreferenceChanged_resetsAllFlags() async {
+        let (viewModel, _) = makeTestableViewModel()
+
+        // Setup: set all flags
+        viewModel.torStatusAnnounced = true
+        viewModel.torInitialReadyAnnounced = true
+        viewModel.torRestartPending = true
+
+        // Action
+        viewModel.handleTorPreferenceChanged(Notification(name: .init("test")))
+        try? await Task.sleep(nanoseconds: 100_000_000)
+
+        // Assert: all flags reset
+        #expect(!viewModel.torStatusAnnounced)
+        #expect(!viewModel.torInitialReadyAnnounced)
+        #expect(!viewModel.torRestartPending)
+    }
+}
@@ -1,12 +1,16 @@
+import Foundation
+import Nostr
 import Testing
+import BitFoundation
@testable import bitchat

+@Suite(.serialized)
 struct CommandProcessorTests {
-    private var identityManager = MockIdentityManager(MockKeychain())

    @MainActor
    @Test func slapNotFoundGrammar() {
-        let processor = CommandProcessor(chatViewModel: nil, meshService: nil, identityManager: identityManager)
+        let identityManager = MockIdentityManager(MockKeychain())
+        let processor = CommandProcessor(contextProvider: nil, meshService: nil, identityManager: identityManager)
        let result = processor.process("/slap @system")
        switch result {
        case .error(let message):
@@ -18,7 +22,8 @@ struct CommandProcessorTests {

    @MainActor
    @Test func hugNotFoundGrammar() {
-        let processor = CommandProcessor(chatViewModel: nil, meshService: nil, identityManager: identityManager)
+        let identityManager = MockIdentityManager(MockKeychain())
+        let processor = CommandProcessor(contextProvider: nil, meshService: nil, identityManager: identityManager)
        let result = processor.process("/hug @system")
        switch result {
        case .error(let message):
@@ -30,7 +35,8 @@ struct CommandProcessorTests {
    
    @MainActor
    @Test func slapUsageMessage() {
-        let processor = CommandProcessor(chatViewModel: nil, meshService: nil, identityManager: identityManager)
+        let identityManager = MockIdentityManager(MockKeychain())
+        let processor = CommandProcessor(contextProvider: nil, meshService: nil, identityManager: identityManager)
        let result = processor.process("/slap")
        switch result {
        case .error(let message):
@@ -39,4 +45,389 @@ struct CommandProcessorTests {
            Issue.record("Expected error result for usage message")
        }
    }
+
+    @MainActor
+    @Test func msgStartsPrivateChatAndSendsMessage() async {
+        let identityManager = MockIdentityManager(MockKeychain())
+        let context = MockCommandContextProvider()
+        let peerID = PeerID(str: "abcd1234abcd1234")
+        context.nicknameToPeerID["alice"] = peerID
+        let processor = CommandProcessor(contextProvider: context, meshService: nil, identityManager: identityManager)
+
+        let result = await withSelectedChannel(.mesh) {
+            processor.process("/msg @alice hello there")
+        }
+
+        switch result {
+        case .success(let message):
+            #expect(message == "started private chat with alice")
+        default:
+            Issue.record("Expected success result")
+        }
+        #expect(context.startedPrivateChats == [peerID])
+        #expect(context.sentPrivateMessages.count == 1)
+        #expect(context.sentPrivateMessages.first?.content == "hello there")
+        #expect(context.sentPrivateMessages.first?.peerID == peerID)
+    }
+
+    @MainActor
+    @Test func whoInMeshListsSortedPeerNicknames() async {
+        let identityManager = MockIdentityManager(MockKeychain())
+        let transport = MockTransport()
+        transport.peerNicknames = [
+            PeerID(str: "b"): "bob",
+            PeerID(str: "a"): "alice"
+        ]
+        let processor = CommandProcessor(contextProvider: MockCommandContextProvider(), meshService: transport, identityManager: identityManager)
+
+        let result = await withSelectedChannel(.mesh) {
+            processor.process("/who")
+        }
+
+        switch result {
+        case .success(let message):
+            #expect(message == "online: alice, bob")
+        default:
+            Issue.record("Expected success result")
+        }
+    }
+
+    @MainActor
+    @Test func whoInGeohashListsVisibleParticipantsExcludingSelf() async throws {
+        let bridge = NostrIdentityBridge(keychain: MockKeychain())
+        let identityManager = MockIdentityManager(MockKeychain())
+        let context = MockCommandContextProvider(idBridge: bridge)
+        let geohash = "u4pruy"
+        let selfPubkey = try bridge.deriveIdentity(forGeohash: geohash).publicKeyHex.lowercased()
+        context.visibleGeoParticipants = [
+            CommandGeoParticipant(id: selfPubkey, displayName: "me"),
+            CommandGeoParticipant(id: String(repeating: "b", count: 64), displayName: "bob")
+        ]
+        let processor = CommandProcessor(contextProvider: context, meshService: MockTransport(), identityManager: identityManager)
+        let channel = ChannelID.location(GeohashChannel(level: .city, geohash: geohash))
+
+        let result = await withSelectedChannel(channel) {
+            processor.process("/who")
+        }
+
+        switch result {
+        case .success(let message):
+            #expect(message == "online: bob")
+        default:
+            Issue.record("Expected success result")
+        }
+    }
+
+    @MainActor
+    @Test func clearInPrivateChatRemovesOnlySelectedConversation() async {
+        let identityManager = MockIdentityManager(MockKeychain())
+        let context = MockCommandContextProvider()
+        let activePeer = PeerID(str: "active")
+        let otherPeer = PeerID(str: "other")
+        context.selectedPrivateChatPeer = activePeer
+        context.privateChats = [
+            activePeer: [makeMessage(sender: "alice", content: "secret")],
+            otherPeer: [makeMessage(sender: "bob", content: "keep")]
+        ]
+        let processor = CommandProcessor(contextProvider: context, meshService: nil, identityManager: identityManager)
+
+        let result = await withSelectedChannel(.mesh) {
+            processor.process("/clear")
+        }
+
+        switch result {
+        case .handled:
+            break
+        default:
+            Issue.record("Expected handled result")
+        }
+        #expect(context.privateChats[activePeer] == [])
+        #expect(context.privateChats[otherPeer]?.count == 1)
+    }
+
+    @MainActor
+    @Test func clearInPublicChatClearsTimeline() async {
+        let identityManager = MockIdentityManager(MockKeychain())
+        let context = MockCommandContextProvider()
+        let processor = CommandProcessor(contextProvider: context, meshService: nil, identityManager: identityManager)
+
+        let result = await withSelectedChannel(.mesh) {
+            processor.process("/clear")
+        }
+
+        switch result {
+        case .handled:
+            break
+        default:
+            Issue.record("Expected handled result")
+        }
+        #expect(context.clearCurrentPublicTimelineCallCount == 1)
+    }
+
+    @MainActor
+    @Test func hugInPrivateChatSendsPersonalizedMessageAndLocalEcho() async {
+        let identityManager = MockIdentityManager(MockKeychain())
+        let context = MockCommandContextProvider(nickname: "me")
+        let transport = MockTransport()
+        let peerID = PeerID(str: "abcd1234abcd1234")
+        context.selectedPrivateChatPeer = peerID
+        context.nicknameToPeerID["bob"] = peerID
+        transport.peerNicknames[peerID] = "Bob"
+        let processor = CommandProcessor(contextProvider: context, meshService: transport, identityManager: identityManager)
+
+        let result = await withSelectedChannel(.mesh) {
+            processor.process("/hug @bob")
+        }
+
+        switch result {
+        case .handled:
+            break
+        default:
+            Issue.record("Expected handled result")
+        }
+        #expect(transport.sentPrivateMessages.count == 1)
+        #expect(transport.sentPrivateMessages.first?.content == "* 🫂 me hugs you *")
+        #expect(context.localPrivateSystemMessages.first?.content == "🫂 you hugged bob")
+        #expect(context.localPrivateSystemMessages.first?.peerID == peerID)
+    }
+
+    @MainActor
+    @Test func slapInPublicChatSendsPublicRawAndEcho() async {
+        let identityManager = MockIdentityManager(MockKeychain())
+        let context = MockCommandContextProvider(nickname: "me")
+        let peerID = PeerID(str: "abcd1234abcd1234")
+        context.nicknameToPeerID["bob"] = peerID
+        let processor = CommandProcessor(contextProvider: context, meshService: MockTransport(), identityManager: identityManager)
+
+        let result = await withSelectedChannel(.mesh) {
+            processor.process("/slap @bob")
+        }
+
+        switch result {
+        case .handled:
+            break
+        default:
+            Issue.record("Expected handled result")
+        }
+        #expect(context.sentPublicRawMessages == ["* 🐟 me slaps bob around a bit with a large trout *"])
+        #expect(context.publicSystemMessages == ["🐟 me slaps bob around a bit with a large trout"])
+    }
+
+    @MainActor
+    @Test func blockWithoutArgsListsMeshAndGeohashBlocks() async {
+        let identityManager = MockIdentityManager(MockKeychain())
+        let context = MockCommandContextProvider()
+        let transport = MockTransport()
+        let peerID = PeerID(str: "abcd1234abcd1234")
+        transport.peerNicknames[peerID] = "bob"
+        transport.peerFingerprints[peerID] = "fp-bob"
+        context.blockedUsers = ["fp-bob"]
+        context.visibleGeoParticipants = [
+            CommandGeoParticipant(id: String(repeating: "c", count: 64), displayName: "carol")
+        ]
+        identityManager.setNostrBlocked(String(repeating: "c", count: 64), isBlocked: true)
+        let processor = CommandProcessor(contextProvider: context, meshService: transport, identityManager: identityManager)
+
+        let result = await withSelectedChannel(.mesh) {
+            processor.process("/block")
+        }
+
+        switch result {
+        case .success(let message):
+            #expect(message == "blocked peers: bob | geohash blocks: carol")
+        default:
+            Issue.record("Expected success result")
+        }
+    }
+
+    @MainActor
+    @Test func blockAndUnblockMeshPeerUpdateIdentityState() async {
+        let identityManager = MockIdentityManager(MockKeychain())
+        let context = MockCommandContextProvider()
+        let transport = MockTransport()
+        let peerID = PeerID(str: "abcd1234abcd1234")
+        transport.peerFingerprints[peerID] = "fp-bob"
+        context.nicknameToPeerID["bob"] = peerID
+        let processor = CommandProcessor(contextProvider: context, meshService: transport, identityManager: identityManager)
+
+        let blockResult = await withSelectedChannel(.mesh) {
+            processor.process("/block @bob")
+        }
+        switch blockResult {
+        case .success(let message):
+            #expect(message == "blocked bob. you will no longer receive messages from them")
+        default:
+            Issue.record("Expected success result")
+        }
+        #expect(identityManager.isBlocked(fingerprint: "fp-bob"))
+
+        let unblockResult = await withSelectedChannel(.mesh) {
+            processor.process("/unblock bob")
+        }
+        switch unblockResult {
+        case .success(let message):
+            #expect(message == "unblocked bob")
+        default:
+            Issue.record("Expected success result")
+        }
+        #expect(!identityManager.isBlocked(fingerprint: "fp-bob"))
+    }
+
+    @MainActor
+    @Test func blockAndUnblockGeohashPeerUseNostrBlockList() async {
+        let identityManager = MockIdentityManager(MockKeychain())
+        let context = MockCommandContextProvider()
+        context.displayNameToNostrPubkey["carol"] = String(repeating: "d", count: 64)
+        let processor = CommandProcessor(contextProvider: context, meshService: MockTransport(), identityManager: identityManager)
+
+        let blockResult = await withSelectedChannel(.mesh) {
+            processor.process("/block carol")
+        }
+        switch blockResult {
+        case .success(let message):
+            #expect(message == "blocked carol in geohash chats")
+        default:
+            Issue.record("Expected success result")
+        }
+        #expect(identityManager.isNostrBlocked(pubkeyHexLowercased: String(repeating: "d", count: 64)))
+
+        let unblockResult = await withSelectedChannel(.mesh) {
+            processor.process("/unblock @carol")
+        }
+        switch unblockResult {
+        case .success(let message):
+            #expect(message == "unblocked carol in geohash chats")
+        default:
+            Issue.record("Expected success result")
+        }
+        #expect(!identityManager.isNostrBlocked(pubkeyHexLowercased: String(repeating: "d", count: 64)))
+    }
+
+    @MainActor
+    @Test func favoriteCommandIsRejectedOutsideMesh() async {
+        let identityManager = MockIdentityManager(MockKeychain())
+        let processor = CommandProcessor(
+            contextProvider: MockCommandContextProvider(),
+            meshService: MockTransport(),
+            identityManager: identityManager
+        )
+        let channel = ChannelID.location(GeohashChannel(level: .city, geohash: "u4pruy"))
+
+        let result = await withSelectedChannel(channel) {
+            processor.process("/fav alice")
+        }
+
+        switch result {
+        case .error(let message):
+            #expect(message == "favorites are only for mesh peers in #mesh")
+        default:
+            Issue.record("Expected error result")
+        }
+    }
+
+    @MainActor
+    private func withSelectedChannel<T>(_ channel: ChannelID, perform work: @escaping () throws -> T) async rethrows -> T {
+        let originalChannel = LocationChannelManager.shared.selectedChannel
+        await setSelectedChannel(channel)
+        do {
+            let result = try work()
+            await setSelectedChannel(originalChannel)
+            return result
+        } catch {
+            await setSelectedChannel(originalChannel)
+            throw error
+        }
+    }
+
+    @MainActor
+    private func setSelectedChannel(_ channel: ChannelID) async {
+        LocationChannelManager.shared.select(channel)
+        for _ in 0..<40 {
+            if LocationChannelManager.shared.selectedChannel == channel {
+                return
+            }
+            await Task.yield()
+            try? await Task.sleep(nanoseconds: 5_000_000)
+        }
+    }
+
+    private func makeMessage(sender: String, content: String) -> BitchatMessage {
+        BitchatMessage(
+            sender: sender,
+            content: content,
+            timestamp: Date(timeIntervalSince1970: 1_700_000_000),
+            isRelay: false
+        )
+    }
+}
+
+@MainActor
+private final class MockCommandContextProvider: CommandContextProvider {
+    var nickname: String
+    var selectedPrivateChatPeer: PeerID?
+    var blockedUsers: Set<String> = []
+    var privateChats: [PeerID: [BitchatMessage]] = [:]
+    let idBridge: NostrIdentityBridge
+
+    var nicknameToPeerID: [String: PeerID] = [:]
+    var visibleGeoParticipants: [CommandGeoParticipant] = []
+    var displayNameToNostrPubkey: [String: String] = [:]
+
+    private(set) var startedPrivateChats: [PeerID] = []
+    private(set) var sentPrivateMessages: [(content: String, peerID: PeerID)] = []
+    private(set) var clearCurrentPublicTimelineCallCount = 0
+    private(set) var sentPublicRawMessages: [String] = []
+    private(set) var localPrivateSystemMessages: [(content: String, peerID: PeerID)] = []
+    private(set) var publicSystemMessages: [String] = []
+    private(set) var toggledFavorites: [PeerID] = []
+    private(set) var favoriteNotifications: [(peerID: PeerID, isFavorite: Bool)] = []
+
+    init(nickname: String = "tester", idBridge: NostrIdentityBridge = NostrIdentityBridge(keychain: MockKeychain())) {
+        self.nickname = nickname
+        self.idBridge = idBridge
+    }
+
+    func getPeerIDForNickname(_ nickname: String) -> PeerID? {
+        nicknameToPeerID[nickname]
+    }
+
+    func getVisibleGeoParticipants() -> [CommandGeoParticipant] {
+        visibleGeoParticipants
+    }
+
+    func nostrPubkeyForDisplayName(_ displayName: String) -> String? {
+        displayNameToNostrPubkey[displayName]
+    }
+
+    func startPrivateChat(with peerID: PeerID) {
+        startedPrivateChats.append(peerID)
+    }
+
+    func sendPrivateMessage(_ content: String, to peerID: PeerID) {
+        sentPrivateMessages.append((content, peerID))
+    }
+
+    func clearCurrentPublicTimeline() {
+        clearCurrentPublicTimelineCallCount += 1
+    }
+
+    func sendPublicRaw(_ content: String) {
+        sentPublicRawMessages.append(content)
+    }
+
+    func addLocalPrivateSystemMessage(_ content: String, to peerID: PeerID) {
+        localPrivateSystemMessages.append((content, peerID))
+    }
+
+    func addPublicSystemMessage(_ content: String) {
+        publicSystemMessages.append(content)
+    }
+
+    func toggleFavorite(peerID: PeerID) {
+        toggledFavorites.append(peerID)
+    }
+
+    func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool) {
+        favoriteNotifications.append((peerID, isFavorite))
+    }
 }
@@ -9,6 +9,8 @@
 import Testing
 import CryptoKit
 import struct Foundation.UUID
+import BitFoundation
+import Noise
@testable import bitchat

 struct PrivateChatE2ETests {
--- a/Show More
+++ b/Show More